Privacy Policy

Controller

The controller for the processing described here is:
Wispit UG (haftungsbeschränkt), Musterstraße 1, 10115 Berlin, Germany.
Email: [email protected]. Our full company details are in the imprint.

No data protection officer has been appointed; the thresholds under Art. 37 GDPR are not currently met.

What we collect

Account data (email, name), the inputs you give wispit (your website URL, social handles, competitor selections, uploads), the content wispit generates for you, billing data if you are on a paid plan, and technical log data needed to operate and secure the service.

Research data

To produce insights, wispit analyzes publicly available social media posts and their public engagement metrics. We do not access private accounts or non-public data. Those posts may contain personal data of their authors, which we process on the basis of our legitimate interest in market research for our customers.

Why we process it, and on what legal basis

To provide the service and perform our contract with you, including running your research, generating your content and billing you: Art. 6 (1)(b) GDPR.

To keep the service secure, prevent abuse, and improve results in the aggregate, and to analyze public market content: our legitimate interests under Art. 6 (1)(f) GDPR.

For analytics, and for the optional location and weather personalization described below: your consent under Art. 6 (1)(a) GDPR, which you can withdraw at any time with effect for the future.

To meet retention, tax and accounting duties: Art. 6 (1)(c) GDPR.

How your data is used

To run your research, generate your content, and improve your results over time. We do not sell your data. Content generated for your brand is yours.

Processors and recipients

The categories of providers below operate parts of the pipeline on our behalf as processors under Art. 28 GDPR, each bound by a data processing agreement and processing data only on our instructions:

• AI model inference providers, for generating research, scripts, captions, images, and video.
• Web and social data collection providers, for gathering publicly available posts and engagement metrics from social platforms and public websites.
• A payment processor, for billing on paid plans.
• A transactional email provider, for account and product email.
• An error-monitoring provider, for operating the service reliably.
• A weather service and an IP geolocation service, only when you switch on the optional location personalization described below.

We keep a current list naming each subprocessor, its role, and where it is located. For a business customer, we provide it on request once a data processing agreement is in place, so it can feed your own vendor security review rather than sit on a public page where anyone can read it — email [email protected] to request it.

Your browser also requests your profile picture from a public avatar service tied to a one-way hash of your email address and your IP address; set a profile image in wispit and no request is made.

Transfers outside the EU

Some of these providers are established outside the European Economic Area, in particular in the United States. Where that is the case, the transfer is covered by an adequacy decision of the European Commission or by Standard Contractual Clauses under Art. 46 (2)(c) GDPR, together with supplementary measures where required. You can request a copy of the safeguards at [email protected].

How long we keep it

Account and project data are kept while your account exists and are deleted within 30 days of account deletion, except where a statutory retention duty applies. Invoices and related records are kept for the statutory period of up to ten years. Technical logs are kept for 90 days.

Analytics

We measure how wispit is used so we can fix what gets in the way. No identifier is stored on your device and no usage event leaves your browser until you accept analytics, and you can decline without losing any part of the product.

Location personalization

Dashboard greetings use your browser's local time and language only. wispit does not send your IP address to a geolocation or weather service for greetings, and no location data is stored for this feature.

How AI-generated content is marked

Video and images wispit produces are marked as artificially generated, so that platforms and recipients can detect it. Where an underlying model provider applies its own marking, such as an invisible digital watermark or a visible on-image mark, we keep it intact and never strip a provider's provenance data. Where a provider marks nothing, we stamp the IPTC digital source type "trainedAlgorithmicMedia" into the file ourselves. Posts published through wispit also record when AI disclosure was confirmed, and on Instagram a disclosure line is added to the caption.

Automated decisions

wispit scores and ranks content ideas and predicts how a post may perform. These are suggestions. They do not produce legal effects for you and nothing is published without your approval, so no automated decision-making within the meaning of Art. 22 GDPR takes place.

Your rights

Under the GDPR you can request access, correction, export, restriction, or deletion of your data, and you can object to processing based on our legitimate interests, at any time: [email protected]. You can also export everything wispit holds for you, or delete your account outright, from your account settings. Where processing rests on consent, you can withdraw it at any time without affecting processing already carried out.

Right to complain

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, place of work, or the place of the alleged infringement. The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information).