Privacy policy

Whisp is a weekly content plan for small creators and small businesses who use Instagram to get customers. It’s built and run by a small, independent team. On this page, “Whisp”, “we” and “us” mean that team. Whisp is meant for adults running a business or a creator account.

Your account

Your name, email address and password. We store the password only as a one-way hash, so nobody at Whisp can read it. We also keep the invite code you used and your time zone, so “Monday” means your Monday.

Your answers about your business

What describes you, what you sell and who buys it, what counts as a win for you (inquiries, bookings, sales or audience growth), how much time you have to film, what you’re promoting, how customers reach you, the tone you want, your customer questions, and anything you add or change in your profile. We also store the brand profile Whisp writes from those answers.

Instagram data you connect

When you connect Instagram, you approve access on Instagram’s own screen, and we receive data through Meta’s official Instagram API:

• your username, profile picture and follower count;
• your posts’ captions, media links (including each slide of a carousel), post links, formats and dates;
• your posts’ insights: likes, comments, saves, shares, reach, views and watch time;
• the comments on your posts from the last 30 days, if you allow it: the words, the time and the like count of each comment, and whether it is your own reply;
• account-level numbers by day: contact-button taps, follows, reach and views.

We do not store who wrote a comment: no usernames and no profile details. Instagram sends the author’s name with each comment; Whisp uses it only to tell your own replies apart and does not keep it.

We also store the access token Meta gives us, encrypted, so Whisp can keep this data up to date, and the list of permissions you granted. Whisp only reads: it can’t post or send messages for you. To read comments, Instagram requires a permission that also covers managing them; Whisp never replies to, hides or deletes a comment. If you don’t grant it, everything else works and comments are simply not read.

What Whisp reads in your posts

So that its advice is about your account and not a generic one, Whisp reads each of your recent posts once: the cover image or carousel slides, the full caption, the words spoken in a reel and the comments under it. From that it keeps a short description of the post: its topic, the kind of post, its opening words, how it was made, a two-sentence summary, the spoken words as text, and a count of the questions asked in its comments. From those descriptions it also keeps a short brief about your account.

Whisp does not keep copies of your images or videos. Images are passed to the AI to be described and are not saved by Whisp. For a reel, Whisp sends the link to the video to a transcription service, which fetches it and returns the words; Whisp never downloads or stores the video file.

What you tell Whisp to remember

Short notes about you and your business that you save, or that Whisp saves during a conversation with you and shows you when it does. Your “Anything new this week?” notes are kept in the same place for eight weeks. Nothing is remembered silently: you can see, change and remove every note in Profile, and a removed note is no longer used.

Your plans, replies and results

The weekly plans Whisp writes for you, your edits, the scripts and reply messages you generate, and the posts you mark as posted. We also keep what you tell us about each post: which Instagram post it became, the inquiries, bookings or sales you count, and the answers to the results question.

Your weekly note and customer questions

The “Anything new this week?” note you write, the customer questions you save, and any comments you paste into the reply helper.

Reminders and devices

Your reminder preferences (email and push on or off), the hour you want reminders, and your time zone. For each device where you turn on push notifications, the subscription details your browser gives us (a delivery address and keys), so we can send it a reminder.

Payment status

Your subscription status from Stripe (for example trial, active, past due or ended), and your Stripe customer ID. Whisp never sees your card number; Stripe handles payment details.

Usage analytics and session recordings

We use PostHog to understand how Whisp is used: the pages you visit, the buttons you tap, and recordings of sessions (a replay of what happened on screen) so we can find what’s confusing or broken. Recordings mask everything you type and are set up to leave out your business content, such as plans, captions, reply messages, profile answers and notes. Once you sign in, analytics are linked to your account (your account ID, name and email). Visits to this website before you sign in are measured the same way, without a name attached.

Server logs

Like most websites, our servers log technical details of each request, such as IP address, browser type, time and the page or action requested. We use them to keep Whisp running and to fix errors.

We use your data only to provide Whisp to you:

• to write your weekly plans, scripts, reply messages and answers;
• to show you which of your posts are working, based on your Instagram data and results;
• to send reminders by email and push, which you can turn off in Profile (every email has an unsubscribe link);
• to keep your account secure and Whisp running;
• to understand how Whisp is used and make it better.

During the pilot, the Whisp team may look at plans, replies and results to fix problems and improve quality. We never sell your data, we don’t show ads, and we don’t use your data for advertising.

These service providers handle data on our behalf, only to provide their service to us:

• Anthropic: the AI that writes your plans, scripts, replies and answers, and reads your posts. For each request we send what it needs, such as your business answers, post numbers, recent results, the notes you saved, and, when it reads a post, the post’s images, caption, spoken words and the text of its comments (never who wrote them).
• Deepgram: turns the words spoken in your reels into text. We send it the link to the reel’s video; it returns the words.
• Meta: provides your Instagram data through its official API.
• Railway: hosts Whisp’s servers and database.
• Resend: sends reminder emails.
• Stripe: handles payments and subscriptions. Whisp never sees your card number.
• Browser push services (Apple, Google and Mozilla): deliver push notifications to the devices where you turn them on.
• PostHog: usage analytics and session recordings (optional).

These providers may process data in the United States and other countries. We may also share data if the law requires it.

Whisp keeps you signed in by storing a token in your browser’s local storage. PostHog uses cookies and local storage to tell visits apart. Push notifications use your browser’s push service. We don’t use advertising cookies.

We keep your data while your account is active. When you delete your account, it’s removed from Whisp’s database right away. Copies kept by our providers, such as analytics data, server logs and any backups, are deleted on their own schedules.

Delete your account and data

1. Sign in to Whisp and open Profile.
2. Under Delete account & data, choose Delete my account and confirm.

This permanently deletes your account and everything linked to it from Whisp’s database: your answers, Instagram data, plans, replies, results and notes. It can’t be undone.

Remove Whisp’s access to Instagram

In Instagram, go to Settings → Apps and websites and remove Whisp. This stops new data from coming in; to remove what’s already stored, delete your account as described above.

To keep your account but stop syncing, disconnect Instagram in Profile. That removes the connection and the posts Whisp synced.

Can’t sign in?

Contact the Whisp team (the person who invited you can put you in touch) and we’ll delete your account for you. Tell us if you’d also like the analytics data about your visits deleted.

We use encrypted connections, store passwords only as hashes and encrypt Instagram access tokens. No online service is perfectly secure, so we can’t promise nothing will ever go wrong, but if something affects your data, we’ll tell you.

If we change this policy, we’ll update the date at the top. If the change is significant, we’ll tell you in Whisp. Our terms of use cover the rest of how the pilot works.

Questions about your data, or a request to see, correct or delete it: contact the Whisp team. The person who invited you can put you in touch.