Privacy Policy

This Privacy Policy explains how Underlying Labs, LLC (“Wispal,” “we,” “us,” or “our”) collects, uses, and shares information when you use Wispal — our browser extension and our web app at wispal.ai (together, the “Service”). We use the name “Wispal” to refer both to our company and to the product.

Wispal lets you highlight and annotate your conversations on ChatGPT, Claude, and Gemini — the AI chat platforms Wispal currently supports — and generate notes from them. Because that content can be personal, we’ve tried to write this policy plainly and to collect as little as possible.

1. Our privacy principles

• We only collect what you actively create or provide. Wispal reads content from a chat page or your microphone only when you take a deliberate action — saving a highlight, generating a note, or recording a voice annotation. We don’t read chat content or record audio silently or in the background.
• We don’t sell your data, show ads, or use third-party trackers. We do not sell or rent your personal information, we display no advertising, and we use no third-party analytics or advertising trackers that follow you across the web.
• We collect the minimum needed for each feature. When you save a highlight, we store only the text you select — not the surrounding conversation — and our re-anchoring uses a one-way (irreversible) fingerprint of nearby text, not the text itself. (Generating a note works differently and uses more of the conversation — see Section 4.)
• We configure our AI providers so that your content is not used to train their models.

2. Information we collect

Account information. When you create an account, we collect your email address and a securely hashed password. If you sign in with Google, we receive your name, email address, profile picture, and Google account identifier from Google. Providing an email address is necessary to create an account; without it we cannot provide the Service.

Content you create. When you save a highlight, we store the text you selected, your annotation, and a small amount of context needed to display and re-locate it — the conversation’s page title and its URL (origin and path only; any query string or fragment is removed). For highlights, we do not collect any other part of your conversation beyond the text you select. Generating a note works differently: to create a note, Wispal reads the full conversation shown on the page at the moment you generate it — not just your highlights — and sends it to an AI provider to produce the note (see Section 4). We use the full conversation only in that moment to generate your note; we do not store the full conversation itself — only the note we create for you is saved. Highlights and notes you save are independent copies kept by Wispal — deleting or losing the original conversation on ChatGPT, Claude, or Gemini does not delete what you’ve saved in Wispal, which you can remove separately.

Voice recordings. If you use voice annotations, your microphone audio is recorded and stored locally on your device only (for up to 7 days — or fewer if you have many pending recordings — so you can retry if transcription fails). It is sent to an AI provider for transcription (see Section 4) but is never stored on our servers. We use your recording only to turn your speech into text — we do not create, extract, or store a voiceprint or any other biometric identifier, and we do not use your voice to identify you.

Payment information. If you purchase a subscription, payment is processed by Stripe. We store only your subscription status and the identifiers needed to manage your plan — we never receive or store your full payment card number.

Usage and device data. Our hosting provider records standard web-request data, including your IP address and browser user agent, and our sign-up and login flow uses your IP address for security (for example, to rate-limit and prevent bulk account creation or code-guessing attacks). We also keep operational records of AI requests (such as counts, tokens used, and cost) — but not the content of those requests.

Preferences. Your Wispal settings (such as annotation mode and text size) are saved using your browser’s built-in sync (Chrome Sync, provided by Google) so they follow you across devices signed into the same browser. This preference data does not pass through our servers.

A note on the content you save. Your conversations may sometimes contain sensitive details, and may include information about other people (for example, something someone else shared in a chat). We don’t seek out or intentionally collect sensitive categories of data, and we recommend you avoid saving information you wouldn’t want processed — if you do save content about other people, you’re responsible for having the right to do so.

3. How we use your information, and our legal bases

• Provide the features you use — store and display your highlights and notes, sync your data (if you enable it), generate notes, and transcribe voice. Legal basis: performance of our contract with you.
• Authenticate you and keep you signed in. Legal basis: performance of our contract.
• Keep the Service secure and prevent abuse — including rate-limiting and fraud prevention. Legal basis: our legitimate interests.
• Understand and improve Wispal — we may analyze how the Service is used, in aggregated form (for example, overall counts of highlights or notes created), derived from data we already store to provide the Service; we do not collect additional data solely for analytics. Legal basis: our legitimate interests.
• Process payments for subscriptions. Legal basis: performance of our contract.
• Send you essential service messages (such as account verification and password reset). Legal basis: performance of our contract.
• Comply with legal obligations, and protect the rights, safety, and security of our users, the public, and Wispal. Legal bases: compliance with a legal obligation; our legitimate interests.

We do not use your information for advertising or to build marketing profiles.

4. AI processing of your content

• Notes. When you generate a note, the full content of the conversation shown on the page, together with your highlights and annotations, is sent to an AI provider to produce the note.
• Voice transcription. When you record a voice annotation, the audio is sent to an AI provider to be transcribed into text.

Who processes this. This processing is performed by third-party AI providers on our behalf — such as Google, OpenAI, or Anthropic — and may be routed through an AI gateway (such as OpenRouter). We may change providers over time to improve quality. These AI providers are separate from the chat platform whose conversation you’re annotating; which provider processes your content does not depend on whether you are using ChatGPT, Claude, or Gemini.

How your content is protected. Regardless of which provider is used:

• We configure our providers and gateway so that your content is not used to train AI models.
• We do not enable prompt logging, so your content is not stored long-term by us or by the gateway.
• Based on our providers’ standard policies for this kind of usage, the AI provider retains it only for a short period, solely to detect and prevent abuse, and then deletes it.
• Your original voice recording stays on your device and is never stored on our servers.

5. Where your information is stored

On your device. Your highlights, notes, and voice recordings are stored locally in your browser. (Your preferences sync through Chrome Sync, as described in Section 2.)

In the cloud (only if you turn on Cloud Sync). If you enable Cloud Sync, we store a copy of your highlights and notes on our servers in the United States so you can view them in the web app, back them up and restore them, and sync across your devices. Alongside these, we store the basic conversation information needed to organize them (such as the conversation’s title and link), which is derived from the items you save. Note generation requires Cloud Sync, so notes are only ever created for users who have turned it on. Your voice recordings are never stored on our servers.

6. How we share your information

We do not sell or rent your personal information.

We share information only in these cases:

• Service providers who process data on our behalf, by category: cloud database and backend hosting, the AI providers described in Section 4, email delivery (for account verification and password-reset emails), payment processing (Stripe), and web hosting. These providers may process your information only to provide services to us.
• Sign-in providers you choose to use — if you use Sign in with Google, Google processes your sign-in information under its own privacy terms.
• Legal and safety reasons — to comply with the law, respond to lawful requests, or protect the rights, safety, and security of our users, the public, or Wispal.
• Business transfers — if we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

7. International data transfers

We are based in the United States, and your information is stored and processed there. When personal data of users in the European Economic Area, the United Kingdom, or Switzerland is transferred to the United States, we rely on appropriate safeguards. For providers that process data on our behalf, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable). Some providers — such as Stripe (payments) and Google (Sign-in) — handle certain data under their own privacy terms; their transfers of that data to the United States are covered by their certification under the EU-U.S. Data Privacy Framework (and, for UK data, its UK Extension). You can request a copy of the safeguards we rely on by emailing hello@wispal.ai.

8. Data retention

This section is about the information we hold on our side. We keep it for as long as your account is active and as needed to provide the Service, and for a limited additional period where required for legal, security, or dispute-resolution purposes. You can ask us to delete your data at any time.

• Web-request logs (including IP address) are kept for a short period (around 7 days) for security and reliability.
• Deletion requests: email us at hello@wispal.ai and we will delete your account and associated data as soon as we can, and within 30 days at the latest.

Voice recordings are the one thing we never hold on our servers — they stay on your device and delete automatically; see Section 2.

9. Your rights and choices

Depending on where you live, you may have some or all of the following rights: to access the personal data we hold about you; to correct it; to delete it; to receive a copy in a portable format; and to restrict or object to certain processing. Where we rely on your consent, you may withdraw it at any time. We will not treat you differently for exercising any of these rights.

To exercise a right, email us at hello@wispal.ai. We will verify your request using the email address on your account and may ask for additional information to confirm your identity. You may also use an authorized agent to submit a request, in which case we may require proof of the agent’s authorization and verification of your own identity.

• EEA / UK / Switzerland: you also have the right to lodge a complaint with your local data protection supervisory authority.
• California: you have the right to know what personal information we collect, to access and delete it, and to correct it. We do not sell or share your personal information as those terms are defined under California law.

You can also sign out at any time and manage your data locally through the extension.

10. Automated decision-making

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

11. Cookies and local storage

We use a small number of essential cookies to keep you signed in. We also use local browser storage on your device to hold your Wispal content (highlights, notes, and voice recordings) and to remember your preferences — see Section 5. We do not use advertising cookies or third-party analytics or tracking technologies.

Because we don’t track you across other websites and don’t sell or share your personal information, there is nothing for a “Do Not Track” or Global Privacy Control signal to opt out of; we honor the intent of those signals simply by not performing that kind of tracking.

12. Security

We protect your information using industry-standard measures, including encryption in transit (HTTPS), encryption at rest through our infrastructure providers, and access controls designed to restrict access to your data to you and to the limited personnel who need it to operate the Service. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

13. Children

Wispal is not directed to children, and you must be at least 16 years old to use it. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact us at hello@wispal.ai and we will delete it.

14. Chrome Web Store and Google API disclosure

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. More generally, Wispal’s collection, use, and transfer of information received through the Wispal browser extension also adheres to the Google API Services User Data Policy, including its Limited Use requirements.

15. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above. If a change materially affects how we collect, use, or share your personal information, we will notify you through the Service or by email before it takes effect.

16. Contact us

Underlying Labs, LLC
131 Continental Dr, Suite 305, Newark, DE 19713, United States
Email: hello@wispal.ai · Phone: +1 (302) 499-3811

If you are in the EEA or UK, you may contact us at the email above with any questions about this policy or your personal data.