"Zero data retention" is the most over-read phrase in privacy software. It sounds like a property of the product. In almost every case it is a property of a contract between two companies, one of which you have never heard of and both of which already have your data.
What Wispr Flow actually says
“Wispr always maintains zero data retention agreements with all third-party AI providers. All third party AI models used in Flow Dictation are subject to these agreements. Certain features, such as briefs for Notetaker, rely on features from third party AI providers that are not supported under zero data retention.”
Three sentences, three distinct claims, and the third one is the interesting one. The company is telling you, in its own documentation, that the zero-retention guarantee has an exception. Notetaker briefs are processed by providers that cannot offer ZDR. Wispr does not say what happens to that data instead; it says only that those providers "cannot use your data for model training".
That is a meaningful protection. It is not zero retention.
And on the other side of the chain
“Customer content is also processed by third-party AI and language model providers to deliver the service. They process it solely to provide the service, and it's generally deleted within 30 days.”
Two words in that sentence are doing a lot of work: generally, and 30 days. A zero-day promise and a 30-day norm are not the same commitment, and they are published by the same company about the same pipeline. The most generous reading is that the two sentences describe different features. The least generous reading is that they describe the same one. Either way, a buyer cannot resolve it from outside, and that is precisely the problem with promises made about servers you do not control.
Zero data retention is three different claims
Vendors use the phrase for at least three materially different positions, and the badges are not interchangeable.
1. Zero retention at the subprocessor
The transcription vendor keeps your data for the length of the job and deletes it immediately after, with a contractual zero-day policy flowing down the chain. This is a real and meaningful guarantee — but it only describes the seconds-to-minutes window inside a vendor you have already handed the audio to.
2. Zero training use
Your content is never used to improve a model. This is the single most load-bearing privacy clause in the category, and the strongest version names third parties explicitly, so the promise survives the vendor swapping model providers.
3. Zero retention anywhere
Nothing is retained because nothing is transmitted. There is no copy on anyone's infrastructure, which means there is no retention window to configure, no DPA to negotiate, and no breach of yours to worry about on the vendor's side.
Most products in this comparison are at position 1 or 2. Position 3 is a different architectural claim, not a stronger version of the same one.
The layer that no vendor can fix
| Layer | Covered by a ZDR claim? | What it means for you |
|---|---|---|
| Third-party model provider (Flow Dictation) | Yes, per Wispr | Your audio is not kept by that provider |
| Third-party model provider (Notetaker briefs) | No, explicitly excluded | Not covered by the ZDR commitment |
| Wispr Flow itself | No | Governed by your retention setting, not by ZDR |
| Your device | Not applicable | Audio is uploaded before transcription happens |
| Jot | Not applicable | Audio is never transmitted, so there is no retention window to negotiate |
Every row except the last one is a promise about someone else's database. The last row is a statement about where the audio is, which is the only kind of statement that does not need to be believed.
Why "zero retention" keeps being used for this
Because it is a good contract term and a better marketing term. ZDR agreements are genuinely valuable: they stop a subprocessor from keeping training corpora built out of your meetings, and they are the difference between a vendor that thought about the supply chain and one that did not. The mistake is reading a supply-chain guarantee as a product guarantee.
A product-level version of the claim exists, and it looks different. Jot's App Store listing: “No text is saved, transcription is done on device, corrective AI calls are de-identified, use American ZDR providers, and optional.” The ZDR part applies to the optional network calls. The "no text is saved" part is true because of where the work happens, not because of what a supplier promised.
Verdict
Wispr Flow's ZDR claim is real and narrower than it sounds. It covers third-party model providers for dictation, excludes at least one feature family, and says nothing about how long Wispr itself keeps your content.
Enterprise customers get the strongest version — data sharing off, no option to enable it — but that is a contract, not an architecture, and it costs a procurement cycle.
If you want retention that does not depend on a supplier's contract, the audio has to stay where you can see it. Jot on the App Store.
Sources
Primary sources, read on the date above. The ZDR and 30-day quotations are verbatim from Wispr Flow's Data Controls and enterprise privacy pages.