Privacy Policy

Last updated: August 2026

1. Information We Collect

We collect information you provide directly to us when using VCaaS, including:

  • Account Information: Your email address and basic profile information via Firebase Authentication.
  • Biometric Data (Voice References): Audio samples uploaded for the purpose of zero-shot voice cloning.
  • Prompts: The text inputs you provide for synthesis.
  • Usage Data: API call frequency, processing times, and diagnostic telemetry.

2. Handling of Biometric Data & Voice References

Because VCaaS deals with voice data, we handle it with extreme care. Reference files may be held temporarily in application or worker storage while processing and may be retained when you explicitly save a voice to your account. The exact retention period depends on the workflow, deployment, operator agreement, and applicable law. We do not use customer voice references to train foundational models without a separate, explicit agreement.

3. Deepfake Detection & Watermarking Logs

To comply with ethical AI guidelines, when you generate audio using our platform, we automatically embed a cryptographic watermark. We retain logs of generated watermarks (including timestamps, associated account IDs, and cryptographic hashes) to aid in the verification of deepfakes and the prevention of platform abuse.

4. Third-Party Data Processors

We rely on carefully vetted third-party services to operate the platform:

  • Google Firebase: Used exclusively for secure user authentication and account management.
  • Infrastructure and telephony partners: May provide approved hosting, media transport, or operator-network processing for enabled workflows.
  • Vercel: Hosts our frontend web application and edge network.

These providers are contractually obligated to protect your data and do not have rights to use your biometric inputs for their own purposes.

5. Data Retention & Deletion

You can request deletion from your account workflow or through the privacy team. Deletion applies to active account data subject to legal, security, billing, backup, and operator-retention requirements. Some audit, provenance, or fraud-prevention records may be retained for a limited period when legally permitted or required.

6. Security Measures

We use access controls, transport-layer security for API communications, encryption where supported by the deployment, audit logging, and least-privilege service boundaries. Carrier-integrated workflows also require operator controls for consent, lawful processing, media access, and retention. No transmission or system can be guaranteed perfectly secure.

7. Contact Us

If you have questions regarding this Privacy Policy, your biometric data, or wish to exercise your data rights (including GDPR and CCPA requests), please contact our privacy team via the Help center.