Privacy Policy

The controller under the GDPR is Paul Schwarz, Rudolf-Waisenhorn-Gasse 27/11, 1230 Wien, Austria. Contact for all privacy questions: support@voiceact.ai.

• Speech is generated by AI models on hardware we operate. Your texts, voice recordings and audio are not sent to third-party AI services and not used to train models.
• We count visits with Plausible Analytics: no cookies, no personal data and no tracking across sites; only aggregate statistics (pages, referrers, countries, button clicks).
• Payments are handled by a Stripe company as reseller; we never see your card details.
• You can delete single items, voices or your whole account at any time.

Account data (email address, name, login details) to provide your account. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Texts you enter and the audio we generate, stored in your history so you can replay and download it. Legal basis: contract. Kept until you delete the item or your account.

Voice recordings you upload for cloning and the voice profile computed from them (a numeric representation used to generate speech in that voice; we don't use it to identify people). Legal basis: contract and your consent, which you give before each upload and can withdraw by deleting the voice. Kept until you delete the voice (for a one-off clone without a saved voice: that generation) or your account.

Consent records for cloning: time, IP address, browser and the version of the consent statement, so we can handle complaints about voices cloned without permission. Legal basis: our legitimate interest in preventing and investigating misuse (Art. 6(1)(f)). Kept for three years from the upload; the recording itself is deleted with the voice or account.

Technical data: your IP address is used to protect the service (for example the daily limit for visitors without an account, kept for 24 hours) and is stored with each generation to investigate misuse. Our servers keep short-lived technical logs. Legal basis: legitimate interest in security and abuse prevention.

Purchases: the reseller tells us what you bought (plan, amount, country, email) so we can add your credits. Legal basis: contract. We keep these records as long as tax and commercial law requires.

We use these providers, bound by data processing agreements where they act on our behalf:

• Hetzner Online GmbH (Germany): servers in Finland for the database and stored audio.
• Cloudflare, Inc. (USA): network protection and delivery of the website; all traffic passes through it. It also stores our backups (Cloudflare R2, in the EU, encrypted at rest; voice recordings are additionally encrypted by us before upload).
• Vast.ai (USA): when our own GPU is unavailable, audio is generated on GPU servers rented through Vast.ai, only from hosts in the EU/EEA, Switzerland or the UK. Your text and, for cloned voices, the voice recording are processed there only to generate the audio; we delete the rented server when we stop using it.
• Functional Software, Inc. (Sentry, USA): error reports from our servers, stored in the EU. They contain no texts, audio or account details.
• Plausible Insights OÜ (Estonia): visit statistics without cookies or personal data.
• Clerk, Inc. (USA): sign-in and account management, including sign-in emails.
• Stripe: the reseller for purchases is a Stripe company acting as merchant of record. It processes payment data as an independent controller under its own privacy policy.

Audio is normally generated on GPU hardware operated by us. If we add other GPU providers, we will list them here before they process any data.

Transfers to the USA rely on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

Every generated file and stream carries an inaudible watermark and, in downloaded files, signed metadata that identifies it as AI-generated by VoiceAct (required by the EU AI Act). The marking contains no personal data: no name, email or account ID.

We only use cookies that are needed for signing in and keeping you signed in (set by Clerk), plus local browser storage for settings. No consent banner is needed for these; we use no advertising or analytics cookies.

You can delete single generations in your history and saved voices in your voice library. When you delete your account, we delete your texts, generated audio, voices and voice recordings. We keep only what we must or may keep for the reasons above (purchase records, consent records without the recording). Our backups are kept for 30 days, so deleted data also disappears from them within 30 days; if we ever restore a backup, we delete it again.

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest, and you can withdraw consent at any time. Write to support@voiceact.ai.

You can also complain to the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at) or the authority in your country.

We update this policy when our processing changes, for example when we add a provider. The date at the top shows the current version. See also our Terms of Service.