VOOCALY PRIVACY & DATA PROTECTION POLICY

01. Scope & Controller/Processor Roles

This Privacy Policy applies to personal data processed by THE CRAFT SHOP through the Voocaly platform.

• Individual Creators & Direct Users: THE CRAFT SHOP acts as the Data Controller under the GDPR, UK Data Protection Act, and India DPDP Act.
• Enterprise & B2B Customers: Where a business customer contracts with Voocaly to process personal data on behalf of its own employees, clients, or end-users, the business customer acts as the Data Controller and THE CRAFT SHOP acts as the Data Processor pursuant to our Data Processing Addendum.
• Paddle as Independent Controller: Paddle operates as an independent Data Controller regarding buyer billing information, transaction fraud checks, tax accounting, and statutory financial compliance.

02. Data Categories Collected

1. Account & Auth Data: Email address, Firebase Auth user UID, display name (optional), and registration timestamp.
2. Customer Inputs (Processing Data): Text scripts entered into Studio, voice model identifiers, emotion and prosody tags, and reference audio files uploaded for custom voice cloning.
3. Billing Identifiers: Paddle customer IDs, transaction IDs, subscription IDs, subscription status, and plan entitlement tiers. (Voocaly never receives or stores raw payment card numbers or banking data).
4. Security & Technical Data: IP addresses (processed for rate limiting and fraud prevention), user-agent headers, and security event logs.
5. Operational Telemetry: Anonymized, consent-gated UI metrics (such as synthesis latency and playback duration).
6. Local Browser Storage: UI theme, player volume, and unauthenticated guest demo audio stored on your local device via localStorage and IndexedDB.

03. Voice & Biometric Data Considerations

Depending on the jurisdiction, purpose of processing, and technical characteristics of the voice data, voice recordings or derived acoustic characteristics may be treated as biometric or special-category data. Where applicable law requires consent or another specific legal basis, Voocaly will apply the legally appropriate basis and obtain any required consent.

Note: Flagged for Ongoing Legal Counsel Review across operating jurisdictions.

Voocaly does not use voice-cloning data for biometric identity verification, authentication, or physical access control.

Reference audio uploaded to Voocaly is analyzed solely for acoustic timbre conditioning to synthesize requested speech.

04. GDPR Article 6(1) Legal Basis Matrix

05. Complete Retention & Deletion Lifecycle

06. International Data Transfers

Depending on the feature, personal data may be processed by Voocaly and third-party providers listed in our current Subprocessor & Third-Party Provider Register.

Where personal data from the EEA, UK, or Switzerland is transferred to a country without an adequacy decision, we implement safeguards under GDPR Article 46, primarily Standard Contractual Clauses (SCCs) approved by the European Commission, the UK International Data Transfer Addendum, or applicable contractual mechanisms.

07. California Privacy Notice (CCPA / CPRA) & ADMT

• NO SALE OF PERSONAL INFORMATION: Voocaly has not sold personal information to third parties for monetary or other valuable consideration in the preceding 12 months, and does not sell personal information.
• NO SHARING FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING: Voocaly does not share personal information with third parties for cross-context behavioral advertising.
• Automated Decision-Making Technology (ADMT): Voocaly does not use automated decision-making technologies or profiling to make decisions producing legal or similarly significant effects concerning consumers (such as financial eligibility, employment, or housing). Automated safety scripts and rate limiters protect system integrity; account-level enforcement decisions and refund determinations are subject to human review upon request.
• California Rights: California residents have the right to know, access, correct, delete, and opt out of the sale/sharing of their personal information, and the right to non-discrimination. To exercise your rights, email support@voocaly.com (Subject: "Privacy / Data Request").

08. India DPDP Act 2023 / 2025 Rules & Grievance Officer

In compliance with the India Digital Personal Data Protection Act, 2023 and MeitY notification guidelines:

• Personal data is processed solely for specified lawful purposes (account access, audio synthesis, billing validation).
• Data Principal rights include: right to access a summary of personal data, right to correction and erasure, right to grievance redressal, and right to nominate a representative.

09. Self-Service Account Deletion

You can initiate permanent account deletion at any time directly in Account Settings.

Deletion permanently removes the applicable active account and content records from Voocaly systems (including authentication records, text scripts, generated audio history, and reference voice clone recordings), subject to limited records that must or may lawfully be retained for security, fraud prevention, accounting, legal, or dispute-resolution purposes. Statutory financial transaction records remain preserved independently by Paddle as Merchant of Record.

10. Your Data Subject Rights

Under the GDPR and global data protection laws, you possess the right to:

• Access: Request confirmation of processing and a copy of your personal data;
• Rectification: Request correction of inaccurate or incomplete personal data;
• Erasure: Request permanent deletion of your personal data;
• Restriction & Objection: Object to or restrict specific processing operations based on legitimate interests;
• Data Portability: Receive your data in a structured, commonly used format;
• Withdraw Consent: Withdraw consent at any time where processing was consent-based, without affecting prior lawful processing.

To exercise any right, email support@voocaly.com (Subject: "Privacy / Data Request"). We respond to all verified requests within thirty (30) days without charge.