Privacy Policy
How Voxify Studio collects, uses and protects personal data.
1. Who is the controller
The data controller is GZK CONSULTING S.R.L., a Romanian limited liability company, Trade Registry no. J2026029220009, tax ID (CUI) 54615390, intra-community VAT no. RO54713445, registered office Str. Dr. Daraban nr. 400 BIS 1, Sat Samurcași, Comuna Crevedia, Dâmbovița County, Romania.
Data-protection contact: support@voxify.studio. We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR; you can reach our data-protection contact at the address above.
2. Scope
This policy covers personal data of: visitors to our website, registered users and Account Admins, people invited as team Users, prospects and people who contact us. Where we act as a processor for API/Embedded customers, that customer is the controller of their end users’ data and the DPA applies.
3. What data we collect
| Category | Examples / fields |
|---|---|
| Identity & account | First name, last name, organisation, country, email address, password (stored hashed), role, account/subscription status. |
| Authentication, device & security logs | IP address, browser user-agent, session identifiers; and approximate geolocation derived from your IP at sign-up/sign-in via a third-party service (ipapi.co): city, region, country and country code, latitude/longitude, timezone, UTC offset, currency, ISP/organisation, ASN/network, and whether the IP is in the EU. |
| Usage data | Projects and creatives, actions in the editor, Credits granted/used/remaining, feature usage, timestamps, support interactions. |
| User Content | Scripts and text you enter; audio files you upload; voice samples and voice clones (which may be biometric data — see section 6); brand assets; generated Output. |
| Billing | Subscription plan, billing period, invoices and billing details. Card/payment data is handled by our payment processor; we do not store full card numbers. |
| Communications | Emails, support tickets, and (if you opt in) newsletter/marketing subscription preference. |
| Cookies & analytics | See the Cookie Policy. We use Google Analytics 4 and store some data in your browser’s local/session storage. |
4. How we collect it
- Directly from you — when you register, log in, complete your profile, upload content, contact us or subscribe.
- Automatically — through use of the Service (logs, device data, analytics, local storage).
- From third parties — approximate geolocation from ipapi.co based on your IP; and, for invited Users, identity details from the Account Admin who invites you.
5. Why we process data and our legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Create and manage your account; provide the Service and Output; process projects and uploads. | Performance of a contract (Art. 6(1)(b)). |
| Process voice samples to create voice clones / synthetic voices. | Explicit consent (Art. 9(2)(a)) where the data is biometric — see section 6 — together with contract performance. |
| Billing, invoicing, fraud prevention, debt collection. | Contract performance; legal obligation (Art. 6(1)(c)) for tax/accounting. |
| Security, abuse prevention, logging, troubleshooting, service improvement, aggregated analytics. | Legitimate interests (Art. 6(1)(f)) in operating a secure, reliable service. |
| Analytics cookies (Google Analytics) and marketing emails. | Consent (Art. 6(1)(a)); withdrawable at any time. |
| Comply with legal obligations and respond to lawful requests; establish/defend legal claims. | Legal obligation; legitimate interests. |
6. Voice samples and biometric data
When you create a voice clone, the voice sample is used by our AI provider to build a synthetic voice model. A voiceprint used to uniquely identify a natural person is special-category (biometric) data under Article 9 GDPR. We process it on the basis of explicit consent and the warranties you give in our Voice Cloning Terms: you confirm you own the rights to the voice or have the rightful owner’s documented consent. You are responsible for the lawful basis where the voice is of another person. You may withdraw consent and request deletion of a voice clone at any time; this does not affect past processing. We will not knowingly create voice clones of public figures or any person without consent.
7. Who we share data with (processors & sub-processors)
We do not sell personal data. We share it with service providers (sub-processors) who process it on our behalf under contracts that meet Article 28 GDPR, and with authorities where legally required. Our current sub-processors are:
7.1 AI, voice & speech providers
| Provider | Location | Purpose | Data involved |
|---|---|---|---|
| ElevenLabs | USA | Text-to-speech, voice cloning, sound effects | Scripts, voice samples (biometric), generation parameters |
| OpenAI | USA | AI script & recommendation generation | Prompts, briefs, scripts, URLs you provide |
7.2 Platform, infrastructure & analytics providers
| Provider | Location | Purpose | Data involved |
|---|---|---|---|
| [Hosting / cloud provider] | [Region] | Application & data hosting | All categories above |
| Google Analytics (Google Ireland Ltd) | EU / USA | Website & app analytics | Usage events, device, IP-derived data |
| Google Fonts / Fonts CDN (Google) | EU / USA | Serving fonts | IP, user-agent (technical) |
| Cloudflare, jsDelivr (CDNs) | Global | Serving icon/flag assets | IP, user-agent (technical) |
| ipapi.co | EU | IP geolocation at login/sign-up | IP address (returns approximate location) |
| melod.ie | EU | Music library assets | Track selections (no account identifiers required) |
| [Email provider] | [Region] | Transactional & marketing email | Email, name |
| [Payment processor — TBD] | [Region] | Payment processing | Billing & payment details |
8. International transfers
Some providers (e.g. AI and analytics providers) are located in or transfer data to countries outside the European Economic Area, including the United States. Where we transfer personal data outside the EEA, we rely on appropriate safeguards: an adequacy decision, the EU Standard Contractual Clauses, and/or the EU–US Data Privacy Framework where the provider is certified. You can request information about the safeguards used.
9. How long we keep data
- Account & content — for the life of your account and a reasonable grace period after closure, then deletion or anonymisation. You can delete projects and voice clones earlier.
- Accounting & invoicing records — retained as required by Romanian tax and accounting law (generally up to 5 or, for certain records, 10 years).
- Security logs — kept for a limited period proportionate to security needs.
- Marketing consent — until you withdraw it.
10. Your rights
Subject to the GDPR, you have the right to: access your data; rectify inaccurate data; erase data (“right to be forgotten”); restrict or object to processing (including direct marketing); data portability; and to withdraw consent at any time (without affecting prior processing). You also have the right not to be subject to solely automated decisions producing legal or similarly significant effects — we do not make such decisions.
To exercise your rights, contact support@voxify.studio. We respond within one month. You may lodge a complaint with the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), dataprotection.ro, or with the authority in your country of residence.
11. Security
We implement appropriate technical and organisational measures, including encryption in transit, hashed passwords, access controls and session management. No system is perfectly secure; we will notify you and the authority of a personal-data breach where legally required.
12. Children
The Service is not intended for children under 16. We do not knowingly collect their data; if you believe a child has provided data, contact us and we will delete it.
13. When we act as a processor
If you reach us through a customer’s website or app via our Embedded SDK or public API, that customer is the controller and we process the data on their behalf under the DPA. Please refer to that customer’s privacy notice for how they use your data.
14. Changes
We may update this policy. We will post the new version with an updated date and, for material changes, notify you (e.g. by email or in-app). Continued use after the effective date means you acknowledge the updated policy.
15. Contact
Questions or requests: support@voxify.studio · GZK CONSULTING S.R.L., Str. Dr. Daraban nr. 400 BIS 1, Sat Samurcași, Comuna Crevedia, Dâmbovița County, Romania.