Privacy Policy

1. Data we collect

• Account data: name, email address and password (stored only as a hash), or, if you sign in with a third-party identity provider such as Google, the identifier, name, email address and picture that provider shares with us; organisation membership and role. Some mobile apps create an account without your name or email: it is tied to your device by an app key and Apple’s App Attest check, which confirms the requests come from a genuine copy of the app.
• Content you submit: audio, video, text, documents and other files you send to a Service, and the results we produce, such as transcripts, translations, subtitles and dubbed audio. This can include recordings of your voice and of other people’s voices that you submit.
• Voice samples and voice clones: where a product lets you create a synthetic voice that sounds like a particular person (a "voice clone"), the recordings used to make it, the voice model made from them (which can include a numerical representation of how the voice sounds), the record of that person’s consent, and the audio produced with it.
• Usage and billing records: features used, quantities consumed (for example credits, minutes or words), orders, credit balances and refunds. From our payment provider we receive transaction details such as the order number, product, amount and currency; we do not receive your card details.
• Technical data: IP address, device and browser type, app version, language, timestamps, sign-in sessions, logs and error and performance reports, needed to run and secure the Services.
• Messages you send us, for example through our contact form (name, email address, company if given and your message).

2. Why we use it and our legal bases

• To provide the Services you ask for, including processing your content, metering credits and managing your account (contract).
• To take payment, keep accounting and tax records and meet other legal duties (legal obligation).
• To secure the Services, prevent fraud and abuse, fix errors, and measure and improve the quality and reliability of our Services, for example by checking the accuracy of transcripts, translations and voices on stored session records (legitimate interests). We do not use your content to train our own AI models.
• To create and use a voice clone, only with the explicit consent of the person whose voice it is (explicit consent). Because a voice model could be used to recognise a person, we treat voice samples and voice clones as sensitive data, whether or not they are used that way. We do not use them to identify or verify anyone, to train our own AI models, or to make voices for anyone outside the account or organisation that created them. The person can withdraw consent at any time, and we then delete the voice clone and its samples; withdrawal does not affect what was done before it.
• To answer your messages and requests (legitimate interests, or steps before a contract).
• To send service messages such as receipts, security notices and important changes (contract and legitimate interests).
• To send optional product news, only where you have agreed (consent), which you can withdraw at any time.
• We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Automated checks limit request rates, verify the app and stop use when credits run out.

3. Organisations, events and other people’s data

When an organisation uses our Services to process other people’s personal data, for example the speakers and audience of an event it hosts, or people who appear in recordings, videos or documents it uploads, that organisation decides what is processed and why. It is responsible for having a lawful basis and for informing those people, and requests about that data may be passed to it. We process such data to provide the Service to the organisation and, as described in this policy, to keep the Services secure and measure their quality. Anyone who creates a voice clone of another person must first have that person’s explicit consent; we may ask the person to confirm it to us directly, and the person can contact us at any time to withdraw consent and have the voice clone deleted. Business customers who need data processing terms can contact us.

4. Who we share it with

We do not sell personal data or share it for advertising. We share it only with service providers that process it on our behalf, with providers you choose, and when the law requires. The categories we use, which may change as products grow, are:

• Payments and tax: Paddle, our Merchant of Record, which acts as an independent controller for the payment data it collects under its own privacy notice; for purchases inside a mobile app, the app store (such as Apple), under its own privacy notice.
• AI and language processing: providers of speech recognition, translation, text-to-speech, voice cloning, voice and language models, reached directly or through a model-routing service (such as OpenRouter), which receive the content you submit, including audio of speech, to produce results. A voice-cloning provider receives the voice samples and may keep the voice model it makes on our behalf until we delete it. Depending on the product, the model and availability, the content may be processed by different model providers.
• Infrastructure: cloud hosting, storage, backups, networking and DNS, email delivery, and security services such as a bot-check on our contact form (Cloudflare Turnstile).
• Identity: our sign-in service and the identity providers you choose to use, such as Google; Apple for the App Attest check.
• Monitoring: error and performance monitoring (Sentry). Reports contain technical details, which in some products include your IP address, user ID or email address, and, in some apps, a masked replay of the screen around an error, with text and images hidden.
• Professionals and authorities: our accountants and advisers, and courts or authorities where the law requires.

5. Where data is processed and international transfers

Our main servers, databases and backups are hosted in the European Union. Some providers, including AI model providers and monitoring and payment services, are based in or process data in countries outside the European Economic Area, such as the United States and the United Kingdom. Where that is so we rely on an adequacy decision (for example the EU-US Data Privacy Framework for certified companies, or the decision for the United Kingdom), the European Commission’s Standard Contractual Clauses, or another safeguard the GDPR allows. You can ask us for details of the safeguard for a transfer.

6. How long we keep data

We keep personal data only as long as needed for the purposes above, and then delete or anonymise it:

• Account data: while your account is active; after you ask us to close it, we delete it unless we must keep some of it for legal, accounting or tax duties or to resolve disputes.
• Content and results: for as long as the product needs them to provide the Service or you keep them in your account, or until you delete them where the product allows. Some products delete records automatically; where they do, the product’s own section of this policy says when. Unless it says otherwise, text records of sessions, such as transcripts and translations, are kept for quality and support until you ask us to delete them, or until we set a shorter period for them.
• Voice clones: until you delete them, the person whose voice it is withdraws consent, or the account closes; we then delete the voice clone and its voice samples and ask our providers to delete their copies. We keep the record of consent for up to 3 years after that, to show the consent was given if a claim arises.
• Billing and accounting records: for the period tax and accounting law requires.
• Logs and traces: kept for a short period, normally about 7 days; database backups are kept for about 30 days, then overwritten.
• Messages to us: as long as needed to deal with them and any follow-up.

7. Your rights

You can ask us to access, correct, delete, restrict or port your personal data, and to object to processing based on legitimate interests, including the quality checks described above. Where processing is based on consent you can withdraw it at any time. To use these rights, or to close your account and have its data deleted, contact us through the form at fusionbox.cloud/#contact. We answer within one month, and may need to verify your identity first. You may also complain to the Hellenic Data Protection Authority (dpa.gr) or the supervisory authority where you live or work.

8. Cookies, local storage and similar technologies

We do not use analytics, advertising or tracking cookies. We use only what is strictly needed to provide what you ask for: first-party cookies or browser storage that keep you signed in, remember settings such as your theme, devices or language, and keep a checkout in progress; a bot-check when you use our contact form; and error reports. These do not need consent. If we ever add analytics or marketing technologies we will ask for your consent first where the law requires and update this policy.

Payment checkout pages are provided by Paddle, which may use its own cookies under its own notice.

9. Data on your device

Some products have a mode that runs entirely on your device: what it processes is not sent to us. If you turn on a backup to your own cloud account (for example iCloud), that copy is handled by your cloud provider. Such a mode may still download files it needs, such as language models, from our servers.

10. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, hashed passwords, access controls and monitoring. No system is perfectly secure, so please protect your credentials as well. If a personal data breach is likely to result in a high risk to you, we will tell you without undue delay, as the law requires.

11. Children

The Services are not directed at children under 16, and children under 16 may not create an account. A voice clone of anyone under 18 needs the consent of their parent or guardian. If you believe a child under 16 has given us personal data, contact us and we will delete it.

12. Vozwave

• Speech: in Vozwave’s hosted (online) modes, the content you submit includes your recorded speech and the speech of anyone else the microphone or event feed picks up.
• Characteristics inferred from audio: to choose a matching dubbing voice and the right language, Vozwave estimates from the audio which language is spoken and whether a voice sounds male or female. This estimate is kept only while the session runs and is not used to identify anyone.
• Event listeners: people who open an event’s listening page need no account. We keep only aggregate figures, such as the number of listeners, time listened and the kind of device (from the browser’s user-agent), not a listener’s identity.
• Retention: Vozwave deletes the audio of a hosted session 7 days after the session’s last activity. The audio and transcript of an event are kept until the host deletes the event.
• Vozwave Pocket: it runs entirely on your iPhone, and its speech and translations are not sent to us. The app still downloads language packs from our servers.
• The play button on vozwave.io: the optional button uses your browser’s built-in speech voice; some browsers produce that voice with an online service of the browser maker.

13. Changes and contact

We will post updates here with the date and, for material changes, tell you in the product or by email. Controller: FUSIONBOX, a business based in Greece. Contact us through the form at fusionbox.cloud/#contact.