Privacy Policy

The data controller responsible for your personal information is Zephyni, a company registered in Uruguay (registration number: 150972020015). For any privacy-related enquiry, contact us at partners@zephyni.com.

This policy covers the Zephyni web application — your account, the voice samples you upload, the recordings you generate, and the links you share with your clients. Your contractual rights and obligations are set out separately in our Terms of Use.

• Account data — your email address and password. If you sign in with Google, we receive your email address from Google instead of a password. We also keep the date your account was created.
• Profile data — a display name, if you choose to provide one.
• Voice recordings — the MP3 samples you upload, together with a title and duration. Your voice is used to synthesise audio in your own voice. Because a voice sample can identify you, we treat it as biometric data and a special category of personal data under Article 9 of the GDPR.
• Generated recordings and their content — the script you write, the title, any tags, the note you add for a client, and the resulting audio file.
• Share links — the tokens you generate to give a client access to a recording, and their expiry dates.
• Billing data — your credit balance and a history of top-ups and charges, including amount, date, status and a receipt reference from the payment provider. Card and PayPal account details are handled by the payment provider and never reach our servers.
• Technical data — a session identifier stored in a cookie, and the server logs our hosting and backend providers keep in order to operate and secure the service.

We process the data above on the following legal bases:

• Performance of a contract (Article 6(1)(b)) — creating and running your account, generating recordings, serving share links, and taking payment.
• Explicit consent (Article 9(2)(a)) — processing your voice sample, which is a special category of data. Consent is separate from accepting our Terms of Use, and you can withdraw it at any time by deleting the voice sample from your account. Withdrawal does not affect processing already carried out.
• Legitimate interests (Article 6(1)(f)) — keeping the service secure, preventing abuse, and diagnosing faults.
• Legal obligation (Article 6(1)(c)) — retaining records of payments for as long as accounting and tax law requires.

When you write a note for a client, name a recording after them, or send them a share link, you decide what personal data goes into the service and why. In that relationship you are the data controller and Zephyni acts as your processor: we handle that data on your instructions and for no purpose of our own.

You are responsible for having a lawful basis to process your clients' data and for meeting your own professional and legal obligations towards them. If you need a data processing agreement, contact us at partners@zephyni.com.

Anyone who opens a share link can play the recording without an account. We do not ask a recipient to identify themselves and we do not profile them.

Unlike a one-off demo, this is a working tool: your material stays available until you remove it.

• Voice samples are kept until you delete them or close your account. Deleting a sample removes it from our storage.
• Generated recordings, scripts, tags and notes are kept until you delete them or close your account.
• Share links stop working once they expire or once you revoke them.
• Payment records are retained for the period required by accounting and tax law, even after an account is closed.
• Account data is deleted when you close your account, apart from anything we must keep by law.

We use one strictly necessary cookie to keep you signed in. It holds a session identifier, it is not used for advertising or profiling, and the service cannot work without it.

On a share page, your client's browser stores a copy of the recording it has already downloaded, using the browser's local database. This exists so the recording still plays if their connection drops. It never leaves their device, and it is discarded once the link stops working. Clearing browser data removes it.

We do not use analytics, advertising cookies, or third-party tracking of any kind.

We use the following sub-processors to operate the service:

• Supabase — authentication and cloud storage for voice samples and generated recordings, under a Data Processing Agreement.
• AI inference provider — the script you write is transmitted to a third-party AI service to prepare it for audio synthesis.
• Audio editor provider — your voice sample and prepared script are transmitted to a third-party service to produce the recording. This is where your biometric data is processed, and only on the basis of your explicit consent.
• PayPal — payment processing for top-ups. PayPal is an independent controller of the payment data you give it.
• Vercel — hosting for this web application.

We do not sell your data, and we do not share it with anyone beyond what is necessary for the processing described here.

Our providers may process data outside your country, including outside the European Economic Area. Where that happens, the transfer is covered by an appropriate safeguard under Chapter V of the GDPR, such as the European Commission's Standard Contractual Clauses. Write to partners@zephyni.com if you would like details of the safeguards that apply to your account.

Voice samples and recordings are held in access-restricted storage and are served through short-lived links rather than public URLs. Traffic is encrypted in transit. No system is perfectly secure, so please use a strong, unique password and tell us at partners@zephyni.com if you suspect your account has been accessed by someone else.

Under the GDPR you have the right to:

• Access — obtain a copy of the data we hold about you.
• Rectification — correct data that is inaccurate or incomplete.
• Erasure — have your data deleted. Most of it you can delete yourself from within the application.
• Restriction and objection — limit or object to certain processing.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — withdraw your consent to voice processing at any time, without affecting the lawfulness of processing already carried out.
• Complain — lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at partners@zephyni.com. We respond within one month, as required by Article 12(3).

The service is intended for practising professionals and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, contact us at partners@zephyni.com and we will delete it.

We may update this policy as the service develops or the law changes. The current version is always published on this page with its date. For material changes we will give reasonable notice, for example by email or a notice in the application.

For any question about this Privacy Policy or how we handle your data, contact us at partners@zephyni.com.