Privacy Policy

Last updated: November 11, 2026

This policy explains how VoiceSpony collects and uses personal data, in accordance with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act.

1. Data controller

2. Data we collect

• Account data: email address and password (stored only as a secure hash — we can never read it).
• Content: the texts you submit and the audio files generated from them.
• Usage data: characters used, plan, dates of generation, voice and settings chosen.
• Billing data: plan purchased, amount, date, and payment/membership identifiers sent by Whop. Card details are collected directly by Whop; we never receive them.
• Technical data: IP address and browser information in server logs, used for security and abuse prevention.

3. Why we use it (purposes and legal bases)

• Provide the Service, your account, your library and your plan — performance of the contract (Art. 6.1.b GDPR).
• Process payments and keep accounting records — contract and legal obligation (Art. 6.1.c).
• Secure the Service, prevent fraud and abuse (rate limiting, logs) — legitimate interest (Art. 6.1.f).
• Send essential emails (password reset, important changes) — contract.

We do not sell your data, do not use it for advertising, and do not use your texts or audio to train AI models.

4. Who receives it

• OVH SAS (France) — website hosting and database.
• Vast.ai, Inc. (United States) — GPU servers that convert your text to audio. Texts are processed in memory and not stored there.
• Whop, Inc. (United States) — payment processing; Whop acts as an independent controller for the payment data it collects, under its own privacy policy.

Transfers outside the EU are protected by the European Commission's Standard Contractual Clauses and/or the EU-US Data Privacy Framework, where applicable.

5. How long we keep it

• Account, texts and audio: as long as your account exists. You can delete any audio file at any time; deleting your account deletes everything immediately.
• Accounts with no login for 3 years are deleted.
• Billing records: 10 years, as required by French accounting law (Art. L.123-22 of the Commercial Code).
• Security logs: 12 months maximum.

6. Your rights

You have the right to access, rectify, erase and port your data, to object to or restrict its processing, and to give instructions about your data after your death. Write to support@voicespony.com; we answer within one month. You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

7. Security

All traffic is encrypted (HTTPS). Passwords are hashed with a modern algorithm. Audio files are private: only you can access them while logged in.

8. Cookies

We only use one strictly necessary cookie. See the Cookie Policy.