Privacy Policy

1. Who we are, and the roles we act in

The controller responsible for the processing described in this policy is Loryvoice DOO (“we”, “us”). For anything in this policy, contact privacy@loryvoice.com.

Loryvoice acts in two distinct roles, and this policy is explicit about which is which:

• As controller — for the personal data of our website visitors, prospects, applicants, and customer account holders: account and contact data, billing data, form submissions, and the technical data described below. For this data, Loryvoice decides the purposes and means of processing.
• As processor — for the personal data contained in the content our business customers upload for dubbing, including recordings of speakers who are not the customer themselves. For this data, the customer is the controller: it decides why the material is processed and must have a lawful basis for it. Loryvoice processes it only on the customer's documented instructions, under a data processing agreement (DPA) that we make available to every business customer. Sections 5 and 12 explain what this split means in practice.

2. Data we collect

We collect only what the service needs. Everything in the last six categories below is website analytics, and none of it is collected unless you accept analytics on the banner described in section 6:

• Account and contact data — name, email address, company name, and the message you send us through the waitlist, demo, or contact forms. Applicants to open roles may also share a CV link and a portfolio link.
• Customer content — the source recordings, video, and scripts a customer uploads for dubbing, and the finished renders we deliver back. This content can contain personal data of people other than the customer, in particular speakers' voices and likenesses.
• Voice data — recordings of a speaker's voice and, where a customer orders voice cloning, the voice model derived from those recordings.
• Consent receipts — the signed consent document for each cloned voice, naming the cleared speaker and recording who consented, to what, and when. We attach it to every render produced with that voice, on every plan.
• Billing data — invoicing details, VAT number, and records of finished minutes rendered. Card details, where used, are handled by our payment provider and never stored by us.
• Usage and technical data — IP address, browser and device information, pages visited, and the anti-bot signals produced by Cloudflare Turnstile when you submit a form. This category is not analytics: it is the request and security data our infrastructure necessarily handles on every visit, whatever you answer on the consent banner.
• Website analytics — pages viewed and the navigation between them; clicks, taps, and other interface interactions recorded automatically, including the visible text and the link target of the element involved; how far down a page you scrolled; events marking that a form was started and submitted, and from which position on the page; the page you entered the site on, any campaign parameters in the link you followed, and the site that referred you; and your browser, device, operating system, and the approximate location derived from your IP address.
• Session recordings — a reconstruction of your visit, replayed from those same interface events. It is not a video capture of your screen. Input fields are masked in your browser before anything is transmitted, so what you type into our forms is not readable in a recording.
• Heatmap interaction data — where visitors click, move the pointer, and scroll on a given page, aggregated across visits.
• Survey answers — where we run a short survey on the site, the option you select and any free text you write into it. Free text is stored as you wrote it, so please do not put personal details in there; we do not need them to read the answer.
• Error reports — the type, message, and stack trace of an error that occurs in your browser on our site, and the page it happened on.
• The analytics identifier and the profile behind it — a random identifier stored in your browser when you accept analytics, and the profile the categories above accumulate against. It is not your name: we never put your email address or the content of your message into analytics. If you submit a form while analytics is on, we do record what happened to that submission — accepted, blocked as spam, rate-limited, rejected as incomplete or malformed, or failed to send — against the same identifier, together with which of our forms it was. Our forms always answer successfully to the browser so that spam gets no feedback, which makes this the only way we can tell whether a real message actually reached us.

3. Voice cloning, consent, and biometric data

Voice cloning is the most sensitive processing we do, and it runs on one rule: no cloned voice without a signed consent receipt from the speaker. We do not train or operate a voice model for a speaker who has not signed one.

A voice recording processed to build a model of a specific, identified person's voice can, depending on how it is used, qualify as biometric data within the meaning of Article 9 GDPR. Rather than argue the classification, we apply the higher standard by design: every consent receipt must record the speaker's explicit consent to the creation and use of a voice model of their voice, identifying the speaker, the permitted uses, and the date of consent. That is the standard Article 9(2)(a) GDPR requires for special-category data, and it is the standard we require even where the classification could be debated.

The consent receipt travels with the output: we attach it to every render produced with the cloned voice. If a speaker withdraws consent, use of the voice model stops immediately: we stop producing new renders with it, notify the customer, and delete the model within 30 days unless a legal hold applies. Withdrawal does not affect the lawfulness of processing carried out before it. We retain the consent receipt itself after withdrawal, as described in section 8, so that the lawfulness of past renders remains verifiable.

Where the customer — not the speaker — uploads the recordings, the customer is the controller of the speaker's personal data and is responsible for informing the speaker about the processing (Article 14 GDPR); the consent receipt process supports that duty — the customer remains responsible for informing speakers — and this policy is available to every speaker who signs one.

4. Why we process data, and on what legal basis

Where Loryvoice is the controller, each purpose has a legal basis under Article 6 GDPR:

• Providing the service — managing your account, delivering the renders you ordered, and administering your plan. Payment itself is taken by our merchant of record, who is the seller of record for the transaction. Basis: performance of a contract (Article 6(1)(b)).
• Responding to enquiries — replying to waitlist, demo, contact, and job-application submissions. Basis: our legitimate interest in responding to people who contact us (Article 6(1)(f)), and steps taken at your request before entering a contract (Article 6(1)(b)).
• Website analytics — understanding how the site is used so we can improve it: the analytics data, session recordings, heatmap data, survey answers, and error reports described in section 2. Basis: your consent (Article 6(1)(a)). We collect none of it before you accept, we do not fall back to legitimate interest if you decline, and you can withdraw at any time — see sections 6 and 12.
• Security and abuse prevention — Turnstile verification, rate limiting, and access logging. Basis: our legitimate interest in keeping the service secure and free of spam and fraud (Article 6(1)(f)).
• Enforcing the one-per-organisation limit on the free pilot — checking whether a new request is linked to a pilot we have already served, using the email address and its domain, the IP address and the network it belongs to — including whether that network is a data centre, hosting provider, VPN, proxy or anonymising service — the browser and device characteristics the request carries, and request timing and sequence. Where a paid account is used to farm free pilots, we may also compare the payment instrument and billing details held by our payment provider. We compare these signals across requests for this purpose only; we do not use them to build a profile for marketing, pricing, or any other decision about you. A match is reviewed by a person before any account is suspended or closed, and you are told the reason and can respond — see section 7. Basis: our legitimate interest in offering a free trial without funding its abuse (Article 6(1)(f)). You can object at any time under section 12; if you do, we may be unable to grant a free pilot, which does not affect any paid plan.
• Legal obligations — keeping invoicing and tax records for as long as EU and national law requires. Basis: compliance with a legal obligation (Article 6(1)(c)).
• Establishing, exercising, or defending legal claims — retaining consent receipts and related records as evidence of lawful processing. Basis: our legitimate interest in demonstrating compliance and defending claims (Article 6(1)(f); Article 9(2)(f) where special-category data is concerned).

5. Where Loryvoice is the processor

For the personal data inside customer content — including speakers' voices — the customer, as controller, is responsible for the lawful basis. For voice cloning specifically, we require, as a non-negotiable condition of the service, that this basis be the speaker's explicit consent, evidenced by the signed consent receipt described in section 3. We process this data only to provide the service the customer ordered, never for our own purposes, and we do not use customer content or voice data to train models for anyone else.

6. Cookies, device storage, and the consent banner

The Loryvoice website uses two kinds of storage, and they are treated differently.

Strictly necessary storage — what the site needs to work and to protect its forms, including Cloudflare's security cookies — is set on every visit. Strictly necessary cookies are exempt from the consent requirement under EU ePrivacy rules.

Non-essential storage is used for website analytics and nothing else, and only after you accept it. We show a consent banner on your first visit, and until you answer it we write nothing non-essential to your device and send no analytics data anywhere. The analytics code is loaded, but it is held in a mode that keeps its state in memory only, so there is no cookie and no local-storage entry to find while the banner is open.

If you accept, PostHog stores an analytics identifier and session state in your browser's local storage and session storage, and in a first-party cookie. If you decline, the only thing stored is your refusal, under the key lv-analytics-consent, so we do not ask you again on every page. Accepting stores that same key with the opposite value.

One detail worth stating plainly, because it is what makes loading the analytics code before you answer acceptable rather than merely convenient: analytics traffic goes to loryvoice.com, not to PostHog. Our own server forwards it. Before you consent the only thing that reaches PostHog is the request for the analytics script itself, and our server sends that on with your IP address and location removed — so PostHog learns nothing about you or your device until the moment you accept. Your IP address is passed on only for the events you have consented to, and only so that the approximate location in section 2 is your own rather than a data centre's.

We run no advertising cookies, we do not sell personal data, and we share nothing with ad networks. You can change your answer at any time through Analytics settings in the site footer — see section 12.

7. Automated decision-making

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). Anti-abuse controls such as Turnstile may block automated form submissions; a blocked visitor can always reach us at hello@loryvoice.com. Where signals suggest the free-pilot limit is being circumvented, the signals are gathered automatically but the decision is not: a person reviews the match, you are told the reason, and you can respond before anything is closed.

8. How long we keep data

We keep personal data only as long as the purpose requires:

• Customer content and renders — for the life of the customer's account, or the shorter retention window agreed in the customer's contract; deleted on account closure, subject to any legal hold.
• Voice models — for as long as the speaker's consent stands and the customer's contract is in force; use stops immediately on withdrawal, and the model is deleted within 30 days of consent withdrawal or contract end, unless a legal hold applies.
• Consent receipts — retained alongside the renders they cover, so the provenance of every render remains verifiable; after withdrawal of consent or contract end, retained only as long as needed to demonstrate the lawfulness of past processing and to establish, exercise, or defend legal claims, then deleted.
• Form submissions and enquiries — up to 24 months from last contact, then deleted. Unsuccessful job applications are deleted within 6 months unless you ask us to keep them longer.
• Billing records — for the retention period EU and national tax law requires.
• Technical logs — typically 30 days, longer only where needed to investigate a security incident.
• Website analytics events — pageviews, interface events, survey answers, error reports, and the record of what happened to a form submission: 12 months from collection, then deleted. Heatmap data is derived from those same events and goes when they go.
• Session recordings — 30 days, then deleted. They are the most revealing category we hold about a website visit, so they are the shortest.
• Analytics profiles — the profile behind a browser's analytics identifier: kept while events attached to it are still inside the 12-month window. We clear profiles with nothing left attached at least once a quarter, and we delete any profile immediately on request, as described in section 12.

9. Who we share data with

We do not sell personal data, and we do not share it with advertisers. We share data only with subprocessors that run the service for us, each under a data processing agreement. The subprocessors we publicly name today include:

• Cloudflare — hosting, content delivery, DDoS protection, and Turnstile anti-bot verification.
• Resend — transactional email delivery for form submissions and service notifications.
• PostHog — website analytics: the analytics data, session recordings, heatmap data, survey answers, and error reports described in section 2, processed and stored on PostHog's EU Cloud in Frankfurt, Germany. Engaged only where you have accepted analytics; if you decline, no data about your visit reaches PostHog at all. We intend to move this workload onto infrastructure we host ourselves; we are not putting a date on that, and this page will say so when it happens.

10. Disclosures and subprocessor changes

Beyond subprocessors, we disclose personal data only where the law requires it — for example, to comply with a binding order of a court or authority — and, where legally permitted, we will inform the affected customer before doing so.

The full current subprocessor list is available on request from privacy@loryvoice.com. We will inform customers under a data processing agreement in advance before adding or replacing a subprocessor that touches their data, and the DPA gives them the right to object on reasonable data-protection grounds.

11. International transfers

Loryvoice processing and storage run in the European Union by default — see our EU Hosting & Data Residency page for detail, including exactly what may leave the EU and why. Where a subprocessor processes personal data outside the EU or EEA, the transfer is covered by the European Commission's Standard Contractual Clauses or another valid transfer mechanism under Chapter V GDPR, with supplementary measures where required.

Website analytics is an EU-region workload: the PostHog project is hosted in Frankfurt, and analytics data is stored there. It does not reach PostHog directly from your browser — it goes to loryvoice.com and our server forwards it, which means that hop crosses Cloudflare's global edge network in the same way every other request to this site does. That edge caveat is described on the EU Hosting & Data Residency page and applies here too; what it does not change is where the analytics data comes to rest, which is the EU.

12. Your rights

Under the GDPR you have the right to access your personal data, to rectification, erasure, and restriction of processing, to data portability, and to object to processing based on legitimate interest. Where processing rests on consent — including voice cloning — you can withdraw that consent at any time, without affecting the lawfulness of processing before withdrawal. A speaker who has signed a consent receipt can withdraw it by writing to privacy@loryvoice.com; we will act as described in section 3.

Website analytics consent has its own control, because the GDPR requires withdrawal to be as easy as giving consent (Article 7(3)) and an email exchange would not be. Open Analytics settings in the footer of any page and answer the banner again. It takes effect in that browser immediately: collection stops, session recording, surveys, and error reporting shut down with it, and the analytics identifier and every other non-essential entry PostHog wrote is removed from your device. Withdrawal does not affect the lawfulness of what was collected while consent stood, and it does not by itself delete that data — for that, ask us to erase it, as described next.

Erasing analytics data we already hold. Analytics is keyed to a random identifier rather than to your name, so we need that identifier to find your data — an email address alone does not appear anywhere in it. You can read the identifier yourself: on loryvoice.com, open your browser's developer tools, go to Application, then Local Storage, open the entry whose name begins with ph_, and copy the distinct_id value inside it. Send that to privacy@loryvoice.com and we will delete the profile it belongs to together with every event, session recording, heatmap contribution, survey answer, and form-outcome record attached to it, and confirm to you when it is done. If you submitted a form on this site while analytics was on, tell us the email address you used and roughly when — the server-side record of that submission carries the same identifier, which normally lets us find your profile without the developer-tools step. If neither route is available to you we will say so rather than confirm a deletion we could not actually verify, because a purely anonymous browsing record may not be findable at all.

To exercise any of these rights, email privacy@loryvoice.com. We respond within one month; for complex or numerous requests we may extend this by up to two further months, and we will tell you within the first month if so. Where your request concerns data we process on behalf of a customer (see section 1), we will forward it to that customer without undue delay and assist them in responding, as the GDPR requires of a processor. One exception is honoured directly: withdrawal of voice-cloning consent is acted on as described in section 3, as a condition of the service, whoever the controller is.

You also have the right to lodge a complaint with your local data protection supervisory authority, or with the supervisory authority of the EU member state where Loryvoice is established.

13. Security

We encrypt data in transit and at rest, restrict access to personal data to the people who need it to operate the service, log administrative access, and protect public forms with layered anti-abuse controls. Full technical and organisational measures are documented in the data processing agreement. No system is perfectly secure, but we design for the sensitivity of what you trust us with — people's voices.

14. Changes to this policy

When we change this policy we will update the date at the top of this page. For material changes we will notify account holders by email before the change takes effect.

15. Contact

Privacy questions, consent withdrawals, and data-subject requests: privacy@loryvoice.com. Everything else: hello@loryvoice.com.