Data Processing Addendum

If you use Audexum to process personal data about other people — your customers, your staff, the speakers in a file you transcribe or dub — you are the controller and we are your processor. This page is the contract Article 28 GDPR requires us to have. You do not need to sign anything: accepting our Terms as a business customer brings this page into your agreement as it stands on that day.

What it says, in short: we process your data only on your instructions; we keep it in the European Union on our own hardware in Bulgaria, except for the hosted AI processing named on /subprocessors; we use a short list of sub-processors, published at /subprocessors; several of them are in the United States and those transfers run on the Standard Contractual Clauses; we tell you about breaches; we help with data-subject requests; and we delete or return your data when you stop using the Service.

Section 16 lists, plainly, what we cannot offer yet — no third-party audit report, no certification, no encryption of the database at rest. You would find that out in due diligence anyway, so we put it in the contract. The numbered sections below are the binding text.

This Data Processing Addendum (the Addendum) is between Audexum (the Processor, we, us) and the business customer that accepts it (the Controller, you).

Read this before you rely on the Addendum. The company Audexum EOOD is not yet on the Bulgarian Commercial Register. Until it is, the party contracting with you, and the party bound by this Addendum, is a natural person established in Bulgaria trading as Audexum. We publish no company number or VAT number because neither exists yet. Full detail is on our Imprint. If you need the named individual and their address before you contract — for your own Article 30 record, or for your procurement file — email [email protected] and we will give them to you in writing.

1.1 Incorporation. This Addendum forms part of your agreement with us from the moment you accept our Terms and use the Service to process personal data on behalf of other people. No signature, purchase order or counter-signature is needed for it to bind us.

1.2 A signed copy, if you need one. If your procurement process needs an executed document, email [email protected] with your legal name, registered address, country and privacy contact. We will return a copy of this text, with Annex I completed for you, signed on our side, normally within 10 business days. We will also sign your own DPA template if its substance does not go beyond what this Addendum says; where it does, we will tell you which clauses we cannot meet rather than sign and hope.

1.3 Order of precedence. On the subject of personal-data protection this Addendum prevails over the rest of the agreement, including the Terms. Our Privacy Policy describes the processing we carry out as a controller in our own right; it does not narrow this Addendum.

Words defined in the GDPR — personal data, processing, controller, processor, data subject, personal data breach, supervisory authority — carry their GDPR meaning here. Other terms:

• GDPR — Regulation (EU) 2016/679, and the Bulgarian Personal Data Protection Act that supplements it.
• Service — everything listed in section 4.1.
• Customer Personal Data — personal data we process on your behalf through the Service.
• Sub-processor — a third party we engage to process Customer Personal Data.
• SCCs — the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914.

3.1 For Customer Personal Data you are the controller under Article 4(7) GDPR and we are the processor under Article 4(8). Where you are yourself a processor for someone else, we are a sub-processor and this Addendum is read accordingly; you warrant that you have the authority to appoint us.

3.2 Where we act as controller, not processor. Some processing is ours, not yours, and sits outside this Addendum: your own account and login data, billing and payment records, credit-ledger entries, fraud and abuse prevention, security logging, aggregate usage statistics, the referral bonus, and answering your emails. That processing is governed by the Privacy Policy.

3.3 Embedded widget. If you install our embeddable widget on your own site, the visitors of your site are your data subjects, the widget calls we receive are Customer Personal Data, and this Addendum covers them. You are responsible for the notice and, where required, the consent your visitors are given.

3.4 Public share clips. If you publish audio as a public share clip, you are making it available to the world at large. We host it for you as your processor, but we cannot make it private again for people who already have the link and copied the file. Treat publication as irreversible. Abuse of hosted clips is handled through /report.

4.1 This Addendum applies to every part of the Service, not only text-to-speech:

• text-to-speech synthesis in the web Studio, on any of our voice engines and tiers;
• speech-to-text / dictation and the transcripts it produces;
• custom voice cloning — enrollment, the stored speaker embedding, the consent record, and synthesis from a cloned voice;
• dubbing of video and audio you upload;
• audiobook generation from files you upload, and any podcast RSS feed generated from it;
• batch synthesis;
• image and video generation in the web app, for accounts that turn it on (section 10.3 and /subprocessors section 2A);
• saved presets, history and share clips;
• the public REST API and webhooks;
• the ElevenLabs-compatible API endpoints, which route to the same processing as the native API;
• the embeddable widget;
• the Android and Windows applications.

4.2 The details required by Article 28(3) GDPR — subject matter, duration, nature and purpose, types of personal data and categories of data subjects — are set out in Annex I and form part of this Addendum.

5.1 We process Customer Personal Data only on your documented instructions, including as to international transfers, unless EU or Bulgarian law requires otherwise. In that case we tell you before processing, unless the law forbids us from telling you.

5.2 What counts as a documented instruction: this Addendum, the Terms, and every request you send through the Studio, the apps, the REST API, the ElevenLabs-compatible endpoints, the widget or your account settings. Emails from you to [email protected] are also instructions.

5.3 If we believe an instruction infringes the GDPR or other EU or Member State data-protection law, we will tell you (Article 28(3), final paragraph). We may suspend the affected processing until the point is resolved.

You confirm, for as long as you use the Service, that:

• you have a lawful basis under Article 6 GDPR — and under Article 9 where it applies — for everything you submit;
• you have given the data subjects the transparency information Articles 13 and 14 require, including the fact that a processor generates synthetic speech from their data;
• your instructions to us are lawful, and you are responsible for their accuracy and quality;
• you hold the rights and permissions needed for every voice you enroll for cloning, for every recording you upload for transcription or dubbing, and for every book or document you upload — see the Acceptable Use Policy;
• you will not submit special-category data (Article 9 GDPR) or criminal-offence data (Article 10) without agreeing it with us in writing first, and without your own documented lawful basis;
• you will not use the Service, or anything it produces, to identify a natural person from their voice or face;
• you hold the consent of every recognisable person in an image you upload for image or video generation;
• you keep your credentials, API keys and widget keys secure, and revoke them when they leak;
• you comply with the disclosure duties described at /ai-disclosure, including telling listeners when audio is AI-generated where the law requires it.

7.1 A speaker embedding created during voice-cloning enrollment is personal data at all times. We do not pretend otherwise.

7.2 It becomes biometric data within Article 9(1) GDPR only where it is processed for the purpose of uniquely identifying a natural person. We process it to synthesise speech, not to identify anyone. We run no speaker matching, no speaker search and no voice-based authentication, and we do not make the embedding available for those purposes. On that basis we treat it as ordinary personal data processed under Article 6(1)(b).

7.3 Enrollment requires the speaker to read a consent sentence aloud, which we check with our own speech-to-text engine, and we keep a record of that consent. This check is not proof of identity and can be defeated by a determined user — for example by joining their own recording of the consent sentence to someone else's audio. It reduces casual misuse; it does not replace your duty to hold the speaker's permission. You remain responsible for every voice enrolled under your account.

7.4 The enrollment recording is kept encrypted (AES-256-GCM) for at most 12 months, so the voice keeps working when it is synthesised on a hosted lane, and is erased when the voice is deleted. The embedding lasts as long as the voice, and the consent record for 5 years after the voice is revoked — see the retention table in the Privacy Policy, and section 13.3 below for what that means on termination.

Everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality, by contract or by statute, and that duty survives the end of their engagement. Access to production systems is limited to the people who need it to operate the Service.

9.1 We implement the technical and organisational measures set out in Annex II. Annex II lists only measures that are actually in place. It is deliberately shorter than the security page of a larger vendor, and it names what is missing rather than leaving you to assume it.

9.2 We may change the measures in Annex II as the Service develops, provided the overall level of security is not reduced. Material reductions will be notified in advance in the same way as sub-processor changes.

9.3 You are responsible for deciding whether the measures in Annex II are appropriate to the risk of the data you choose to submit, given the state of the art and the nature of that data. If they are not, do not submit it.

10.1 General authorisation. You give us a general authorisation to engage sub-processors under Article 28(2) GDPR. The current list, what each one does, and where it processes data, is published and kept current at /subprocessors. A snapshot of that list at the date of this version is in Annex I.

10.2 Core sub-processors. Before we add or replace a sub-processor that handles Customer Personal Data for every account, we will update /subprocessors and email the address on your account at least 14 days in advance.

10.3 Feature sub-processors. Some sub-processors run only an optional feature or a model you choose, such as an image, video or voice engine. Each is listed on /subprocessors and named where you turn the feature on or pick the model, before any of your data reaches it. Turning the feature on or picking the model is your specific authorisation for that sub-processor under Article 28(2) GDPR and your documented instruction under Article 28(3)(a). A feature sub-processor receives no data from an account that does not use that feature. If we change the provider behind a feature you use, we name the new one where you use it before your next request goes to it. You can turn any optional feature off at any time.

10.4 Objection. You may object on reasonable, documented data-protection grounds within 14 days of a core notice, or at any time for a feature sub-processor, by emailing [email protected]. We will try to find a workable answer — another provider, or a configuration that keeps your data away from the new one. If we cannot, you may terminate the affected part of the Service without penalty and we will refund any credits you have paid for and not used.

10.5 Urgent changes. Where a provider fails or a security problem forces a replacement, we may act first and notify you as soon as we can. Your right to object and to the refund in 10.4 runs from that notice.

10.6 Each sub-processor is engaged under a written contract imposing data-protection obligations no less protective than this Addendum. We remain fully liable to you for their performance.

10.7 Accounts on an earlier version. This section took effect in version 3.6. If your account accepted an earlier version and has not accepted version 3.6 or later, we will instead give you at least 30 days' notice by email before a new sub-processor processes your Customer Personal Data, with a right to object within those 30 days on the terms of 10.4, as the version you accepted promised.

11.1 The Service runs on our own hardware in Bulgaria. The database and stored files stay in the European Union. Request content leaves the EEA only through the sub-processors below, including OpenRouter for the V4 voice tier and for processing during scheduled windows when our own GPUs are unavailable, and, for accounts that turn on image and video generation, fal and the model developers it passes requests to, and, for Motion Cinema, OpenRouter and BytePlus.

11.2 What Cloudflare actually sees. Our traffic reaches you through a Cloudflare tunnel, and TLS terminates at Cloudflare. Cloudflare therefore handles request and response content in the clear at its edge, not merely DNS records and IP addresses. We say so because describing Cloudflare as "DNS and routing" would understate the transfer. Cloudflare Turnstile, which protects some forms, is a third-party browser embed and sends the visitor IP address to Cloudflare.

11.3 Transfers to the sub-processors we contract with directly rely on the SCCs, module 3 (processor to processor), incorporated in that provider's data processing agreement, with us as data exporter. Onward transfers by those sub-processors to their own providers (for example OpenRouter to BytePlus, or fal to MiniMax) rely on the safeguards between them, which we have not negotiated. Data is encrypted in transit.

11.4 Honest limit. We completed a transfer impact assessment for Motion Cinema (OpenRouter to BytePlus) on 20 October 2026; we have not yet done one for the other transfers. We will share the transfer documentation we hold, and the relevant provider terms, on request to [email protected].

12.1 Taking into account the nature of the processing, we assist you with your obligation to answer requests under Articles 15 to 22 GDPR, so far as it is possible for us to do so.

12.2 Much of it you can do yourself: history entries, presets, transcripts, cloned voices and share clips can be deleted from the account that created them, and deletion of a record deletes the audio attached to it.

12.3 For anything the interface does not cover, email [email protected]. We acknowledge within 5 business days and complete the work within 30 days of a clear request, unless it is genuinely complex, in which case we tell you why and when. Some of this work is manual today — see section 16.

12.4 If a data subject contacts us directly about Customer Personal Data, we will not answer on the substance. We will tell them to contact you, and pass the request on if we can identify you.

13.1 Articles 32 to 36. We assist you with security of processing, breach notification to the supervisory authority and to data subjects, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to us. Practically, that means we answer security questionnaires, provide the information in Annexes I and II, and describe our processing so you can complete your own Article 30 record and any DPIA.

13.2 Personal data breach. If we become aware of a personal data breach affecting Customer Personal Data we notify you without undue delay, and we aim to do so within 72 hours of becoming aware. The notice will describe what happened, the categories and approximate number of records affected, the likely consequences and what we are doing about it, so far as we know it at the time, and we will send updates as we learn more. Notification is not an admission of fault. Report a suspected vulnerability or breach to [email protected].

13.3 Deletion or return on termination. When you stop using the Service, we delete Customer Personal Data, or return it to you first if you ask within 30 days of termination, except where EU or Bulgarian law requires us to keep it — invoices and accounting records being the usual case. In practice:

• generated audio files are deleted automatically 30 days after creation;
• history rows, batch jobs, transcripts, audiobook jobs and dubbing jobs are deleted automatically 90 days after creation, together with their job directories;
• generated images and videos and uploaded images are deleted automatically 30 days after creation, and media job records 90 days after creation, or earlier when the media tools are turned off;
• a cloned voice unused for 24 months is revoked automatically, and the consent record of a revoked voice is deleted 5 years after revocation;
• public share clips have no automatic expiry today. They stay until you delete them, or until you ask us to. If you want them gone on termination, say so — do not assume a timer exists;
• deletion takes effect in live systems immediately and works out of our off-site backups within 30 days, the length of the backup window.

13.4 We confirm deletion in writing on request.

14.1 We make available to you the information necessary to demonstrate compliance with Article 28 GDPR. On request to [email protected] we provide: this Addendum with Annex I completed; the current sub-processor list; Annex II; the relevant provider terms and SCCs for international transfers; and written answers to a reasonable security questionnaire.

14.2 If that is not enough for your obligations under Article 28(3)(h), you — or an independent auditor bound by confidentiality and reasonably acceptable to us — may audit the processing, on at least 30 days' written notice, no more than once in any 12-month period, during business hours, under confidentiality, and in a way that does not disturb the Service or expose other customers' data. A supervisory authority requiring an audit, or a personal data breach affecting your data, lifts the once-a-year limit.

14.3 Each party bears its own audit costs. You bear our reasonable costs for audits that go beyond the above, or that repeat within 12 months without reasonable cause.

Each party's liability under this Addendum is subject to the limits in the Terms, except that nothing in this Addendum or the Terms limits or excludes liability that the law does not permit to be limited or excluded, including under Articles 82 to 84 GDPR, and nothing affects a data subject's rights under Articles 77 to 79 GDPR.

A buyer finds this out in due diligence, so we would rather say it here. As at 2026-10-23:

• No third-party audit report and no certification. There is no SOC 2 report, no ISO/IEC 27001 certificate, no approved GDPR code of conduct and no Article 42 certification. Nobody outside the operator has audited these systems. If your policy requires one, we do not meet it today.
• No encryption of the database at rest, and the local backup copy is not encrypted. Off-site backup copies have been encrypted since 5 October 2026. The data sits on our own hardware, on disks whose physical security is our responsibility. Earlier versions of our Privacy Policy claimed otherwise; that claim was wrong and has been removed.
• No data protection officer. We do not meet the Article 37 thresholds and have not appointed one. Data-protection matters go to [email protected].
• No availability commitment in this Addendum. This Addendum makes no uptime, latency or support-response promise, and you should not read one into it from anywhere else on the site.
• A small operation. Audexum is operated by one person with a small number of sub-processors. There is no 24/7 security operations centre and no on-call rota. Response times are the ones written above and nothing faster.
• The operator is not yet a registered company. See section 1 and /imprint. If contracting with a natural person is a problem for your procurement, tell us before you buy.

17.1 This Addendum starts when you first process Customer Personal Data through the Service and lasts as long as we hold any of it. Sections 8, 11, 13, 14 and 15 survive termination for as long as they need to.

17.2 Changes. We may update this Addendum. Material changes are posted here and shown to you in the app with a summary, and apply to you once you accept them. If you do not accept a change that materially reduces your protection, you may terminate the affected part of the Service and we will refund credits you have paid for and not used. If you use the Service only through the API and have not accepted a change, the version you accepted keeps applying until we email you about it at least 30 days before it takes effect. Changes to sub-processors follow section 10. If you have a counter-signed copy under section 1.2, that copy continues to govern until you agree otherwise in writing.

17.3 Governing law. Bulgarian law and the GDPR govern this Addendum. Our lead supervisory authority is the Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg. Nothing here removes a data subject's right to complain to their own supervisory authority or to go to court.

17.4 Contacts. Data protection: [email protected]. Contracts and signed copies: [email protected]. Security: [email protected]. Abuse: [email protected]. These four addresses are the only ones that reach us.

A. The parties

B. Description of the processing

C. Sub-processors at this version

The authoritative, current list is at /subprocessors. Our website analytics run on self-hosted software on our own servers, first-party, so no third party receives that data.

These are the measures actually in place. Where a measure a buyer would expect is absent, it is named in section 16 rather than left out quietly.

1. Confidentiality and access control

• TLS on all public web and API traffic; TLS terminates at our Cloudflare edge (see section 11.2).
• Passwords stored as bcrypt hashes. We never see or store a plaintext password.
• API keys stored hashed, never in plaintext; only the key prefix is retained in readable form.
• Widget keys are restricted keys: they can call only the synthesis endpoint, so a key visible in your page source cannot read your account.
• Session cookies set HttpOnly, Secure and SameSite=Lax.
• Generated audio stored on local disk with owner-only file permissions (mode 0700).
• Production access limited to the operator, under a duty of confidentiality.
• Email verification required before synthesis; voice cloning limited to paid plans.

2. Integrity

• Database constraints and application-level validation on inputs.
• Stripe webhook signatures verified before any billing event is acted on.
• Uploads validated for type and size before processing; file paths built from server-issued identifiers only, never from client input.
• Automated test suite run before deployment.

3. Availability and restoration

• Automated database backups, copied off-site to a third location, on a 30-day rolling window. Off-site copies are encrypted; the local copy is not — see section 16.
• Automatic process restart on failure.
• Restore from backup is the documented recovery path. No availability figure is promised (section 16).

4. Resilience against attack

• Cloudflare DDoS mitigation and Turnstile anti-bot on exposed forms.
• Application-level rate limiting and quota enforcement on every metered endpoint.
• Firewall on internet-facing services; the machine is not directly exposed to the public internet outside the Cloudflare tunnel.

5. Data minimisation and purpose limitation

• We do not use your inputs or outputs to train, fine-tune or evaluate any model. Requests processed by hosted models through OpenRouter are subject to that model provider's own rules.
• Speech models and language models run on our own hardware in Bulgaria, except the V4 voice tier and scheduled windows when our GPUs are unavailable, when requests go through OpenRouter (section 11).
• Voice-enrollment recordings are stored encrypted and deleted when the voice is deleted or the account is closed.
• Automated retention cleanup runs daily and deletes expired audio, history, transcripts and job data on the schedule in section 13.3.

6. Transparency of generated audio

• Generated audio carries a machine-readable AudioSeal watermark, and the production system is configured to fail closed — if the watermarking service is unavailable, audio is not delivered rather than delivered unmarked. See /ai-disclosure for the exceptions and for your own disclosure duties.
• Voice-cloning enrollment requires a spoken consent sentence, verified by our speech-to-text engine, and stores a consent record. Its limits are stated in section 7.3.

7. Governance

• Security reports accepted at [email protected]; abuse reports at [email protected] and through /report.
• Security patches applied on a best-effort basis, prioritising anything remotely exploitable.
• Annex II reviewed whenever this document is revised.
• Sub-processors selected on their published security posture and their willingness to sign EU-aligned data-protection terms including the SCCs.

• Terms of Service — the agreement this Addendum forms part of
• Privacy Policy — our own controller processing, and the full retention table
• Sub-processors — the current, authoritative list
• Acceptable Use Policy — what may and may not be submitted
• AI Disclosure — watermarking and your disclosure duties
• Cookie Policy · Imprint · Report content