Privacy Policy

This summary is here to orient you. It is not the policy — the numbered sections below are, and they control if the two ever differ.

• We run a text-to-speech and speech-to-text service. To do that we process the text you submit, the audio you upload or dictate, the audio we generate, and the account and billing data needed to charge you.
• If you create a cloned voice, we store a speaker embedding derived from your recording, plus a record of the consent sentence you read aloud. Section 4 explains exactly what that is and why we take the position we take on it.
• Our servers are our own hardware in Bulgaria. Generated audio, uploads and the database sit on those machines. A small number of third parties are involved — payments, email, sign-in, edge network, and hosted AI models through OpenRouter for the V4 voice tier and when our own GPUs are unavailable. Section 9 names all of them.
• We do not use your inputs or outputs to train, fine-tune or evaluate models. We do not sell personal data. If you accept advertising cookies, Meta measures our ads (section 9); if you do not, nothing is sent to Meta.
• Cloned voices and public share clips have no automatic expiry: they last until you delete them or close your account. Free-tool leads and feedback are deleted after 24 months. Section 8 has every period.
• Image and video generation is off until you turn it on. If you turn it on, your prompts and any image you upload go to fal (United States) and through it to the developer of the model you pick, or for Motion Cinema to OpenRouter (United States) and through it to BytePlus, ByteDance’s cloud service (Singapore, Malaysia, US, Hong Kong, Indonesia or Japan); results are kept for 30 days. Section 3A.
• For any privacy request, email [email protected]. Section 15 tells you what we do with it and how fast.

• Controller: Audexum, established in Bulgaria (the "Operator", "we", "us").
• Legal status: Audexum is not yet an incorporated company. Incorporation as a Bulgarian single-member limited liability company is in progress. Until the entry appears on the Commercial Register, the controller is a natural person established in Bulgaria trading as Audexum. We do not publish a company number or a VAT number, because neither exists yet. When the register entry is made, this page will carry the company name, seat and UIC, and the version number at the top will change. See /imprint.
• Privacy contact: [email protected]
• Legal contact: [email protected]
• Security contact: [email protected]
• Abuse reports: [email protected]
• Data Protection Officer: none appointed. Our processing does not meet the Article 37 GDPR thresholds for a mandatory DPO. Privacy requests go to [email protected] and are handled by the Operator personally.
• EU representative (Article 27 GDPR): not required — the controller is established in the EU.

These four addresses are the only ones we publish, and each has been tested to confirm it receives mail. Please do not use any other address you may find quoted elsewhere.

This Policy applies when you visit audexum.com, use the Studio, dictation, audiobook, dubbing, voice-cloning or image and video features, use our Android or Windows apps, call our public REST API or our ElevenLabs-compatible API, use a free tool without an account, talk to the chat assistant, refer someone, listen to a public share clip, or contact us by email.

Where you use the Service to process other people's personal data — for example submitting your customers' text through the API, uploading a recording of someone else, or embedding our widget on your own site — you are the controller of that data and we act as your processor. See section 17 and /dpa.

Grouped by where it comes from in the product. Not every item applies to every user — if you never use dubbing, we hold no dubbing data about you.

• Account data: email address; a bcrypt hash of your password (we never hold the plaintext); your Google account identifier and primary email if you sign in with Google; email-verification status; plan tier; account creation time; your credit balance; the version of the Terms you accepted, when you accepted them, and the IP address the acceptance came from; your marketing opt-in or opt-out and when it was set; the first-touch marketing source captured at signup (the referring site, the page you landed on and the search or campaign parameters in its address); your GitHub account identifier if you sign in with GitHub.
• API credentials: for each API key, its visible prefix, a bcrypt hash of the secret, a label you choose, creation time, last-used time and revocation time. We cannot recover the secret itself.
• Billing data: your Stripe customer identifier, subscription status and period, credit purchases, and the credit ledger — an append-only record of every credit granted, spent, reserved or refunded on your account. Card numbers, bank details and 3-D Secure data are handled by Stripe directly; we never see or store them.
• Submitted text (Inputs): the text you send for synthesis, together with the voice, language, speed and step parameters, stored as history entries.
• Generated audio and its metadata: the audio file itself, plus character count, generation time, audio duration, real-time factor, and the voice and language used.
• Dictation and speech-to-text: the audio you record or upload is transcoded and sent to our speech-recognition model on our own servers (or, during scheduled windows when our own GPUs are unavailable it may instead be processed by a hosted model reached through OpenRouter (section 9)); the working copy is deleted as soon as transcription finishes and is not kept. The transcript text is stored, with the language, the audio duration, the processing time and which channel it came from. If you use the optional clean-up or rewrite feature, the transcript text is also processed by a language model on our own servers (or, during scheduled windows when our own GPUs are unavailable it may instead be processed by a hosted model reached through OpenRouter (section 9)). Your browser additionally keeps a local dictation history on your own device — see /cookies.
• Voice enrollment audio and speaker embeddings: when you create a cloned voice we process the reference recording, the spoken consent sentence, a SHA-256 hash of the raw enrollment audio, the length of the reference in seconds, the language hint and the name you give the voice. What we keep afterwards is the speaker embedding, the consent record and an encrypted copy of the reference recording. See section 4.
• Dubbing uploads: the video or audio file you upload, the label derived from its filename, its duration, the transcript of the source audio, the translated text, the target language, the voice used and the job status. The upload and the produced files live in a job directory on our servers.
• Audiobook uploads and podcast feeds: the book file you upload, the title, the chapter list we derive from it, the voice, language and speed, character counts and job status, and the generated chapter audio. If you request a podcast feed, we produce an RSS feed at an unguessable, token-signed URL. That URL is not listed anywhere, but it is not authenticated — anyone you give the link to, or anyone it leaks to, can fetch the feed and the episode audio.
• Public share clips: if you share a clip, we store the audio, a text excerpt of up to 500 characters, the voice, the language, the duration and a play counter. Share clips are served at a public URL with no login. Do not share a clip containing anything you would not publish.
• Presets and batch jobs: preset names and parameters you save; batch job parameters, status, result links and timestamps.
• Webhooks: if you configure one, we store the destination URL and the signing secret. The signing secret is stored in plain text in our database, because we need it to sign outgoing payloads. Treat it as a shared secret of moderate sensitivity, rotate it if you have any concern, and do not reuse it anywhere else. We also store a record of processed webhook events for de-duplication.
• Referral data: your referral code. For each referral we store the referred account, when the bonus was credited, and — to detect referral farming — the IP address of the referred signup and a normalised form of the referred email address. If you applied to our former paid affiliate programme (closed 15 September 2026), any payout email or application details you gave us are kept only as long as section 8 allows.
• Free-tool leads: if you enter your email address into one of our free public tools, we store that email address, which tool it came from, the context you supplied and your IP address.
• Feedback: the message you send through the in-app feedback form, its category, the email address you give us if any, your IP address, and your account if you are signed in.
• Android app (Audexum Voice): the app uses Android's Accessibility service to find the text field you are typing in and insert your dictation there. It can read the contents of that focused field on your device; it uses that only to place the text and never uploads or stores it. Password fields are ignored. The audio you record by tapping the mic is sent to us for transcription, as described above. Unless you switch off “Share anonymous usage stats” in its settings, the app also sends us usage events (which screen or button was used, short error messages) with a random identifier created when you install it, and your account once you sign in. They are kept for 13 months. To sign you back in, it stores your login on the device, in Android's encrypted storage where the device supports it.
• Chat assistant: your message, the assistant's reply, the page it offered to take you to, how long the reply took, a per-session conversation identifier, your IP address, and your account if you are signed in. Your message goes to a language model running on our own servers in Bulgaria, or, during scheduled windows when our own GPUs are unavailable it may instead be processed by a hosted model reached through OpenRouter (section 9). You do not need an account to use it.
• Usage counters: characters and seconds consumed per billing period, per account.
• Email correspondence: the content of emails you send us and our replies.
• Verification codes: short-lived one-time codes for email verification and password reset.
• Connection and technical data: IP address, user-agent, request time, request path, response status and error detail. IP addresses are mostly processed transiently for rate-limiting, abuse prevention and incident analysis. Some records store the IP alongside the entry itself — the Terms-acceptance record, chat turns, feedback, free-tool leads and referral signups — and those are kept for the periods in section 8.
• Cookies and local storage: see section 11 and /cookies.

Apart from speaker embeddings, which section 4 addresses directly, we do not ask for and do not want special categories of personal data under Article 9 GDPR — health data, racial or ethnic origin, religious or political beliefs, trade-union membership, sex life or sexual orientation. Please do not put such data into the Service. We do not knowingly process children's data; see section 14.

AI assistants connected through MCP (added 2026-10-04)

You can connect an AI assistant of your choice (for example Claude, ChatGPT, Gemini, Cursor, or a local model in any MCP-compatible app) to our MCP server at audexum.com/mcp. When you do:

• What the assistant sends us is only what a tool needs: the text to speak, the engine, voice and language, or the link to the audio or YouTube video to transcribe. We process it exactly as if you had used the website. We never receive the rest of your conversation with the assistant.
• What we store: a registration record for the assistant app (the name and sign-in return addresses the app itself supplies); an API key named “MCP: …” linked to your account; and a usage record of each tool call (which tool, character count or file size, engine, and whether it worked), used for billing, credit notices and abuse prevention, and to see which tools people use so we can improve them (legitimate interest, Art. 6(1)(f) GDPR; it never includes your text or files, and is kept 13 months like the rest of the activity trail in section 8). Your IP address is used for rate limiting, as on the rest of the Service.
• Generated audio is stored behind a private, unguessable link for 30 days and then deleted. Audio sent for transcription is handled as described in section 8.
• The assistant provider (Anthropic, OpenAI, Google or whoever runs the assistant you chose) receives the tool results, including audio links and transcripts, because you asked it to. It is an independent controller of your conversation under its own privacy policy; it is not our processor, and we send it nothing else.
• To disconnect, remove Audexum from your assistant or revoke the “MCP: …” key on the developer page. The legal basis for all of the above is the performance of our contract with you (Art. 6(1)(b) GDPR).

These tools are off for every account until you turn them on. Nothing below happens to an account that never does.

• Activation record: when you turn the tools on we store the time, your confirmation that you are 18 or older, the version of the sub-processor list and media terms you were shown, and for a business account the fact that you authorised those sub-processors on behalf of your organisation. Turning the tools off is recorded the same way. Each entry is added, never overwritten, and kept while your account exists.
• What you submit: your prompt, the settings you choose (product, resolution, length, aspect ratio, sound), and any image you upload. Before we store or send an upload we re-encode it, which removes its EXIF metadata, including GPS location and camera details. If the image shows a person, we also store your confirmation that you have their consent.
• Who processes it: we send the prompt, settings and upload to fal (Features & Labels, Inc., United States), which runs the model and may pass the request to the model's developer (MiniMax, Black Forest Labs or Google). For Motion Cinema we send them to OpenRouter (United States), which passes them to BytePlus, ByteDance’s cloud service (Singapore, Malaysia, US, Hong Kong, Indonesia or Japan). Your prompt goes through OpenRouter to an automated safety check before anything is generated, and so does every result: each generated image, and three frames of each video. OpenRouter passes them to the model that runs the check, which is hosted by Google LLC. Sections 9 and 10, and /subprocessors, say where each of them is.
• What we keep: the generated image or video and a thumbnail, stored on our own servers, and a job record: the prompt, settings, credits charged, status, the result of the safety checks, and the provider's request identifier. We never give you, or anyone else, the provider's link to the file.
• Faces. An uploaded photo of a person is personal data, and a face can reveal more than the person might want. We do not use uploads to recognise or identify anyone, we run no face matching, and we do not create face templates. Upload a photo of someone else only with their consent.
• Turning it off: in your account settings. We then stop sending your data to these providers and delete your images, videos, uploads and prompts from our servers. For generations from the last 24 hours, and any that were reported, we keep a record with no content in it (credits, status, and any block or report) until our normal 90-day retention ends, so that daily limits, abuse protections and report reviews keep working. What the providers already received is held under their own retention rules, described at /subprocessors. For Motion Cinema, how long BytePlus and OpenRouter keep an uploaded image and the generated video until we download it, we have not confirmed.
• Legal basis: generating what you asked for is performance of our contract with you (Art. 6(1)(b)). The safety checks and keeping a record of blocked requests rest on our legitimate interest in preventing abuse and illegal content, and on our duties as a hosting provider (Art. 6(1)(f) and (c)). The activation record is kept as evidence of your choice and authorisation (Art. 6(1)(c) with Art. 5(2), and Art. 6(1)(f)).

Audexum offers voice cloning. It is a paid feature and it is part of the product. Earlier versions of our documents said otherwise. That was wrong, and this section replaces it.

How enrollment works. To create a cloned voice you must record yourself reading a specific consent sentence aloud, ending with two words we pick at random for you, so an old recording cannot be reused. We check by speech recognition that the sentence was actually spoken. From that recording our cloning engine computes a speaker embedding — a numeric vector, a few kilobytes in size, that captures the characteristics of the voice. We keep the embedding, the consent sentence, the time of consent, a SHA-256 hash of the raw enrollment audio and the reference length. We also keep the reference recording itself, encrypted, because some of our cloning engines need it at generation time; it is deleted when you delete the voice or close your account, and in any case 12 months after enrollment. During scheduled windows when our own GPUs are unavailable, a request in a cloned voice sends that reference recording to a hosted cloning model through OpenRouter (section 9), which uses it for that request only.

Our position on Article 9. We do not claim this is not personal data. A speaker embedding is personal data at all times, and we treat it as such. Under Article 4(14) GDPR, biometric data becomes a special category under Article 9 when it is processed for the purpose of uniquely identifying a natural person. We process the embedding to synthesise speech, not to identify anyone. We do not run speaker matching, speaker verification or voice search; we do not compare embeddings against each other or against any database; and we do not use them to recognise who is speaking. On that basis we do not treat the embedding as Article 9 data, and our legal basis is Article 6(1)(b) — performing the contract you asked us to perform — with the spoken consent record as the evidence that the voice was supplied by the person it belongs to.

The limit of the consent check, stated openly. The check confirms that the consent sentence was spoken in the recording. It does not confirm that the whole recording is one single speaker. A determined person could record the consent sentence themselves and splice it onto someone else's audio. We are telling you this because it matters: if a voice that sounds like yours has been enrolled without your permission, write to [email protected] or use /report, and we will remove it. You do not need an account with us to make that request.

Retention. A voice you have not generated with for 24 months is revoked automatically. Revoking a voice, by deleting it in the app or by that timer, erases the speaker embedding and the stored recording at once and stops the voice being usable. The consent record (the sentence that was read, when, and a fingerprint of the recording, with no audio) is kept for 5 years after revocation as evidence that the enrollment was authorised, then deleted. Closing your account deletes all of it immediately. If you want the consent record erased sooner, ask at [email protected] and we will do it.

• directly from you — signup, settings, text, recordings, uploads, forms, emails;
• from your browser or HTTP client — connection and technical data, cookies, local storage;
• from Stripe — subscription and payment events, never card numbers;
• from Google — your account identifier and primary email, only if you choose Google sign-in;
• from GitHub — your account identifier and email, only if you choose GitHub sign-in;
• from someone's referral link — the referral code that brought you to the site;
• from a publisher who embeds our widget — in which case the publisher is the controller and we act on their instructions.

Every live processing activity, with the basis we rely on for it.

Where we rely on legitimate interest, we have weighed our interest against your rights and you can ask us for the reasoning at [email protected]. You have the right to object under Article 21 GDPR — see section 15.

We do not use your inputs or outputs to train, fine-tune or evaluate machine-learning models. We do not sell personal data. With your consent we share the data described in /cookies section 6A with Meta to measure our ads. Under some US state privacy laws that counts as "sharing" for cross-context behavioural advertising; you opt out by pressing Reject, through Cookie settings, or with Global Privacy Control, which we honour.

We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing within the meaning of Article 22 GDPR. Automated rules do exist for rate-limiting, quota enforcement and referral-fraud throttling; if one of them blocks you, email [email protected] and a human will look at it. Stripe runs its own fraud scoring on payments as a separate controller; we do not control that scoring, but you can ask us to pass on a request for human review.

A daily job enforces the periods below. Where a row says there is no expiry, that is the honest current position, not an oversight we are hiding.

Not covered by the automatic job: account data is kept while the account exists and is deleted on closure, except where law requires otherwise; presets are kept until you delete them or close the account; usage counters are kept per billing period for billing and dispute handling; the credit ledger is deleted with your account; payment and invoicing records are kept by Stripe and by us for as long as Bulgarian accounting and tax law requires, which is longer than the periods above and which we cannot shorten on request; email correspondence is kept for as long as needed to resolve the matter and to defend any claim arising from it.

Backups. Off-site backups are held at a third location on a rolling 30-day window. When we delete something at your request it goes from the live system immediately and ages out of backups within that window. We do not restore a backup to reinstate deleted data. These backups hold the database (your account, history rows, transcripts, settings), not files: generated audio, images and videos are not backed up.

The Service runs mainly on our own hardware in Bulgaria. The parties below are the only ones that receive personal data in the course of running it. The current list is also maintained at /subprocessors.

Analytics are not on this list, deliberately. We run Umami, which is analytics software we host ourselves and serve from our own domain. It is first-party and no analytics data leaves our servers, so it is not a sub-processor. It is still analytics, and /cookies describes what it records.

We may also disclose personal data to professional advisors under a duty of confidence, to competent authorities where we are legally required to, and to an acquirer in a merger, sale or reorganisation, subject to a continuing privacy commitment at least equivalent to this Policy.

If we add or replace a sub-processor we will update /subprocessors and this page before the change takes effect.

Our own infrastructure is in Bulgaria and stays there. Several of the recipients in section 9 are or include entities in the United States: Cloudflare, Resend, Amazon Web Services, OpenRouter and the model providers it routes to, and GitHub; Google may process sign-in data in the US as well. If you turn on image and video generation, fal (United States) and the model developers it passes requests to also receive your prompts and uploads; for MiniMax that may include processing in Singapore or China, which have no EU adequacy decision. If you use Motion Cinema, OpenRouter passes your prompt, settings and uploaded image to BytePlus, part of the ByteDance group, which may process them in Singapore, Malaysia, Hong Kong or Indonesia (no EU adequacy decision), Japan (adequacy decision) or the United States. If you accept advertising cookies, Meta may transfer the ad-measurement data to Meta Platforms, Inc. in the United States. Data reaching them therefore leaves the EEA.

We rely on the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914) as incorporated in each provider's data processing agreement, together with the technical and organisational measures each provider commits to there. Where a provider is certified under the EU-US Data Privacy Framework, that certification applies in addition. Meta is not our processor and we have no data processing agreement with it: the onward transfer from Meta Platforms Ireland to Meta Platforms, Inc. is Meta's own, under Meta Platforms, Inc.'s EU-US Data Privacy Framework certification and Meta's Standard Contractual Clauses.

To be straight with you: we have a transfer impact assessment for Motion Cinema (OpenRouter to BytePlus, 20 October 2026), but not yet for each other recipient, and we will not claim to have completed work we have not. If you need the detail for your own compliance file, ask at [email protected] and we will tell you what we have.

We use a first-party session cookie to keep you logged in, cookies set by Cloudflare for bot mitigation and Turnstile, cookies set by Stripe on its own checkout pages, and browser storage keys that remember choices you made or keep the feature you are using working. For marketing attribution we store nothing on your device unless you press Accept on the advertising-cookie banner, which lets Meta's pixel set two cookies. The full inventory and our assessment of each item are in /cookies.

What follows is what we actually do. We have removed claims that earlier versions of this page made and that were not true of our systems.

• The Service runs on hardware we own and physically control, in Bulgaria. The database is local to those machines and generated audio is stored on local disk in a directory readable only by the service account.
• All web and API traffic is carried over TLS. TLS is terminated at the Cloudflare edge, as section 9 describes.
• Passwords are stored as bcrypt hashes; API key secrets are stored as bcrypt hashes and cannot be recovered by us.
• Session cookies are set HttpOnly, Secure and SameSite=Lax. Changing your password invalidates existing sessions.
• Rate-limiting and abuse controls run on authentication, synthesis, chat, feedback and the free tools.
• Access to production systems is limited to the Operator.
• Off-site backups of the database go to a third location on a rolling 30-day window. Files are not backed up.
• Generated audio carries a machine-readable watermark, and the system is configured to refuse to deliver audio it could not watermark.
• We operate a vulnerability disclosure contact: [email protected].

What we do not have, stated rather than glossed over: the database is not encrypted at rest, and the backup copy on the same server is not encrypted; off-site backup copies are encrypted. Webhook signing secrets are stored in plain text, as section 3 says. We hold no security certification — no ISO 27001, no SOC 2 — and you should not assume one from anything on this site.

No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Commission for Personal Data Protection (Комисия за защита на личните данни) within 72 hours of becoming aware of it where Article 33 requires, and will tell you directly without undue delay where Article 34 requires.

The Service uses artificial intelligence to generate synthetic speech, to transcribe speech and to power the site chat assistant. Audio we generate carries a machine-readable watermark; you must not strip or attempt to defeat it. That watermark carries 16 bits: a fixed marker identifying Audexum, and a keyed value placing your account in one of 255 groups. It is deliberately not a unique identifier — about one account in 255 shares any given value — and it is computed with a secret key, so it tells no one but us anything. We read it only when investigating a report of abuse involving a specific file. If you would rather not have it, the answer is not to publish audio generated here; we cannot deliver unmarked audio, because Article 50 does not let us. Where Regulation (EU) 2024/1689 or other law requires it, you must tell listeners that audio produced through the Service is AI-generated. Voice previews are watermarked too, and public share pages show a visible AI-generated label next to the player. Images and videos keep the provider's own provenance marks, carry AI-generated XMP metadata and a visible AI-generated label; the metadata is not personal data and does not identify your account. Full detail is at /ai-disclosure.

The Service is not directed at anyone under 16 and we do not knowingly collect personal data from children under 16. If you believe we hold data about a child under 16, write to [email protected] and we will delete it. Image and video generation is for adults only: you must confirm you are 18 or older to turn it on, and if we learn a user of it is under 18 we turn it off and delete their media data.

Under Articles 15 to 22 GDPR you have the right to:

• Access — be told whether we process your data and get a copy of it, with the information in Article 15.
• Rectification — have inaccurate data corrected and incomplete data completed.
• Erasure — have data deleted, except where we must keep it (accounting and tax records, and data needed to establish or defend a legal claim).
• Restriction — have us stop using data, while keeping it, in the situations Article 18 lists.
• Portability — receive the data you gave us in a structured, commonly used, machine-readable format.
• Object — object to processing based on legitimate interest, including the chat, feedback and analytics processing in section 6. Object to direct marketing and we stop, with no balancing test.
• Withdraw consent — at any time, for marketing email and for a free-tool lead, without affecting processing already carried out.
• Not be subject to a solely automated decision with legal or similarly significant effects.
• Complain to a supervisory authority (section 16).

The route that works: email [email protected] with "GDPR request" in the subject line and tell us what you want. We will reply within one month of receiving your request, as Article 12(3) requires. If a request is genuinely complex we may extend that by up to two further months and will tell you why within the first month. There is no charge, unless a request is manifestly unfounded or excessive, in which case we will say so rather than quietly ignore it. We may ask you for information to confirm your identity, and only what is needed for that.

What the in-product buttons do and do not do — read this before relying on them. The account page offers a data export and an account-deletion button. Account deletion removes your audio as well as your records: your account, history, API keys, presets, batch jobs and usage counters, and the actual audio files behind them — saved generations, shared clips and audiobook directories — are deleted from our servers, so any share link you have handed out stops working. Invoices are kept where Bulgarian tax law requires. The export now covers everything we hold that is about you — your account, generation history, dictation transcripts, assistant conversations, audiobooks, dubbing jobs, share clips, cloned-voice consent records, credit ledger, referrals, feedback, the marketing emails we queued or sent you, any free-tool lead we recorded against your email address, and the activity log we keep against your account — which actions and pages we recorded, and the country your requests came from. Three things are deliberately left out: email verification codes (live authentication material — returning it in a downloadable file would be a credential leak), our Stripe delivery log, and the raw voice embedding behind a cloned voice, which is a derived vector that means nothing outside our engine — its metadata and consent record are exported. If you want any of those three anyway, ask at [email protected].

If you think we have handled your personal data wrongly, please tell us first at [email protected] — it is usually the fastest fix. You also have the right to complain to a supervisory authority at any time, without going through us.

Our lead supervisory authority is the Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, [email protected], www.cpdp.bg. You may instead complain to the supervisory authority where you live or work, or where you think the problem happened.

When you use the Service to process personal data of your own users, you are the controller and we are your processor under Article 28 GDPR. Our data processing terms, the sub-processor list they refer to, and the security description they incorporate are published at /dpa and /subprocessors. Nothing in this Policy narrows what those terms say.

When this Policy changes we update the date at the top of this page, and the change takes effect when it is posted. Where a change needs your consent, we ask for it before the processing starts.

The version dated 2026-10-23 supersedes all earlier versions.

• Privacy and GDPR requests: [email protected]
• Legal and contracts: [email protected]
• Abuse, including a voice cloned without permission: [email protected] or /report
• Security vulnerabilities: [email protected]
• Supervisory authority: Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria

Related pages: /terms, /cookies, /dpa, /subprocessors, /ai-disclosure, /aup, /imprint.