Privacy Policy
Last updated: 2026-08-18Version 1.0
1. Who we are
Voiceora is a service operated by GravitonForge Technologies Ltd, a company registered in England and Wales (company number 16734183), whose registered office is at 12 Primrose Gardens, Auckley, Doncaster, England, DN9 3RR.
We are the data controller for the personal data described in this policy.
Contact: support@voiceora.io
We are registered with the UK Information Commissioner's Office (ICO), registration number ZC218184.
2. What this policy covers
This policy explains what personal data we collect when you use voiceora.io and the Voiceora applications, why we collect it, who we share it with, and what rights you have. It applies to visitors to our website and to registered users of the service.
Our use of cookies and similar technologies is explained separately in our Cookie Policy.
3. The personal data we collect
You give us:
| Data | When |
|---|---|
| Email address, name (if provided), password or third-party sign-in identifier | When you create an account |
| Brand voice samples and descriptions | When you configure your brand voice |
| Content you submit — pasted text, article links, photographs, and (when enabled) Moment Bundle video | When you use the service to generate drafts |
| Billing name, address and country; partial card details | When you subscribe. Full card details go directly to Stripe and are never held by us |
| Correspondence | When you contact support |
We collect automatically:
| Data | Purpose |
|---|---|
| IP address, browser and device type, operating system | Security, abuse prevention, error diagnosis |
| Usage data — generations created, features used, timestamps | Enforcing plan limits, billing, improving the service |
| Error and diagnostic data — browser, device and stack traces | Diagnosing faults (collected via Sentry). IP address storage is disabled |
| Cookie and local storage identifiers | See our Cookie Policy |
Special category data. We do not ask for special category data (health, ethnicity, political opinions, biometric data and similar). Content you upload — particularly photographs — may incidentally contain such data. Please do not upload content containing sensitive personal data unless you are satisfied you have a lawful basis for doing so.
Other people's data. If you upload content containing personal data about other people — for example photographs or video of identifiable individuals, or transcripts of conversations — you are responsible for ensuring you have the right to do so. See section 9.
4. Why we use your data, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and administering your account | Performance of a contract |
| Generating drafts from the content you submit | Performance of a contract |
| Applying your configured brand voice to outputs | Performance of a contract |
| Taking payment, managing subscriptions, issuing invoices | Performance of a contract; legal obligation (tax records) |
| Sending service and transactional emails (receipts, failed payment notices, security alerts) | Performance of a contract |
| Enforcing usage limits and rate limits | Performance of a contract; legitimate interests (protecting the service from abuse and runaway cost) |
| Detecting, investigating and preventing fraud, abuse and security incidents | Legitimate interests (protecting our service, our users and our business) |
| Diagnosing errors and maintaining reliability | Legitimate interests (operating a functioning service) |
| Understanding aggregate product usage to improve the service | Legitimate interests (improving a product our users pay for) |
| Marketing emails about Voiceora | Consent, or the soft opt-in where you are an existing customer. You can withdraw at any time |
| Complying with legal and regulatory obligations | Legal obligation |
| Establishing, exercising or defending legal claims | Legitimate interests |
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights. You can ask us for a summary of that assessment.
5. How we use AI, and what happens to your content
Voiceora generates drafts using large language models. You should understand the following:
- Where processing happens. Content you submit for generation is sent to our AI routing provider, OpenRouter, and processed by open-weight Qwen models hosted by DeepInfra in the United States. We restrict routing to this provider by a hard-coded allowlist; your content is not routed to other inference providers.
- We do not use your content to train AI models, and neither do our providers. OpenRouter's published policy is that it does not store prompts or responses unless prompt logging is enabled on the account — we keep that switched off, and we do not permit routing to providers that train on submitted data. DeepInfra's published policy states that it will not store, sell or train on API inputs and outputs without explicit consent.
- Limited retention for debugging. DeepInfra states that it may occasionally retain inputs and outputs for a limited period for debugging purposes. We do not control that period. OpenRouter retains request metadata such as token counts and latency, but not the content itself.
- Outputs are drafts. Outputs are generated automatically and may be inaccurate, may not be original, and may resemble content produced for other users. You are responsible for reviewing and editing outputs before you publish or rely on them.
- No automated decision-making about you. We do not make decisions producing legal or similarly significant effects about you by automated means. Generating content is not a decision about you.
6. Who we share your data with
We share personal data with the service providers below, who process it on our instructions under a written data processing agreement.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Authentication, database, file storage | United Kingdom — London (eu-west-2) |
| Vercel | Website and application hosting, content delivery, aggregate usage and page performance measurement | United States and global edge network |
| Stripe | Payment processing, subscription management | United States, EU, UK |
| OpenRouter | AI request routing | United States |
| DeepInfra | AI model inference | United States |
| Sentry | Error monitoring and diagnostics | European Union |
| Google (Google Workspace) | Business email, including support correspondence | EU/UK |
A current list is maintained at voiceora.io/subprocessors. We will update it before adding a new provider.
We may also disclose personal data:
- to professional advisers (lawyers, accountants) bound by confidentiality;
- to a buyer or successor if we sell or reorganise the business;
- where required by law, court order, or a regulator; and
- where necessary to establish, exercise or defend legal claims.
We do not sell your personal data, and we do not share it with advertisers.
7. International transfers
Some of our providers are located outside the UK, principally in the United States. Where we transfer personal data outside the UK, we rely on:
- the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the International Data Transfer Agreement, as applicable; together with
- a documented transfer risk assessment and appropriate technical measures.
You can request a copy of the relevant safeguards by emailing support@voiceora.io.
8. How long we keep your data
| Data | Retention |
|---|---|
| Account data | For as long as your account is open, then deleted on account deletion |
| Content you submit and generated outputs | For as long as your account is open, or until you delete them |
| Rendered video clips | 30 days from generation |
| Free-plan content and uploads | Locked read-only 30 days after creation; deleted 90 days after creation. You can still export it while locked, and upgrading unlocks it |
| Billing and transaction records | 6 years from the end of the relevant financial year (UK tax law) |
| Support correspondence | 2 years from last contact |
| Security and error logs | 90 days |
| Records of consent and marketing preferences | For as long as needed to evidence compliance |
When you delete your account we delete your account record, your stored content, your files, and your authentication record, and we cancel your subscription. Limited records are retained where the law requires (principally billing records) or where necessary to defend legal claims. We do not currently maintain automated backups, so deletion from our live systems is immediate and complete.
9. Content containing other people's data
Where you upload content containing personal data about other people, you are the controller of that data and we act on your instructions in processing it. You are responsible for having a lawful basis, for providing any notice those individuals are entitled to, and for responding to their requests. If someone contacts us about content you have uploaded, we will normally refer them to you.
10. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- rectify inaccurate data;
- erase your data in certain circumstances;
- restrict our processing in certain circumstances;
- object to processing based on legitimate interests, and to direct marketing at any time;
- portability — receive certain data in a machine-readable format;
- withdraw consent where we rely on consent, without affecting prior processing.
To exercise any of these, email support@voiceora.io. We will respond within one month. We may need to verify your identity. We do not charge a fee unless a request is manifestly unfounded or excessive.
You can delete your account and all associated content yourself at any time from your account settings.
11. Complaints
If you are unhappy with how we have handled your personal data, please tell us first at support@voiceora.io. We will acknowledge your complaint within 30 days and explain how we will handle it. Our full procedure is at voiceora.io/complaints.
You also have the right to complain to the Information Commissioner's Office at any time:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF · 0303 123 1113 · ico.org.uk/make-a-complaint
12. Security
We protect your data using encryption in transit and at rest, row-level security in our database so users cannot access each other's data, authentication guards on every server route, multi-factor authentication on administrative accounts, and least-privilege access to production systems. No system is perfectly secure, but we take these obligations seriously and we maintain a documented breach response procedure.
13. Children
Voiceora is not intended for and may not be used by anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact support@voiceora.io and we will delete it.
14. Changes to this policy
We may update this policy. If we make a material change we will notify registered users by email or in the application before it takes effect. The date at the top shows when it was last updated.
15. Contact
GravitonForge Technologies Ltd 12 Primrose Gardens, Auckley, Doncaster, England, DN9 3RR support@voiceora.io