1. Who we are
VoxyAI (“VoxyAI”, “we”, “us”) is an independent software business operated by Zhang Qiang, an individual developer based in China, running voxyaudio.com and the related text-to-speech service (the “Service”).
For the purposes of the EU/UK General Data Protection Regulation, we are the data controller of the personal data described below. Our payment processor, Paddle, acts as an independent controller for the payment and tax records it is legally required to keep.
We keep collection to the minimum needed to run the Service. We do not sell your personal data, and we do not use your text inputs or generated audio to train voice models or to target advertising.
Related documents: Terms of Service · Refund Policy.
2. Data we collect
| Category | What it includes | Why we need it |
|---|---|---|
| Account data | Email address, display name, password (stored only as a salted one-way hash), account creation date, plan tier | To create and secure your account |
| Usage & billing data | Plan type, characters used this cycle, credit pack balance, renewal dates, order references, amounts, credit movements | To meter usage, apply quotas, reconcile payments |
| Content you submit | Text you enter, selected voice, speed and pitch settings, target language, timestamps, generated audio and file size | To synthesize audio; history is stored only when you are signed in |
| Technical data | IP address (held in memory for anonymous daily quota counting and rate limiting), request timestamps, error diagnostics | Security, abuse prevention, capacity planning |
| Preferences | Interface language and display settings saved in your browser (localStorage) | Convenience only; you can clear it at any time |
We do not intentionally collect government ID numbers, contact lists, precise location data or biometric identifiers. Card details are never sent to or stored on our servers: they are entered on Paddle’s checkout and handled by Paddle and its payment partners.
Generated audio is stored only when you are signed in, and only so you can replay or download it from your History. Guest generations are returned to your browser and are not saved to an account.
3. How we use your data
| Purpose | Legal basis |
|---|---|
| Creating your account, authenticating you and delivering the Service you requested | Performance of a contract |
| Metering character usage, enforcing quotas, applying purchased credits | Performance of a contract |
| Processing payments, issuing invoices, handling refunds | Performance of a contract; legal obligation |
| Preventing abuse, fraud, rate-limit evasion and unauthorized access | Legitimate interests in keeping the Service safe |
| Responding to support requests and legal notices | Legitimate interests; legal obligation |
| Essential service email: password reset, security notices, material changes | Performance of a contract; legal obligation |
| Product or marketing email, only if you opt in | Consent, withdrawable at any time |
We do not make automated decisions that produce legal or similarly significant effects about you. Quota checks are automated, but you may always contact us to have a decision reviewed by a human.
5. Who we share data with
We share personal data only with providers that help us run the Service, and only the minimum necessary. They act as our processors under contract and may not use your data for their own purposes.
| Provider | Role | Data involved |
|---|---|---|
| Paddle.com Market Ltd | Merchant of Record: checkout, payments, subscriptions, tax, invoicing, fraud screening | Name, email, billing country, payment method, order data |
| Volcano Engine (ByteDance) | Text-to-speech inference | Submitted text, voice, language and prosody settings |
| MiniMax | Text-to-speech inference (alternate engine) | Submitted text, voice, language and prosody settings |
| Cloudflare, Inc. | DNS, content delivery, TLS, email routing | Request metadata in transit (IP, user agent, URL) |
| Alibaba Cloud (Hong Kong) | Application hosting; storage of account records and generated audio | Account data, usage data, generated files |
| Email delivery provider | Transactional email: password reset, notices, support replies | Email address, message content |
We may also disclose data where required by law, to respond to valid legal process, to protect our rights or the safety of users, or as part of a merger or sale of the business (and we will notify you beforehand).
Text sent for synthesis is processed by the inference provider solely to produce your audio. Please do not submit sensitive personal data, health information or third-party confidential material as synthesis text.
6. Payments & Paddle
All purchases are sold and processed by Paddle.com Market Ltd as the Merchant of Record. Paddle handles card processing, currency conversion, sales tax and VAT determination and remittance, invoicing, subscription renewals and refunds.
When you buy a plan or credit pack, Paddle collects and processes your payment and billing details under its own privacy policy at paddle.com/legal/privacy. We receive only what we need to provision your account: email address, product purchased, an order reference, amount and currency, billing country, and subscription status. We never see or store your full card number or security code.
Paddle may run fraud screening and identity checks required by financial regulation. If a check fails, Paddle may decline the transaction; we do not receive the underlying identity documents.
7. International transfers
We are based in China and our servers are located in Hong Kong. Our processors are located in the European Union, the United Kingdom, the United States and Asia. Your data may therefore be transferred to and processed in countries other than your own.
Where personal data of EEA or UK residents is transferred outside those regions, we rely on appropriate safeguards — in particular the European Commission’s Standard Contractual Clauses (with the UK Addendum where applicable) — together with technical measures such as encryption in transit. You may request a copy of the relevant safeguards by emailing us.
8. How long we keep data
- Account data — kept while your account is active, and deleted or anonymized within 30 days after you close your account.
- Generated audio and history — kept until you delete the item or close your account. You can delete individual items from History at any time.
- Billing and tax records — retained for the period Paddle and applicable tax law require (typically 7 to 10 years), even after account closure.
- Server logs containing IP addresses — held in memory for quota and rate-limiting purposes and rotated out automatically; retained no longer than 30 days.
- Support correspondence — kept up to 24 months so we can resolve repeat issues.
9. Security
We protect data with TLS on all connections, hashed and salted password storage, least-privilege access to production systems, rate limiting and abuse monitoring. Access to account records is limited to what is necessary to operate and support the Service.
No system is perfectly secure. If a personal data breach affects your rights, we will notify affected users and the relevant supervisory authority without undue delay where the law requires it. Keep your password confidential and contact us immediately if you suspect unauthorized access to your account.
10. Your rights
Depending on where you live, you may have some or all of the following rights over your personal data:
- Access — request a copy of the personal data we hold about you.
- Correction — fix inaccurate or incomplete data (most fields are editable in Settings).
- Deletion — ask us to delete your account and associated content.
- Restriction and objection — ask us to limit or stop certain processing, including direct marketing.
- Portability — receive your data in a structured, machine-readable format.
- Withdraw consent — at any time, without affecting processing already carried out.
- Non-discrimination — we will not degrade the Service because you exercised a privacy right.
To exercise any right, email hello@voxyaudio.com from the address associated with your account. We respond within 30 days (or 45 days for CCPA requests) and may ask you to verify your identity first. If you are in the EEA or UK you also have the right to lodge a complaint with your local supervisory authority; in California you may contact the Attorney General.
California residents (CCPA/CPRA): we do not sell or share personal information for cross-context behavioral advertising, and we do not knowingly sell the data of consumers under 16. The categories of information we collect are listed in section 2.
11. Children
The Service is not directed to children. You must be at least 16 years old (or the age of digital consent in your country) to create an account. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.
12. Changes to this policy
We may update this policy to reflect changes in the Service, our providers or the law. The “Last updated” date at the top always shows the current version. If a change materially affects your rights, we will notify you by email or with a prominent notice on the site before it takes effect. Continuing to use the Service after an update means you accept the revised policy.
13. Contact
Privacy questions, data requests and complaints: hello@voxyaudio.com. We aim to reply within two business days.
Operator: Zhang Qiang, individual developer, China. Service: VoxyAI, voxyaudio.com.