Legal
Privacy Policy
Effective September 21, 2026Last updated September 21, 2026Version 1.1
This policy is provided in Arabic and English. If the two versions differ, the English version prevails.
This Privacy Policy explains how the individual who operates Vocla (see “Who we are”) (“we”, “us”) collects and uses personal data when you visit vocla.ai, use the Vocla app or API, or contact us. We wrote it to be read, not skimmed past — the summary below gives the essentials.
Who we are
Vocla is operated by an individual (sole proprietor), not a registered company.
Contact: support@vocla.ai (support, billing and refunds) · privacy@vocla.ai (personal data) · legal@vocla.ai (legal notices).
Payments are processed by Dodo Payments, our merchant of record: Dodo Payments sells subscriptions and credits to you, charges your payment method, and handles billing, sales tax/VAT and invoices. Your card details are never shared with us.
Operator details (full legal name, country of residence and postal address) will be published here before launch.
1. Who is responsible for your data
The controller of your personal data is the individual who operates Vocla (see “Who we are”). You can reach us about privacy at privacy@vocla.ai.
Payments. When you buy a plan or credits, Dodo Payments acts as merchant of record and collects your payment details directly. Dodo Payments is an independent controller for that data and processes it under its own privacy policy (dodopayments.com/legal/privacy-policy). We receive from Dodo Payments only what we need to manage your subscription — such as your name, email, billing country, plan, amounts, tax, invoice and payment status — never your full card number.
2. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Account | Name, email, username, password (stored only as a hash), optional phone number, language, region, profile photo, two-factor settings | You |
| Sign-in with Google | Name, email address and an account identifier | Google, when you choose it |
| Workspace and preferences | Workspaces, members and invitations, onboarding answers (such as your goals), presets, notification preferences, waitlist sign-ups | You |
| Content | Text, scripts, prompts, lyrics, uploaded audio and video, voice-design descriptions, support messages and attachments, and the audio, voices, songs and dubs generated for you | You and the Service |
| Voice recordings | Recordings you upload for the voice changer, voice cleaner, dubbing or the voice assistant, which may contain your voice or other people's voices | You |
| Billing | Plan, subscription status, invoices, amounts, currency, billing country, coupon codes | You and Dodo Payments |
| Technical and security | IP address, browser and device type, session records, request logs and trace IDs, rate-limit counters, login alerts, bot-check signals on sign-up | Your device and our systems |
| Usage | Features used, credits spent, generation history and analytics about your own usage shown in Settings | The Service |
| Shared links | View counts for links you share; viewers are counted using a salted daily hash, and raw IP addresses and user agents are not stored | Visitors to your links |
| Referrals and affiliates | Referral code and attribution; for affiliates, payout details such as IBAN or PayPal email and commission records | You and referral links |
| Email events | Whether our emails were delivered, bounced or unsubscribed | Our email provider |
You do not have to provide personal data, but without an account email and the content you submit we cannot provide the Service.
3. Voice recordings
A voice is personal and can be sensitive: in some countries recordings that could identify a person are treated as biometric-adjacent or sensitive data. We therefore apply extra safeguards:
- Recordings are processed only to deliver the feature you selected (for example re-voicing, cleaning, transcribing, dubbing or voice cloning) and to keep the Service secure.
- We do not use recordings to identify you or create voiceprints, and we do not build a synthetic copy of a voice unless you choose to clone one.
- Voice cloning. When you choose to clone a voice, the reference recordings you provide are transcribed and processed, by us and by a specialised voice-model provider acting as our processor, to build a private voice model for your workspace. Deleting the cloned voice also deletes its voice model. The reference recordings are uploads, so they are deleted automatically after 7 days like any other upload.
- Raw uploads are deleted automatically after 7 days; generated results follow the retention rules below.
- Only upload recordings of other people if you have their permission — see the Voice Consent Policy.
4. Why we use your data and our legal bases
| Purpose | Legal basis |
|---|---|
| Create and run your account, generate output, store your projects, provide support | Performance of our contract with you |
| Manage subscriptions, credits, invoices and refunds with Dodo Payments | Contract; legal obligations (tax and accounting) |
| Keep the Service secure: authentication, fraud and abuse prevention, content moderation, rate limiting, bot checks | Legitimate interests in a safe service; legal obligations |
| Service emails (verification, receipts, security alerts, product changes that affect you) | Contract; legitimate interests |
| Product news and marketing emails | Your consent or preferences, which you can change anytime |
| Improve the Service using aggregated usage statistics and quality evaluations on our own test material | Legitimate interests |
| Optional analytics cookies on our website | Your consent |
| Comply with law, respond to lawful requests, enforce our Terms | Legal obligations; legitimate interests |
Where we rely on consent you can withdraw it at any time; this does not affect processing that took place before.
5. AI providers and automated processing
To generate audio, transcripts, translations, lyrics, voice designs, cloned voices and assistant replies, we send the relevant inputs (text, prompts and audio) to AI providers that process them on our behalf and return the result. Currently these are Google (Gemini, Cloud Text-to-Speech, Speech-to-Text and Lyria models), OpenAI and, for voice cloning, a specialised voice-model provider. Some tasks, such as noise removal, run on models we host ourselves. We route each task to one provider at a time and send only what that task needs.
Training. We do not use your content to train our own models. Our providers process your content under their business and API terms; you can read how they handle data at cloud.google.com/vertex-ai/generative-ai/docs/data-governance and openai.com/enterprise-privacy/.
Moderation. Before generation, text is checked automatically against our Acceptable Use Policy (for example, blocked phrases related to fraud or impersonation). A request can be blocked automatically; flagged content may be reviewed by a person. We do not make decisions with legal or similarly significant effects about you based solely on automated processing.
7. International transfers
Our providers may process data in countries other than yours, including the United States and the European Union. When personal data leaves the Kingdom of Saudi Arabia, the United Arab Emirates, Egypt or another country with transfer rules, we rely on the safeguards those laws allow — such as contractual commitments (including standard data-protection clauses offered by our providers), adequacy decisions or your explicit consent where required — and we transfer only the data needed for the purpose.
Enterprise customers can ask about regional hosting and in-region processing options.
8. How long we keep data
| Data | Retention |
|---|---|
| Raw uploads (audio and video sources) | Deleted automatically after 7 days (incomplete uploads after 1 day), or sooner if you delete them |
| Generated audio on the Free plan | Deleted after 30 days |
| Generated audio, voice designs, songs and projects on paid plans | Kept while your account is active, until you delete them |
| Cloned voices (voice model) | Kept while your account is active, until you delete the cloned voice; deleting it also deletes its voice model. Reference recordings follow the upload rule above |
| Share links | Until you revoke them or they expire; hashed daily viewer records expire after 90 days |
| Account data after you delete your account | Anonymised after 30 days; workspace files are erased after 30 days |
| Billing and invoice records | As long as tax and accounting laws require (typically several years); Dodo Payments keeps its own records |
| Security logs and session records | For a limited period needed for security and troubleshooting |
| Support requests | As long as needed to resolve them, and a reasonable period afterwards |
Backups roll over on a short cycle, so deleted data can remain in backups for a limited time before it is overwritten.
9. How we protect data
We use encryption in transit (TLS) and at rest, access controls with least privilege, hashed passwords and API keys, optional two-factor authentication, CSRF protection, signed download links that expire after 15 minutes, and audit logs for administrative actions. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant authority as the law requires.
10. Your rights
Depending on where you live, you have some or all of these rights: to be informed; to access your data and get a copy; to correct it; to delete it; to restrict or object to certain processing (including direct marketing); to data portability; to withdraw consent; and not to be subject to decisions based solely on automated processing. You can also complain to a data protection authority.
Saudi Arabia — Personal Data Protection Law (PDPL)
You have the right to be informed about how your data is processed, to access and obtain a copy of it, to request its correction, completion or update, to request its destruction when it is no longer needed, and to withdraw consent. You may complain to the Saudi Data & AI Authority (SDAIA).
United Arab Emirates — Federal Decree-Law No. 45 of 2021 (PDPL)
You have the right to obtain information about the processing and a copy of your data, to data portability, to correction and erasure, to restrict processing, to object to processing (including for direct marketing and automated decisions), and to withdraw consent. You may complain to the UAE Data Office.
Egypt — Personal Data Protection Law No. 151 of 2020
You have the right to know about and access your data, to withdraw prior consent, to correct, amend, erase or restrict processing of your data, and to be notified of any breach affecting it. You may complain to the Personal Data Protection Centre.
European Economic Area, United Kingdom and similar laws
You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent, as provided by the GDPR or equivalent laws. You may complain to your local supervisory authority.
11. How to exercise your rights
- In the app: Settings → Account lets you edit your profile, export your data (account details, generations and memberships) and delete your account. You can delete individual uploads, generations and voices at any time.
- By email: write to privacy@vocla.ai from the email address on your account and tell us which right you want to exercise. We may ask you to verify your identity.
- We reply within 30 days (or sooner if your local law requires) and do not charge a fee unless a request is manifestly unfounded or excessive. If we cannot fully act on a request, we will explain why and how you can appeal or complain.
12. Emails and communication preferences
We send service emails that you need to use Vocla (for example verification, receipts and security alerts). Product news and marketing emails are optional: you can turn them off in Settings → Notifications or with the unsubscribe link in each email.
13. Children
Vocla is for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact privacy@vocla.ai and we will delete it.
15. Changes to this policy
We will update this policy when our practices change. For material changes we will notify you by email or in the app before they take effect. The effective date and version at the top of the page show the current version.
16. Contact
Privacy questions and requests: privacy@vocla.ai. Other legal matters: legal@vocla.ai.