Privacy Policy

This policy explains what Voxcene collects, why, who else sees it, and how long it is kept. It is written to be read rather than to be survived, and it describes what the product actually does today — not what it might do later.

Who is responsible

Voxcene is developed and managed by NF Brandminds Studio Ltd, and operated by Nikolas Spyrou, registered at 3 Askos Street, 8560 Paphos, Cyprus. Under the GDPR we are the data controller for the information described below.

For anything in this policy, write to [email protected]. We have not appointed a data protection officer; our processing does not meet the threshold in Article 37 that requires one.

What we collect

Your account

An email address, and a password held by our authentication provider in hashed form — we never see it. If you sign in with Apple, we receive the identifier Apple gives us and the email you chose to share, which may be a private relay address.

What you make

The video and audio you upload or record, and everything derived from it: transcripts, translations, captions, generated images, synthetic voiceovers, project names, and any brand kits you save (colours, fonts and logo files).

Your subscription

Which plan you are on and whether it is active. We never see your card. Payment is handled entirely by Apple; we receive only a subscription status from our billing provider.

Usage

A ledger of what you have used — transcription minutes and AI credits — so that both of us can see what a plan has actually bought. Plus ordinary server logs: request identifiers, timestamps, error traces, and the IP address the request arrived from.

Your video is the sensitive part, so read this bit

Recordings of people are personal data, and a recording of someone speaking is biometric-adjacent: it carries their voice and their face. We treat it accordingly.

• Your media is stored in the European Union, in a bucket partitioned per workspace so one workspace cannot read another's files.
• Transcription sends your audio to a specialist speech-to-text provider. There is no way to caption a video without a speech-to-text service hearing it, and we would rather say so plainly than bury it. If the first one cannot be reached, the same audio goes to a second, so your captions still arrive.
• Voiceovers, dubbing, sound effects and music send text to a speech and music provider: the script to be spoken, your translated captions, your prompts, and for Brand Music the lyrics and your brand brief. Reading the words of a song, or separating its vocals from its backing, sends the song's audio.
• Translation, captions, editing and Reels suggestions, Create with AI scripts, lyric suggestions and image generation send text — never video: your transcript, your prompts, your lyrics and your brand brief, whatever the feature needs.
• Animating a picture sends that picture to a video-generation provider. In Create with AI that can be a photo you chose. A logo intro sends a generated background, never your logo.
• Several of these providers are outside the EEA, mostly in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses.
• We do not use your content to train models, and we do not sell it or share it for advertising.
• If you record other people, you are responsible for having their consent. We cannot obtain it for you.

Why we are allowed to (lawful bases)

What	Why	Basis
Account, projects, media, processing	To provide the service you asked for	Contract — Art. 6(1)(b)
Subscription and usage records	Billing, and proving what a plan included	Contract, and legal obligation for tax records
Server logs and abuse prevention	Keeping the service up and unabused	Legitimate interests — Art. 6(1)(f)
Support correspondence	Answering you	Contract, and legitimate interests

Who else processes it

A small number of companies handle data on our behalf, each under contract, each only to do the one job we give it. These are the categories, and every one of them is a live integration in the product rather than an aspiration:

• Hosting, database and file storage — the servers that run the app and hold your account, your projects and your media, in the European Union.
• Website hosting and content delivery — serving this site and the app's files, from a global edge network.
• AI providers — transcription, translation, synthetic voices, dubbing, music, vocal separation and image generation, exactly as described above. Several are outside the EEA.
• Subscription and billing — Apple takes the payment; a billing provider tells us only whether your subscription is active.

Where a processor is outside the EEA, the transfer relies on the European Commission's Standard Contractual Clauses. If you want them by name rather than by category, ask — we will tell you who they currently are at [email protected].

Cookies and your choice

There are no advertising trackers, no third-party cookies and no cross-site tracking anywhere in the app or on this site.

On your first visit this site asks what it may measure. Four categories, and only the first is on before you answer:

• Necessary — always enabled. Required for the website to work. This includes the record of the choice you make here, which is kept in your own browser and nowhere else.
• Analytics — page views, website usage, button clicks, sessions and performance analytics.
• Preferences — remembers settings and website preferences.
• Marketing — advertising, campaign attribution and marketing-related tracking.

Nothing in the optional categories loads until you allow it. Decline, and no analytics request is made at all — not held back, not queued: never sent. You can change your mind at any time: open your cookie preferences, or use the link in the footer of every page.

What Analytics measures, if you allow it

With Analytics consent this site counts page views and clicks on its own buttons and links, and loads a cookieless analytics script, which sets no cookies, builds no profile and does not follow you across sites.

What is recorded is the page path with the query string removed, the name of the control you pressed, the part of the page it sits in, and whether you are on a mobile, tablet or desktop screen — worked out from the size of your window, never from your device's identity. Each visit is given a random reference that lets us count one visit as one visit; it is erased when you close the tab and cannot be linked to you, to an account, or to a second visit. No IP address and no browser fingerprint is stored. These records are deleted after 180 days.

The product can report anonymous counters — how often an export succeeds, which provider handled it, roughly how long videos are. That reporting is restricted by code to six non-identifying properties (plan tier, a duration bucket, language code, provider name, failure category, platform), it is sent under a single constant identifier rather than one per person, and any value containing a path or URL is discarded before sending. It is currently switched off in production.

How long we keep things

What	How long
Uploaded video, while you are on a paid plan	Kept, so your projects stay editable
Uploaded video, after a paid plan ends	Up to 30 more days, then deleted
Uploaded video, on the free plan	24 hours after it processes, or 72 hours after a failure
Music, voiceovers and generated images	Until you delete the project, or the account closes
Finished exports	Until you delete them, or the account closes
Projects, transcripts and settings	Until you delete them, or the account closes
Billing and usage records	As long as tax law requires, typically several years

Your footage is the largest and most sensitive thing we hold, so on the free plan we delete it as soon as your export exists. On a paid plan we keep it instead, because an editor that throws your source away is an editor you cannot go back to — you should be able to reopen a project months later and change it.

If your plan ends we do not delete anything immediately. Your uploads stay for up to 30 more days, so a lapsed card or a change of mind never costs you your work.

Your rights

If you are in the EU or UK, you have the right to:

• get a copy of what we hold about you;
• correct anything wrong;
• have it erased;
• receive it in a portable format;
• restrict or object to processing based on legitimate interests;
• withdraw consent where consent was the basis, without affecting what came before.

Ask at [email protected] and we will answer within one month. There is no charge.

Deleting your account. Email us and we will delete the account and everything in it. We are building this into the app itself; at the time of writing it is a request by email, and we would rather tell you that than describe a button that is not there yet.

If you think we have handled your data badly, please tell us first — but you can complain to a supervisory authority regardless, in your case the Office of the Commissioner for Personal Data Protection (Cyprus).

Children

Voxcene is not for children under 16. We do not knowingly collect their data; if you believe a child has an account, write to us and we will remove it.

Security

Traffic is encrypted in transit. Files are partitioned per workspace and served through short-lived signed links rather than public URLs. Access to production data is limited to people who need it and is logged. No system is perfectly secure and we will not pretend otherwise; if a breach affects your rights we will tell you and the supervisory authority within the 72 hours the GDPR requires.

Changes

If this policy changes materially we will say so in the app before the change takes effect, rather than quietly editing the page. The date at the top always reflects the last substantive revision.