Privacy Policy

We collect what we need to run Audexum: your email, password hash, plan, the text you submit, basic usage counters, and your Stripe customer ID. We use one session cookie. We do not run third-party advertising trackers, sell data, or train AI models on your inputs. Our servers are in the EU. The full policy below controls.

Analytics: we use self-hosted Umami for aggregate traffic analytics. No cookies, no cross-site tracking, no IP address storage. All analytics data stays on our EU servers.

• Controller: Audexum EOOD, a Bulgarian limited liability company (the "Operator", "we", "us").
• Registered seat: [to be inserted on registration]
• UIC / VAT: [to be inserted on registration]
• Privacy contact: [email protected]
• EU Representative (Art. 27 GDPR): not required — controller is established in the EU (Bulgaria).
• DPO: not required under Article 37 GDPR for our current processing; the privacy contact above handles all data-subject inquiries.

This Privacy Policy explains how we process personal data when you visit audexum.com, use the Studio, call the API, sign up, pay, or contact us. It also covers personal data we process on behalf of business customers under our Data Processing Addendum.

• Account data: email address; bcrypt-hashed password (we never see the plaintext); optional Google account ID and primary email (only if you sign in with Google); email-verification status; plan tier; account creation timestamp.
• API credentials: the prefix and a bcrypt hash of each API Key you generate; an optional label you choose; last-used timestamp; revocation timestamp.
• Billing data: your Stripe customer ID, your subscription status and current period, the amount and currency of invoices, the country we charge VAT in. Card numbers, bank details, and 3-D Secure data are handled directly by Stripe; we do not see, store, or have access to them.
• Submitted text (Inputs): the text content you submit for synthesis, plus voice ID, language code, speed, and steps parameters.
• Generated audio metadata: character count, generation time, audio duration, real-time factor, voice and language used.
• Saved content: presets you create, batch jobs you queue (status, parameters, downloadable result link, completion timestamp), and history entries (text, parameters, metadata).
• Usage counters: characters consumed per calendar month, per Account.
• Chat assistant: the messages you send to the assistant on our website, its replies, which page it offered to take you to, and how long the reply took. Your message is sent to a language model running on our own servers in the EU — it is not sent to any third-party AI provider. You do not need an account to use it; if you are signed in, the exchange is linked to your Account.
• Technical / connection data: IP address, user-agent string, request timestamps, request paths, response status codes, error messages. IP addresses are mainly processed transiently for rate-limiting, fraud prevention, and security incident analysis. Some records do store the originating IP alongside the entry itself — feedback submissions, chat messages, free-tool leads, and the signup / terms-acceptance record — and those are kept for the periods set out in Section 8.
• Email correspondence: the content of emails you send to us and our replies, for as long as needed to resolve the matter.
• Verification codes: short-lived (typically under 24 hours) one-time codes generated to verify your email address or reset your password; deleted automatically once consumed or expired.
• Cookies: see Section 9 and our Cookie Policy.

We do not deliberately collect special categories of personal data (Article 9 GDPR) such as health data, biometric data, racial or ethnic origin, religious beliefs, political opinions, trade-union membership, or sex-life data. Do not submit such data through the Service. We do not collect children's data — see Section 12.

• directly from you (sign-up, account settings, Inputs, billing forms, support emails);
• from your browser or HTTP client (technical / connection data, cookies);
• from Stripe (subscription events, payment outcomes — never card numbers);
• from Google (if you sign in with Google, the Google account ID and primary email).

We do not use your Input or Output to train, fine-tune, or evaluate machine-learning models. We do not sell personal data, and we do not perform cross-context behavioural advertising.

We use a small number of carefully selected sub-processors to operate the Service. Each is bound by a written agreement requiring confidentiality, security measures, and processing only on our documented instructions. Current sub-processors:

We may also disclose personal data to: our professional advisors (lawyers, accountants, auditors) under duties of confidence; competent authorities where legally required; and an acquirer in connection with a merger, sale, financing, or reorganisation, subject to confidentiality and a continuing privacy commitment at least equivalent to this Policy.

The list of sub-processors may change. We post material changes at least 30 days in advance for business customers under our Data Processing Addendum.

Our primary infrastructure is in the European Union (Bulgaria). The only sub-processor processing personal data outside the EEA is Resend, Inc. (United States). Transfers to Resend rely on the European Commission's Standard Contractual Clauses (SCCs) for processors (Commission Implementing Decision (EU) 2021/914) and we have completed a transfer impact assessment. You can request a copy of the SCCs (with commercial terms redacted) by emailing [email protected].

Cloudflare may route traffic through edge locations worldwide for performance and DDoS mitigation; this is in-transit routing rather than storage of personal data outside the EU. Cloudflare's DPA includes SCCs.

We use one first-party session cookie to keep you logged in, plus cookies set by Stripe Checkout for payment processing and fraud detection. We do not use any advertising, analytics, cross-site tracking, fingerprinting, or social-media-pixel cookies. See the Cookie Policy for the full list, duration, and purpose. Because every cookie we use is strictly necessary, we do not display a consent banner.

• TLS 1.2+ for all web and API traffic;
• passwords stored as bcrypt hashes (cost factor ≥ 12); API keys stored as bcrypt hashes;
• session cookies set with HttpOnly, Secure, and SameSite=Lax;
• network firewall and Fail2Ban on all internet-facing services;
• database encryption at rest; encrypted backups;
• least-privilege access controls; only the Operator's personnel and a limited number of contractors bound by confidentiality can access production systems;
• monitoring and rate-limiting against brute-force, credential-stuffing, and abuse;
• vulnerability disclosure programme — [email protected].

No system is 100% secure. If we suffer a personal data breach likely to result in a risk to your rights and freedoms, we will notify the Bulgarian Commission for Personal Data Protection (KZLD / CPDP) within 72 hours where required, and we will notify you without undue delay where the breach is likely to result in a high risk to your rights and freedoms (Articles 33–34 GDPR).

We do not make decisions about you that produce legal or similarly significant effects solely on the basis of automated processing within the meaning of Article 22 GDPR. Stripe may run its own fraud-prevention scoring on your payment; we do not control that scoring, but you can request human review by emailing [email protected].

The Service is not directed to anyone under the age of 16, and we do not knowingly collect personal data from children under 16. If you believe we hold data about a child under 16, contact [email protected] and we will delete it promptly.

Subject to Articles 15–22 GDPR, you have the right to:

• access — get a copy of the personal data we hold about you;
• rectification — correct inaccurate or incomplete data;
• erasure ("right to be forgotten") — delete data, subject to legal exceptions;
• restriction — limit processing in certain circumstances;
• portability — receive structured, commonly used, machine-readable data;
• object — to processing based on legitimate interest, including direct marketing;
• not be subject to a solely automated decision producing legal or similarly significant effects;
• withdraw consent at any time for any processing based on consent, without affecting prior lawful processing;
• lodge a complaint with a supervisory authority, in particular the Bulgarian Commission for Personal Data Protection (KZLD / CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, cpdp.bg, or with the authority of your habitual residence or place of work.

To exercise your rights, email [email protected] with the subject "GDPR request". We respond within 30 days of verifying your identity (we may extend this by two further months for complex requests, with notice). There is no fee unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act, with notice.

The Service uses artificial intelligence to generate synthetic speech from your text. Where required by Regulation (EU) 2024/1689 (the AI Act) or other applicable law, you must clearly disclose to listeners and recipients that audio generated through the Service is AI-generated. We may embed machine-readable provenance markers in the Output; you must not strip these markers.

We do not offer voice cloning of identifiable real persons. The preset voices we provide are either fully synthetic or licensed from voice actors who consented to the use. Voice samples used in training or licensing do not constitute personal data of end users.

If you use the Service to process personal data of your own end users (for example, submitting customer-facing text through our API), you are the controller and we are the processor under Article 28 GDPR. Our standard Data Processing Addendum is available on request to [email protected] and is incorporated into the Agreement on signature.

We will post material changes here at least 30 days before they take effect and, where you have an Account, send a notification by email. Non-material changes take effect on posting. The "Last updated" date at the top of this page reflects the most recent version.

• Privacy / GDPR rights: [email protected]
• Legal / contracts: [email protected]
• Abuse reports: [email protected]
• Security vulnerabilities: [email protected]
• Supervisory authority: KZLD / CPDP, 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, cpdp.bg