This policy explains what personal data we process, why, on what legal basis, how long we keep it and what you can do about it. Read it with particular attention if you are going to clone a voice: that processing involves special category data and requires your explicit consent.
The controller is a United States LLC registered in New Mexico. Even so, the GDPR applies to this processing because the Service is directed at data subjects located in the European Union (art. 3.2 GDPR). The data is hosted and processed mainly in the EU (see Sections 5 and 8).
1. Controller
- Controller: WE LAUNCH LLC, LLC incorporated in the State of New Mexico (USA).
- Registration no. / EIN: EIN 38-4335906.
- Registered address: 412 W 7th St, Clovis, NM 88101, EE. UU..
- Contact email for privacy matters: support@makeityours.app.
- Representative in the European Union (art. 27 GDPR): En proceso de designación (art. 27 RGPD).
- Data Protection Officer (DPO): not designated during the beta; privacy point of contact: support@makeityours.app. The obligation to designate a DPO must be re-analysed before the open launch, when the scale changes.
2. Who is responsible for what when you clone another person’s voice
If you use MakeItYours to clone a third party’s voice —for example, your client’s—, we are the controller of that person’s data: we determine how the samples are collected, how ownership is verified, how the evidence is protected and how long it is kept. You have the contractual obligation, under Section 9.3 of the Terms, to have informed that person beforehand and to have provided them with this policy before they give their consent.
3. What data we process and on what legal basis
3.1 Waiting list
Data: email address; professional segment; volume or frequency of ads. Purpose: to manage the beta waiting list and to invite you when your turn comes. Legal basis: your consent (art. 6.1.a GDPR). We do not send commercial communications to the waiting list beyond those relating to your access to the Service.
3.2 Account and access
Data: email address; name; password (always stored encrypted by means of a derivation function, never in the clear); invitation token; session records; for administration accounts, the second-factor secret. Purpose: to create and maintain your account, verify your email, authenticate you and protect access. Legal basis: performance of the contract (art. 6.1.b GDPR).
3.3 Acceptance of terms and record of consents
Data: version of the accepted document and timestamp of the acceptance. Purpose: to evidence what you accepted and when, in accordance with the accountability principle. Legal basis: legal obligation (arts. 5.2 and 7.1 GDPR) and performance of the contract (art. 6.1.b).
3.4 Content you upload: creatives and results
Data: the video files you upload and the results of your conversions, including the voices, images and sounds they contain; the name you give them; and the technical metadata of the file. Purpose: to run the conversion you request, show you the result and maintain your library. Legal basis: performance of the contract (art. 6.1.b GDPR). Bear in mind that your creatives may contain personal data of third parties; by uploading them, you warrant that you hold the necessary rights and consents.
3.5 Voice cloning — special category data
This is the most sensitive processing in the Service and the one that requires your explicit consent. Data: audio samples of the holder’s voice; the technical representation of the voice («cloned voice»); the recording of the consent phrase read live; the text generated for that phrase; the timestamp; the version of the accepted consent text; and the declared name of the holder. Purpose: (a) to create and keep your cloned voice operational so that you can use it in your conversions; (b) to verify that whoever gives the consent is in fact the holder of the voice, in order to prevent the impersonation of third parties. Legal basis (general rule): explicit consent for the processing of biometric data (art. 9.2.a GDPR), in combination with performance of the contract (art. 6.1.b). Legal basis (ownership evidence after withdrawal of consent): establishment, exercise or defence of legal claims (art. 9.2.f GDPR, in conjunction with art. 17.3.e). We apply the art. 9 regime to all voice material.
What we do NOT do with your voice: we do not use it to identify you when you log in, nor for any authentication purpose other than the ownership verification described; we do not transfer it to third parties for their own purposes; we do not use your voice to train AI models, and we have configured our voice processing provider so that it does not use your data for training purposes either (our provider stores your voice model solely in order to provide the service to you and deletes it in accordance with our retention policy); and the recording of the consent phrase never goes out to the voice conversion technology provider: it is stored exclusively in our encrypted storage and is only accessible from the internal operations panel, with each access logged.
3.6 Subscription and billing
Data: contracted plan, subscription status, billing cycles, minute consumption, extra minutes, invoices and tax data. We do not store your full card details: they are processed directly by our payment provider. Purpose: to manage your subscription, charge for the service and comply with our accounting and tax obligations. Legal basis: performance of the contract (art. 6.1.b) and legal obligation (art. 6.1.c).
3.7 Use of the Service, metrics and technical logs
Data: consumption record per conversion and variant; stages, times and errors of each conversion; product events; IP address and anti-bot challenge data on the public surfaces; audit logs of administration actions. Purpose: to provide the service, account for consumption accurately and auditably, diagnose incidents, protect the public surfaces against automated abuse and measure the health of the product. Legal basis: performance of the contract (art. 6.1.b) and legitimate interest (art. 6.1.f) in security, fraud prevention and improvement of the Service. You may object to processing based on legitimate interest in accordance with Section 7.
3.8 Reports of voice misuse
Data: contact email address of the reporting person, description of the facts, reference to or description of where the content was seen, and declared relationship with the affected voice. Purpose: to investigate and resolve reports of impersonation or voice misuse, and to adopt any appropriate corrective measures. Legal basis: legitimate interest (art. 6.1.f) in protecting the rights of third parties and the integrity of the Service; art. 9.2.f where the report involves processing voice data; and legal obligation where referral to an authority is appropriate. Reports are kept as an independent record and are not deleted when the reported person deletes their account, because the data they contain belongs to the person reporting, not to the person reported.
3.9 User support
Data: the message you write to us from the Help section, with its category and subject; your name and your email address, so that we can reply to you; the screenshot you decide to attach; and a minimum technical context that we record automatically (your plan, the screen you are writing from and the browser you use), so that we do not have to ask you for it. Purpose: to assist you, resolve the incident and improve the Service on the basis of what you tell us. Legal basis: performance of the contract (art. 6.1.b). Your message is deleted when you delete your account. The copy left in our support inbox, together with any email conversation we have, is kept for the period stated in Section 6.1. We ask you not to include in the message any data that is not needed to resolve your query.
3.10 Communications
We send you by email: the verification of your account, the beta invitation, the notice that a conversion has finished, consumption notices, notices prior to a data deletion and contractual communications. These are service communications, necessary for the performance of the contract, and you cannot unsubscribe from them while you keep your account. The product does not currently provide for any commercial mailing.
3.11 Cookies and similar technologies
During the beta, the Service uses only technical cookies exempt from consent: session and authentication cookies necessary for operation, and those installed by the anti-bot challenge on the public surfaces (Cloudflare Turnstile) for security purposes. No advertising, behavioural tracking or third-party analytics cookies are used.
4. Automated decisions
We do not take decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you (art. 22 GDPR). Cloned voices created from agency accounts are flagged internally for priority review by a person; that flag by itself produces no effect on you. The measures in Section 11 of the Terms (voice deletion, account block) are always taken by a person, not by an automatic system.
5. Who receives your data
We do not sell your data and we do not transfer it to third parties for their own purposes. To provide the Service we use processors which act on our instructions and under a processing agreement in accordance with art. 28 GDPR:
- Application and database infrastructure (hosting, database and job queue), in the European Union (Western Europe): Railway Corp. (USA).
- File storage (creatives, results, samples and ownership evidence), in the European Union (Amsterdam, Netherlands): Backblaze Inc. (USA).
- Payment gateway and billing (charging subscriptions and extra minutes, issuing invoices), in the European Union / USA: Stripe.
- Transactional email delivery (verification, invitations, conversion and consumption notices): Resend.
- Error monitoring (diagnosis of technical incidents), USA: Sentry.
- Anti-bot protection (defence of the public surfaces against automated abuse), global network: Cloudflare.
- AI voice conversion and cloning (running the voice conversion and creating the cloned voice from your samples), USA under the contracted plan: external voice synthesis and conversion provider, whose identity is not disclosed on user surfaces under the white-label rule.
In addition, we may disclose data to judges, courts, law enforcement bodies and public authorities where there is a legal obligation to do so.
6. How long we keep your data
6.1 General retention table
- Waiting-list registration: deleted when the person registers and, in any event, 24 months after registration or at the close of the beta, whichever occurs first.
- Account and access data: for as long as the account is active. On deletion, they are erased; the user row survives turned into a record with no identifying data, solely as a technical integrity anchor.
- Creatives and results: for as long as the account is active. They are deleted when the account is deleted.
- Free-trial accounts with no completed conversion: 30 days, with an email notice 7 days beforehand.
- Voice samples: for as long as the cloned voice exists. They are deleted when the voice is deleted, when consent is withdrawn or when the account is deleted.
- Cloned voice: for as long as you keep it. It is deactivated after prolonged inactivity (with automatic recovery possible) and is definitively deleted when you delete it, when you withdraw consent, when you delete the account or when a measure under Section 11 of the Terms is applied.
- Ownership evidence: special regime — see Section 6.3.
- Consumption record, conversion stages and product events: kept without identifying data after the account is deleted, in order to maintain the integrity of the accounting and of the aggregate metrics.
- Invoices and accounting and tax documentation: for the period required by the applicable United States tax and accounting rules; by default, 7 years.
- Reports of misuse: five years (1,830 days), consistent with the period of the ownership evidence they refer to. They survive the deletion of the reported account.
- User support messages: the message stored in the Service is deleted when you delete your account. The copy left in our support inbox, and the associated email conversation, are kept for 12 months from the last message and are purged thereafter.
- Audit logs of administration actions: kept for audit integrity, purging from them any data identifying the deleted person or third parties.
6.2 What exactly happens when you delete your account
When you delete your account: (1) we first close any pending billing and delete your data from the payment provider; (2) we delete your cloned voices, including in the systems of our technology providers, and verify that the deletion has taken place; (3) we delete your files —creatives, results and voice samples, including all their versions—; (4) we delete or turn into records with no identifying data the rest of your data; and (5) we keep the ownership evidence under the restricted regime of Section 6.3.
6.3 The only exception: the ownership evidence
When you delete your account, the ownership evidence is not deleted immediately. That evidence is the only thing that makes it possible to prove, against a future claim, that the person whose voice was cloned consented to it; if we deleted it, we would destroy precisely the proof that protects the person who might have been impersonated and the one that allows us to defend ourselves. The right to erasure does not cover data necessary for the establishment, exercise or defence of legal claims (art. 17.3.e GDPR), and art. 9.2.f GDPR permits the processing of special category data for that same purpose. This is not anonymisation: the evidence retains the holder’s name and the recording of their voice; what is broken is its link with the account, not its content. While the retention lasts, the evidence is sealed and unlinked from the account; it is not accessible from any user surface (only from the internal operations panel); each consultation leaves an audit record; it remains encrypted at rest in European Union storage; and it is automatically destroyed when the period expires, with all its versions. The period is five years (1,830 days), counted from the moment the voice it covers is definitively deleted —not when you delete your account nor when the evidence was recorded—, so that if your voice is simply deactivated through inactivity or because you end your subscription, the period has not yet begun. If a report or an investigation is open in respect of a piece of evidence, its destruction is suspended until the case is resolved; on resolution, the period resumes, it does not restart.
7. Your rights
You may at any time exercise the rights of access, rectification, erasure, restriction, portability and objection, as well as withdraw the consent you gave (without this affecting the lawfulness of the prior processing).
7.1 How to exercise them
By writing to support@makeityours.app, stating the right you are exercising. We may ask you to prove your identity. We will reply within one month, extendable by a further two months if the request is complex, in which case we will tell you. In addition, many actions are available directly in the product: you can delete your cloned voice, update your samples, delete your conversions and delete your account without writing to us.
7.2 Withdrawal of consent to voice cloning
Withdrawing consent is equivalent to deleting your voice. You can do it from «My voice» at any time and without giving reasons. When you do, your cloned voice is deleted, including in the systems of our providers; your audio samples are deleted; and the ownership evidence passes to the restricted regime of Section 6.3 and is destroyed when its period expires.
7.3 Complaint to the supervisory authority
If you consider that we have processed your data improperly, you may complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es), without prejudice to any other administrative or judicial avenue. We would be grateful if you told us first, so that we can resolve it.
7.4 If you are not a user and your voice has been used without your permission
If you believe that someone has cloned your voice on MakeItYours without your consent, you do not need to have an account in order to act. Write to us at support@makeityours.app or use the public reporting form. We investigate these reports as a priority and we can delete the voice immediately.
8. International data transfers
Your data is hosted and processed mainly in the European Union. The application infrastructure and the file storage —including the voice samples and the ownership evidence— are located in EU data centres (Amsterdam). However, the controller is a United States company (New Mexico LLC) and some of our providers are companies incorporated outside the European Economic Area, mainly in the United States; in particular, voice conversion and cloning takes place, under the contracted plan, in the United States. These disclosures constitute international data transfers. Where a transfer is directed to a third country, we rely on the mechanism that corresponds under Chapter V of the GDPR: the applicable adequacy decision or the importer’s certification under the EU-US adequacy framework where it is in force and applicable to it, and, failing that, the Commission’s standard contractual clauses (SCCs), with any additional safeguards that may be appropriate. Reinforced attention is paid to transfers involving biometric data. You may request a copy of the safeguards applied by writing to the privacy contact address.
9. Security
We apply technical and organisational measures appropriate to the risk, among them: encryption in transit for all communications; encryption at rest for stored files, with a separate, access-restricted store for voice samples and ownership evidence; separation of surfaces (the internal operations panel requires an administrator role and mandatory second-factor authentication); audit logging of administration actions and of every access to the sealed evidence; least-privilege principle for storage access credentials; access control to the voice conversion provider (all communication with it takes place from our servers; your browser never communicates with it nor knows its credentials, although it does communicate directly with the file storage through temporary single-use links that we issue); and versioning and version retention in the sensitive store, as protection against accidental deletions (every effective deletion also removes the earlier versions). No measure eliminates risk entirely. Should a security breach occur that entails a high risk to your rights, we would notify you in accordance with art. 34 GDPR.
10. Impact assessment
Since we process biometric data in voice cloning, this processing is subject to a data protection impact assessment (art. 35 GDPR), which we address prior to processing real data in the beta.
11. Minors
The Service is reserved for persons over 18 years of age and is not directed at minors (Section 5 of the Terms). We do not knowingly collect data of minors under that age. If we detect that an account belongs to a person under 18, we will suspend it and delete their data —including voice samples and the associated evidence— except for what we must keep by legal obligation.
12. Changes to this policy
We may update this policy. Every update generates a new version with its own date, and the version in force is always published on this page. If the change is substantial —in particular, if it affects the purposes, the legal bases or the retention periods of voice data— we will notify you by email before it takes effect and, where the legal basis is consent, we will ask you to give it again.