Privacy Policy

Avatvox ("the Service", "we", "us") is an online tool reachable at avatvox.com that takes a video of a person speaking and produces a new video of that same person saying a different script, using AI-driven voice cloning and lipsync. This Privacy Policy explains what information we collect when you use the Service and what we do with it.

The Service is operated by G Younis Properties Ltd, registered in England and Wales under company number 15186217(trading as "Avatvox"). Public registration details are on the UK Companies House register: find-and-update.company-information.service.gov.uk/company/15186217.

If you have questions or want to exercise the rights described below, reach us at hello@avatvox.com.

We only collect what we need to operate the Service:

• Account data — your Google account ID, name, email, and profile picture, obtained when you sign in with Google. We do not see or store your Google password.
• Reference videos and audio — clips you upload so the Service can learn how you speak and look.
• Scripts — the text you submit for each generation.
• Generated videos — the output the Service produces from your references and scripts.
• Usage metadata — timestamps, job status, duration of each generation, credits consumed.
• Payment metadata — invoice ID, amount, status, and the last four digits of the card from our payment processors. We do not receive or store full card numbers.

• To run the generation pipeline you requested.
• To bill you accurately and credit you back when a job fails.
• To prevent abuse (e.g. fraud, automated scraping).
• To contact you about important account or service events (we do not send marketing email by default).
• To debug and improve the Service. Engineers may view error logs that include opaque identifiers (job IDs, user IDs) but not the contents of your videos unless you explicitly ask us to investigate a specific generation.

We share the minimum data needed for the Service to function, and only with these processors:

• Google — sign-in and identity verification.
• Cloudflare R2 — object storage for your reference videos and generated outputs.
• Neon — managed Postgres database for account, job, and ledger records.
• Third-party AI providers — used to clone the voice from your reference audio, synthesise speech from your script, and align the generated audio with the reference video. We share only the specific reference clip, script, and generated artefacts needed for each job. The exact providers may change as the technology evolves; the current list is available on request.
• Stripe — payment processing for credit top-ups. Card data is entered directly with Stripe; we never see it.
• Google Analytics, Google Tag Manager, and Yandex.Metrika — aggregated traffic analytics (pages visited, device type, country, referrer, basic interaction events). These services may set cookies and local storage entries in your browser. We do not pass them your account email or any contents of your references or generated videos.

We do not sell your personal data, and we do not share it with advertising networks.

Your account records and the ledger of credits live in a managed Postgres database hosted by Neon. Your reference videos and generated outputs live in Cloudflare R2 object storage. Both providers operate globally distributed infrastructure; specific region placement may vary.

Some of our processors operate from countries outside the United Kingdom and the European Economic Area. Where personal data is transferred outside the UK/EEA, we rely on the transfer mechanisms recognised by UK GDPR and EU GDPR — most commonly the European Commission's and UK government's Standard Contractual Clauses, or an adequacy decision where one exists for the destination country. By using the Service you accept that your data may be processed in jurisdictions other than your own under those safeguards.

Reference videos and generated outputs are kept for as long as your account exists. If you delete a reference or a generation, we remove the corresponding row immediately; the file in object storage is purged by a background sweeper shortly after.

If you delete your account, we delete your personal data within 30 days, except for records we must keep for tax, anti-fraud, or legal reasons (e.g. an invoice issued through Stripe).

If you are in the United Kingdom or the European Union, you have the following rights under UK GDPR and EU GDPR:

• Access — request a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate data (in practice, update your Google profile and the correction propagates on next sign-in).
• Erasure — delete your account and most of the associated data; some records may be retained for tax, anti-fraud, or legal reasons (see section 7).
• Restriction — ask us to limit how we process your data while a dispute is resolved.
• Portability — receive your data in a machine-readable format. Generated videos are already downloadable from the Service.
• Objection — object to specific processing where we rely on legitimate interests as the legal basis.
• Withdraw consent — where we process data on the basis of your consent, you may withdraw it at any time.

To exercise any of these rights, email us at hello@avatvox.com. We respond within 30 days. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, the data protection authority in your country.

Strictly-necessary cookies. We use a single first-party session cookie to keep you signed in. It contains a signed token (JWT) and no other identifiers; it is HttpOnly, Secure, and SameSite=Lax. This cookie is required for the Service to work and does not need consent under UK GDPR / EU GDPR.

Optional analytics cookies. If — and only if — you click Accept all on the cookie banner shown on your first visit, we load our analytics providers (Google Analytics, Google Tag Manager, Yandex.Metrika — see section 4). These providers set their own cookies and local-storage entries to count unique visitors, sessions, and interaction events. If you click Reject non-essential, none of these are loaded.

Your choice is stored locally on your device. You can change it at any time by clearing browser storage for avatvox.com, which will re-display the banner on your next visit. We do not use advertising or retargeting cookies.

The Service is not intended for use by anyone under 18. We do not knowingly collect data from children. If you believe a child has provided data to us, contact us and we will delete it.

We use reasonable technical and organisational measures to protect your data, including encrypted transport (HTTPS), signed session tokens, scoped storage credentials, and least-privilege access for engineering staff. No system is perfectly secure, however; if you suspect unauthorised access to your account, contact us at hello@avatvox.com immediately.

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be announced on the Service before they take effect.

Questions, complaints, or requests: hello@avatvox.com.