This statement provides information pursuant to Art. 13 and Art. 14 of the General Data Protection Regulation (GDPR) on the processing of personal data by Good Point GmbH.
1. Controller
| Controller within the meaning of Art. 4(7) GDPR | Good Point GmbH, Liechtensteinstrasse 63/10, 1090 Wien, Österreich |
| Data protection contact | legal@hancvoice.com |
We have not appointed a data protection officer, as there is no legal obligation to do so. For any data protection questions, please contact the address above.
2. Processing overview
We process personal data in the following categories and for the following purposes:
| Data category | Purpose | Legal basis |
|---|---|---|
| Master & contact data (name, e-mail, account) | Registration, sign-in, operation of the account | Art. 6(1)(b) GDPR (contract) |
| Usage & log data (IP, logs, projects, generations) | Provision, security, abuse prevention | Art. 6(1)(b) and (f) GDPR |
| Voice data (recording, reference text, derived voice models, voice print) | Creation of an author voice (your own voice), voice synthesis, narration of texts (content creation) | Art. 6(1)(a) GDPR (consent) |
| Payment & invoicing data | Handling of subscriptions and purchases | Art. 6(1)(b) and (c) GDPR |
| Marketplace data (author profiles, listings, payouts) | Operation of the voice marketplace | Art. 6(1)(b) GDPR |
3. Principles of processing
- Lawfulness & transparency: We process data only on a legal basis under Art. 6 GDPR and inform transparently about it.
- Purpose limitation & data minimisation: We collect only the data required for the respective purpose.
- Storage limitation: Data is deleted as soon as the purpose ceases to apply or consent is withdrawn (see section 10).
- Integrity & confidentiality: Protection through technical and organisational measures (see section 12).
- No identification of persons: Voice data is processed exclusively for the creation of a voice and for voice synthesis (narration of texts). The voiceprint is used to generate and operate your synthetic voice and is not used to identify you as a person or to match you against external identity databases. Any automated checks for abuse and rights protection serve solely to prevent legal violations and not to identify individuals.
4. Use of the website
When the website is accessed, the hosting/CDN provider processes technically required data (IP address, date/time, resource requested, user agent) in server log files. This is necessary for stable and secure provision (Art. 6(1)(f) GDPR). This data is not combined with other data sources.
Contact by e-mail: We process the data you submit to handle the enquiry (Art. 6(1)(b) or (f) GDPR).
5. Use of the platform
To use HancVoice you create an account. We process account, project and generation data in order to provide voice synthesis from around 318 public voices in 10 languages, the management of your projects, as well as export (WAV/MP3) and API access. The legal basis is performance of the contract (Art. 6(1)(b) GDPR).
6. Voice data & voice synthesis
HancVoice processes voice data exclusively for the creation of individual voice models and for voice synthesis. In detail:
Your voice samples and entered texts are not used to train or improve general AI models. They serve solely to create your own (author) voice and to voice your texts.
- Voice recording & reference text: Uploaded or recorded voice samples and the associated reference text are processed to generate a voice model.
- Voice synthesis (TTS): Entered texts are converted into audio. The texts are processed for the creation and delivery of the result.
- Author voice (your own voice) & consent: Creating your own voice from your voice sample requires your explicit consent (see Consent to voice processing). Without documented consent, no voice is created.
- Voice-print bank (embedding bank): A compact mathematical voice print (embedding/x-vector) is derived from a voice and stored in a voice bank so that the voice can be synthesised again. The voiceprint is used to generate and operate your synthetic voice and is not used to identify you as a person or to match you against external identity databases. Any automated checks for abuse and rights protection serve solely to prevent legal violations and not to identify individuals.
- Voice Conversion ("Transformation"): In speech-to-speech conversion we process an input recording you provide together with a target voice. You must hold the necessary rights to the input recording. The input recording is processed solely to carry out the conversion and is deleted after processing.
- Transcription: Audio files uploaded for transcription may contain sensitive content. They are processed solely to produce the transcript and are not used otherwise; the uploaded file is deleted after processing.
Author voices (your own voices) are private. Publication in the marketplace only takes place after separate submission for moderation and separate acceptance of the marketplace terms. The processing of voice data serves exclusively the creation of a synthetic voice for the narration of texts (content creation) and not the unique identification of a natural person; no biometric identification within the meaning of Art. 9 GDPR takes place. The legal basis is your explicit consent under Art. 6(1)(a) GDPR, which you may withdraw at any time with effect for the future; after withdrawal, the voice and the derived voice print are deleted.
7. Cookies
We use technically necessary cookies to provide the basic functions (e.g. session, security); these do not require consent. Optional cookies (in particular analytics) are only set after your consent via the consent banner. Details are in our Cookie Policy. You can withdraw your consent at any time via the cookie settings.
8. Third parties (processors)
We use carefully selected service providers on the basis of data processing agreements pursuant to Art. 28 GDPR:
| Service provider | Purpose | Data categories |
|---|---|---|
| Stripe Payments Europe, Ltd. (Ireland); where applicable Stripe, Inc. (USA) as onward processor | Payment processing for subscriptions and purchases (transfer to the USA safeguarded by the EU–US Data Privacy Framework and/or EU standard contractual clauses, see section 11) | Payment, invoicing and transaction data |
| Hetzner Online GmbH (DE/EU) | Application hosting, file and audio storage in the EU | Account, project, voice and audio data, logs |
| Verda Cloud Oy (FI/EU) | GPU compute for speech synthesis and voice conversion; data centre Finland (EU) | Voice and audio data for processing |
| Twilio (Verify) | Sending SMS confirmation codes for phone number verification at registration | Phone number, country, IP address |
| Microsoft (Azure Communication Services) | Sending transactional email (confirmations, security notices, billing) | Email address, message content |
| Google Ireland Ltd. (Ireland), reCAPTCHA | Abuse prevention at registration and sign-in; not used for analytics | IP address, browser data |
| Google Ireland Ltd. (Ireland), Google Analytics 4; where applicable Google LLC (USA) as sub-processor | Reach measurement — only after consent (“Analytics” category), with IP anonymisation; US transfers safeguarded by the EU–US Data Privacy Framework and/or EU Standard Contractual Clauses (see section 11) | Usage/device data in pseudonymised form, truncated IP address |
Insofar as a service provider processes data outside the EEA, the guarantees named in section 11 apply.
9. Data subject rights
Under the GDPR you have the following rights:
- Access (Art. 15), rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18).
- Data portability (Art. 20).
- Objection to processing based on legitimate interests (Art. 21).
- Withdrawal of consent given, with effect for the future (Art. 7(3)) — in particular for voice data.
- Complaint to a supervisory authority (Art. 77). Competent in Austria: Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.
To exercise your rights, a message to legal@hancvoice.com is sufficient.
10. Retention & deletion
We store personal data only for as long as is necessary for the respective purposes or as long as statutory retention obligations exist.
Voice data & derived models: Once the purpose ceases to apply, after account deletion, or after withdrawal of consent, voice data (recording, reference text), the models derived from it, and voice prints are deleted or anonymised within 30 days.
Billing & invoice data: By way of exception, we retain invoice and accounting data for seven years due to statutory retention obligations (§ 132 BAO, § 212 UGB). During this period, processing is restricted to fulfilling these obligations.
Log data: Event-log entries are deleted after 90 days. In the synthesis log the IP address is removed after 90 days; the remaining entry is kept for billing and statistics. Phone-verification attempts are deleted after 30 days. Records of your cookie consent are kept until withdrawal plus the limitation period — they are our evidence under Art. 7(1) GDPR.
11. International data transfers
Processing takes place primarily in the European Union. Should a transfer to a third country be necessary in an individual case, we base it on an adequacy decision of the EU Commission or on appropriate safeguards pursuant to Art. 46 GDPR (in particular EU standard contractual clauses) together with supplementary protective measures.
In particular, our payment service provider Stripe Payments Europe, Ltd. (Ireland) may engage Stripe, Inc. (USA) as a further (onward) processor. The associated transfer to the USA is safeguarded by the EU Commission's adequacy decision on the EU–US Data Privacy Framework (DPF) of 10 July 2023 and/or by EU standard contractual clauses (Art. 46 GDPR).
12. Security
We take technical and organisational measures pursuant to Art. 32 GDPR: access restrictions, encryption of transmission — TLS towards the outside, an encrypted tunnel (WireGuard) between our own systems — and of storage, logging, regular backups and separation of processing areas. Voice prints are managed technically separately from clear data.
13. Changes to this statement
We adapt this privacy policy when the legal situation, the processing or the services used change. The respective current version is published with a date on this page.