Privacy Policy
Effective date: 14 October 2026 · Version: 1.0
This policy explains how Vaux Technologies Ltd ("Vaux", "we") collects, uses, shares and protects personal data when you use our website, apps, API and related services (the "Service"). It is written to meet the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive (GAID) 2025, the EU and UK General Data Protection Regulation (GDPR), and US state privacy laws including the California Consumer Privacy Act as amended (CCPA).
Summary
- Live audio is processed in memory to convert your voice and is not stored.
- Transcripts and conversation history are saved only if you turn history on, and you can delete them at any time.
- Voice samples for clones are kept until you delete the clone. We never use your voice to train AI models without your explicit opt-in.
- We do not sell personal data, and we do not share it for cross-context behavioural advertising.
1. Who we are
The data controller is Vaux Technologies Ltd, Lagos, Nigeria. Contact our Data Protection Officer at [email protected].
If you use Vaux through another company's product built on our API, that company is usually the controller of your data, and we process it on its behalf as a processor.
2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email, password hash or sign-in provider ID, country, preferred currency | You |
| Billing data | Plan, transactions, billing country, last 4 digits and card brand. Full card details are handled by our payment processors, not stored by us | You, payment processors |
| Live audio | Microphone audio and meeting audio you choose to share during a session | You |
| Voice samples | Recordings you upload or record to create a voice clone, and your consent statement | You |
| Generated content | Typed text, transcripts, agent briefs, agent replies, conversation history (if enabled) | You, the Service |
| Uploaded sounds | Audio files you add to your soundboard | You |
| Usage and device data | Session times and lengths, minutes and characters used, features used, IP address, browser and OS, error logs | Automatically |
| API data | API keys (stored hashed), request metadata, end-user identifiers you pass to us | Developers |
| Communications | Support messages, feedback, survey answers | You |
| Cookies | See our Cookie Policy | Automatically |
Voice data. A voice recording can identify you. Where voice data is used to create a voice clone, we treat it as sensitive personal data: we process it only with your explicit consent, keep it private to your account, and protect it with additional safeguards. We do not use voice data to identify or authenticate you (we do not create "voiceprints" for biometric identification).
3. How we use data and our legal bases
| Purpose | Legal basis (NDPA / GDPR) |
|---|---|
| Create and run your account; provide voice conversion, type-to-speak, agent, soundboard and API | Performance of a contract |
| Create and host voice clones | Explicit consent (withdraw any time by deleting the clone) |
| Save conversation history and transcripts | Consent (history toggle) and performance of a contract |
| Billing, fraud prevention, accounting and tax | Contract; legal obligation; legitimate interests |
| Security, abuse detection and enforcing our Acceptable Use Policy (including reviewing reported content) | Legitimate interests (keeping users and the public safe); legal obligation |
| Service improvement using aggregated or de-identified usage metrics | Legitimate interests |
| Product emails about your account, security and billing | Contract; legitimate interests |
| Marketing emails | Consent (unsubscribe in any email) |
| Responding to legal requests and protecting rights | Legal obligation; legitimate interests |
We do not make decisions with legal or similarly significant effects about you based solely on automated processing.
4. How the Service processes your audio
- Your browser or app streams audio to our voice engine over an encrypted connection.
- Our engine and carefully selected technology partners process it in real time to produce speech in your selected voice. In agent mode, transcripts and your brief are also processed to write replies.
- Audio passes through memory only and is discarded when the session ends. We keep usage metadata (for example, minutes and characters used) for billing.
- Our partners are contractually limited to processing data to provide their service to us, may keep data briefly for abuse monitoring under their terms, and may not use it to train models for others.
5. Who we share data with
We share personal data only with the categories of recipients below. We do not sell personal data. The names of our current sub-processors are available on request from [email protected].
| Recipient | Purpose | Location |
|---|---|---|
| Cloud database and storage providers | Accounts, data storage, file storage | Region chosen at deployment |
| Speech and voice technology providers | Real-time speech processing, voice synthesis, voice clones | United States |
| AI language model providers | Writing replies for the meeting agent | United States |
| Payment processors (Stripe, Paystack, Korapay) | Payment processing | United States / Nigeria |
| Hosting and CDN providers | Running the website and engine | Region chosen at deployment |
| Email provider | Account and transactional email | Varies |
| Professional advisers, authorities | Legal, accounting; when required by law or to protect safety | As required |
| A buyer or successor | If we are involved in a merger, acquisition or sale of assets, under confidentiality | As applicable |
6. International transfers
Some recipients are outside Nigeria, the EEA or the UK. Where we transfer data internationally, we rely on adequacy decisions, standard contractual clauses or other safeguards recognised under the NDPA and GDPR, and on providers' contractual commitments. You can ask for a copy of the safeguards from [email protected].
7. How long we keep data
| Data | Retention |
|---|---|
| Live audio | Not stored; discarded when the session ends |
| Conversation history and transcripts | Until you delete them or turn history off and clear it; deleted within 30 days of account closure |
| Voice clone samples and clones | Until you delete the clone or close your account |
| Account data | For the life of the account, then up to 30 days |
| Billing and tax records | As required by law (typically 6–7 years) |
| Security and abuse logs | Up to 12 months, longer if needed for an investigation or legal claim |
| Backups | Rolling, up to 35 days |
8. Security
We use encryption in transit (TLS) and at rest, row-level access controls so each user can only reach their own data, hashed API keys, short-lived session tokens, least-privilege access for staff, and audit logs for administrative actions. No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant regulator as the law requires (under the NDPA, within 72 hours of becoming aware where required).
9. Your rights
Depending on where you live, you may have the right to:
- access your personal data and receive a copy;
- correct inaccurate data;
- delete your data ("right to be forgotten");
- restrict or object to processing, including processing based on legitimate interests and direct marketing;
- data portability, receiving data you provided in a machine-readable format;
- withdraw consent at any time, without affecting earlier processing;
- not be subject to solely automated decisions with legal or similarly significant effects;
- under the CCPA: know what we collect and disclose, delete, correct, opt out of sale or sharing (we do not sell or share), limit the use of sensitive personal information, and not be discriminated against for using these rights.
You can exercise many rights directly in Settings (export data, delete conversations, delete clones, close account), or by emailing [email protected]. We will reply within the time the law requires, usually within 30 days. We may need to verify your identity. An authorised agent may make a request for you with your written permission.
Complaints. You can complain to the Nigeria Data Protection Commission (NDPC), your local EU data protection authority, the UK Information Commissioner's Office, or the California Privacy Protection Agency. We would appreciate the chance to resolve your concern first.
10. Children
The Service is not for anyone under 18, and we do not knowingly collect children's personal data. If you believe a child has given us personal data, contact [email protected] and we will delete it.
11. Developers and their end users
If you integrate our API, you are responsible for giving your end users notice, getting any consents they need (including voice-clone consent), and honouring their rights. We will help with reasonable requests. A Data Processing Addendum is available on request.
12. Changes
We will post updates here and update the effective date. For material changes, we will notify you by email or in the app before they take effect.
13. Contact
Vaux Technologies Ltd · Lagos, Nigeria · Data Protection Officer: [email protected] · General: [email protected]
This document is provided for transparency and is not legal advice. If anything here conflicts with mandatory law where you live, that law prevails.