1. Who is responsible
Vocaic is the party responsible for the personal information described here (the controller for GDPR and UK purposes, and the business for US state-privacy purposes). Vocaic is a pre-incorporation project; when its legal entity, home jurisdiction and registered address are established, this notice will be updated to name them. Until then, contact agarw574@purdue.edu for any privacy matter.
2. Data by product
Vocaic collects only what each feature needs to work.
| Product | What is processed | Where it goes |
|---|---|---|
| Talk | Display name, chosen language, mode and accent voice; messages, their translations and any optional voice recordings; polls and reminders you ask Ava to run in the room | Stored on Vocaic’s server to run the room; deleted 24 hours after the room’s last activity |
| Desk | The words you send and the language pair | Runs in your browser; only text sent for translation and speech leaves the tab. Nothing is stored beyond the shared translation cache |
| Studio (Accent Studio, Translate, Dictate) | Audio you record or upload for the Accent Studio; text you translate or dictate | Audio is transcribed by an open-source model on Vocaic’s own server and the temporary upload is deleted after transcription; translated text pairs are cached without identity |
| Waitlist | Optional name, email, interest type, marketing-consent flag, the Terms and Privacy versions you accepted, and submission time | Stored to contact you about the product |
| Investor room | Name, work email, organization, role, country, purpose, the statements you accepted, a receipt id, access events, and your user agent | Stored to record assent and control access; a hashed session token is set as an eight-hour cookie |
| Vocaic Listen | Live microphone audio recognized into text by built-in browser recognition or Vocaic's on-device recognizer, the finished phrases, and their translations into your language | Runs in your browser; no audio is stored on Vocaic’s server. In browsers without built-in speech recognition, Vocaic recognizes your speech on your device; the audio is not uploaded. Only finished text phrases are sent for translation (and cached as text without identity). If you ask Ava what a phrase meant, that phrase is sent to Ava |
| Ava (AI guide, assistant and room agent) | The question you type or say to Ava, the page you are on, and your recent conversation; images and documents you attach to a message; your custom instructions and answer language. In a Talk room, Ava the AI agent reads the recent room messages to reply. On the Ava page, also the notes you ask her to remember and any public web page link you ask her to summarize | Your question, conversation and attachments are processed by AI models hosted by Vocaic’s cloud provider, Amazon Web Services, to write Ava’s answer. They are not used to train models, and attachments are not stored. When Ava looks up a public fact, Vocaic’s server sends a short search query, written from your question, to Wikipedia and shows the articles it used as sources. A cached answer to a single quick question, without any identity, is kept for 7 days so the same question is faster next time; conversations in the Ava app are not cached on the server. Your Ava app conversations, custom instructions and answer language stay in your browser (IndexedDB vocaic-ava-chats; localStorage vocaic-ava-instructions and vocaic-ava-answer-lang). Notes Ava remembers stay in your browser (localStorage key vocaic-ava-memory) and are sent with your questions only as context; they are never stored on Vocaic’s server. If you give Ava a public web page link, Vocaic’s server fetches that page’s text once to summarize it |
| Slack, WhatsApp, Telegram and Discord (live preview) | When a business or team connects its own Slack, WhatsApp Business, Telegram or Discord app: the keys it pastes, each member’s chosen language, mode and accent (keyed by their platform user id), and the messages and English voice notes the platform sends to Vocaic for that connection | Messages are translated and, when someone asks Ava, answered, then sent back through that platform’s own API. Vocaic does not store the message text. Keys are encrypted at rest (AES-256-GCM) and used only for that connection; member preferences are kept until the connection is disconnected; event ids, without any content, are kept 7 days so a message is never processed twice. English voice notes are transcribed on Vocaic’s own server. The connecting business is responsible for that platform’s terms and for telling the people in its workspace or chats |
| Alexa (live preview) | When someone connects their own Alexa skill: their developer key (kept only as a hash), a connection name, the skill’s id, and the voice and language chosen for Ava; then the question each person asks the skill | Amazon sends the question to Vocaic and plays Ava’s answer. Vocaic checks each request with Amazon’s public certificate, writes the answer with Vocaic’s AI, and speaks it with Vocaic’s speech service. The spoken answer is stored as audio for 24 hours under an unguessable link so Alexa can play it, then deleted. No Alexa account token and no personal profile is stored. The skill owner is responsible for Amazon’s terms |
| Agent API (developer preview) | The message your agent sends, the recipients and their language, accent and mode; a developer key you create; for replies, the text or English audio a person sends back; and text you send to the speech and translate endpoints | Processed to deliver each message and to turn replies into English. A delivered MP3 is stored on Vocaic’s server with an unguessable id and deleted after 24 hours. Developer keys are stored only as SHA-256 hashes. Replies are transcribed by an open-source model on Vocaic’s own server; text is translated as elsewhere (Amazon Translate, or MyMemory for other languages). Text sent to the speech and translate endpoints is used to answer the request and is not stored with your key; only daily usage counts are kept per key. Message text is never logged with a key or IP |
| Voice library (Studio) | A designed voice you choose to publish: its name, description and tags, the Vocaic voice and the design settings (never a recording); likes and reports on published voices | Stored on Vocaic’s server so others can find and use the voice. Your IP address is kept only as a one-way SHA-256 hash, to limit publishing and to count likes and reports; no audio and no raw IP address is stored. A voice is hidden after reports from three different people |
| Agent builder (live preview) | An agent you build: its name, instructions, first message, language, accent and voice, the knowledge you paste or upload, an optional webhook, and the conversations visitors have with it | Stored on Vocaic’s server under your developer key (kept only as a SHA-256 hash) so the agent can answer and you can review its history. Replies are written by Vocaic’s AI, hosted by Amazon Web Services, and are not used to train models. Visitors’ IP addresses are used only in memory for rate limits and are not stored |
| Read aloud embed | On a website that adds Vocaic’s Read aloud player, the article text on that page | Sent from the reader’s browser to Vocaic’s speech engine to be spoken; the audio plays on the reader’s device. Vocaic does not fetch the page and does not store the text with any identity |
| Guide storage | Two browser flags: that Ava’s first-visit hint was shown, and the accent or language you chose for Ava | Stored only in your browser (localStorage keys vocaic-guide-hint and vocaic-guide-voice); never sent to the server |
Hosting and security infrastructure may also process technical data such as IP address, browser, device, requested URL, timestamps and security events.
3. Developer API
The Agent API (a developer preview, documented on the developers page) processes the message your agent sends and each recipient's language, accent and mode so it can deliver the message, and the text or English audio a person sends in a reply so it can return clean English. For voice recipients, Vocaic synthesizes an MP3 and stores it on its own server addressed by an unguessable link; that audio is deleted 24 hours after it is created. Developer keys are stored only as SHA-256 hashes, never in the clear. Reply audio is transcribed by an open-source model on Vocaic's own server; reply text is translated by MyMemory, the same translation service used across the product. Vocaic does not log message text together with a key or an IP address.
Webhooks. If you register a webhook for your key, Vocaic sends the events you choose (a delivery was created, a reply arrived) to the URL you provide, with the message text, recipient ids, languages, accents and modes, signed with a secret only you and Vocaic hold. Vocaic stores the URL, the events and the secret with your key and retries a failed send a few times. Remove the webhook to stop all sends.
Studio tools. Vocaic Studio includes text to speech, voice design, a voice changer, a voice isolator, dubbing, an editor, a podcast studio, sound effects, music, transcription and an ad localizer. Every voice is a Vocaic voice or one you design from a Vocaic voice; Vocaic never clones anyone's voice. Transcription, the voice changer, dubbing, isolation and the editor's captions run on your device: the audio and video you process stay in your browser and are not uploaded, and the speech engine's files are downloaded from Vocaic and cached by your browser. Only text leaves your device: text you choose to have spoken goes to Vocaic's speech server, and text you translate goes to the translation service. Podcast drafts, voice design suggestions, sound recipes, music scores and ad copy you localize are processed by Vocaic's AI, hosted by Amazon Web Services, and are not used to train models. Designed voices are kept in your browser's local storage, and editor projects and their media in your browser's IndexedDB storage, on your device only. Songs with vocals are sung by a Vocaic voice in your browser; the lyrics go to Vocaic's speech server like any other text you choose to have spoken. MP3 export and script alignment run on your device. Publishing a designed voice to the Voice library stores only its name, description, tags and design settings, never a recording (see the table above). Match my settings listens to your microphone for a few seconds to measure pitch, pace and brightness on your device; nothing is recorded or kept, and your voice is not copied.
4. Purposes and legal bases
- To run the features you use (deliver a room, translate, synthesize speech, transcribe an upload): performance of a contract with you, or Vocaic’s legitimate interest in operating the service you requested.
- To keep the service secure and prevent abuse (rate limits, security events, hashed tokens): legitimate interests.
- To contact waitlist and investor registrants and record their assent: legitimate interests and, for optional marketing, your consent.
Where Vocaic relies on consent (for example optional marketing), you may withdraw it at any time without affecting prior processing.
5. Processors and international transfers
Vocaic uses the service providers listed on the Subprocessors page. Translation is performed by Amazon Translate (Amazon Web Services) for the 75 languages it covers, and by MyMemory (Translated srl) for the others and as a backup; if both are unavailable, the AI model Vocaic uses on Amazon Web Services translates the message. Text you translate is sent to whichever of these handles it. Speech synthesis for spoken messages is provided by Microsoft. Hosting, delivery and storage use Amazon Web Services, which also hosts the AI model that writes Ava’s answers and the replies of agents built with the agent builder; questions you ask Ava are processed by that model and are not used to train models. Built-in live speech recognition uses your browser vendor's recognition feature under that vendor's terms. In browsers without built-in speech recognition, Vocaic recognizes your speech on your device; the audio is not uploaded. These providers may process information in the United States or other countries; where required, transfers rely on appropriate safeguards such as standard contractual clauses. When Ava looks up a public fact, a short search query is sent to Wikipedia (Wikimedia Foundation). Messages from a Slack, WhatsApp, Telegram or Discord app that a business connects reach Vocaic from that platform, and replies go back through it, under the business’s own agreement with the platform. Questions asked to an Alexa skill someone connects reach Vocaic from Amazon, and Ava’s spoken answer goes back to Amazon to be played.
6. Retention
| Data | Kept for |
|---|---|
| Talk-room messages, translations and voice recordings | Deleted 24 hours after the room’s last activity |
| Polls and reminders Ava runs in a Talk room | Deleted with the room, 24 hours after its last activity |
| Voices published to the Voice library, with their likes and reports (IP addresses only as one-way hashes) | Kept while the voice is listed; email agarw574@purdue.edu to remove one |
| Agents you build: instructions, knowledge and conversation history | Kept until you delete the agent, which also deletes its knowledge and history |
| Integration connections (encrypted keys) and member language, mode and accent preferences | Kept until the connection is disconnected, which deletes them |
| Integration event ids (no message content) | Deleted after 7 days |
| Ava’s spoken answers for an Alexa skill (audio) | Deleted 24 hours after they are created |
| Ava app conversations, custom instructions and answer language | Only in your browser, until you delete them or clear site data |
| Accent Studio audio upload | Deleted after transcription |
| Vocaic Listen audio | Not stored; only finished text phrases are translated and cached without identity |
| Ava’s cached answer (no identity) | Kept 7 days so the same question is faster, then deleted |
| Translation cache (source and translation text pairs, no identity) | Kept to save quota and speed up repeats |
| Agent API delivered audio (MP3) | Deleted 24 hours after it is created |
| Agent API developer key | Stored only as a SHA-256 hash until you stop using it or it is revoked |
| Investor session | Cookie and session expire eight hours after assent |
| Waitlist and investor assent records | Kept only as long as reasonably needed for product communication, compliance, security and reproducing consent |
7. Security
Traffic is served over HTTPS. Talk seat tokens and investor session tokens are stored only as SHA-256 hashes, never in the clear. Vocaic stores no passwords because there are no accounts. More detail, and how to report a vulnerability, is on the Security page. No system is perfectly secure.
8. Your rights
If the GDPR or UK GDPR applies to you, you have the right to access, correct, delete, restrict and port your personal information, to object to processing based on legitimate interests, to withdraw consent, and to lodge a complaint with your supervisory authority.
If a US state privacy law applies to you (including California), you have the right to know, delete and correct your personal information, to non-discrimination for exercising your rights, and to opt out of any sale or sharing. Vocaic does not sell personal information and does not share it for cross-context behavioral advertising. You may use an authorised agent to submit a request.
To exercise a right linked to your email, contact agarw574@purdue.edu. Vocaic may verify a request proportionately before acting.
9. Global Privacy Control
Because Vocaic does not sell or share personal information and uses no advertising or analytics trackers, there is nothing to opt out of. Vocaic honours a Global Privacy Control signal as a valid opt-out request should that ever change.
10. Children
The site, the waitlist and the investor room are not directed to anyone under 18, and Vocaic does not knowingly collect personal information from children. If you believe a child provided information, contact Vocaic and it will be deleted.
11. Automated decisions
Vocaic does not make automated decisions that produce legal or similarly significant effects about you. Translation, speech synthesis and Ava’s answers are automated, but they process your words rather than making decisions about you. Ava is AI and can be wrong; do not share personal details with her.
12. Changes and contact
This notice will be updated before introducing materially different data practices; the effective date and version at the top identify the notice tied to each submission. Contact agarw574@purdue.edu with any question.