Data processing addendum

Roles and how this applies

For personal data inside your content - the scripts you submit, the recordings you upload, the voices you clone - you are the controller and we are the processor. For your own account and billing data, we are the controller and the privacy policy governs it.

This addendum forms part of the terms and takes effect when you first use the service, so there is nothing to counter-sign. If your procurement needs a PDF with a signature on it, write to hello@naadly.com and you will get one with these words in it.

What we process, and only that

Subject matter: speech synthesis, voice conversion, transcription, translation and dubbing of the content you send. Duration: as long as your account exists. Categories: whatever your scripts and uploads contain, plus voice recordings, which are biometric data when used to identify a person - which is why consent is a hard requirement in the acceptable use policy.

We act only on your instructions, which are the requests your account makes. We do not train models on your content, we do not enrich it, and we do not sell it.

Subprocessors

The current list is public and versioned on the subprocessors page. Account owners are emailed before a new one starts, and you may object; if the objection cannot be resolved you may terminate and, by exception to the refund policy, we refund the unused part of a prepaid period.

Security measures

• TLS on every connection, passwords stored as salted scrypt hashes.
• Tenant isolation on every query, API keys scoped to one workspace and revocable.
• Least-privilege access: one operator, two-factor on the hosting account, secrets only in the platform's environment.
• Signed webhooks, rate limiting, and an administrator audit log.
• Encrypted backups, restored and verified rather than assumed.
• The security page lists these in detail and says honestly what a one-person service does not have.

International transfers

Processing is in the EU (Paris). Where a subprocessor is outside it - Dodo Payments and Resend are US companies - transfers rely on the EU Standard Contractual Clauses and, where applicable, the UK Addendum and the EU-US Data Privacy Framework.

Breach notification

If we discover a breach affecting your data we tell you without undue delay and within 72 hours of becoming aware, with what happened, what data, what we have done and what you should do. We will not wait for certainty to warn you.

Audits, assistance, deletion

You get this documentation, our answers in writing, and help with data-subject requests and impact assessments at no charge. Two of those requests need no assistance at all: the controller can export the whole workspace as JSON and erase it, both from settings, and erasure removes the audio in object storage in the same request. Database backups held by the hosting provider age out on its schedule, and consent records survive as evidence - see what a deletion leaves.