Privacy policy

The short version

We hold an email address, a password hash, what you generated and how much of it, and the audio you asked for until you delete it. We do not sell it, we do not profile you, we run no advertising network and there is no analytics vendor inside these pages.

Your text and your generated speech are yours. We do not use them to train a voice model, and the voices in the catalogue were trained by their publishers on licensed datasets before we ever met you - which is why the licences page can name every one.

What we collect, and why each item exists

• Account - your email address, a scrypt hash of your password (never the password), your workspace name, your role and the plan you are on. Without it there is no account.
• Content - the text you type, the projects and lines you save, files you upload for cleanup, dubbing or a voice clone, and the audio we render for you. This is the product.
• Usage - characters and audio seconds per month per engine, so a plan's limits can be enforced and shown to you on your usage page.
• Consent records - for a cloned voice, who consented, when, and the statement they gave. Kept after the voice is deleted, because it is the evidence that the clone was allowed.
• Security records - API keys you create, invitations, password-reset requests with the address that asked, and an administrator audit log. Four reset requests in an hour is what an account takeover looks like from outside.
• Operational counters - page and error counts, kept in our own database rather than a third-party analytics product.
• The free demo on the landing page - a salted hash of your IP address and a daily count, so one visitor cannot spend the day's allowance. The address itself is never stored and the hash cannot be reversed to it.

What we do not collect

No advertising or social pixels. No session recording or heat maps. No third-party fonts - the two typefaces on this page are served from this domain, so Google never sees that you read it. No cross-site tracking cookie of any kind: see the cookie policy, which is short for that reason.

Where it lives

The application and its database run on Scalingo in Paris. Generated audio is stored either in that database or, where the deployment configures it, in Cloudflare R2 object storage. Every other company that touches your data is named on the subprocessors page, with what it does and where it is.

How long we keep it

• Projects, lines and generated audio - until you delete them; deleting the workspace deletes them in the same request, audio included.
• Uploads for cleanup, dubbing or voice changing - processed and kept with the job, deleted with the job.
• Usage counters - 24 months, because they are what a yearly invoice is checked against.
• Consent records for cloned voices - 7 years, as evidence, even after the voice is gone.
• Password-reset and invitation rows - kept, so an account can answer "who let this person in".
• Backups - our hosting provider's database backups, on its own rolling schedule, so a deletion is reflected in backups only once they roll over.

Your rights

Under the GDPR, the UK GDPR, India's DPDP Act and the CCPA you can ask for a copy of your data, a correction, deletion, or a machine readable export, and you can object to processing. Two of those are buttons rather than requests: Download everything in settings hands you one JSON file with the workspace, its people, every project and script line, a link to each rendered file, jobs, cloned voices, pronunciations and usage; Delete workspace on the same page erases it. Individual renders and subtitle files download from the studio as audio and .srt.

For anything else write to hello@naadly.com. We answer within 30 days and we do not charge for it. If you are in the EU or UK you may also complain to your data protection authority; we would rather you told us first.

What a deletion leaves

Deleting the workspace removes the account, its people, projects, lines, jobs, cloned voices, pronunciation entries, webhooks, generated sounds, usage counters and API keys, and the audio behind them in object storage. Two things deliberately survive:

• Cloning consent records. They are the evidence that a voice was cloned with permission, and the person they protect is not the person deleting the account. They keep the hash of the reference clip rather than the clip.
• Administrator audit entries. Every act of ours on an account is logged, and a log that can be erased by the account it describes is not a log.

If you want those gone as well, write to hello@naadly.com and say so; we will tell you what we are allowed to remove and what we have to keep.

Children

This is a paid tool for making voice-over. It is not for under-16s and we do not knowingly hold their data. If a child's data reached us, tell us and it will be deleted.

Changes

When a material change happens - a new subprocessor, a new purpose - the date at the top of this page moves and account owners are emailed before it takes effect. Old versions are in the repository's history, which is public.