1. Scope
This policy explains how LipVox handles personal data across the website and the product.
LipVox LLC ("LipVox", "we", "our", "us"), a company organized in Wyoming, United States, with its registered office at 30 N Gould St, Ste N, Sheridan, WY 82801, USA, operates lipvox.com and related product surfaces, and is the controller responsible for the personal data described here. This Privacy Policy explains what personal data we collect from landing-page visitors, registered product users, paying subscribers, and people who contact us.
2. Data we collect
We collect account data, content data, billing data, and technical usage data.
The exact data we collect depends on how you use the service, and can include the following:
- Account data such as name, email address, login identifiers, and authentication records.
- Marketing data such as email address, sign-up source, campaign parameters, consent records, and communication preferences.
- Project data such as prompts, scripts, uploaded assets, and generated media outputs.
- Voice and likeness related data that is needed to create synthetic voice and avatar output.
- Billing data such as plan, invoices, payment status, and transaction references from payment partners.
- Technical data such as IP address, browser type, device signals, logs, and diagnostics.
3. How we use data
We use data to run the product, secure accounts, support billing, and improve reliability.
We process personal data only for legitimate product and business purposes, including to:
- Provide account access, product features, and customer support.
- Operate the public website, product onboarding, and related communications.
- Process uploads and generate requested outputs.
- Prevent abuse, fraud, security incidents, and policy violations.
- Manage subscriptions, payments, invoices, and account limits.
- Measure performance and improve quality, speed, and stability at an aggregated level.
- Send product-related and marketing communications where you have consented or where applicable law permits a soft opt-in; you can opt out of marketing at any time using the unsubscribe link in each email or by contacting us.
We do not sell personal data, and we do not use your uploaded inputs or generated outputs to train LipVox models without your separate, express opt-in. To create the outputs you request, we send your Input and Output to specialist AI providers listed below. As of the effective date shown at the top of this policy, and based on the terms in place with those providers, they process your Input and Output only to perform the requested generation and to keep that generation secure, and they are not permitted to use it to train their own general-purpose or foundation models. Each provider's processing is nonetheless governed by its own terms, which can change; we review those terms from time to time, select providers accordingly, and will update this policy and our subprocessor list if a provider's role changes. When we use a third-party provider to deliver a requested feature, we determine the purpose and means of that processing and remain responsible for selecting appropriate providers and safeguards. We require providers that process personal data for us to use it only to provide the service to us, unless we tell you otherwise and have a valid legal basis for different processing.
4. Legal bases
When required by law, we rely on contract, legitimate interests, consent, and legal obligations.
If privacy laws such as the GDPR apply to you, we must rely on a valid legal basis for each type of processing. The basis we rely on depends on why we are using the data.
- Contract: we process your data to provide the service you requested and to perform our agreement with you.
- Legitimate interests: we process your data to operate, secure, and improve the service, where those interests are not overridden by your rights and freedoms.
- Consent: we rely on your consent where the law requires it. For special categories of data under the GDPR, including biometric data such as your likeness or voice, we rely on your explicit consent under Article 9, and you may withdraw that consent at any time.
- Legal obligation: we process your data where we are required to, for example to meet tax, accounting, regulatory, and lawful law-enforcement requirements.
5. Biometric, voice, and likeness data
Face and voice inputs can be biometric data; we process them only to create your requested outputs, with consent where required, and on the retention and destruction schedule set out here.
Because LipVox creates avatar and voice outputs, we process photos, voice samples, and related media that can constitute biometric identifiers or biometric information under laws such as the Illinois Biometric Information Privacy Act (BIPA) and similar state or national laws. This section, together with the Retention section below, is our written, publicly available policy establishing our retention schedule and destruction guidelines for this data.
- We use this data solely to create and deliver the specific outputs you request, and not for identity verification, authentication, surveillance, or profiling. LipVox does not create or store faceprints, voiceprints, or other biometric templates for the purpose of identifying you.
- To generate your avatar or voice, we send the relevant photos or voice samples to the specialist providers that produce the output (for example, our avatar-video and voice providers). Those providers create and store the technical voice or avatar model needed to fulfil your request under their own terms, and we instruct them to delete it when you delete the corresponding voice or avatar.
- Where required by law, we obtain your informed consent before collecting or processing biometric data, and you may withdraw consent for future processing at any time.
- We do not sell, lease, trade, or otherwise profit from your biometric data, and we do not use it to train LipVox's own foundation models without your separate, express opt-in.
- We retain this data only until the purpose for which it was collected is satisfied — including when you delete the related photo, voice, avatar, or project, or when you ask us to close your account — or within the period required by applicable law (for example, no later than three years after your last interaction with us under the Illinois BIPA), whichever occurs first, after which we permanently destroy it and instruct our providers to do the same. You may request deletion at any time, and we will honor verified requests where legally required.
- If you upload data about another person, you must have that person's informed consent and be able to provide proof of your rights and permission on request.
6. Sharing and service providers
We use carefully selected service providers to run authentication, billing, infrastructure, and generation.
We share data only as needed to operate and secure the service, including with the following types of providers:
- Authentication providers such as Auth0 (Okta).
- FastSpring, our authorized payment provider and Merchant of Record for subscription and credit purchases.
- Hosting, storage, CDN, logging, observability, and security vendors, including Amazon Web Services and Sentry where enabled.
- AI and media processing providers used to generate requested outputs, including HeyGen, ElevenLabs, Replicate, Fal, OpenAI, Google Gemini, and Topaz where enabled for the requested feature.
- Communication providers, such as Brevo, for operational and transactional email, product updates, and support.
We assess the role of each provider and put in place the contractual safeguards required for that role, including data-processing terms and international-transfer safeguards where applicable. We do not sell personal data or disclose it for third-party behavioral advertising. You may request the current list of active subprocessors and relevant transfer information at the contact address below.
7. International transfers
Data can be processed in countries outside your own because we use global infrastructure.
When data is transferred across borders, we use safeguards required by applicable law, such as contractual safeguards or equivalent transfer mechanisms.
8. Retention
Most content is kept until you delete it or close your account; some records are kept longer where the law requires.
How long we keep data depends on its type and on your actions. In general, your content stays under your control: it remains available until you delete it or ask us to close your account, and it is not deleted on a fixed timer.
- Account and profile data: kept while your account is active. If you ask us to close your account, we delete or anonymize it within a reasonable period, except for limited records we are required to keep.
- Uploaded Input (photos, audio, scripts, and other files) and generated Output (avatars, voices, videos, images, research, and other assets): kept until you delete the item, delete the related project, or close your account. Once deleted, it is removed from our active systems promptly and purged from routine backups on our normal backup rotation.
- Biometric-source media (photos and voice samples used to build a voice or avatar): retained and destroyed as described in the Biometric, voice, and likeness data section above.
- Security, diagnostic, and generation logs: kept for a limited period for abuse prevention, troubleshooting, and dispute handling, then deleted or anonymized.
- Transaction and tax records: retained by us and by our Merchant of Record, FastSpring, for the period required by applicable tax and accounting law, even after you close your account.
- When you request deletion and the law allows it, we delete or anonymize the relevant data within a reasonable period and instruct our providers to do the same.
9. Your rights
You can request access, correction, deletion, portability, or objection where law grants those rights.
Your available rights depend on your location, and may include the right to:
- Access personal data we hold about you.
- Correct inaccurate or incomplete data.
- Request deletion, restriction, or portability where available.
- Withdraw consent for processing based on consent.
- File a complaint with your local privacy authority.
California residents (CCPA/CPRA): you may request the categories and specific pieces of personal information we collect, the categories of sources (you, your use of the Service, and our service providers) and the purposes for collection, and you may request access, correction, and deletion. Biometric information is treated as sensitive personal information; we use and disclose sensitive personal information only for the purposes permitted by the CCPA or with your consent, which means we honor the right to limit the use of sensitive personal information by default. We do not sell or share personal information as those terms are defined under California law, and because we do not sell or share, there is no sale or share to opt out of through an opt-out preference signal such as Global Privacy Control. You will not be discriminated against for exercising these rights. To make a request, use the contact details below.
10. Cookies and similar technologies
We use strictly necessary cookies plus limited error and performance monitoring; we do not run advertising trackers.
Some cookies and similar technologies are strictly necessary to run the service, keep you signed in, maintain session state, and prevent abuse. We also use Sentry to monitor errors and performance and, where enabled, to record diagnostic session replays in which text is masked and media is blocked, so that the replay does not capture the content you upload or generate. We do not use advertising cookies or sell or share personal data for cross-context behavioral advertising. If we later add non-essential analytics or marketing tracking, we will provide the required notice and, where the law requires it, obtain your consent before those technologies are set.
11. Security and children
We apply reasonable safeguards and the service is not intended for children under 18.
No platform is completely secure, but we use technical and organizational controls designed for the risks of an AI media product.
- We limit access to data based on business need.
- We monitor abuse and security events.
- If we become aware of a personal-data breach that affects you, we will notify you and the relevant authorities where, and within the time limits, applicable law requires.
- If you believe your account is compromised, contact us right away.
12. Changes, Wyoming notices, and contact
We may update this policy as the product and law evolve.
If we make material changes, we will update the date at the top of this page and provide notice where required.
- Postal address: LipVox LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA
- Legal notices and privacy requests: privacy@lipvox.com
- DMCA and copyright notices: dmca@lipvox.com
- General support: support@lipvox.com
- European Union and EEA: LipVox has its main establishment in the European Union in Bulgaria, from which our processing in the EU is managed, and we are subject to the GDPR for that processing. Our lead supervisory authority is the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни). You can reach our privacy function for any GDPR request at privacy@lipvox.com, and you may lodge a complaint either with the Bulgarian Commission for Personal Data Protection or with the data protection authority in your own EU or EEA country of residence.
- This policy is governed by applicable U.S. law and relevant Wyoming law where contractual terms require it.
