CCPA Notice

This California Consumer Privacy Act (CCPA) Notice applies to California residents who use the BhaShaVox website, applications, or services. It explains the categories of personal information we collect, how we use and disclose it, how long we keep it, and your rights under California law.

This notice supplements our Privacy Policy. Where this notice and the Privacy Policy differ for California residents, this notice controls.

In the past 12 months we may have collected the following categories of personal information:

• Identifiers — name, email address, account ID, IP address, and phone number where you provide it.
• Customer records — billing contact details and subscription information.
• Commercial information — purchase and transaction history, plan and token usage.
• Internet or network activity — interactions with our Services, feature usage, and technical logs.
• Geolocation data — approximate location inferred from IP address. We do not collect precise geolocation.
• Audio, electronic, visual, or similar information — voice recordings, video, images, audio, and documents you submit for translation, dubbing, or related features.
• Biometric information — voice recordings and derived voice models used to generate synthetic speech at your request.
• Professional or employment information — company name and role where you provide them in an enquiry.
• Inferences — preferences derived from your use of the Services, such as language settings. We do not create profiles of your characteristics, behaviour, or attitudes.

We do not knowingly collect personal information from consumers under 18, and we do not sell or share the personal information of minors.

Under the CPRA, some of what we collect is sensitive personal information:

• Account log-in credentials — your email and password combination, used to authenticate you.
• Biometric information — voice recordings and derived voice models, where you use voice cloning or speech features.
• Contents of communications — the content you submit for translation may include the contents of email, messages, or documents where we are not the intended recipient.

We collect and use sensitive personal information only to perform the Services you request, to authenticate you, to prevent and investigate security incidents and fraud, and to comply with law — all of which are purposes permitted without a right to limit under CCPA regulations.

We do not use or disclose sensitive personal information to infer characteristics about you, for advertising or profiling, or for any purpose other than those listed above. We do not sell or share it.

We collect personal information directly from you, automatically when you use the Services, and from service providers such as our payment processor acting on our behalf.

We use it for the business purposes described in our Privacy Policy: providing and maintaining the Services, processing transactions, providing support, ensuring security and preventing fraud, debugging, improving reliability, communicating with you, and complying with legal obligations.

In the past 12 months we may have disclosed the following categories to service providers and contractors for the business purposes above:

• Identifiers and customer records — to our cloud host, transactional email provider, and payment processor.
• Commercial information — to our payment processor and accounting providers.
• Internet or network activity — to our cloud host and error monitoring providers.
• Audio, visual, and similar information, and biometric information — to the AI model and cloud providers that perform translation, transcription, and speech generation on our behalf.

Each recipient is engaged under a written contract that limits use of the information to the purposes we specify and prohibits selling it or using it for its own purposes.

We may also disclose personal information to comply with law or lawful requests, to protect rights and safety, or in connection with a merger or sale of assets.

We do not sell your personal information, and we have not sold it in the past 12 months.

We do not share personal information for cross-context behavioural advertising as defined under California law, and we have not done so in the past 12 months. We do not use third-party advertising or retargeting technology, so there is no "Do Not Sell or Share My Personal Information" mechanism to offer. If this ever changes, we will update this notice and provide the opt-out mechanisms California law requires before any such disclosure begins.

We keep each category of personal information only as long as reasonably necessary for the purpose it was collected for. Our standard periods are:

• Identifiers and customer records — while your account is active, and up to 90 days after closure.
• Commercial information, invoices, and tax records — up to 8 years, as required by Indian tax and companies law.
• Audio, visual, and similar information you submit — until you delete it or close your account; removed from active systems within 30 days.
• Biometric information (voice recordings and models) — until you delete the voice or close your account; removed from active systems within 30 days.
• Log-in credentials — while your account is active.
• Internet or network activity logs — up to 90 days.
• Enquiry and feedback records — up to 24 months from your last interaction.

Encrypted backups age out on a rolling 30-day cycle. Full detail is in our Privacy Policy.

If you are a California resident, you have the right to:

• Know — the categories and specific pieces of personal information we collected, the sources, the business purposes, and the categories of third parties we disclosed it to.
• Access — request a portable copy of the personal information we hold about you.
• Delete — request deletion of personal information we collected from you, subject to legal exceptions.
• Correct — request correction of inaccurate personal information.
• Opt out of sale or sharing — not applicable, because we do not sell or share personal information.
• Limit the use of sensitive personal information — we already limit our use of sensitive personal information to the purposes permitted under CCPA regulations, so there is no further use to limit. Section 3 explains what we do and do not do.
• Non-discrimination — we will not deny you services, charge different prices, or provide a different quality of service because you exercised your rights.

To submit a verifiable consumer request, email privacy@bhashavox.com with the subject line "CCPA Request" and include:

• your name and the email address associated with your BhaShaVox account;
• the right you wish to exercise; and
• enough information for us to verify that you are the person the information relates to.

We verify requests by matching the information you provide against our records, and may ask for additional confirmation for requests involving sensitive information or deletion. We do not use information provided for verification for any other purpose.

We will confirm receipt within 10 business days and respond substantively within 45 days, or tell you if we need a further 45 days.

Authorised agents. You may designate an authorised agent to submit a request on your behalf. We will ask the agent for written permission signed by you and may ask you to verify your identity directly.

BHASHAVOX PRIVATE LIMITED
Yamuna Nagar, Haryana, India
Email: privacy@bhashavox.com

For general privacy questions, see our Privacy Policy. For complaints, see the Grievance Officer section of that policy.