Privacy Policy

BHASHAVOX PRIVATE LIMITED ("BhaShaVox", "we", "us", "our") operates the BhaShaVox website (bhashavox.com), web application, mobile applications, APIs, and all related products and services (collectively, the "Services").

• Registered office: Yamuna Nagar, Haryana, India
• Entity identifier: U62013HR2026PTC143739
• GSTIN: 06AAOCB6317L1ZC
• Privacy contact: privacy@bhashavox.com

Under India's Digital Personal Data Protection Act, 2023 we act as a Data Fiduciary. Under the EU and UK GDPR we act as a controller for account, billing, and website data, and as a processor acting on your instructions for the content you submit for translation or generation.

This policy describes what we collect, why we collect it, who we share it with, how long we keep it, and the choices you have.

Depending on how you use BhaShaVox, we may collect:

• Account information — name, email address, password (stored in hashed form), profile photo, and language preferences.
• Content you submit — text, documents, audio, video, images, and other files you upload or create for translation, transcription, dubbing, voice cloning, subtitles, or related features.
• Voice recordings — audio you provide for voice cloning or speech features. Depending on your jurisdiction this may be treated as biometric or sensitive personal data. See section 3 for the basis on which we process it.
• Usage and technical data — IP address, device type, browser, operating system, app version, pages viewed, feature usage, error and crash logs, and approximate location derived from IP.
• Payment and billing data — subscription plan, transaction history, and billing contact details. Card details are collected and processed directly by our payment partner; we do not receive or store full card numbers.
• Enquiries and feedback — the name, email address, phone number, company, and message you submit through our contact, sales, and feedback forms, together with the page or form the enquiry came from.
• Support communications — support tickets, survey responses, and emails you send us.
• Cookies and similar technologies — see section 12 and our Cookie Policy.

Where data protection law requires a legal basis for processing, we rely on the following:

• Performance of a contract — creating and operating your account, delivering the translation, dubbing, and generation features you request, and processing payments and invoices.
• Consent — processing voice recordings for voice cloning, sending marketing emails, publishing your feedback as a public testimonial, and any optional cookies. You may withdraw consent at any time without affecting processing carried out before withdrawal.
• Legitimate interests — securing the Services, preventing fraud and abuse, responding to sales and support enquiries, and monitoring performance and reliability. We balance these interests against your rights and you may object at any time.
• Legal obligation — tax and accounting records, and responding to lawful requests from authorities.

Voice and biometric data. Voice recordings you submit for cloning may constitute biometric or sensitive personal data. We process them only with your explicit consent, only to produce the output you have asked for, and we do not use voiceprints to identify, verify, or authenticate any person, or to infer characteristics about anyone.

We use personal information to:

• Provide, operate, and maintain the Services you request.
• Create and manage your account and authenticate you.
• Process translations, voice output, dubbing, and other AI-powered features.
• Process payments, subscriptions, and invoices.
• Send service-related messages (account alerts, security notices, billing notices, and material changes to these policies).
• Respond to sales enquiries, support requests, and feedback, including sending an acknowledgement when you submit a form.
• Publish feedback as a public testimonial, but only where you have given separate, specific consent (see section 11).
• Monitor performance, debug issues, prevent fraud, and protect the security of the Services.
• Analyse aggregated and de-identified usage to improve features and reliability.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not use your content to serve advertising.

BhaShaVox is an AI-powered translation and content platform. To deliver our Services, your submitted content (text, audio, video, documents) is processed by automated systems, which may include third-party AI model providers and cloud infrastructure providers acting on our behalf as processors or sub-processors.

• Content is processed only to provide the feature you use — for example, translating text or generating dubbed audio.
• We do not use your private content to train our own models. Content sent to our AI sub-processors (currently Groq and Google Gemini) is processed under their commercial API terms, which do not permit use of customer content to train their public models when we use paid or commercial API access. Temporary logging for abuse monitoring or reliability by a provider may still occur under that provider’s terms. We do not opt in to any provider programme that uses customer content for training.
• No automated decisions with legal effect. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing, and we do not profile you for that purpose.
• Human review is limited. Your content is not routinely reviewed by people. Our staff may access specific content only where necessary — to investigate a support request you raised, to investigate suspected abuse or a security incident, or to debug a fault where we cannot reproduce it otherwise. Such access is restricted, logged, and limited to what is needed.
• You are responsible for ensuring you have the right to upload and process the content you submit, and that it does not violate the rights of others or applicable law.
• Please do not upload highly sensitive information (such as government identification numbers, health records, or financial account credentials) unless you have a separate enterprise agreement with appropriate safeguards in place.

We share information only in the following situations:

• Service providers and sub-processors — vendors who host our infrastructure, process payments, send transactional email, or perform AI processing on our behalf, each under written confidentiality and security obligations and permitted to use the data only for the purposes we specify. A current list of sub-processors is available in our Sub-processors notice, and on request from privacy@bhashavox.com. Enterprise customers under a Data Processing Agreement receive advance notice of material changes.
• Legal requirements — where required by law, court order, or a lawful government request, or to establish, exercise, or defend legal claims and protect rights, safety, and security.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, with notice where required by law.
• With your consent or at your direction — for example when you connect a third-party integration, or consent to your feedback being published.

We do not sell personal information, and we do not disclose it for cross-context behavioural advertising.

We are based in India and we process and store information in India and in other countries where we or our service providers operate. Data protection laws in those countries may differ from the laws of your country.

India is not currently the subject of an adequacy decision by the European Commission or the UK government. Where we transfer personal data out of the EEA, the UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (with the UK International Data Transfer Addendum where applicable), supported by a transfer risk assessment and additional technical and organisational measures. Copies of the relevant transfer mechanism are available on request from privacy@bhashavox.com.

We keep personal information only as long as necessary for the purposes described in this policy, unless a longer period is required by law. Our standard periods are:

• Account data — for as long as your account is active, and up to 90 days after account closure to allow recovery, resolve disputes, and prevent fraud.
• Submitted content and generated output — until you delete the project, or until account closure. Deleted items are removed from active systems within 30 days.
• Voice recordings and voice models — until you delete the voice or close your account, and removed from active systems within 30 days of deletion.
• Backups — encrypted backups are retained on a rolling 30-day cycle, after which deleted data ages out.
• Security, access, and error logs — up to 90 days, or longer where retained for an ongoing investigation.
• Contact, sales, and feedback submissions — up to 24 months from your last interaction, so we can handle follow-up enquiries. Published testimonials are retained until you withdraw consent.
• Invoices, tax, and accounting records — for the period required by Indian tax and companies law, currently up to 8 years.

Where we no longer need data but cannot immediately delete it, we restrict access or de-identify it.

We implement technical and organisational measures designed to protect your information, including encryption in transit (HTTPS/TLS), encryption at rest for our managed databases, object storage, and backups, password hashing, role-based access controls, and monitoring for unauthorised access.

No method of transmission or storage is 100% secure. While we work hard to protect your data, we cannot guarantee absolute security. Please use a strong, unique password and keep your credentials confidential.

If we become aware of a personal data breach affecting your information, we will notify you and the relevant supervisory authorities within the timeframes required by applicable law. See our Security page for more detail.

Depending on where you live, you may have the following rights:

• Access — request a copy of the personal information we hold about you.
• Correction — update inaccurate or incomplete information, in your account settings or by contacting us.
• Deletion — request deletion of your account and associated personal data, subject to legal retention requirements.
• Restriction or objection — object to processing based on legitimate interests, or request restriction where applicable.
• Portability — receive data you provided in a structured, machine-readable format.
• Withdraw consent — where processing is based on consent, withdraw it at any time.
• Marketing opt-out — unsubscribe from promotional emails using the link in those messages.
• Nominate — if you are in India, nominate another person to exercise your rights in the event of death or incapacity, as provided under the Digital Personal Data Protection Act, 2023.

To exercise any of these rights, email privacy@bhashavox.com. We may ask for information to verify your identity, and we will respond within 30 days or such shorter period as applicable law requires. We will not discriminate against you for exercising your rights.

Complaints. If you are unhappy with our response, you may complain to our Grievance Officer (section 15). If you are in the EEA, the UK, or Switzerland, you also have the right to lodge a complaint with your local data protection supervisory authority. If you are in India, you may escalate to the Data Protection Board of India. California residents should also see our CCPA Notice.

EU/UK representative. We have not currently appointed an Article 27 representative in the EU or the UK. If you are in the EEA, the UK, or Switzerland, contact privacy@bhashavox.com for data-protection matters. You also retain the right to lodge a complaint with your local supervisory authority.

When you send us feedback about BhaShaVox, we use it to improve the product and to respond to you.

We may also want to publish your feedback as a testimonial on our website or in marketing material. If we do:

• We publish only where you have given separate, specific consent at the time you submitted the feedback. We do not treat submitting feedback as consent to publish it.
• A published testimonial may include your first name, role, and company, together with your quote — edited only for length, spelling, or clarity, never to change its meaning.
• We never publish your email address, phone number, or any content you submitted for translation.
• You can withdraw consent at any time by emailing privacy@bhashavox.com, and we will remove the testimonial from our website within a reasonable period. Cached or third-party copies may persist outside our control.

We use cookies and similar technologies to keep you signed in, remember your preferences, and keep the Services secure.

• Strictly necessary cookies — required for login, session security, and core functionality. These are set without consent because the Services cannot work without them.
• Preference storage — remembers your language, theme, and interface settings.

We do not currently run third-party advertising or cross-site tracking technologies. If we introduce analytics or marketing cookies in future, we will update our Cookie Policy and, where consent is required, ask for it before those cookies are set.

Our Services may contain links to third-party websites or offer integrations such as payment gateways and social sign-in. We are not responsible for the privacy practices of those third parties, and this policy does not apply to them. We encourage you to review their privacy policies before providing personal information.

BhaShaVox is intended for users aged 18 or over. You must confirm that you meet this requirement when you create an account, and we do not knowingly collect personal information from children.

Under India's Digital Personal Data Protection Act, 2023, a child is a person under 18, and processing a child's data requires verifiable parental consent and prohibits tracking, behavioural monitoring, and targeted advertising directed at children. We do not knowingly carry out any such processing.

Education and institutional use. Where a school, university, or other organisation uses BhaShaVox with material relating to people under 18, that institution is responsible as the controller or data fiduciary for obtaining any required parental consent, and must use the Services under a separate written institutional agreement. Individual accounts may not be used to process children's personal data.

If you believe a child has provided us with personal information, contact privacy@bhashavox.com and we will take steps to delete it.

In accordance with India's Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Digital Personal Data Protection Act, 2023, we have appointed a Grievance Officer to receive and resolve complaints about our handling of personal data and content on the Services.

• Name: Shivam Verma
• Designation: Grievance Officer & Data Protection Contact
• Email: grievance@bhashavox.com
• Postal address: Yamuna Nagar, Haryana, India

We acknowledge complaints within 24 hours and aim to resolve them within 15 days of receipt. Please include your account email, a description of the issue, and any relevant references so we can investigate.

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. When we make material changes we will post the updated policy on this page, update the "Last updated" date, and give you notice by email or an in-product notice at least 30 days before the change takes effect, unless a shorter period is required by law or necessary for security.

Your continued use of the Services after the effective date of an update means you accept the revised policy. If you do not agree, you may stop using the Services and close your account.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us:

• Privacy and data requests: privacy@bhashavox.com
• Grievance Officer: see section 15
• General support: support@bhashavox.com
• Entity: BHASHAVOX PRIVATE LIMITED
• Address: Yamuna Nagar, Haryana, India

We aim to respond to privacy requests within 30 days, or sooner where required by law.