1. Who we are (Data Controller)
This service is operated by Kjaer Labs (CVR: 46556534, Denmark) ("we", "us", "our").
Contact: [PLACEHOLDER: privacy@kjaerlabs.com]
2. What data we collect and why
2.1 Account data
When you sign in with Google we receive your name, email address, and profile picture from Google's OAuth service. We use this to identify your account and display your name in the app.
Legal basis: Article 6(1)(b) — performance of a contract (providing the service you requested).
2.2 App content (drafts, phrases, history)
We store the text you type (drafts and saved phrases) and a log of generated utterances so you can replay them later. Audio files are stored in EU-based cloud storage (Supabase, Frankfurt, Germany).
Legal basis: Article 6(1)(b) — performance of a contract.
2.3 Text-to-speech processing (ElevenLabs)
When you generate speech, the text you have typed is sent to ElevenLabs, Inc. (a US company) via their API. ElevenLabs converts this text to an audio file, which is returned to us and played on your device.
ElevenLabs may process and temporarily store this text on their infrastructure in the United States. The transfer is covered by EU Standard Contractual Clauses (SCCs) pursuant to GDPR Article 46(2)(c).
We do not currently have a Data Processing Agreement (DPA) with ElevenLabs. We have documented this gap and will update this policy when a DPA is in place.
Legal basis: Article 6(1)(a) — consent. You are asked to consent before the first TTS generation.
2.4 Voice cloning (if you upload audio)
If you use the voice cloning feature, you upload an audio recording of yourself (or someone else, with their consent). Voice recordings are biometric data under GDPR Article 9(1).
Processing biometric data requires explicit consent (Article 9(2)(a)). You will be shown a dedicated consent screen before any audio is uploaded. A record of your consent is stored in our database.
Your audio recording and the resulting voice profile are stored and processed by ElevenLabs, Inc. (USA) under SCCs.
Legal basis: Article 9(2)(a) — explicit consent.
2.5 Analytics cookies (with your consent)
If you choose "Accept all" in the cookie banner, we may use anonymous analytics (e.g. Vercel Web Analytics) to understand aggregate usage patterns. No personally identifiable information is sent to analytics providers. Analytics are only activated after you consent.
Legal basis: Article 6(1)(a) — consent.
2.6 Essential cookies
We set a small number of cookies and localStorage values that are strictly necessary for the service to function (e.g. your login session, your language preference, your text-size accessibility setting). These do not require your consent under ePrivacy rules.
3. Data retention
| Data type | Retention |
|---|---|
| Account & profile | Until you delete your account |
| Drafts, phrases, folders | Until you delete them or your account |
| Utterance history & audio | 90 days, then automatically deleted |
| TTS request logs | 90 days |
| Consent records | Kept for 3 years after account deletion (legal obligation to demonstrate consent was obtained) |
4. Where data is stored
Our primary database and file storage is provided by Supabase, hosted on AWS in Frankfurt, Germany (eu-central-1) — inside the EU/EEA.
Text sent for speech synthesis is transferred to ElevenLabs (USA) under SCCs (see §2.3).
Our web application is hosted on Vercel. Vercel acts as a data processor for access logs; see Vercel's Privacy Policy ↗.
5. Your rights under GDPR
If you are in the EU/EEA, you have the following rights. To exercise them, email us at [PLACEHOLDER: privacy@kjaerlabs.com]. We will respond within 30 days.
- Right of access (Article 15): Request a copy of the personal data we hold about you. You can also export your data directly from Settings → Privacy & data.
- Right to rectification (Article 16): Ask us to correct inaccurate data.
- Right to erasure (Article 17): Ask us to delete your data. You can delete your account immediately from Settings → Account.
- Right to data portability (Article 20): Download your data in a structured, machine-readable format from Settings → Privacy & data.
- Right to withdraw consent (Article 7(3)): Withdraw any consent you have given (TTS, analytics, voice cloning) at any time in Settings → Privacy & data. Withdrawal does not affect lawfulness of prior processing.
- Right to lodge a complaint: You have the right to lodge a complaint with your national data protection authority. In Denmark: Datatilsynet ↗.
6. Data sharing and sub-processors
We share data with the following sub-processors:
| Sub-processor | Location | Purpose |
|---|---|---|
| Supabase | EU (Frankfurt) | Database & file storage |
| ElevenLabs | USA (SCCs) | Text-to-speech & voice cloning |
| Vercel | USA (SCCs) | Web hosting & CDN |
| USA (SCCs) | OAuth sign-in |
We do not sell your data. We do not share it with any other third parties.
7. Children
This service is not directed at children under 16. We do not knowingly collect personal data from children.
8. Changes to this policy
We may update this policy from time to time. We will notify you of material changes by email or via a notice in the app. The "last updated" date at the top of this page always reflects the current version.
9. Contact
Questions or requests: [PLACEHOLDER: privacy@kjaerlabs.com]