Version: 1.0 of this document was created on April 8, 2026

Vocoda believes data privacy is important. This Privacy Notice (also referred to as "Notice") explains what personal data we may collect, how we may collect it, and what we do with it. It also outlines your data privacy rights and how to exercise them.

What this Privacy Notice covers

This Privacy Notice applies when you use our products and services, or interact with us through our channels and activities. This covers the Vocoda platform, services, websites, and other activities described in this Privacy Notice.

We may provide additional privacy notices for certain products and services.

In this Notice, personal data (also referred to as "data" and "personal information") refers to information that can be linked to or used to identify a particular person. This excludes any data that has been made anonymous.

As Vocoda, we're responsible for deciding how your data is processed, making us the data controller as per this Notice, unless stated otherwise.

This Privacy Notice does not cover situations where we are not the controller of your data. In the case where we process personal data on behalf of our customer, their privacy notice applies.

Who we are

Vocoda is a speech synthesis technology provider operated by Ambassadors Lab B.V., registered in the Netherlands.

What data we may collect and how we may do this

The personal data we collect about you depends on how you interact with us and the specific products and services you use.

Data you provide to us

You may provide us with your personal data as follows:

• Account profile data such as your name, email address, username, password and other security codes.

• Text input such as text you type or provide for speech synthesis.

• Text presets such as saved phrases or messages you configure for repeated use.

• User settings such as your preferred language, voice, and model configuration.

Data processed on your device

Certain data is processed locally on your device and is not transmitted to our servers:

• Speech recognition input. When you use speech-to-text functionality, audio is processed by your browser or device operating system (e.g. Google Chrome, Safari). This processing is governed by your browser vendor's privacy policy (e.g. Google's or Apple's privacy policy). Vocoda only receives the resulting text transcription, not the original audio.

• User settings, text presets, and text input are stored locally in your browser's storage. This data remains on your device and under your control unless you choose to transmit it through the platform.

Data we collect automatically

We and our service providers may automatically collect personal data about you, your device and your interaction with us over time such as:

• Device data like your IP address, log data, error messages, device type, and unique device identifiers.

• Usage data on how you use our products and services, like your browser type and how you interact with the platform.

We use only essential cookies that are necessary for the functioning of our services. For more information, see our Cookie Policy.

Data from children

Our services are not designed for children under 18, so we do not intentionally collect their data. If a child has provided personal information to us, we'll act to remove it promptly. To report any instances of such cases, please reach out to us as specified in the "How can you contact us" section.

How we may use your data and the legal basis

We process your personal data on the following legal grounds under the EU General Data Protection Regulation (GDPR):

Contractual necessity (Art. 6(1)(b) GDPR)

We process data that is necessary to provide you with the services you have requested:

• Account data to create and maintain your account, authenticate your identity, and provide you with access to the platform.

• Text input to perform speech synthesis and deliver the audio output you have requested.

Legitimate interest (Art. 6(1)(f) GDPR)

We process data where we have a legitimate business interest that does not override your rights:

• Device and usage data to maintain platform security, diagnose technical issues, and improve our services.

Consent (Art. 6(1)(a) GDPR)

Where required by law, we ask for your explicit consent before processing your data. You may withdraw consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing performed before the withdrawal.

Legal obligation (Art. 6(1)(c) GDPR)

We may process your data to comply with applicable laws and regulations.

Where your data is stored and processed

Vocoda's infrastructure is hosted in the European Union. Specifically:

• Scaleway (Amsterdam) — hosting our application infrastructure, authentication systems, and temporary inference cache.

• Hetzner (Germany) — hosting supporting infrastructure.

If you are located outside the European Union (including Indonesia), your data is transferred to and processed in the EU. The EU provides a high level of data protection under the GDPR. By using our services, you acknowledge this transfer. We ensure that appropriate safeguards are in place for cross-border data transfers in accordance with applicable data protection laws.

How we may share your data

We may share your personal data with third parties in the following circumstances:

• With infrastructure providers. Your data is processed on infrastructure provided by Hetzner and Scaleway, as described in "Where your data is stored and processed." These providers act as sub-processors under data processing agreements with us.

• For legal reasons. We may share your data for legal reasons or to protect our rights, without needing your consent and as the law allows.

How long we keep your data

We retain your data only for as long as necessary for the purposes described in this Notice:

Data type // Retention period

Account data (profile, credentials): Until you delete your account.

Inference audio cache (synthesized speech output): 30 days, then automatically deleted.

Device and usage data (logs, IP addresses): As long as necessary for security and diagnostic purposes, then deleted or anonymized.

Local data (settings, presets, text input stored in your browser):

Controlled by you through your browser. Vocoda does not determine when this data is deleted.

You have the right to ask us to delete your data at any time (refer to the "What data privacy rights you have" section).

How we secure your data

We take the security of your data seriously. We have implemented technical and organizational measures to protect your data, including:

• Encryption of data in transit using TLS.

• Access controls and authentication for all infrastructure.

• Regular review of security practices and infrastructure.

If you have concerns about your data's security, please reach out to us as specified in the "How can you contact us" section.

Data breach notification

• In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR (Art. 33) and Indonesian data protection law (PDP Law).

• Notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

• Document the breach, its effects, and the remedial actions taken.

What data privacy rights you have

Under the European General Data Protection Regulation (GDPR), you have the following rights:

Right of access — request a copy of the personal data we hold about you.

Right to rectification — request correction of inaccurate or incomplete data.

Right to erasure — request deletion of your personal data.

Right to restrict processing — request that we limit how we use your data.

Right to data portability — request a copy of your data in a structured, machine-readable format.

Right to object — object to processing based on legitimate interest.

Rights related to automated decision-making — Vocoda uses automated processing to perform speech synthesis based on your text input. This processing is necessary to provide the service and does not produce legal or similarly significant effects.

To exercise these rights, contact us as specified in the "How can you contact us" section. We'll review your request and respond within one month. We may ask for proof of identity to process your request.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).

How can you contact us?

If you have any questions or concerns about this notice or your data, email us at info@vocoda.ai.

Ambassadors Lab B.V. is the data controller responsible for your personal data as described in this Notice.