Voice and Biometric Data Policy

Effective date: the day voice cloning opens to customers · Contact: privacy@aikit.ai · aiKit.

In plain words: We only make an AI copy of a voice when the person it belongs to is an adult, agrees in writing, and reads a consent sentence out loud in their own voice. We use the voice for one thing: so that person can make audio in their own voice. We never sell it, rent it, share it for ads, or use it to train AI. It is stored encrypted and private to your account. You can delete it any time. Your raw recordings are deleted 30 days after your voice is made. Your voice stays while you use it and is deleted automatically after 6 months without use (we email you 30 days and 7 days before), or within 30 days of a delete request or of closing your account.

1. What this policy covers

"Voice data" in this policy means all of the following. We treat all of it as biometric data, whether or not a particular law would call it that.

Audio you make with your AI voice (your scripts read aloud) is your content. It is covered by the Privacy Policy, not this one, but it is deleted with your account like all your content.

Faces. aiKit does not identify people by their face, does not run face recognition, and does not create or store face templates or "faceprints." Video Kit's "Follow the face" feature finds a face in your video only to keep it in frame; it runs entirely on your own device, and no face data is sent to us or stored. Photos of people that you upload to image or video tools are handled as ordinary personal data under the Privacy Policy. If we ever add a feature that measures face geometry on our servers, we will update this policy and ask for consent first.

2. Whose voice may be cloned

• Only your own voice, and only if you are 18 or older.
• You must record the consent sentence yourself, live, in the Voice Kit flow. It cannot be uploaded.
• Samples may be recorded or uploaded, but only recordings of your own voice with no one else speaking.
• Never anyone else's voice: not a celebrity, a public figure, a customer, an employee, a family member, a child, or a person who has died. Making a voice for another person (for example a teammate) is not available. If we add it, that person will go through this same flow on their own device, and this policy will be updated first.
• We may refuse, pause, or delete any voice we believe was made without valid consent, and we may report illegal use to the authorities.

3. Your written consent (release) comes first

Before we collect any voice data, you are shown a plain summary of this policy and must, on your own, tick separate unticked boxes, type your name, and press "I agree" (the exact wording is in the Voice Consent Flow). Your agreement is your written release. It covers: what we collect; the one purpose we use it for; who receives it; how long we keep it and when we destroy it; that we never sell it; and that saying no does not affect any other part of aiKit. We save the release record described in section 1. You then read the consent sentence aloud, and we check that the words match and that it is the same voice as your samples. If either check fails, no voice is made.

Consent is voluntary. You can use every other aiKit tool, including our stock AI voices, without giving it, and we will never charge you more or give you worse service for saying no.

4. The one purpose we use it for

We use voice data only to:

1. make your AI voice and read your scripts in it, for you and your account;
2. check that the consent and the samples are the same person;
3. keep the service secure and stop impersonation and fraud; and
4. follow the law.

We do not use voice data to identify you, to profile you, for advertising, or to train or improve any AI model (ours or anyone else's).

5. What we never do

• We never sell, lease, trade, or otherwise profit from your voice data, and we never give it to anyone in exchange for money or anything of value.
• We never use it for advertising or marketing.
• We never let another aiKit account use your voice. A voice profile works only inside the account that made it.
• We never make a voice from a link, a video, a phone call, or someone else's recording.
• We never keep it longer than the schedule in section 7.

House voice: aiKit staff may offer their own voice, made through this same consent flow, as a labeled stock voice that other accounts can use. No customer's voice is ever used this way.

6. Who receives it

We disclose voice data only to the following, and only for the purpose in section 4:

Each of them may use the data only to provide their service to us. We also disclose it: to you; to people you ask us in writing to send it to; and when required by law (for example a valid subpoena or court order), after we review the request and tell you where we are allowed to. If aiKit is sold or merged, voice data stays under this policy, and the buyer must honor it or delete the data. We will update this list before adding any new recipient.

Your scripts (text) are also checked by an AI text provider for impersonation (section 9); that check sees the words only, never your voice.

7. Retention and destruction schedule

This schedule is published so anyone can read it. We permanently destroy voice data at the earliest of these times:

"Use" means making or previewing audio in that voice. "Destroy" means permanent deletion so it cannot be recovered or used. If a voice provider cannot be reached when we delete, we keep retrying every day until the provider confirms, and we hold only the provider's reference number (no audio, no personal data) while we retry. If a court or law requires us to keep specific data, we keep only that data, only as long as required, and destroy it afterward.

Our voice providers' own copies: we instruct ElevenLabs and Cartesia to delete the voice through their systems at the same time. Their deletion of any short-term logs or backups on their side follows their own terms.

8. How we protect it

We protect voice data with at least the same care we use for our most sensitive information (passwords and payment-related data), including:

• Encrypted in transit (HTTPS/TLS) everywhere, and encrypted at rest by our database host.
• Private to your account: every request is checked against the signed-in account, and the provider's reference number for your voice is never sent to your browser.
• Limited staff access: only the people who run aiKit's systems can reach the database, and only to operate, secure, or support the service, to respond to your request, or to follow the law.
• Contracts with each provider in section 6 limiting their use of the data.
• If voice data is ever accessed without permission, we will tell affected people and authorities as the law requires.

No system is perfectly secure, but we will never knowingly keep voice data in a less-protected way than described here.

9. Labeling and impersonation safeguards

• AI voices are labeled as AI voices inside aiKit.
• Before any script is read in an AI voice, it is checked for impersonation. We refuse scripts that pretend to be a famous person, a well-known company, a bank or government body, or that try to trick someone into paying or giving personal details.
• Where the law requires it (for example political ads, robocalls, or rules in the EU), you must tell listeners that audio is AI-generated.

10. Your rights and how to use them

• Delete your voice any time in Voice Kit (Your voices → Delete). We remove it at every voice provider and then delete your recordings, preview, and profile here.
• Withdraw consent by deleting the voice or emailing privacy@aikit.ai. We stop using it right away and destroy it within 30 days.
• Close your account by emailing privacy@aikit.ai from your account email. All voice data is destroyed within 30 days, starting at the providers.
• Get a copy of your voice data (your recordings and release record), or ask what we hold: email privacy@aikit.ai. We verify it is you and reply within 30 days.
• Ask questions or complain to us at privacy@aikit.ai, or to your state attorney general or data-protection authority. Residents of Illinois, Texas, Washington, California, the EU/UK, and other places have the rights their laws give, and nothing in this policy takes them away.

11. Your responsibilities

When you make an AI voice you promise that: it is your own voice; you are 18 or older; you will use it only lawfully and for your own work; you will not use it to deceive anyone, pretend to be someone else, make someone think you are speaking live when you are not in a way that harms them, defame, harass, or commit fraud; and you will disclose AI-generated audio where the law requires. You are responsible for how you use audio you make (see the Terms of Service, including the indemnity). Tell us at once at privacy@aikit.ai if you believe a voice was made in your account, or of you, without valid consent.

12. Laws this policy is designed to meet

This policy applies the strictest rules to everyone. It is written to satisfy, among others:

• Illinois Biometric Information Privacy Act (740 ILCS 14): a public written retention and destruction schedule (section 7: destroyed when the purpose is met, and never later than 6 months after you last use your voice, which is well inside the 3-year limit); informed written release before collection (section 3); no sale, lease, trade, or profit (section 5); disclosure only with consent or as required by law (section 6); and protection at least as strong as for other confidential data (section 8).
• Texas Capture or Use of Biometric Identifier Act (Bus. & Com. Code § 503.001): notice and consent before capture, no sale, reasonable care, and destruction within a reasonable time and no later than one year after the purpose ends.
• Washington biometric law (RCW 19.375) and My Health My Data Act: notice and consent before enrollment, limited disclosure, and no use for other purposes.
• Tennessee ELVIS Act (2024) and other right-of-publicity and digital-replica laws (including California and New York): a person's voice is theirs; we only clone the voice of the person who consents, and forbid cloning anyone else.
• FTC Impersonation Rule (16 CFR Part 461) and Section 5 of the FTC Act: we forbid and screen for impersonation of businesses and government, and we do not provide tools for fraud.
• FCC and TCPA rules on AI voices in calls, state anti-fraud and deepfake laws.
• California CCPA/CPRA (sensitive personal information used only to provide the service), EU/UK GDPR (explicit consent for special-category data, withdrawable as easily as given), Brazil LGPD, and EU AI Act transparency rules.

13. Changes

If we change this policy in a way that lets us do more with your voice data, we will ask for your consent again before doing it. Other changes will be posted here with a new date and version.

14. Contact

privacy@aikit.ai · aiKit.