Privacy Policy – Narrare (Your Audiobook)
Effective date: [EFFECTIVE DATE]
This policy explains how we handle your personal data when you use narrare.ai and the Narrare service, also called "Your Audiobook". We have tried to keep it short and in plain English.
1. Who we are
The controller responsible for your personal data is:
[COMPANY LEGAL NAME]
[ADDRESS]
Country of establishment: [COUNTRY]
Privacy contact: [PRIVACY CONTACT EMAIL]
Data Protection Officer: [DPO]
In this policy, "Narrare", "we" and "us" mean the controller above.
2. What Narrare does
Narrare turns ebooks and PDFs that you upload into audiobooks using text-to-speech. The speech generation (inference) runs on a private server that we control, which is not reachable from the public internet. Our public website, uploads, job queue and temporary storage run on Cloudflare.
3. Data we collect
- Waitlist data: your email address, and a record that you confirmed it.
- Account data (planned): your email address, name and login details.
- Uploaded files: the ebooks and PDFs you upload, and the audiobooks we create from them.
- Voice recordings ("Sample your voice"): a short recording (about 10 seconds) of you reading a consent phrase, and the voice samples we generate from it. Because these can identify you, we treat them as biometric data (see section 10).
- Consent records: when you use "Sample your voice", we store the time of your consent, the version of the consent text and your email address or user ID.
- Usage and security data: request logs from Cloudflare (such as IP address, browser type, pages requested and time of request), and security and bot-protection data from Cloudflare Turnstile.
We do not ask for any other personal data. Please do not upload files that contain sensitive personal data about other people.
4. Why we use your data
- To run the waitlist and send you a confirmation email.
- To create and manage your account (once accounts launch).
- To convert your uploaded files into audiobooks and deliver them to you.
- To create voice samples from your own recording, if you choose to use "Sample your voice".
- To keep a record of your consent, so we can show that we have it.
- To keep the service secure, prevent abuse and bots, and fix technical problems.
- To meet legal obligations, such as the EU AI Act transparency rules for AI-generated audio.
We do not use your uploaded files, voice recordings or generated audio to train AI models. [NO TRAINING CONFIRMATION]
5. Legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Waitlist sign-up and confirmation email | Consent – Art. 6(1)(a) |
| Creating and running your account | Contract – Art. 6(1)(b) |
| Converting your uploads into audiobooks | Contract – Art. 6(1)(b) |
| Voice recording and voice samples | Explicit consent – Art. 6(1)(a) and Art. 9(2)(a) |
| Keeping consent records | Legal obligation – Art. 6(1)(c) (to demonstrate consent, Art. 7(1)) |
| Security, bot protection and request logs | Legitimate interests – Art. 6(1)(f) (keeping the service safe and working) |
| AI-generated content labelling and watermarking | Legal obligation – Art. 6(1)(c) (EU AI Act Art. 50) |
6. How long we keep your data
| Data | How long we keep it |
|---|---|
| Waitlist email | Until you unsubscribe or we launch and close the waitlist [WAITLIST RETENTION PERIOD] |
| Account data | While your account is open, then deleted [ACCOUNT RETENTION PERIOD] |
| Uploaded ebooks and PDFs (source files) | Deleted after processing [SOURCE FILE RETENTION PERIOD] |
| Finished audiobooks | Until you delete them or close your account [AUDIOBOOK RETENTION PERIOD] |
| Raw voice recording | Deleted automatically from temporary storage within 1 hour, and in practice right after our server picks up the job |
| Generated voice sample bundle | 30 days, then deleted automatically |
| Consent records | [DATA RETENTION PERIOD] |
| Cloudflare request logs and security data | [LOG RETENTION PERIOD] |
Our private server keeps no copy of your voice recording or voice samples after the job is finished.
7. Who we share data with
We do not sell your personal data. We share it only with service providers (processors) who act on our instructions under a data processing agreement:
- Cloudflare, Inc. – website hosting (Cloudflare Pages), uploads (Workers), bot protection (Turnstile), job queue (Cloudflare Queues) and temporary storage (Workers KV).
- Email provider – sends waitlist confirmation emails. [EMAIL PROVIDER]
- Analytics provider – none at present. [ANALYTICS TOOL]
We may also disclose data where the law requires it, for example to a court or authority.
8. International transfers
Cloudflare is a US company, so some of your data may be processed outside the EU/EEA (and Switzerland). We rely on the EU-US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses (SCCs) as a safeguard. [TRANSFER SAFEGUARDS] You can ask us for a copy of the relevant safeguards.
9. Your uploaded files
We process your ebooks and PDFs only to create your audiobook. We do not read, publish or share them for any other purpose. You must have the right to upload and convert the files you use.
10. Voice and biometric data ("Sample your voice")
"Sample your voice" lets you create voice samples from your own voice. It is available in eight languages: Polish, English, Spanish, French, German, Italian, Chinese and Japanese.
Your own voice only. You may record only your own voice. You must never record or upload anyone else's voice.
Explicit consent. A recording of your voice used to create voice samples is biometric data, a special category of personal data under Art. 9 GDPR. We process it only with your explicit consent (Art. 9(2)(a)). You give this consent by ticking a clear consent box and reading a consent phrase aloud in your browser. Using this feature is optional.
How it is intended to work:
- You record about 10 seconds of audio in your browser.
- The raw recording is stored in Cloudflare temporary storage (Workers KV) with an automatic 1-hour expiry.
- Our private server picks up the job, deletes the recording from Cloudflare straight away, and generates your voice samples.
- The generated sample bundle is stored in Cloudflare temporary storage for 30 days, then deleted automatically.
- Our private server keeps nothing after the job is done.
- You see your results through an on-screen link that you can bookmark. We do not email your results.
Consent record. We keep a record of your consent: the time, the version of the consent text and your email address or user ID. This lets us show that you agreed.
Withdrawing consent. You can withdraw your consent at any time, as easily as you gave it, by [VOICE CONSENT WITHDRAWAL METHOD]. When you withdraw, we delete any of your voice recordings and samples we still hold. Withdrawal does not affect processing that already took place.
No training. We do not use your voice to train AI models. [NO TRAINING CONFIRMATION]
11. AI-generated content: labelling and watermarking
Under the EU AI Act (Art. 50), AI-generated audio must be identifiable as such. All audio Narrare creates is labelled as AI-generated, and it carries an imperceptible watermark embedded by the speech engine we use (Chatterbox).
You must not remove or alter these labels or watermarks, and you must not use Narrare's output to deceive people or to impersonate anyone.
12. Your rights
Under data protection law you have the right to:
- Access – get a copy of your personal data.
- Rectification – have inaccurate data corrected.
- Erasure – have your data deleted.
- Restriction – ask us to limit how we use your data.
- Portability – receive data you gave us in a common, machine-readable format.
- Objection – object to processing based on our legitimate interests.
- Withdraw consent – at any time, without affecting earlier processing.
- Complain – lodge a complaint with a data protection supervisory authority, in particular where you live or work, or where you think the law was broken. Our lead authority is [SUPERVISORY AUTHORITY].
To use your rights, contact us at [PRIVACY CONTACT EMAIL]. We will reply within one month. We may need to confirm your identity first.
13. Children
Narrare is not intended for anyone under [MINIMUM AGE]. We do not knowingly collect data from children. If you think a child has given us personal data, contact us and we will delete it.
14. Security
We protect your data with technical and organisational measures, including:
- running speech generation on a private server that is not reachable from the public internet;
- encrypted connections (HTTPS) to our website;
- bot protection on uploads;
- short, automatic expiry for temporary data, especially voice recordings;
- access to systems limited to people who need it.
No system is perfectly secure, but we work to keep risks low and will notify you and the authorities of a data breach where the law requires it.
15. Cookies
We use only strictly necessary cookies and similar technologies, such as those needed for security and bot protection (Cloudflare Turnstile) and, once accounts launch, to keep you logged in. These do not need your consent. We do not use advertising or tracking cookies. If we add analytics, we will update this section and ask for your consent where required. [ANALYTICS TOOL]
16. Changes to this policy
We may update this policy as Narrare develops. We will post the new version here with a new effective date and, for significant changes, let you know by email or on the website.
17. Contact
Questions about this policy or your data:
[COMPANY LEGAL NAME]
[ADDRESS]
Email: [PRIVACY CONTACT EMAIL]