Privacy Policy

Who we are

Intispeak[TODO: legal entity name and address] (“we”, “us”) operates this platform. For people in the EEA/UK and South Korea we are the data controller of your personal information. Our privacy contact is listed here.

Information we collect

• Your voice recordings. The audio you record is biometric data. We store the original recordings and may derive features from them.
• Account & profile. Email, password (hashed), phone, country, languages, accent, and equipment.
• Age. Date of birth, to confirm you are at least 18.
• Identity / KYC. Withdrawals are paid via PayPal, which verifies your identity when you claim your payout; we do not collect or store identity documents ourselves.
• Device & technical data. Device identifiers and labels, browser/user-agent, IP address, and capture details recorded with each submission.
• Site traffic and visit data.First-party, self-hosted traffic measurement (no third-party analytics service is involved): the page path, the referring page’s address and any campaign tags (utm parameters, ad click identifiers) on the link you followed, a coarse device type, browser family and operating-system family, a coarse country (derived from your IP address at collection using an offline database; the IP itself is discarded and never stored), your interface language, and interaction counters (e.g. clicks on “sign up” or “start recording”). A first-party analytics cookie (ispk_vid, a random identifier lasting up to 400 days — see the Cookie Notice) lets us count returning visitors and group page views into visits; if you sign in, we associate that identifier with your account so we can understand which channels and pages bring people who become contributors — including, when you create an account, a one-time snapshot of which of our own articles and guides you read in the 30 days beforehand. When you follow one of our own short links (e.g. /l/…), we count the click on our server before redirecting you. A short-lived per-tab flag in sessionStorage (cleared when the tab closes) helps classify where a visit began. If a page malfunctions in your browser, we record a technical error report — the error message and code location, the page it happened on, and the version of our software running — so we can find and fix the fault; individual reports are deleted after 14 days, and de-identified per-fault summaries are retained. No raw IP address or user-agent string is stored. Raw page-view events are deleted after 12 months; aggregate daily totals and per-visit summaries are retained. We never sell or share this data. The country lookup includes GeoLite2 data created by MaxMind, available from maxmind.com, queried locally on our servers — your IP is never sent to MaxMind.
• Product usage tied to your account. When you are signed in we keep a small first-party record of key actions — opening the app, joining and matching in the recording queue, finishing onboarding, and the outcome of the microphone/headphone check — each stamped with the date and time and your account. We use it only to understand how contributors move through the product (activation, retention, where people drop off) and improve it. These records carry no device identifiers or diagnostic text, are never sold or shared, are deleted when your account is deleted, and are automatically removed after about 13 months.
• Free-text you provide. Labels, notes, and tags on recordings, and messages you send us.

How we use your information

To operate the platform; to build, quality-check, and license voice datasets; to pay you and meet tax/anti-fraud obligations; to prevent abuse; to understand aggregate site traffic and how contributors use the product, and improve the service; and to comply with law.

We license (sell) your voice data

We aggregate recordings into datasets that we license to third-party AI companies for monetary consideration. Under some laws (including the CCPA/CPRA) this is a “sale” and a “share” of personal information. You can exercise your choices on the Your Privacy Choices page. [TODO: confirm final licensing structure with counsel — see BIPA §15(c).]

Legal bases (EEA / UK)

We rely on your explicit consent for biometric (special-category) data; on contract to operate your account and pay you; on legitimate interests and legal obligation for fraud prevention, tax, and security; and on legitimate interests for the first-party traffic measurement and the account-linked product-usage analytics described above. [TODO: finalize basis table.]

How we share information

• AI-company buyers who license datasets, under written terms.
• Service providers (sub-processors) for storage, identity verification, payouts, email, and communications [TODO: publish sub-processor list].
• Authorities where required by law.

International transfers

We are US-based and may transfer data internationally. For EEA/UK/Korea data we rely on appropriate safeguards (Standard Contractual Clauses, the UK Addendum, and the EU-US Data Privacy Framework where the recipient is certified). [TODO: confirm transfer mechanism per route.]

How long we keep it

Account data is kept while your account is active. Voice biometric data follows a defined schedule — see the Biometric Retention & Destruction Policy. If you withdraw a recording we delete it; note that data already delivered in a completed dataset may persist with the buyer under their license. Raw traffic analytics events are deleted after 12 months; after that we keep aggregate daily totals and per-visit summaries. Account-linked product-usage events are deleted after about 13 months, and when your account is deleted.

Account deletion is handled as a request, not a self-service button: ask for it on the Data & privacy requests page and we complete verified requests within 30 days.

Your privacy rights

Depending on where you live, you can request access, correction, deletion, portability, and opt-out, and you can withdraw biometric consent at any time. Submit a request on the Data & privacy requests page — we verify who you are and complete verified requests within 30 days.

Notice of Financial Incentive

Because we pay you for recordings, our program is a “financial incentive” under the CCPA. You opt in by accepting the license and may withdraw at any time. The payments reasonably relate to the value of the data to our business, estimated from the per-minute rate we pay. [TODO: complete the good-faith value estimate and calculation method per Cal. Code Regs. §7016/§7081.]

Cookies

We use a small number of first-party cookies (login session, linked accounts, support chat, language preference, and the ispk_vid analytics visitor identifier) — see the Cookie Notice. None are advertising or cross-site tracking cookies.

Region-specific disclosures

California

We disclose the categories of personal information and sensitive personal information we collect, the purposes, and that we sell/share data. You have the rights to know, delete, correct, opt out of sale/share, and limit the use of sensitive personal information, and we honor Global Privacy Control signals. [TODO: categories table.]

EEA & UK

You may lodge a complaint with your supervisory authority. [TODO: name an EU representative / DPO if required.]

South Korea (PIPA)

We obtain separate consent to collect sensitive (biometric) data, to provide data to third parties, and to transfer it abroad. [TODO: provide a Korean-language version and designate a privacy officer / domestic representative if thresholds are met.]

Children

The platform is for adults (18+) and is not directed to minors.

Changes

We will post updates here and, where required, ask you to re-consent.