Privacy Policy

1. Introduction

This Privacy Policy describes how Brilliant5 Inc., a corporation organized under the laws of Ontario, Canada ("Brilliant5," "we," "our," or "us"), the operator of the VocalMax service ("VocalMax" or "Service"), collects, uses, and safeguards your information when you use our text-to-speech Service. We respect your privacy and are committed to protecting your personal data.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, and password when you create an account
• Payment Information: Credit card details and billing address (processed securely by Stripe)
• Content: Text, documents, and other content you upload for audio conversion
• Communications: Messages you send to our support team

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on the Service
• Device Information: Browser type, operating system, device identifiers
• Log Data: IP address, access times, referring URLs
• Cookies: Small data files stored on your device (see Section 6)

2.3 Biometric and Voice Data

If you use the voice cloning feature, we collect biometric voice data, which includes:

• Audio recordings you upload (MP3, WAV, M4A, up to 10MB per file)
• Voiceprints (mathematical representations of vocal characteristics) generated by ElevenLabs
• Metadata about your voice clones (names, creation timestamps)

This biometric data is special category personal information under GDPR Article 9, sensitive personal information under Quebec Law 25, and biometric identifiers under Illinois BIPA and Texas CUBI Act. We process this data only with your express consent, which we obtain before voice cloning is initiated.

Voice data is processed by ElevenLabs Inc. for the purpose of generating voice clones and audio outputs. Voice data is encrypted in transit and at rest, retained only for the duration of your subscription, and deleted within 30 days of subscription cancellation (90 days for backup purging).

For full details, see our Voice Cloning Consent and Biometric Data Disclosure.

3. How We Use Your Information

We use your information to:

• Provide and maintain our Service
• Process your text-to-speech conversions
• Process payments and manage subscriptions
• Send important updates about your account or the Service
• Respond to your support requests
• Improve and optimize our Service
• Detect and prevent fraud or abuse
• Comply with legal obligations

4. How We Share Your Information

We do NOT sell your personal information. We may share your data with:

• Service Providers: Third parties that help us operate our Service:

  Direct Subprocessors

  These are vendors we contract with directly:

  • Stripe, Inc. (stripe.com) — payment processing and subscription billing. Stripe processes payment information you provide when subscribing to the Service. Reference: stripe.com/privacy
  • ElevenLabs, Inc. (elevenlabs.io) — voice synthesis and voice cloning. ElevenLabs processes text inputs and voice training samples to generate audio output. Reference: elevenlabs.io/privacy
  • Anthropic, PBC (anthropic.com) — large language model AI for content generation features (such as AI Create). Anthropic processes text inputs to generate AI-assisted content. Reference: anthropic.com/legal/privacy

  Platform Subprocessor

  The Service is hosted on the Base44 application platform, which provides the underlying infrastructure including hosting, databases, authentication, file storage, and AI request orchestration:

  • Base44 Ltd. (base44.com) — application platform provider. Base44 processes all data stored in the Service, including user accounts, content, voice clones, and metadata. Base44 maintains SOC 2 Type II and ISO 27001 certifications. Base44 engages its own subprocessors for hosting infrastructure and platform services. The current list of Base44 subprocessors is published in their Data Processing Agreement. Reference: base44.com/privacy-policy

  Browser-Based Services

  Certain features of the Service may invoke speech recognition functionality built into your web browser to provide a live preview while you dictate content. When you use the Dictate Content feature with live preview enabled:

  • Chrome and Microsoft Edge browsers use Google Speech-to-Text, processed by Google LLC. Reference: policies.google.com/privacy
  • Safari browsers use Apple Voice Services, processed by Apple Inc. Reference: apple.com/legal/privacy
  • Firefox browsers do not support browser-based speech recognition; this feature is not available in Firefox and no third-party processing occurs.

  This browser-based speech recognition is invoked by your browser, not by VocalMax directly. The live preview text is used for display purposes only. The final transcription used for your audiobook is always processed by ElevenLabs, our approved subprocessor disclosed above. You can disable the live preview by using a browser that does not support speech recognition or by declining microphone permissions.

  Data Residency

  Service data is currently stored on servers located in the United States, provided by our platform subprocessor Base44. Cross-border data transfers from the EU/EEA, United Kingdom, and Canada are governed by Standard Contractual Clauses (SCCs) and, where applicable, the EU-US Data Privacy Framework. If you have legal or regulatory requirements to store data in a specific region, please contact us before subscribing.

  Subprocessor Changes

  We will provide at least thirty (30) days' advance notice before adding or replacing a subprocessor by updating this Privacy Policy and (for active subscribers) by email. If you object to a new subprocessor for legitimate data protection reasons, you may terminate your subscription before the change takes effect.

• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

5. Data Retention

• Account Data: Retained while your account is active and for a reasonable period after deletion
• Uploaded Content: Retained while your account is active; deleted projects are permanently removed after 30 days
• Generated Audio: Stored for your access; you may delete at any time
• Payment Records: Retained as required for tax and legal compliance

How to Delete Your Account

You can request deletion of your account and associated personal data at any time using one of the following methods:

• Self-Service: Contact us through the Support page in your account dashboard with the subject "Delete My Account."
• Email Request: Send a deletion request to privacy@vocalmax.ai from the email address associated with your account.

Upon receiving a verified deletion request, we will:

• Permanently delete your account and uploaded content within 30 days
• Cancel any active subscriptions (you remain responsible for charges incurred before deletion)
• Retain only data we are legally required to keep (e.g., payment records for tax compliance, fraud prevention records)
• Confirm completion of the deletion in writing

Note: Some content may persist in backup systems for a short period after deletion (typically up to 90 days) before being purged. These backups are not actively used but may be retained for disaster recovery purposes.

6. Cookies and Tracking

We use cookies and similar tracking technologies on the Service. We classify cookies into the following categories:

• Strictly Necessary Cookies — always active, no consent required
• Functional Cookies — consent required
• Analytics Cookies — consent required
• Marketing Cookies — consent required, when deployed

When you first visit the Service, we present a Cookie Consent Banner that allows you to accept all cookies, reject all non-essential cookies, or customize consent by category. You may update your cookie preferences at any time by clicking 'Cookie Preferences' in the website footer.

For complete details, see our Cookie Policy.

6A. AI Processing of Your Information

VocalMax is an artificial intelligence service. The Service uses AI to:

• Convert your text into spoken audio (via ElevenLabs neural text-to-speech models)
• Generate voice clones from audio samples you upload (via ElevenLabs voice cloning)
• Analyze documents to detect chapters and structure (via our AI provider Anthropic Claude)

We do NOT use your content to train general-purpose AI models. Our AI providers are contractually prohibited from using your content to train their general models for use by other customers. Voice clones generated for your account are used only by you.

For complete details on AI processing, see our AI Content Disclosure Policy.

7. Data Security

We implement appropriate security measures to protect your data, including:

• Encryption of data in transit (HTTPS/TLS)
• Secure password hashing
• Regular security assessments
• Limited employee access to personal data

However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

8. Your Rights

Depending on your location, you may have the right to:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data
• Portability: Request your data in a portable format
• Opt-out: Unsubscribe from marketing communications

To exercise these rights, contact us at privacy@vocalmax.ai

Additional Rights for California Residents (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information:

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you, the sources of that information, the business purposes for collecting it, and the third parties with whom we share it.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to certain legal exceptions.
• Right to Opt-Out of Sale: We do NOT sell your personal information. You have the right to opt out of any future sale, should our practices change.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights, including by denying service, charging different prices, or providing different quality of service.

To exercise your California privacy rights, contact us at privacy@vocalmax.ai with the subject line "California Privacy Request." We will verify your identity before fulfilling your request and respond within 45 days as required by law.

Your Rights Under Canadian Federal Privacy Law (PIPEDA)

If you are located in Canada (outside of Quebec), your privacy is protected by the Personal Information Protection and Electronic Documents Act (PIPEDA). Under PIPEDA, you have the right to:

• Be informed of the existence, use, and disclosure of your personal information
• Access your personal information
• Challenge the accuracy and completeness of your personal information and have it amended as appropriate
• Withdraw consent at any time, subject to legal or contractual restrictions
• Submit a complaint to the Office of the Privacy Commissioner of Canada regarding our information handling practices

Quebec Residents — Law 25

If you are a resident of Quebec, your privacy is protected by Law 25 (Act respecting the protection of personal information in the private sector). Under Law 25, you have additional rights including:

• The right to express, withdraw, or modify consent at any time
• The right to data portability
• The right to object to automated decision-making based solely on automated processing
• The right to be informed when sensitive personal information (including biometric data) is collected
• The right to lodge a complaint with the Commission d'accès à l'information du Québec (CAI)

Our designated Privacy Officer for Quebec residents is Mimmo Gallo, CEO, Brilliant5 Inc., 429-420 Main Street East, Milton, Ontario, L9T 5G3, Canada. Email: privacy@vocalmax.ai

9. Children's Privacy

VocalMax is not intended for children under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us immediately.

10. International Data Transfers

Your data may be processed in countries outside your own, including Canada and the United States, where our servers and service providers are located. We rely on the following safeguards for international transfers:

• Standard Contractual Clauses (SCCs): Where data is transferred from the European Economic Area (EEA), United Kingdom, or Switzerland, we use European Commission-approved Standard Contractual Clauses with our service providers.
• Adequacy Decisions: Canada has been recognized by the European Commission as providing adequate data protection, supporting lawful transfers to our Canadian operations.
• Service Provider Compliance: Our key processors (Stripe, ElevenLabs, and our cloud hosting providers) maintain GDPR compliance and implement appropriate technical and organizational measures.

Data Processing Agreement (DPA): If you are an EEA, UK, or Swiss customer and require a Data Processing Agreement to comply with GDPR Article 28 obligations, please contact us at privacy@vocalmax.ai. We will provide a DPA on request.

Where we transfer your personal information to countries outside of Canada, we implement appropriate safeguards to protect your data, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission for transfers from the EEA, post-Schrems II compliant versions
• UK International Data Transfer Agreement (IDTA) for transfers from the United Kingdom
• Data Processing Addenda with all third-party service providers
• Verification that recipient countries provide adequate safeguards under applicable law

You may request a copy of the Standard Contractual Clauses by contacting privacy@vocalmax.ai.

By using our Service, you acknowledge that your data may be transferred to and processed in jurisdictions with different data protection laws than your home country, subject to the safeguards described above.

10A. Automated Decision-Making

VocalMax does NOT make decisions that produce legal or similarly significant effects on you based solely on automated processing. AI is used to generate audio content from your input, but no AI makes account suspension, termination, eligibility, or pricing decisions about you without human review.

If automated decisions are introduced in the future (such as automated content moderation that may suspend accounts), we will update this Privacy Policy and provide affected users with the right to be informed of the logic involved, request human review, and contest the decision.

11. Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the Service. The "Last updated" date at the top indicates when this Policy was last revised.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

Email: privacy@vocalmax.ai

Mailing Address:

Brilliant5 Inc.

#429-420 Main Street

Milton, Ontario, Canada

L9T 5G3