Privacy Policy

This Privacy Policy explains how Cloudax LTD ("Cloudax", "we", "us", or "our"), a company registered at Nicosia, Cyprus, collects, uses, discloses and protects information when you use our text-to-speech, transcription, translation and AI summary platform, Cloudax AI, available at ai.cloudax.io (the "Service"). Cloudax LTD (cloudax.io) owns and operates the Service.

By using the Service you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

1. Information we collect

1.1 Account information

• Name, email address, and password (stored as a salted hash).
• Billing and subscription details, including plan tier and payment status (payment card data itself is handled by our payment processor and is not stored on our servers).
• Support correspondence you send us.

1.2 Content you upload or submit

• Text you submit for speech synthesis, translation, or summarisation.
• Audio files you upload for transcription, translation, or voice conversion, including any generated audio output.

1.3 Usage and technical data

• Log data such as IP address, browser type, device information, and pages visited.
• Product usage data, such as jobs created, voices used, and feature interactions, used to operate and improve the Service.
• Cookies and similar technologies — see our Cookie Policy.

2. Why we process your data

• To provide, operate, and maintain the Service you request.
• To process your uploaded audio and text through the third-party subprocessors listed in Section 4 in order to generate speech, transcripts, translations, or summaries.
• To manage your account, subscription, and billing.
• To send transactional emails (for example verification codes, password resets, and billing receipts).
• To monitor, secure, and improve the Service, including diagnosing technical issues.
• To comply with legal obligations.

3. Data retention

We retain account information for as long as your account is active. For audio you upload, we distinguish between the original audio file and the text we derive from it (transcripts, translations and summaries). Original audio is far larger and is deleted on the schedule below; the derived text is what the Service exists to give you, and is kept until you delete it.

• Uploads that are never completed — if an upload is started but never confirmed for processing, the file is deleted within 24 hours.
• Recordings that fail to process — the original audio is deleted after 7 days. A record of the attempt (its title, timestamps and the error) is kept so you can see what happened.
• Recordings that process successfully — the original audio is retained for 30 days after upload and then deleted automatically. The transcript, translations, summary and any scripture references derived from it are retained until you delete the recording or your account.

Deletion runs on an hourly schedule, so the periods above should be read as “up to” that duration. Text you submit for speech synthesis and the audio generated from it are retained until you delete the conversion or your account. We may retain data longer only where required to comply with a legal obligation or to resolve a dispute. You can delete individual recordings or your entire account at any time from your dashboard, or by contacting us.

4. Subprocessors

We share the minimum data necessary with the following third-party subprocessors so that they can perform specific parts of the Service on our behalf. We do not sell your data.

Each subprocessor is contractually restricted to using your data only to provide the relevant service to us. A current list of subprocessors is available on request at privacy@cloudax.io.

5. Data controller and legal basis for processing (GDPR)

Cloudax LTD is registered in Cyprus, an EU member state, and the General Data Protection Regulation (GDPR) therefore applies directly to our processing of your personal data. Cloudax LTD is the data controller for the personal data described in this policy. We process your data on the following legal bases:

• Performance of a contract — to provide the Service you signed up for (for example, generating speech, transcripts, translations, or summaries, and operating your account and subscription).
• Legitimate interests — to secure, monitor, and improve the Service, prevent fraud and abuse, and diagnose technical issues.
• Consent — where required, for example for non-essential cookies, and for accepting these policies at sign-up. You may withdraw consent at any time; this does not affect the lawfulness of processing carried out before withdrawal.
• Legal obligation — to keep records required by law (for example, billing and tax records).

6. Your rights

If the GDPR (or UK GDPR) applies to you, you have the right to: access the personal data we hold about you; rectify inaccurate or incomplete data; request erasure of your data; restrict certain processing; receive your data in a portable, machine-readable format; object to processing based on legitimate interests; and withdraw consent at any time where processing is based on consent. To exercise any of these rights, contact us at privacy@cloudax.io.

You also have the right to lodge a complaint with a supervisory authority. As Cloudax LTD is established in Cyprus, our lead supervisory authority is the Cyprus Office of the Commissioner for Personal Data Protection ("Επίτροπος Προστασίας Δεδομένων Προσωπικού Χαρακτήρα"). If you are located elsewhere in the EU/EEA, you may also lodge a complaint with your local data protection authority.

7. Cookies

We use cookies to keep you signed in (authentication and session cookies) and, where enabled, to understand how the Service is used. See our Cookie Policy for details and how to control them.

8. International data transfers

Cloudax LTD is based in the EU (Cyprus). Some of our subprocessors — including OpenAI, Deepgram, ElevenLabs, and SendGrid — are based in the United States and process data outside the European Economic Area (EEA). Where we transfer personal data outside the EEA, we rely on appropriate safeguards recognised under the GDPR, such as the European Commission's Standard Contractual Clauses (SCCs) or an equivalent adequacy or transfer mechanism offered by the subprocessor. We have not independently verified every subprocessor's current certification status and recommend contacting us at privacy@cloudax.io if you require further detail on a specific transfer.

9. Security

We use industry-standard technical and organisational measures — including encryption in transit, access controls, and hashed passwords — to protect your data. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Children's privacy

The Service is not directed to individuals under 16, and we do not knowingly collect personal data from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a revised "Last updated" date, and, for material changes, provide additional notice (for example by email).

12. Contact us

Questions about this policy or your data can be sent to privacy@cloudax.io, or by post to Cloudax LTD, Nicosia, Cyprus. This policy is governed by the laws of Cyprus.