Voxmind Customer Privacy Notice

This privacy notice explains how Voxmind collects, uses, shares and protects personal data, including voice biometric data, when you use our voice authentication and deepfake detection services, create an account with us, visit voxmind.ai or contact or do business with us. It also explains your rights and how to exercise them.

Voxmind is the trading name of Voxmind Ltd, a company registered in England and Wales under company number 15450268 with its registered office at WeWork, 5 Merchant Square, London W2 1AY, United Kingdom. Where this notice says "we", "us" or "our", it means Voxmind Ltd.

We have appointed a Data Protection Officer. You can contact them at privacy@voxmind.ai or by post at the address above.

1.1 Three ways you may interact with us

This notice applies to three groups of people, and some sections apply differently to each:

• Account holders. If you or your organisation register for a Voxmind account, use our API, customer portal or developer tools, or contact us directly, we decide how and why your personal data is used. We are the controller of that data and this notice applies in full.

• End users of our customers. If your voice is verified or checked for synthetic speech through a service run by one of our customers (for example your bank, employer or a call centre you contact), that organisation decides why your voice is being processed and is the controller of your personal data. We process your voice data only on that organisation's documented instructions, as its processor, under a written data processing agreement. That organisation's own privacy notice governs, it is responsible for telling you about the processing and for obtaining any consent that is needed, and you should direct requests about your data to it in the first instance. Sections 3, 7.2, 9, 10, 13 and 14 of this notice describe how we handle your data on our customers' behalf, and we will help our customer respond to any request you make.

• Website visitors and business contacts. If you visit voxmind.ai, complete a form on it, request a demo, or are a business contact at a customer, partner or prospective customer, we are the controller of the personal data we hold about you and this notice applies to it.

• Voice biometric data is used only to verify identity and to detect synthetic, cloned or manipulated voices. When we provide our services to an organisation, that organisation is responsible for obtaining your explicit consent (or establishing another lawful basis) before your voice is enrolled or checked, and we act only on its instructions.

• We do not sell personal data, we do not use voice data for advertising, and we do not use voice data to train or improve our models.

• Voiceprints are kept for the period our customer sets (or, for account holders, while your account is active) and are then permanently deleted; account data is deleted 90 days after an account is closed, or sooner if you ask us to.

• Your data is processed in the UK, the European Economic Area or the United States depending on the hosting region chosen by you or the organisation you deal with, and we put safeguards in place for any transfer outside the UK or EEA (see Section 8).

• You can access, correct, delete or export your data, or withdraw consent, at any time through your account settings or by emailing privacy@voxmind.ai. If you are an end user of one of our customers, please contact that organisation first.

We collect only the personal data we need to provide and secure our services. The categories are set out below. Where our services are deployed on a customer's own infrastructure or devices rather than hosted by us, we may not receive the voice data at all.

Table 1: Categories of personal data

We collect personal data in four ways:

• Directly from you when you register for an account, enrol or test your voice, complete a form or request a demo on voxmind.ai, or contact us by email, telephone or through the customer portal.

• Automatically when you use our services, through server logs and API request records that capture technical and usage data.

• From our customers when an organisation that uses Voxmind sends us your voice sample and a reference identifier through our API or SDK so that we can verify you, or check for a synthetic voice, on its behalf. In this situation we receive your data indirectly, as that organisation's processor, and it is responsible for informing you and, where required, obtaining your consent.

• From third parties in limited cases, for example when a business contact's details are provided to us by a colleague or a partner, from publicly available sources such as LinkedIn or company websites for business development, or where we receive information from a payment processor about the status of a payment.

4.1 Personal data collected from sources other than you

Where we receive personal data about you from someone other than you and we are the controller of that data, we will only use it for the purposes described in this notice and we will make this notice available to you at the latest when we first communicate with you, or within one month of receiving the data, unless you already have the information or providing it would be impossible or involve disproportionate effort. Where we act as a processor for one of our customers, the customer is responsible for informing you and its privacy notice applies.

We use personal data only for the purposes for which it was collected, and only where we have a lawful basis to do so. Where our basis is consent, we use the data only after you have given that consent.

Table 2: Purposes and lawful bases

Where we rely on legitimate interests, we have assessed that our interests are not outweighed by your rights and freedoms, because the data used is limited and largely technical or business contact data, is retained for a limited period and is not used to make decisions about you beyond the security of the service. You may object to processing based on legitimate interests (see Section 12).

Your voiceprint is special category data, so it is only created and used with your explicit consent (or, in limited cases, another condition permitted by law that the organisation you deal with has identified). You do not have to enrol your voice. If you choose not to, or if you later withdraw consent, you will not be able to use voice authentication, but the organisation offering it to you should provide an alternative means of verifying your identity.

6.1 How we obtain your consent

Before you enrol, you will be told what data will be collected, why, how long it will be kept and how to withdraw. You will then be asked to confirm your consent by a clear affirmative action, such as ticking a box or giving a spoken confirmation. Where the organisation you deal with enrols you, it obtains and records your consent and we require it to do so under our contract. Where you enrol directly with us, we record who consented, when, what they were shown and how consent was given, and we keep that record for as long as we process your voiceprint and for the applicable limitation period afterwards.

6.2 Withdrawing consent

You can withdraw your consent at any time. If you enrolled through one of our customers, contact that organisation, which will instruct us; if you enrolled directly with us, use your account settings or email privacy@voxmind.ai. When you withdraw, we stop using your voiceprint and delete it in line with Section 9. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.

6.3 Using your data for a new purpose

We use your personal data only for the purposes described in Section 5. If we ever want to use it for a new purpose that is not compatible with those purposes, we will tell you first. Where the new purpose involves your voice biometric data, or where the original basis was consent, we (or the organisation you deal with) will ask for your fresh, specific consent before the data is used in that way, and will not proceed without it.

6.4 If we develop or obtain additional information about you

Our services generate information about you as you use them, such as verification outcomes and risk indicators for suspected synthetic voice. We use this only for the authentication and security purposes in Section 5. If we were to derive or obtain any additional category of personal data about you that is not described in this notice, we would update this notice and inform you before using it, and would seek your consent where the law requires.

We do not sell personal data. We share it only in the circumstances below.

7.1 Service providers acting on our behalf

We use a small number of service providers to run our services. Each is assessed for security and data protection before we engage them, is bound by a written data processing agreement that meets the requirements of Article 28 of the UK GDPR and EU GDPR, and may only use your data on our instructions. They include:

• Cloud infrastructure providers (Amazon Web Services and, where a customer selects them, Microsoft Azure or Google Cloud Platform), which host our services in the UK, EU or US region selected by our customer.

• Payment processors, which handle card payments on our behalf.

• Business tooling providers, such as support ticketing, customer relationship management, email, analytics and website consent-management services, which process account, communication and technical data.

A current list of our sub-processors is available on request from privacy@voxmind.ai.

7.2 Our customers

If your voice is verified or checked through one of our customers, we return the result (for example a match score or a synthetic-voice indicator) to that customer. Your voiceprint is held on that customer's behalf; we return or delete it on the customer's instruction and do not share it with anyone else.

7.3 Legal and regulatory disclosures

We may disclose personal data where we are required to by law, a court order or a regulator, or where disclosure is necessary to establish, exercise or defend legal claims or to protect the rights, property or safety of Voxmind, our customers or others. Where the request relates to data we hold as a processor, we will refer it to the relevant customer unless the law prevents us. We keep a record of the disclosures we make and review it at least annually.

7.4 Business changes

If Voxmind is involved in a merger, acquisition or sale of assets, personal data may be transferred to the successor organisation, which will be bound by this notice until it is updated and you are informed.

7.5 With your authorisation

We will share your data with a third party where you have asked us to, for example to integrate a Voxmind account with another system you use.

We process personal data in the United Kingdom, the European Economic Area or the United States, depending on the hosting region chosen by you or by the organisation you deal with. Some of our service providers are located outside the UK and EEA. Where we transfer personal data to a country outside the UK or EEA that has not been found to provide an adequate level of protection, we put safeguards in place before doing so. Depending on the transfer, these are: for transfers from the UK, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework (the UK-US 'data bridge') for certified US organisations; and for transfers from the EEA, the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. We carry out a transfer risk assessment where required. You can ask for a copy of the relevant safeguards by contacting privacy@voxmind.ai.

We keep personal data only for as long as we need it for the purposes in this notice or as the law requires. Where we process your data as a processor for one of our customers, the customer sets the retention period (typically between 30 days and 12 months for voiceprints, or for as long as you remain enrolled) and we delete or return the data at the end of that period or of our contract with the customer. Our standard retention periods for data we hold as controller are:

Table 3: Retention periods

When a retention period ends, or when you exercise your right to erasure, we delete the data using automated processes. Voice biometric data is cryptographically erased or securely overwritten so that it cannot be recovered, and the same retention periods are applied to our backups so that deleted data is purged from backup rotation. We check compliance with these retention periods every quarter.

Where we process your data as a processor for one of our customers, we retain it for the period the customer instructs, and delete or return it at the end of our contract with them, unless the law requires us to keep it.

We operate an information security management system. Measures that protect your personal data include:

• Encryption of voice biometric data and other sensitive data both at rest and in transit.

• Storage of voiceprints as encrypted numerical templates that cannot be played back or reversed into a recording, and pseudonymisation where feasible.

• Access limited to authorised staff on a least-privilege, need-to-know basis, with quarterly reviews of who has access.

• Continuous security monitoring, logging and alerting for unusual access to personal data.

• Data protection impact assessments for high-risk processing, including our biometric processing.

• Data protection and security training for all staff at onboarding and quarterly thereafter, and contractual confidentiality obligations.

No system can be guaranteed to be completely secure, but we review the effectiveness of these controls regularly and report the results to our management.

We take reasonable steps to keep the personal data we hold accurate and up to date. You can review and update your account data at any time in your account settings, or ask us to correct it by emailing privacy@voxmind.ai; we will act on correction requests within 30 days. Because voices change over time, if voice verification starts to fail for you, you or the organisation you verify with can ask us to re-enrol your voice, which replaces the previous voiceprint.

You have the following rights over your personal data under UK GDPR and EU GDPR. Some rights apply only in certain circumstances. If we process your data as a processor for one of our customers, these rights are exercisable against that customer, and we will help it respond.

Table 4: Your rights

12.1 How to exercise your rights

Email privacy@voxmind.ai to exercise your rights. To protect your data, we will verify your identity before acting on a request, and we may ask you for information to do so. We respond within one month of receiving a verified request. If a request is complex or we receive several from you, we may extend this by up to two further months and will tell you why within the first month. We will not charge you unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline it and explain our reasons. We keep a record of every request and how we responded.

If your voice was enrolled or checked through one of our customers, please contact that organisation first; we will support it in responding to you.

Our services produce a verification result, such as a match score or an indication that a voice may be synthetic. Where we provide the service to an organisation, that result is provided to the organisation, which decides how to act on it in accordance with its own policies; it should offer you an alternative means of verification and the opportunity to have a decision reviewed by a person if you cannot be verified by voice. We do not ourselves make decisions about you based solely on automated processing that have legal or similarly significant effects for you.

If a personal data breach occurs that is likely to result in a high risk to you, we will inform you without undue delay, explaining what happened, the likely consequences and what we are doing about it. We will also notify the Information Commissioner's Office within 72 hours of becoming aware of the breach where required. If we are processing your data on behalf of one of our customers, we will notify that customer without undue delay so that it can inform you and the relevant regulator.

Our services are designed for use by adults and by organisations, and are not directed at children. We do not knowingly enrol the voice of anyone under 18 as an account holder, and we require our customers not to use our services to enrol children unless they have confirmed to us that they have a lawful basis, appropriate safeguards and, where required, parental consent in place. If you believe we hold the voice data of a child without such safeguards, please contact privacy@voxmind.ai and we will investigate and delete it where appropriate.

Our Data Protection Officer monitors our compliance with this notice. We review access to personal data and compliance with our retention periods every quarter, audit our data protection practices at least twice a year, review this notice at least annually, and report the results to our Chief Executive Officer. Staff who breach our data protection rules are subject to disciplinary action.

If you have a question, concern or complaint about how we handle your personal data, please contact our Data Protection Officer at privacy@voxmind.ai or by post at Data Protection Officer, Voxmind Ltd, WeWork, 5 Merchant Square, London W2 1AY, United Kingdom. We will investigate and respond in writing within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office, the UK supervisory authority:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Telephone 0303 123 1113. Website https://ico.org.uk

If you are in the European Economic Area, you may also complain to the supervisory authority in the country where you live or work.

Our website uses cookies and similar technologies. Some are strictly necessary for the site to function. Others, such as analytics cookies, are set only if you agree to them through the cookie banner shown when you first visit our site, where you can also change your choices at any time.

For website tracking, see the Cookie Policy and the website tracking supplement below.

We review this notice at least once a year and whenever our processing changes materially. Each version carries a version number and effective date, and superseded versions are available on request. If we make a significant change, we will tell account holders by email or through the customer portal before it takes effect, and where a change affects the basis on which we process your voice biometric data, fresh consent will be sought.

Data protection questions and complaints: privacy@voxmind.ai

Data subject requests: privacy@voxmind.ai

Post: Data Protection Officer, Voxmind Ltd, WeWork, 5 Merchant Square, London W2 1AY, United Kingdom

This supplement describes website tracking. It does not change how voice biometric data is processed under the sections above.

Consent preferences and website analytics

Cookiebot by Usercentrics records your cookie choices. Where enabled, Google Analytics 4, delivered through Google Tag Manager, measures page views and successful demo requests only after Statistics permission. The demo event does not include the information entered in the form.

Lead Forensics: business visitor identification

When enabled with your explicit Marketing permission, Lead Forensics helps us understand which businesses visit our website and which pages interest them. Its tracking service, delivered through imaginativeagile.com, receives your IP address, page URL and title, referring URL, browser information, screen dimensions and website domain. URLs may include query parameters.

The service uses IP addresses to identify businesses. A business match does not establish which individual visited the site. This does not mean the incoming IP address and visit information are anonymous.

The basis for this collection and business matching is consent. Statistics permission alone does not authorise Lead Forensics. You can browse the site and make an enquiry without allowing Marketing. Allowing website tracking does not subscribe you to marketing emails.

The website integration does not send demo-form fields, voice recordings or biometric templates to Lead Forensics. It does not implement contact-enrichment or CRM-export APIs.

Your controls

Open Cookie settings in the footer, switch off Marketing and save to withdraw. If Lead Forensics has loaded, the page reloads to end its execution. Unsent form entries may be lost. Your saved choice prevents further loading unless you enable Marketing again. The integration also stays off when Global Privacy Control is enabled in your browser.

Withdrawal cannot recall information already transmitted and does not automatically erase provider-held records. Contact privacy@voxmind.ai about information already collected. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.

See the Lead Forensics section of the Cookie Policy for the service and consent controls. For questions about information held by the service, including retention, deletion or international processing, contact privacy@voxmind.ai.