Privacy Policy

The Data Fiduciary is [Company name — to be published], [Registered address — to be published]. Questions about this policy: info@mcorevision.com.

• Account data — name, email address, a hashed password (we never store your password itself), and when you accepted our terms.
• Content you submit — the scripts you convert to speech, delivery directions, pronunciation rules, recordings you upload for dubbing, voice conversion or cloning (processed to produce the result; we don't keep uploaded recordings), transcripts and translations, and the audio files generated.
• Voice cloning consent records — the speaker's name, the statements accepted, the time and IP address, and fingerprints (hashes) of the recordings used. A cloned voice is a recording of a real person's voice characteristics; it is used only for your workspace and removed when you delete it.
• Billing data — billing name, address, state, and GSTIN if you provide one; invoice and payment records. Card, UPI and bank details are entered on Razorpay's secure checkout and are not stored by us.
• Usage and security data — IP address, browser user agent, sign-in sessions, generation history, credit usage, and records of safety checks (category results and a one-way fingerprint of the text, not the text itself).

We don't sell personal data, and we don't use your account data or content to target advertising. Analytics cookies are used only if you accept them (section 4). The service isn't intended for anyone under 18, and we don't knowingly collect children's data.

• To create and secure your account, verify your email and keep you signed in.
• To generate audio from your scripts and keep your history and downloads available.
• To check scripts against our Acceptable Use Policy and prevent fraud, spam and abuse, including duplicate free accounts.
• To take payments, issue GST tax invoices and credit notes, and meet tax and accounting obligations.
• To send service emails (verification, receipts, important changes). We don't send marketing email without separate consent.

When you first visit, we ask whether you accept analytics cookies. If you accept:

• Google Analytics 4 measures which pages are visited and how (with IP anonymisation), and Google Ads measures whether an ad visit led to a sign-up, a first generated audio or a purchase (with the order value). Google receives this through its cookies and tag; ad personalisation is switched off.
• We keep the campaign you first arrived from (the link's utm_ parameters or Google click ID, the landing page and the referring site) in a first-party cookie for 30 days, and save it with your account if you sign up, so we can see which campaigns bring customers.

If you reject, none of these tags or cookies are used and the site works the same. Before you choose, campaign parameters are kept only in your browser tab and are discarded if you reject. You can change your choice any time with “Cookie settings” at the bottom of the site; withdrawing removes these cookies from your browser.

We share only what each provider needs to perform its service for us:

• OpenAI (United States) — converts your script into speech and screens text for policy violations. Your script text and delivery directions are sent to OpenAI for this purpose.
• ElevenLabs (United States) — when you use voice design, voice cloning, voice conversion or sound effects: your descriptions, prompts and uploaded recordings are sent to ElevenLabs to produce the result. Cloned voices and their samples are stored there until you delete the voice.
• Google and Facebook — only if you choose to sign in with them: they tell us your account ID, name and email address. We don't receive your password or post anything to your account.
• Razorpay (India) — processes payments.
• Google Analytics and Google Ads (United States) — only if you accept analytics cookies (section 4): page visits and conversion events, never your scripts or audio.
• Cloudflare — Turnstile bot protection on sign-up, which processes your IP address and browser signals.
• Resend (United States) — delivers transactional email.
• Our hosting and database providers — store account data and audio files.

Some of these providers process data outside India. We transfer data only to countries not restricted by the Government of India under the DPDP Act.

• Account data and generated audio: while your account is open, or until you delete the content or ask us to.
• Invoices, payments and related records: as long as Indian tax law requires (under the CGST Act, at least 72 months from the due date of the annual return for that year).
• Safety-check records: 12 months, unless needed longer to investigate abuse or comply with law.
• Free-credit eligibility record: to stop repeated sign-ups for free credits, we keep a one-way keyed fingerprint (HMAC) of each email address used on your account — not the address itself — with account creation/deletion dates and the free or promotional credits granted. It's kept for 24 months after your last account is deleted, then erased. Network information is kept only as a fingerprint of the network range for 90 days. We don't use device fingerprinting or precise location. These signals only affect free credits — never paid plans — and you can ask for a human review from the app.
• Sign-in history (when you signed in, how — password, Google or Facebook — and whether it succeeded, with the network range and browser/OS type, not your full IP address): 180 days, to protect your account and help with support.
• Security and audit logs: as long as reasonably needed to protect accounts and the service, and to meet legal obligations.

After you close your account, we delete or anonymise your data except where we must keep it by law.

Under the DPDP Act you can:

• ask for a summary of the personal data we process about you and who we've shared it with;
• ask us to correct, complete, update or erase your data;
• withdraw your consent (this closes your account, because we need the data to provide the service);
• nominate another person to exercise your rights if you die or become incapacitated;
• get your grievance addressed by our Grievance Officer (below).

You can download your data and delete your account yourself under Settings → Usage & Data and Settings → Delete account. For anything else, email info@mcorevision.com from your account email address. We may need to verify your identity first.

[Grievance Officer name — to be published] — [Grievance Officer email — to be published]
[Registered address — to be published]

Until the Grievance Officer's details are published, send privacy requests and grievances to our general enquiries address, info@mcorevision.com, or use the Help & Support form.

If you're not satisfied with our response, you may complain to the Data Protection Board of India.

Passwords are hashed with Argon2, sessions are stored as hashed tokens, provider keys stay on our servers, and connections are encrypted with HTTPS. No system is perfectly secure; if a breach affects your data, we'll notify you and the Data Protection Board as the law requires.

If we change this policy materially, we'll update the date above and notify you by email or in the app before the change takes effect.