Voice of Mama Privacy Policy

1. Who We Are

Voice of Mama is operated by Voice of Mama LLC, registered in Texas, USA. If you have any questions about this policy, please contact us at: care@voiceofmama.com

2. What Information We Collect

3. How We Use Your Information

Your information is used exclusively to:

• Create and manage your Voice of Mama account
• Generate a personalised cloned voice model for use in bedtime story narration
• Personalise story content with your child's name and age-appropriate detail
• Process and manage your subscription
• Improve the quality, reliability, and safety of our service
• Send you important account-related communications (e.g. changes to this policy, account security notices)
• Send you optional newsletters or product updates, only if you have opted in

We do not use your data, your voice recordings, or your child's information for any purpose outside of the above without your clear, separate consent. We do not use any of this data for third-party advertising, cross-context behavioral advertising, or to build a profile about you or your child.

4. Voice Cloning, Biometric Data & Consent

Voice cloning is the heart of Voice of Mama, and a cloned voice is biometric data — a "voiceprint" that can identify a specific person. Biometric identifiers receive special protection under laws including the EU/UK GDPR, the California Consumer Privacy Act (which classifies biometric information as "sensitive personal information"), the Illinois Biometric Information Privacy Act, and the Texas Capture or Use of Biometric Identifier Act. We take the following steps because of that:

• You must confirm that the voice being recorded belongs to you, or that you have the explicit, informed consent of the person whose voice is being recorded, before submitting it.
• Voice models are created and used solely within your Voice of Mama account, for the purpose of narrating your bedtime stories.
• We do not sell, lease, trade, or otherwise profit from voice recordings or voice models, and we do not disclose them to any third party except the service provider (Fish Audio) that generates the model on our behalf.
• Source voice recordings are deleted from our active systems within 7 days of the voice model being successfully created (see Section 8).
• You may delete your voice model at any time from within the app, or by contacting us directly.
• Upon account deletion, all voice recordings and generated voice models are permanently and irrecoverably erased from our systems and those of our service providers within 30 days.

Please do not submit recordings of anyone who has not given their informed consent to have their voice cloned.

5. Children's Privacy & COPPA Compliance

Voice of Mama is designed to be used by adults on behalf of their children. We are not directed to children as their own independent users, and children do not create or operate accounts. That said, because we collect a child's first name and age from the parent or caretaker in order to personalise stories, we treat that information as protected under the Children's Online Privacy Protection Act (COPPA) in the US (which applies to information collected about a child under 13) and, where applicable, the UK/EU GDPR's protections for children under 16.

To meet those obligations:

• Verifiable parental involvement. Only the adult account holder — who registers using their own name, email address, and payment method, and confirms they are at least 18 and the parent, legal guardian, or authorized caregiver of any child whose information they enter — can add or edit a child's profile. A child cannot create an account or enter their own information.
• What we collect and why. We collect only a child's first name and age — never a photo, video, precise location, or persistent identifier tied to the child — and use it solely to personalise story text and narration.
• No use for marketing. A child's name and age are never used for advertising, never used to build a behavioral or advertising profile, and never shared with data brokers or advertisers.
• Named recipients. The only parties who receive a child's name and age are our infrastructure providers — Neon (database storage) and Supabase (authentication/session infrastructure) — each bound by a data processing agreement, and neither of whom may use it for any purpose other than providing the service to us. Fish Audio, our voice-cloning partner, does not receive children's names or ages — only the adult's voice recording.
• Retention. A child's profile information is retained only for as long as the associated account is active, and is permanently deleted within 30 days of account deletion, consistent with our general account-data retention in Section 9.
• Parental rights. A parent or caretaker may review, correct, or delete their child's information at any time from within the app, or by contacting care@voiceofmama.com — without needing to delete the entire account. We will respond to any such request within a reasonable time and no later than 30 days.
• No independent child registration. If we become aware that a child has independently created or operated an account without a parent's involvement, we will delete that account and associated data promptly.

If you have questions about our children's privacy practices, contact us at care@voiceofmama.com.

6. Third-Party Service Providers

To deliver Voice of Mama, we work with a small number of trusted technology partners. Each partner is bound by a data processing agreement requiring them to protect your data to a standard consistent with this policy, and each may use the data we share only to provide services to us — never for their own advertising or marketing purposes.

We will notify you promptly if we change any of our key technology partners in a way that affects how your personal data is processed.

7. International Data Transfers

Your data is stored and processed in the United States. If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with data-transfer restrictions, we rely on appropriate safeguards for transferring your data to the US — such as Standard Contractual Clauses approved by the European Commission, the UK's International Data Transfer Addendum, or an equivalent mechanism recognized under applicable law — and we require our service providers to maintain protections consistent with those safeguards.

8. Data Storage & Security

We apply the following security measures:

• Email verification is required to activate all accounts
• All data is encrypted in transit using TLS and at rest
• Access to personal data within our team is strictly limited on a need-to-know basis
• We maintain written security practices designed to identify and address risks specific to children's personal information, and we review our data security practices regularly

While we take every reasonable step to protect your data, no system is completely immune to risk. We will notify you without undue delay in the event of a data breach that may affect your personal information, and as required by applicable law.

9. Data Retention

We retain personal data only for as long as necessary to provide the service:

• Account data (including child profile data) is retained for as long as your account is active
• Voice recordings submitted for cloning are deleted from our active systems within 7 days of the voice model being created
• Voice models are retained until you delete them or close your account
• Upon account deletion, all personal data — including account data, child profile data, and voice models — is permanently erased within 30 days

You may request deletion of specific data at any time without closing your account — see Section 10 for your rights.

10. Your Privacy Rights

Under the GDPR and UK GDPR, we process your data based on: your consent (for voice recordings, child profile data, and optional marketing), the necessity of processing to perform our contract with you (account management, service delivery), our legitimate interests (service improvement, security), and compliance with legal obligations. You have the right to:

• Be Informed — know how your data is used, which this policy explains.
• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete information.
• Erasure — request deletion of your personal data, including your voice model and your child's profile data, at any time.
• Restrict Processing — ask us to pause processing in certain circumstances.
• Data Portability — request your data in a portable, machine-readable format.
• Object — object to certain processing, including direct marketing.
• Rights around Automated Decision-Making — we do not use automated profiling to make decisions that significantly affect you or your child.

Under the CCPA/CPRA (California residents), you have the right to know, access, correct, and delete your personal information, and the right to limit the use of sensitive personal information (which includes voice/biometric data). We do not sell or share personal information, including biometric data or children's information, for cross-context behavioral advertising or any other form of monetary or other valuable consideration, so there is no "opt-out of sale" action needed — there is nothing being sold.

Under state biometric privacy laws (such as the Illinois Biometric Information Privacy Act and the Texas Capture or Use of Biometric Identifier Act), you have the right to know that a voiceprint is being collected, the purpose and retention schedule for that data (Sections 4 and 9), and to have it destroyed as described above.

To exercise any of these rights, please contact us at care@voiceofmama.com. We will respond within 30 days.

11. Marketing Communications

We will only send you marketing emails or newsletters if you have explicitly opted in to receive them. You can unsubscribe at any time by clicking the unsubscribe link in any email, or by contacting us directly. Opting out of marketing will never affect your access to the Voice of Mama service. We never send marketing communications to or about your child, and your child's information is never used for marketing purposes.

12. Account Sign-In & Deletion

You do not need a social-media account to use Voice of Mama. You can delete your account at any time directly within the app (Profile → Account Settings → Delete Account), which permanently removes your account, your child's profile data, your voice recordings, and your voice models within 30 days as described in Section 9. You can also request deletion by emailing care@voiceofmama.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time as our service evolves or in response to changes in law. When we make significant changes — including any change that affects how we handle children's information — we will notify you by email and/or by a prominent notice within the app before the change takes effect. The updated policy will always be available at www.voiceofmama.com/privacy.

Continued use of the app after changes take effect constitutes your acceptance of the updated policy.

14. Contact Us

For any privacy-related queries, data requests, or concerns, please get in touch: