Privacy Policy

Magiska AB, company registration number 559443-8797, Kamgatan 9 E, 415 73 Göteborg, Sweden, is the controller of the personal data described in this policy. We operate the Dubedo service at dubedo.com.

Contact us about anything in this policy at privacy@dubedo.com. We have not appointed a data protection officer and are not required to.

This policy covers the data we handle as a controller: the data of people who hold a Dubedo account and use the service.

It does not cover the content you upload. When you upload a recording of other people, you decide why and how it is processed and we act only on your instructions. You are then the controller and we are your processor. Section 10 explains what that means.

You give us:

• Account details. Your email address, and the name and profile picture your identity provider passes to us if you sign in with Google.
• Uploaded media. The video and audio files you submit for dubbing.
• Reference audio for voices. Clips you upload or record to clone a voice, and text prompts you write to generate one.
• Guide words. The optional names, brands and technical terms you supply to improve transcription accuracy.
• Text you edit. Transcript corrections, translated lines and delivery instructions.
• Support correspondence. Anything you send us by email.

The service produces:

• Transcripts and speaker segments, including who said what and when.
• Speaker embeddings. A numeric representation of a voice, derived from reference audio and used to synthesise speech in that voice. See section 6.
• Translations and generated audio.

We record automatically:

• Usage and billing data. Projects created, credits granted and spent, your plan, and a ledger of the processing operations run for you.
• Technical logs. Request identifiers, method, path, response status, duration and account identifier. Error reports go to our monitoring provider with personal data collection switched off.
• Anti-abuse records. A one-way keyed hash of your email address recorded when a free trial is granted, plus a masked hint such as ni***@example.com. Section 8 explains why this outlives your account.

Payment. Card details are entered directly with Stripe and never reach our systems. We store your Stripe customer identifier, your plan and your payment history in summary form.

Where we rely on legitimate interests we have weighed our interest against your rights. You can object at any time and we will stop unless we have compelling grounds to continue. Section 9 says how.

We do not use your content to train artificial intelligence models, and our agreements with our AI providers prohibit them from doing so. We do not sell personal data, and we do not use it for advertising or profiling.

We set cookies only to keep you signed in. They are strictly necessary for a service you asked for, so we do not ask for consent and there is no cookie banner. We use no analytics, tracking or advertising cookies. Sign-in cookies are refreshed while you keep using Dubedo, and expire when you sign out or after a period of inactivity.

Voice cloning is the most sensitive thing this service does, so we set it out separately.

What happens. When you clone a voice we take the reference audio, derive a speaker embedding from it, and use that embedding to synthesise speech. The embedding exists to reproduce a voice, not to recognise anyone. We never use it to match a voice against another recording or against any database, and we do not use it to identify people.

Whose voice it is. Often it is not yours. It may be a speaker in a video you uploaded, or a clip of a colleague or client. Our terms require you to own the voice or have the speaker's clear permission before cloning it, and obtaining that permission is your responsibility. Where the voice belongs to someone else, you are the controller for that person's data and we act on your instructions.

How long we keep it. A reference clip and its embedding live as long as the voice does. Deleting the voice deletes both, immediately and from backing storage. Voices extracted temporarily from a project are deleted with the project.

If someone else's voice was cloned without permission. Write to privacy@dubedo.com. You do not need a Dubedo account. Tell us enough to locate the material and we will investigate, suspend the account if warranted, and delete the voice and anything generated from it.

We use a small number of providers to run the service. The current list, with each provider's role, location and safeguard, is at Sub-processors and forms part of this policy. We update that page whenever the list changes.

Some of these providers are outside the European Economic Area, in the United States. Speech separation, speech recognition, speech generation, translation and parts of our monitoring and backup tooling run wholly or partly in the United States. That means your uploaded media, your reference audio and your transcripts are transferred there for processing. Our web front end and our database run inside the EU.

Those transfers rely on the European Commission's standard contractual clauses, or on the provider's certification under the EU-US Data Privacy Framework where it holds one, together with supplementary measures including encryption in transit and at rest and deletion of working copies once processing finishes. You may request a copy of the safeguards for any specific provider by writing to privacy@dubedo.com.

What survives account deletion. Deleting your account removes your profile, every project, every file, every voice, your credit balance and ledger, and your sign-in identity. Three things remain:

• A one-way keyed hash of your email address and a masked hint, so a single mailbox cannot collect the free trial repeatedly. The hash cannot be reversed to recover your address. We rely on legitimate interests and keep it for three years.
• Payment and accounting records, for as long as bookkeeping law requires.
• Encrypted backups, until they expire on the schedule above.

You may ask us to:

• give you a copy of the personal data we hold about you;
• correct anything inaccurate;
• delete your data, which you can also do yourself from your profile at any time;
• restrict how we use it while a dispute is resolved;
• give you a portable copy in a structured, commonly used, machine-readable format, or send it to another provider where technically feasible;
• stop processing based on legitimate interests, by objecting; and
• withdraw consent where we relied on it, without affecting what we did beforehand.

Write to privacy@dubedo.com. We answer within one month and will tell you if we need longer. We do not charge unless a request is manifestly unfounded or excessive.

We make no decisions about you by automated means that produce legal effects or similarly significant effects.

If you are unhappy with how we handled it, you can complain to Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm, imy@imy.se, imy.se. If you live in another EEA country you may complain to your own supervisory authority instead.

If you use Dubedo to dub recordings of people other than yourself, you decide the purpose and we follow your instructions. European law then requires a written agreement between us. Our standard data processing agreement applies automatically and covers our security commitments, our sub-processors, how we help you answer requests from the people in your recordings, breach notification, and deletion when you leave.

You remain responsible for having a lawful basis to process those recordings and for telling the people in them, as your own privacy notice requires.

We protect your data with, among other things:

• encryption in transit and at rest;
• authentication through a dedicated identity provider, with tokens verified against its published signing keys on every request;
• database access rules that deny browser clients any direct read of application tables;
• per-account scoping enforced in the interface, so one account cannot reach another's projects, voices or files;
• expiring signed links for media, so a file cannot be fetched from a guessed address;
• rate limits and daily ceilings on the operations that consume processing capacity;
• encrypted daily database backups with the decryption key held separately; and
• error monitoring configured not to collect personal data.

No service can promise perfect security. If a breach is likely to result in a high risk to you we will tell you without undue delay, and we will notify the supervisory authority within 72 hours where the law requires it.

Dubedo is not for children. You must be at least 16 to hold an account and at least 18 to buy a paid plan. If we learn that we hold a younger person's data we delete it.

We update this policy when the service or the law changes. The effective date at the top always shows the current version. If a change materially affects your rights we will tell you by email or in the app before it takes effect.

Magiska AB, Kamgatan 9 E, 415 73 Göteborg, Sweden. privacy@dubedo.com