WellSaid

GDPR overview

Compliance is claimed explicitly and backed by documents. The security page states that WellSaid is SOC 2 Type II certified and maintains compliance with the GDPR and with the requirements of the EU AI Act. A public Data Processing Agreement, last updated on 13 May 2026, covers the GDPR, the UK GDPR, the Swiss FADP and the CCPA, relying on the 2021/914 EU Standard Contractual Clauses and the ICO's UK Addendum for transfers. Sub-processors are engaged under general written authorisation, with fourteen days to object. EEA rights are listed in full, access, rectification, erasure, portability, objection and restriction, with a one-month response window. Two gaps deserve naming: no Article 27 EU representative is designated and no data protection officer is appointed, privacy requests going to the general support address instead.

Who owns the data?

Ownership stays with the customer. WellSaid states that it does not claim ownership of the content customers render on the platform, and every audio file produced on a paid plan carries full commercial usage rights, covering paid advertising, e-learning, brand campaigns and product marketing alike. The free Trial plan is the exception: its three monthly download minutes come without commercial rights. Under the Data Processing Agreement the customer is the controller, or its own customers' processor, and WellSaid the processor or sub-processor, which keeps instruction power on the customer's side. On written request, WellSaid returns or securely destroys personal data within ninety days.

Reuse rights

On a paid plan the answer is yes, with no further permission needed. Every generated file ships with full commercial usage rights, and WellSaid applies identical terms to solo creators and enterprise teams: paid advertising, audio advertising, product marketing, brand campaigns and e-learning content are all covered. The free Trial plan is deliberately carved out, its three monthly download minutes carrying no commercial rights at all. Protection runs in the other direction too. Inputs and outputs are never used to train WellSaid's models on any plan, the pricing table repeating "Never" across all five tiers, and the vendor states that it neither sells customer data nor personally identifiable information. Content moderation applies throughout, with end-user allow-listing negotiable on Enterprise accounts.

Data retention & training

Hosting summary

Everything runs in the United States. Customer data is hosted and processed on Google Cloud Platform in a US region, in an environment managed by WellSaid engineers who are themselves US based. Data in transit is encrypted with TLS 1.2 and data at rest with AES 256-bit encryption. The hosting environment carries 24/7/365 monitoring, continuous vulnerability scanning, intrusion detection and regular penetration testing, and WellSaid states that its infrastructure is deployed on FINRA, HIPAA and ISO-compliant services. Database snapshots are taken every twenty-four hours, with point-in-time recovery. Schedule 3 of the Data Processing Agreement names seven sub-processors, all located in the United States: Google Cloud for storage and text-to-speech processing, Azure for language mechanics, Mixpanel for analytics, Verisoul for user verification, PerspectiveAI and Hive for content moderation, and MongoDB, Inc. for storage and API. No EU or other regional hosting option is offered, and the privacy policy warns European users explicitly that their data is transferred to the United States. System availability is published at status.wellsaidlabs.com.