Dubbing AI

GDPR overview

The privacy policy, effective 23 October 2023 and last updated 9 December 2025, carries a dedicated section, Additional Disclosures for GDPR Compliance (EU). The publisher declares itself data controller and lists consent, contract performance, legitimate interest and legal obligation as legal bases. Transfers outside the EEA rely on European Commission standard contractual clauses, binding corporate rules or another mechanism. Rights offered: access, rectification, restriction, objection, portability (CSV), erasure, non-discrimination and complaint to a supervisory authority. Parental consent is required under 16, and account deletion triggers erasure within 90 days. Missing: no Article 27 EU representative, no named DPO, no DPA, no declared hosting country, and privacy requests go to the general support address. One contradiction is frontal: the terms (13.1, 14.3) place the contract under People's Republic of China law and limit use to mainland China, disclaiming responsibility outside it, especially the European Union.

Who owns the data?

HALO INTERACTIVE PTE. LTD. owns the software, its code, the trademarks and the voice catalogue. The terms state that Dubbing AI content is licensed, not sold: reselling, renting, redistributing and sub-licensing are prohibited, and withdrawn content can become unavailable even to users who already had it, with no compensation. Use is personal and non-commercial, with one exception carved out: creator monetisation on social platforms. For content users publish, the terms grant HALO INTERACTIVE a worldwide, perpetual, irrevocable and free licence covering reproduction, modification, adaptation, translation, derivative works and commercial exploitation. Users warrant they hold the rights to what they upload and face third-party claims alone. The account itself belongs to the publisher; the user only gets a right of use.

Reuse rights

On the user side, the terms allow personal, non-commercial reuse of Dubbing AI voices and sounds without asking permission each time, plus one explicit commercial carve-out: creators may monetise the content they make with them on social platforms. Reselling, redistributing and sub-licensing remain prohibited, and voice cloning requires written consent from every identifiable person in an uploaded file. On the publisher side, the privacy policy lists logs (IP address, browser, pages, timestamps), device data (type, operating system), identity data (name, email, phone, postal address), uploaded content and transaction data. Stated purposes: running and personalising the service, communicating, analytics and market research, advertising and marketing, attributing published content and technical assessment. The GDPR legal bases invoked are consent, contract performance, legitimate interest and legal obligation. Named third parties are Google Analytics, Stripe and Discord; other categories of recipients include affiliates, IT, hosting and analytics providers, partners, authorities and any acquirer in an asset sale. The California notice adds identifiers, customer records, demographic data, audio and visual data and inferences, and the site states it does not respond to Do Not Track signals. Two claims sit in tension and should be read together: the home page says voice conversion runs on the user's device and that external servers are not involved, while the /llm-info page asserts that data is not shared with third parties, which the privacy policy's own list of three named third parties contradicts. The terms also describe uploaded recordings being used to train the cloning AI with the speaker's consent; no general position on model training is published elsewhere.

Data retention & training

Hosting summary

No hosting country or region is declared anywhere on the site: neither the privacy policy, nor the terms of use, nor any other collected page names a jurisdiction, a region or a storage provider, and a targeted search returned nothing. Two things are said. First, voice conversion itself is announced as running on the user's device, the home page stating that external servers are not involved in the AI voice conversion process. Second, the /llm-info page claims data is encrypted in transit and at rest, without saying where. Account, transaction and analytics data plainly leave the device: the privacy policy names Google Analytics, Stripe and Discord, and mentions transfers outside the EEA covered by standard contractual clauses, which implies such transfers happen. A network check on 11 August 2026 resolved the domain to 188.114.96.12, an anycast address belonging to Cloudflare (AS13335); that identifies the CDN edge, not the country where data is stored. The publisher is a Singapore company, but no postal address and no data-centre location are published.