Dubverse

GDPR overview

Dubverse publishes a Data Protection Policy as an annex to its privacy policy, described as framed in compliance with GDPR — an explicit claim rather than an inference. It lists access, rectification, erasure, restriction, withdrawal of consent, portability, objection, objection to direct marketing and the right to complain to a regulator, with a stated one-month response window. Standard Contractual Clauses cover transfers outside the EEA, breach notification runs to three business days between parties, and deletion on instruction is capped at thirty days. Two gaps are worth noting: no Article 27 EU representative is named anywhere, and no DPO is appointed — the only designated contact is an Indian Grievance Officer, Anuja Dhawan. The policy itself is dated April 2022, three years older than the terms of service.

Who owns the data?

Dubverse states in its privacy policy that it is the controller of customer data. Its terms of service claim ownership of the platform and of all the material it ships with it — text, graphics, logos, audio, software — which the company calls the Works, and explicitly carve out the User Content you supply from that claim. The GDPR annex takes a different angle again: there, Dubverse and its counterparty describe themselves as independent controllers, each responsible for its own processing. Data is shared with employees, service providers handling billing and support, business partners, and may transfer in a merger or acquisition.

Reuse rights

The terms exclude User Content from Dubverse's intellectual property claim, so what you upload and what you generate stay yours; conversely, the platform's own material may not be copied, redistributed or reused without written consent. On its side, Dubverse says it uses collected information to improve the product, maintain and protect the service, personalise the experience, communicate on technical matters, run reporting and research, and prevent fraud. It also processes data by automated means for analytics and future features, and may anonymise it and combine it with other sources. No personal information goes to advertisers or third parties, with one named exception: Amazon Web Services, which hosts the servers. Cookies are a separate matter — advertising and analytics vendors are allowed to collect through them, and Dubverse links subscriber details to activity across devices.

Data retention & training

Hosting summary

Dubverse states in section 4 of its privacy policy that information is retained on servers located in Mumbai, India. The only third party named as having access is Amazon Web Services, which the policy identifies as the host of those servers — the same section stresses that no personal information is passed to advertisers or other third parties. The governing jurisdiction is Indian: the policy is written against the IT Act 2000 and the SPDI Rules 2011, and the terms place disputes before the courts of Delhi. No European hosting region, data residency option or regional failover is offered or mentioned anywhere on the site. For transfers of European personal data outside the EEA, the GDPR annex relies on Standard Contractual Clauses, deemed signed by the execution of the agreement. Organisations under EU or UK data residency obligations should treat Indian hosting as the baseline and plan accordingly.