FineVoice

GDPR overview

The privacy policy devotes a section to the GDPR rights of EEA residents: access, update, deletion, rectification, objection, restriction, portability and withdrawal of consent, along with the right to complain to an EEA supervisory authority. Legal bases are named — contract performance, consent, legitimate interest, payment processing and legal obligation — and identity may be verified before a request is answered. A separate CCPA section covers Californian residents. Beyond that, the site never states anywhere that it is GDPR-compliant, names no Article 27 EU representative and no data protection officer, and routes every such request to a single address, support@finevoice.ai. Users outside the United States are told their data is transferred to and processed in the United States. The policy is dated 7 April 2022, well before the January 2026 move to finevoice.ai.

Who owns the data?

FineVoice's terms, dated 5 February 2024, split content ownership by plan. On the Basic, Pro and Business plans the user owns all rights in their User Input and User Output, and FineVoice assigns back any rights it would otherwise acquire, commercial use included. On the free plan the user still owns the input, but receives only a limited, non-exclusive, non-transferable and revocable license to the output, restricted to personal, non-commercial and internal-evaluation use: reselling, sublicensing, redistributing and monetizing are forbidden. Output is not guaranteed to be unique, since other users may generate similar content, and FineVoice reserves the right to withdraw, filter, edit or delete any content at any time, without notice.

Reuse rights

Paid users may reuse their generated audio freely, commercial use included, without asking further permission; free-plan output may only be used personally and internally. In the other direction, the terms grant FineVoice a royalty-free, transferable, sublicensable, worldwide and irrevocable license to access, use, host, cache, store, reproduce, transmit, display, publish, distribute and modify user content, expressly including to train or otherwise improve its artificial intelligence and machine learning models; that license survives termination of the account. The privacy policy, dated 7 April 2022, lists the data collected — email address, first and last name, postal address, cookies and usage data, support exchanges — and the purposes it serves: running the service, notifying changes, taking payment, providing support, analytics, incident detection and marketing messages with an unsubscribe option. Data obtained through Google sign-in is carved out: it is never used for advertising or to train generalized models, and never sold or rented. Google Analytics is used, no personal data is sold under the CCPA declaration, and no card details are stored, payments being handled by PCI-DSS compliant providers.

Data retention & training

Hosting summary

The privacy policy states plainly that data belonging to users located outside the United States is transferred to and processed in the United States. No other hosting country is named, and no European data-residency option is offered. On the security side, the home page and the text-to-speech page announce TLS in transit and AES-256 at rest, regular audits, and an infrastructure described as backed by AWS and Cloudflare — a statement about providers rather than about a specific region. The domain resolves to a Cloudflare anycast address (172.67.68.87), which identifies a CDN node and tells nothing about where the origin servers actually sit. No sub-processor list is published, no data processing agreement is offered, and no security certification such as SOC 2 or ISO 27001 is displayed. In practice, a reader should assume US jurisdiction over their content, with the usual consequences for organizations subject to European transfer rules, and should not expect any contractual commitment on hosting location beyond that single sentence in a privacy policy dated 7 April 2022.