Gradium

GDPR overview

Implementation is concrete rather than declarative. Gradium is established in France, so the GDPR applies directly and the CNIL is the supervisory authority. The privacy policy, dated July 2026 and downloadable as a PDF, lists the data collected, the purpose and the legal basis for each processing operation, and the full set of data subject rights, including an explicit right to object to model improvement. Requests go to dpo@gradium.ai or to the Paris office. A complete Data Processing Agreement is published as Exhibit 1 to the terms: sub-processing, international transfers under the 2021/914 standard contractual clauses, the EU-US Data Privacy Framework, the UK Addendum, audit rights, and deletion or return within forty-five days. Gradium commits to assist with Article 32 obligations. No Article 27 representative is named, and none is needed for an EU-established company.

Who owns the data?

The client keeps every intellectual property right in the data it submits. Gradium receives a worldwide, non-exclusive, royalty-free licence, for the length of the subscription, to use, store, copy, modify and reproduce that data in order to run, maintain and optimise the service, and it may pass it to its own service providers. A second, separate licence covers service improvement and AI model training; that one falls away when Zero Data Retention is switched on. Gradium owns the models, the API and the documentation, and any feedback a client sends becomes Gradium's exclusive property, model training included. On personal data, Gradium acts as processor for client content and as controller for account data.

Reuse rights

Outputs belong to the client's side of the contract: the client owns the intellectual property rights in what it submits, and the terms place no restriction on reusing the generated audio or transcripts in its own product, provided the underlying use is lawful. Permission is not required for that reuse, but three duties travel with it. The client must obtain consent from every individual whose voice is recorded, cloned or processed, and must tell people they are talking to an AI system. It must not direct the service to impersonate anyone without authorisation, to produce disinformation or political content, or to give medical, legal or financial advice without the relevant qualifications. Reverse-engineering the models, or using outputs to train a competing model, is expressly forbidden. On the free plan the licence is limited to internal, non-commercial use.

Data retention & training

Hosting summary

By default, requests to api.gradium.ai are routed to the nearest server. Two regional endpoints exist, one for the European Union and one for the United States. Without enrolment, calling a regional endpoint is a best-effort request with no commitment attached. Once an organisation is enrolled, the call carries a guarantee: the session runs inside its zone, or it is refused, with a 403 over REST and a 1008 close over WebSocket. Every response names the zone it used, in a response header over REST and in the ready message over WebSocket, so the customer can assert on it rather than trust a hostname. Enrolment is arranged by the vendor on paid plans, in either an explicit per-call mode or an implicit organisation-wide mode. Data that is not session data — account records, custom voices, pronunciation dictionaries — lives in a control plane hosted in the European Union for every customer, and that holds even under US residency. The marketing site itself is served from Paris, on French infrastructure. The jurisdiction of the contract is France, with exclusive jurisdiction to the Paris civil courts.