NaturalReader

GDPR overview

NaturalReader makes explicit compliance claims. The mobile app page states that the service is fully compliant with GDPR, HIPAA and privacy regulations, and the policies page claims compliance with FERPA, COPPA and New York Education Law 2-D in the United States and with the GDPR in Europe. The privacy policy, published as a PDF, carries a dedicated section on the legal basis for processing under the GDPR — contract, consent, legitimate interest, payment and legal obligation — and lists data-subject rights: access, rectification, erasure, objection, restriction, portability, withdrawal of consent and complaint to an EEA supervisory authority. Two gaps stand out: the policy is dated 12 October 2020, well before the current AI features, and no Article 27 EU representative, data protection officer or data processing agreement is named anywhere on the site.

Who owns the data?

The end-user licence agreement is explicit: NaturalSoft owns the underlying technology of the product, but you own all of the content and information conveyed or transmitted through it. Documents you upload therefore remain yours. What changes with the plan is the licence attached to the audio the tool produces. Files generated on a Personal, Mobile or EDU plan are licensed for your own private listening and may not be redistributed. Only audio produced under a paid Commercial subscription carries a licence for public and commercial use. For personal data, the privacy policy states that Naturalsoft Ltd acts as the data controller.

Reuse rights

What you may do with the audio depends entirely on the plan. Under the Personal, Mobile and EDU versions, files are licensed for private listening only: they cannot be published on a website or in a YouTube video, redistributed, or made available to other people or systems. The publisher spells out that internal and non-profit uses, such as training videos or messaging systems, still require a commercial licence. A paid NaturalReader Commercial subscription lifts that restriction and licenses the audio for public, business and commercial use, including advertising, e-learning, podcasts and audiobooks. On the vendor side, uploaded documents are used only to generate audio, never to train AI models, and are never sold to advertisers.

Data retention & training

Hosting summary

The privacy policy states plainly that users located outside Canada and the United States have their data, including personal data, transferred to Canada and processed there. Canada is therefore the jurisdiction governing the processing, and no European hosting option or regional data residency choice is documented anywhere on the site. No data centre, cloud provider or hosting certification is named: the homepage shows 'Data Privacy', 'Security Certified' and 'Encrypted' badges, but no standard such as SOC 2 or ISO 27001 is cited to support them. Technically, the domain resolves to an Amazon address served from a Zurich edge node and images are delivered from an Amazon S3 bucket, which points to a content delivery network rather than to the actual location of stored user data. Organisations subject to EU data residency requirements should note the gap between the GDPR compliance claim displayed on the site and the absence of an EU processing option, a data processing agreement or a published list of subprocessors.