Privacy Policy

1. Who We Are

Escalera Labs S.L. ("Echo", "we", "us", "our") is the data controller responsible for the processing of your personal data. We operate the voicechanger.live website and the Echo desktop application (collectively, "Echo Products").

This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your personal data. It applies to all Echo Products, including the desktop application, browser-based tools, and our website.

The most important thing to know: Echo processes your voice audio entirely on your local device. We do not upload, store, transmit, or listen to your voice data. Your voice never leaves your computer.

2. Information We Collect

2.1 Information You Provide

• Account Information: When you register, we collect your email address and display name. If you sign in via Google OAuth, we receive your name, email address, and profile picture from Google. We do not receive or store your Google password.
• Waitlist Information: If you join our Alpha waitlist, we collect your email address and the source (which page you signed up from).
• Support Communications: If you contact us for support, we collect the content of your messages and any information you provide to help resolve your issue.

2.2 Information Collected Automatically

• Website Analytics: We use privacy-focused analytics to understand how visitors interact with voicechanger.live. This includes anonymized page views, referral sources, browser type, and approximate geographic region. We do not use this data to identify individual users.
• Desktop App Diagnostics (Alpha only): During the Alpha period, the Echo desktop app may collect anonymized crash reports and performance diagnostics (error type, stack trace, OS version, GPU model) to help us fix bugs. This data does not include any audio, voice recordings, or personally identifiable information. You can disable diagnostics in Settings.

2.3 Information We Do NOT Collect

• Voice audio: Echo processes all audio locally on your device. Your voice is never transmitted to our servers. We do not listen to, record, store, or analyze your voice data.
• Microphone access (website): Our browser-based tools request microphone access solely for client-side audio processing (mic test, voice recorder). Audio is processed in your browser and is never uploaded to our servers.
• Voice models: Voice models you import into Echo are stored locally on your device. We do not have access to your imported models.
• Third-party app data: We do not access or collect data from third-party applications you use with Echo (Discord, games, streaming software, etc.).

3. How We Use Your Information

We use the information we collect for the following purposes:

• Account Management: To create and manage your account, authenticate your identity, and provide access to Echo Products.
• Service Delivery: To provide, maintain, and improve Echo Products, including delivering software updates and new features.
• Product Improvement: To analyze anonymized usage patterns and crash reports to fix bugs, optimize performance, and develop new features.
• Communications: To send product updates, release announcements, and important service notifications. You can opt out of non-essential communications at any time.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal data under the following legal bases:

• Contract Performance: Processing necessary to provide you with Echo Products and manage your account (Article 6(1)(b) GDPR).
• Legitimate Interests: Processing for product improvement, security, and analytics, where our interests do not override your rights (Article 6(1)(f) GDPR).
• Consent: Where you have given explicit consent, such as for marketing communications or optional diagnostics (Article 6(1)(a) GDPR). You may withdraw consent at any time.
• Legal Obligation: Where processing is required to comply with applicable laws (Article 6(1)(c) GDPR).

5. Who We Share Your Data With

We do not sell your personal data. We may share limited data with the following categories of service providers, solely to operate Echo Products:

• Supabase — database hosting and authentication infrastructure (account data, encrypted credentials)
• Vercel — website hosting and serverless function execution
• Google — OAuth sign-in provider (only when you choose Google sign-in); website analytics

All service providers are contractually required to process your data only on our instructions and to maintain appropriate security measures. We do not share your data with advertisers or data brokers.

We may disclose your data if required by law, court order, or governmental regulation, or if necessary to protect our rights, property, or the safety of our users or the public.

6. Data Storage & Security

Your account data is stored on Supabase infrastructure with encryption at rest and in transit. Passwords are hashed using industry-standard algorithms. All data transmission between your browser and our servers uses HTTPS/TLS encryption.

While we implement commercially reasonable security measures, no system is 100% secure. In the event of a data breach that may affect your personal data, we will notify you and the relevant supervisory authority in accordance with applicable law.

7. Data Retention

We retain your personal data for as long as necessary to provide Echo Products and fulfill the purposes described in this policy. Specifically:

• Account data: Retained for the lifetime of your account. Deleted within 30 days of account deletion request.
• Waitlist data: Retained until the Alpha period ends or you request removal.
• Crash reports: Anonymized and retained for up to 90 days for debugging purposes, then deleted.
• Analytics data: Aggregated and anonymized — not linked to individual accounts.

We may retain certain data beyond these periods where required by law (e.g., tax records, legal obligations).

8. International Data Transfers

Escalera Labs S.L. is based in Spain (EU). Some of our service providers operate in the United States and other countries. When your data is transferred outside the EEA, we ensure adequate protection through:

• European Commission Standard Contractual Clauses (SCCs)
• Adequacy decisions by the European Commission
• Appropriate contractual safeguards with each provider

9. Cookies & Tracking

We use a minimal set of cookies:

• Essential cookies: Required for authentication (session tokens) and core website functionality. These cannot be disabled.
• Analytics cookies: Used to collect anonymized usage statistics. You can disable these in your browser settings or through our cookie preferences.

We do not use advertising cookies, tracking pixels, or third-party marketing trackers.

10. Your Rights

Regardless of your location, we extend the following rights to all users, based on the protections of the EU General Data Protection Regulation (GDPR):

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Restriction: Request that we limit processing of your data in certain circumstances.
• Data Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Withdraw any previously given consent at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@voicechanger.live. We will respond within 30 days.

For EU/EEA residents: You have the right to lodge a complaint with your local data protection supervisory authority. As Escalera Labs S.L. is based in Spain, you may also contact the Agencia Española de Protección de Datos (AEPD).

11. Children's Privacy

Echo Products are not directed at individuals under 16 years of age. We do not knowingly collect personal data from children under 16. If we learn that we have collected personal data from a child under 16 without parental consent, we will delete that data promptly. If you believe a child under 16 has provided us with personal data, please contact us at privacy@voicechanger.live.

12. Local Audio Processing

Echo's core voice conversion and DSP processing happens entirely on your local device. This section clarifies what this means for your privacy:

• Your microphone audio is captured by Echo, processed by local AI models and DSP effects, and output to a virtual audio device — all on your computer
• No audio data is transmitted over the internet to Echo servers at any point during voice processing
• Voice models (.onnx files) are stored locally on your device and are not uploaded to our servers
• Browser-based audio tools (mic test, voice recorder, stem splitter, etc.) process audio client-side using WebAssembly — audio files are not uploaded unless you explicitly choose to share them

This architecture means that even if our servers were compromised, your voice data would not be at risk — because we never had it in the first place.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Echo Products. Material changes will be communicated via email or a prominent notice on our website. The "Last updated" date at the top of this page indicates when the policy was last revised.

We encourage you to review this policy periodically. Your continued use of Echo Products after changes take effect constitutes acceptance of the updated policy.

14. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights:

Data Controller: Escalera Labs S.L.
Privacy inquiries: privacy@voicechanger.live
General legal: legal@voicechanger.live