Privacy policy
Effective Date: April 28, 2026
Last Updated: April 28, 2026
This Privacy Policy explains how Podonos, Inc. ("Onepin," "we," "us," or "our") collects, uses, shares, and protects information when you use the Onepin website at onepin.ai, our APIs, dashboards, and related services (collectively, the "Services").
Onepin is a voice AI orchestration platform. We help customers find, generate, and validate voice outputs by routing requests across third-party text-to-speech ("TTS") engines, internal validation models, and underlying voice AI providers (including those that support voice cloning). Because of how the Services work, we want to be especially clear about how we treat audio and voice samples you submit.
If you have questions about this Policy, contact us at privacy@onepin.ai.
1. Scope and roles
This Policy covers personal information processed in connection with:
- Visitors to onepin.ai
- People who create an Onepin account
- Customers using the Services on Free, Paid, or Enterprise plans
- Individuals whose voice recordings are submitted to the Services (for example, voice talent uploaded by a customer for validation or voice cloning)
When a customer submits content (including audio of third parties) to the Services, Onepin generally acts as a data processor on that customer's behalf and processes the content under our Terms of Service and any Data Processing Addendum ("DPA") executed with that customer. When we collect information directly from website visitors and account holders for our own purposes, we act as a data controller.
Where the customer is the controller of personal information you provide through their use of the Services, please direct privacy questions to that customer first.
2. Information we collect
2.1 Information you provide
- Account information. Your name and email address. We do not collect or store passwords; authentication is provided by a third-party identity provider such as Google (see Section 2.3). We do not require, request, or store your mailing address, company name, or job title at signup.
- Billing information. We do not collect or store payment card details, bank account information, or billing addresses. Payments are processed by Stripe, Inc. under Stripe's terms and privacy policy. We receive only the limited transaction metadata Stripe returns to us (such as a token, transaction status, last four digits of the card, and country) for purposes of provisioning your plan and reconciling invoices.
- Communications. Messages you send to support, sales, or community channels, including attachments.
- Customer Content. The data you submit to the Services, including text in any format (plain text, CSV, JSON, or other text formats), prompts, pronunciation dictionaries, validation criteria, configuration settings, audio files, video files, and other media data. Customer Content also includes the audio outputs the Services generate and return to you, and validation results.
- Voice Recordings. Audio samples that contain a person's voice and that you submit to the Services so we can process them and route them to underlying voice AI providers (for example, to generate or validate audio in a particular voice). Voice Recordings are treated as biometric information (see Section 4).
2.2 Information collected automatically
- Usage data. Pages viewed, features used, API endpoints called, request volumes, latency and error metrics, and similar telemetry.
- Device and connection data. IP address, browser type and version, operating system, device identifiers, time zone, and language settings.
- Cookies and similar technologies. Used for authentication, session continuity, security, analytics, and remembering preferences. You can manage non-essential cookies through your browser or our cookie banner.
2.3 Information from other sources
- Identity providers. Authentication is handled through Google or other third-party sign-in providers we may add over time. When you sign in, we receive only the basic profile information you authorize the provider to share with us (typically your name, email address, and a stable user identifier). We do not receive your password, and we do not create or store an Onepin password for you.
- Referrals and integrations. If a third-party service connects to the Services on your behalf, we may receive the data needed to deliver the integration.
We do not knowingly collect special-category information (such as health, religious, or political data) other than voice biometric data described in Section 4.
3. How we use information
We use information for the following purposes:
- Provide the Services. Authenticate you (via Google or another third-party sign-in provider), route TTS requests to selected providers, generate and return outputs, run validation, store your projects, and operate dashboards and APIs.
- Validate and correct outputs. Run validation on outputs and apply automated correction (including pronunciation detection and our automatic audio corrector) to improve quality before returning results to you. The validation dimensions we run, and the correction systems we apply, may change over time as we improve the Services. These systems may produce errors; see our AI output disclaimer in the Terms of Service.
- Bill and manage accounts. Calculate usage, generate invoices, and reconcile payments processed by Stripe.
- Communicate with you. Send service notices, respond to support requests, deliver feature announcements, and (where permitted) marketing messages you can unsubscribe from at any time.
- Improve the Services. Investigate bugs, monitor performance, analyze aggregate usage patterns, and develop new features. Improvement work uses aggregate or de-identified data; see Section 5 on model training.
- Maintain security and prevent abuse. Detect fraud, unauthorized access, and violations of our Acceptable Use Policy; investigate complaints; enforce our Terms of Service.
- Comply with law. Meet legal, tax, accounting, and regulatory obligations and respond to lawful requests from authorities.
Our legal bases under the GDPR are: performance of a contract (operating the Services for you), legitimate interests (security, product improvement), legal obligation (tax and compliance), and consent (cookies, voice biometric processing, optional marketing).
4. Voice and biometric data
We treat Voice Recordings you submit to the Services as biometric information and as a special category of personal data under the GDPR and applicable U.S. state laws (including the Illinois Biometric Information Privacy Act). Onepin does not train, fine-tune, or otherwise build machine-learning models on your Voice Recordings; we process them only to provide the Services to you, including by routing them to the underlying voice AI providers selected to handle your request.
Lawful basis and consent. When you submit a Voice Recording, you confirm and warrant that you have obtained express written consent from every individual whose voice appears in the recording, authorizing Onepin to (a) process the recording and (b) route the recording to one or more underlying voice AI providers to generate, validate, or otherwise produce audio outputs returned to you. Our Terms of Service describe these obligations in more detail.
No model training. We do not use Voice Recordings to train Onepin's general voice or validation models. We engage underlying voice AI providers under contracts that, where reasonably available, restrict the use of Voice Recordings for the providers' own model training. Voice Recordings are used only to provide the Services to the customer that submitted them.
Access controls. Voice Recordings are associated only with the customer account that submitted them and are not shared with other customers. Access by Onepin personnel is limited to authorized engineers and support staff with a need to know, for purposes such as fixing reported bugs, responding to support requests, or investigating policy violations.
Retention. Unless you request earlier deletion, we retain Voice Recordings only for as long as needed to provide the Services to you, in accordance with the retention period applicable to your plan, and in any event for no longer than three (3) years after your last interaction with the recording. Upon termination of your account, we delete or de-identify Voice Recordings within the period stated in your applicable agreement (typically 30 days), subject to backup retention windows.
Voice clones held by third-party providers. Some voice cloning features rely on underlying third-party voice AI providers that may create or maintain a voice clone or other voice representation on their own infrastructure. Where this happens, the third party operates as our sub-processor under terms that protect your rights, but the underlying voice representation is held and managed by that provider. Onepin does not store, host, or train its own voice clone of you.
Children's voices. You may not submit a Voice Recording of a person under the age of 18 unless your enterprise agreement explicitly permits it and you have obtained verifiable parental or guardian consent.
If you are an individual whose voice has been submitted to the Services without your authorization, contact privacy@onepin.ai so we can investigate and, where appropriate, delete the recording and any associated outputs.
5. AI model training
We do not use Customer Content (including audio inputs, scripts, and Voice Recordings) to train, fine-tune, or improve Onepin's foundation models, validation models, or any third party's AI models. This applies to Free, Paid, and Enterprise customers.
We may use aggregate or de-identified usage information (for example, anonymized latency, error rates, language coverage statistics, and routing performance metrics) to improve the Services, including the quality and accuracy of our routing and validation systems. Aggregate data is not linked back to you, your customers, or any individual.
Third-party TTS providers and other model vendors that we route requests to operate under their own terms. We engage them under contracts that, where reasonably available, restrict the use of your content for their own model training. Because the underlying model marketplace is dynamic, we cannot guarantee the practices of every routed provider. The categories of providers we use, and the protections we have negotiated where applicable, are summarized in our sub-processor categories list described in Section 6.
6. How we share information
We do not sell personal information. We share information only as described below:
- Sub-processors. We share information with vendors that help us operate the Services, including cloud hosting, content delivery, observability, payments, customer support, and third-party voice AI engines. Categories include:
- Cloud infrastructure and storage
- Database and object storage providers
- Observability, logging, and error reporting services
- Payment processing (PCI-DSS compliant providers)
- Email delivery and customer messaging
- Customer support and ticketing platforms
- Third-party voice AI providers, including (without limitation) leading commercial TTS engines such as ElevenLabs, Cartesia, Google Cloud Text-to-Speech, Microsoft Azure Speech, Amazon Polly, OpenAI, and a rotating set of additional providers selected for quality, language coverage, and cost
- Speech validation and analytics providers, including human reviewers where applicable
A current list of sub-processor categories is maintained at onepin.ai/subprocessors. Enterprise customers may request the named vendor list under a Data Processing Addendum.
- Customers and end users. If you are an end user of an Onepin customer, the customer controls how your information is used in connection with their application.
- Affiliates. Our corporate affiliates, where they help us operate the Services, under terms consistent with this Policy.
- Professional advisors. Lawyers, auditors, accountants, and similar advisors, under confidentiality obligations.
- Legal and safety. Government authorities and others when required by law, court order, or to enforce our agreements, protect our rights or property, or address fraud, security, or technical issues.
- Business transactions. In connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to confidentiality and continuity protections.
We never share Voice Recordings with anyone other than the sub-processors needed to provide the Services to you.
7. International data transfers
The Services are operated from the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States and other countries where we or our sub-processors operate. These countries may have data protection laws that differ from your country.
Where required, we rely on appropriate transfer mechanisms, including the European Commission's Standard Contractual Clauses (and the UK Addendum and Swiss adjustments where applicable) for transfers from the EEA, the United Kingdom, and Switzerland. A copy of the relevant clauses is available on request to privacy@onepin.ai.
8. Data retention
We retain personal information and Customer Content only as long as we need it to provide the Services to you, to meet our legal and accounting obligations, and to enforce our agreements. The current default retention period for each pricing plan, and the retention period for Voice Recordings, is described on our pricing page or in your Enterprise Agreement.
Notification of changes. We may change the default retention period for any pricing plan from time to time. We will notify existing customers by email and in-product notice at least thirty (30) days before any such change takes effect. The notice will identify the affected plan, the prior and new retention periods, and the effective date.
Account-level retention. Account information, billing records, and tax-related data are retained for at least seven (7) years for legal and accounting purposes. Backup copies may persist for a limited additional period after primary deletion.
You can delete most Customer Content from your account at any time. Some content may persist briefly in backups before being purged.
9. Your privacy choices and rights
Depending on where you live, you may have rights to:
- Access personal information we hold about you.
- Correct inaccurate or incomplete information.
- Delete personal information, subject to legal exceptions.
- Object to or restrict certain processing.
- Port a copy of personal information you provided to us in a structured, commonly used format.
- Withdraw consent where processing is based on consent (such as voice biometric processing). Withdrawal does not affect prior lawful processing.
- Opt out of marketing by clicking the unsubscribe link in any marketing email.
- Opt out of certain cookies through our cookie banner or browser controls.
- Lodge a complaint with your local data protection authority.
For California, Colorado, Connecticut, Utah, Virginia, and other U.S. state law residents, you have additional rights including the right to know, the right to delete, the right to correct, and the right to opt out of "sale" or "sharing" (we do not engage in either as defined by these laws). California residents under 16 may opt out of any future "sale" or "sharing."
To exercise any of these rights, email privacy@onepin.ai. We will respond within the time required by applicable law (typically 30 to 45 days). We may need to verify your identity before acting on a request. If your information was submitted to the Services by an Onepin customer, we will refer your request to that customer.
10. Children
The Services are not intended for, and we do not knowingly collect personal information from, individuals under the age of eighteen (18). If you believe a child has provided us with personal information, contact privacy@onepin.ai and we will take steps to delete it.
11. Security
We maintain administrative, technical, and physical safeguards designed to protect personal information, including:
- Encryption in transit (TLS) and at rest for Customer Content and Voice Recordings
- Role-based access controls and least-privilege provisioning for personnel
- Logging and monitoring of access to Customer Content
- Regular vulnerability scanning and third-party security testing
- Vendor security review for sub-processors
Despite these measures, no system is perfectly secure. If you become aware of a security issue or vulnerability, please report it to security@onepin.ai.
12. Automated decision-making
We do not use your personal information to make decisions that produce legal or similarly significant effects on you without meaningful human involvement.
13. Changes to this Policy
We may update this Policy from time to time. If we make a material change, we will notify you by email or through the Services at least thirty (30) days before the change takes effect (except where a shorter period is required by law). The "Effective Date" at the top of this Policy reflects the latest revision. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.
14. How to contact us
For privacy questions, requests, or complaints:
- Privacy: privacy@onepin.ai
- Security: security@onepin.ai
- General inquiries: hello@onepin.ai