Privacy Policy

1. Who we are and what this policy covers

Rebel Audio, Inc. ("Rebel Audio", "we", "us") operates the Rebel Audio website and web app: tools for recording, uploading, importing, transcribing, editing, dubbing, scoring, clipping, hosting and publishing podcasts, with analytics, a show email address and team workspaces. This policy explains what personal data we collect, why, who we share it with, how long we keep it and what rights you have. It covers:

• account holders and the members of their workspaces ("you");
• people who appear in recordings or are credited on a show without holding an account ("guests");
• people who listen to or watch published shows and clips ("listeners");
• visitors to our website and public pages ("visitors").

Rebel Audio is the controller of personal data about account holders, visitors and listeners. For personal data that you put into the Service about other people — the voices and images in your recordings, the guests and crew you credit, the mail your show receives — you are the controller and we process it on your instructions (section 8). For anything in this policy, write to engineering@rebelaudio.ai.

2. What we collect

2.1 What you give us

• Account. Your name, email address, profile photo, username and how you sign in: with your email address (a code, a link or a password) or with Google. Sign-in is provided by Clerk, which stores your credentials and session tokens for us; we never see your password.
• Workspaces and team members. The name of each workspace, who belongs to it and with which role, and the email addresses you invite.
• Billing. Payments are processed by Stripe. We receive your plan, subscription status, add-on purchases, invoice history, billing address, and the card's brand, last four digits and expiry. We never store a full card number.
• Payouts. If you are paid creator earnings (for example your share of Spotify ad money), Stripe collects your bank details, identity and tax information in its own payout onboarding (Stripe Connect). We do not receive or store them. We store the identifier of your Stripe payout account, its country, its status (for example whether payouts are on, and the names of any details Stripe still needs, never their values), and a record of what you earned and what we paid you.
• Your content. The audio, video, artwork, titles, descriptions, show notes and other material you upload, import, record or create, and everything the Service produces from it at your request: transcripts with speaker labels, edits, rendered episodes, dubs, generated music, clips, drafts and generated images.
• People on your show. The hosts, guests and crew you credit on a show — names, roles, contact details, headshots and links — so credits can be published in your feed and on your show pages.
• Show email. If you give a show a Rebel-issued email address, the messages sent to it, which we forward to the address you choose and show in the show's inbox.
• Onboarding answers and surveys. What you are here to do, how you heard about us, what kind of creator you are and your audience size; and, if you answer an in-product survey, your score or choice and any comment you write.
• Ask Rebel and what Rebel remembers. The messages you send Ask Rebel, its answers, and the drafts it writes for you are saved with your account so you can come back to a conversation. Rebel also notices facts, preferences and decisions that you state in your own messages to Ask Rebel (for example who your audience is, or a kind of title you never want), and remembers them so it does not ask twice. It does not remember what Ask Rebel reads about your shows, what is said in your episodes, or a question you ask. This memory is on by default. In Settings › Rebel AI › "What Rebel remembers" you can see each remembered item, forget any of them, and switch memory off. When memory is off, nothing new is remembered and nothing remembered is used, but what is already there stays until you forget it. When you mark a draft "This version is good" or "This version isn't right", that choice and the reasons you pick are kept with the draft. Reasons you give more than once become preferences Rebel follows when it writes for you; you can see and forget them in Settings › Rebel AI › "How Rebel writes for you".
• AI tools. What you give the AI tools and what they make. For guest prep: the guest's name and the notes and links you enter about them (we do not open the links), and the bio, talking points and questions it writes. For the episode coach, listener kits and course outlines: the transcripts of the episodes you choose, and the scores, quizzes, key points and outlines made from them. These are saved with your account; a listener kit you show on an episode's public page can be seen by anyone. To let Ask Rebel find what was said in your episodes, we store a searchable index of your transcripts (numeric representations of short passages) in our own Amazon Web Services storage; it is deleted with the episode or your account.
• Support and communications. Support and bug requests, feedback, and any email you send us, with their attachments.
• Settings. Your theme, notification preferences, default public contact email and the other preferences you set.

2.2 Voices

Everything we do starts with recordings, so we process the voices of everyone who speaks in them. Transcription produces text and a speaker label for each passage ("Speaker 1", "Speaker 2", or the name you give). Speaker labelling tells speakers apart within one recording only. We do not create or keep a voice print, a biometric template or any identifier that could recognise a person in another recording, and we do not ask our provider to; nothing from speaker labelling is kept except the labels in the transcript.

Dubbing does not copy voices either. When you dub an episode into another language, we send the episode's audio to our dubbing provider, ElevenLabs, which translates the speech and reads it with ready-made AI voices from its library. We tell the provider not to clone any voice, so we make and keep no voice print, voice model or likeness of anyone's voice. ElevenLabs processes the audio under terms that do not allow it to use your audio to train its AI. It may keep a copy for a limited time under those terms; for dubs, we ask it to delete the project as soon as the dub is ready (or fails or is cancelled), and we ask again if that request fails. The dubbed audio is then part of your content. Our consent records have a dedicated record type for voice cloning, which nobody can give today. If we ever offer dubbing in a speaker's own voice, we will ask each speaker for that separate, explicit consent first.

2.3 What we collect automatically

• Device and connection: IP address, browser and operating system, language, screen size, and the time of each request.
• Usage: the pages and features you use, the actions you take in the app, upload, processing and publishing outcomes, errors, and how much of your plan you have used.
• Server logs: requests, timestamps, referring URLs and diagnostic information, kept for security and to run the Service (section 10).
• Approximate location: the country and region derived from your IP address. We never collect precise location.
• Cookies and browser storage: as described in the Cookie Policy.

Analytics and consent. Before you make a choice in our cookie banner, or if you decline, we may count visits without cookies: which pages are viewed, where the visit came from, a few clicks on our marketing pages, and what happens on a shared clip's page (opened, played, reacted to, passed on, show followed). Nothing is stored on or read from your device for this beyond what every browser sends with a page request, and no identifier is stored on your device; our analytics provider groups page views into a visit with a one-way hash that changes every day. We do not do this where the law of your region requires consent for it, or when your browser sends the Global Privacy Control signal. Analytics cookies, masked session recordings and anything tied to your account start only after you accept analytics, and you can change your choice at any time.

2.4 Guests and other people in your content

When you upload, import or record content in which other people appear, we process their voices and images, and any name or details you add about them (for example as the people credited on your show). We process this on your instructions; you are responsible for telling them and for getting the consents the law requires before you record, credit, dub or publish them (section 8).

2.5 Listeners

When someone plays a published episode or clip — through a podcast app reading the show's feed, the public episode or clip page, or the embeddable player — our servers and our delivery provider receive the listener's IP address and user agent. We use them to count downloads and plays to industry measurement standards (the IAB Podcast Measurement Guidelines) and to prevent abuse. The IP address is replaced with two one-way hashes: one under a key that changes every day, used to count downloads, and one under a key that changes every calendar month, used only to count how many different listeners a show had in that month. With the daily hash we keep the listener's approximate country and region, the network the request came from, the user agent the app sent and, for our own player, how far the clip or episode was played. From the monthly hash we keep one further one-way value per listener per day, and nothing else. Raw delivery logs, which carry the IP address before hashing, are kept for no more than 30 days; the hashed, derived records are kept for up to 400 days so show owners can see trends over a year. Our delivery provider, Cloudflare, also keeps a short record of each request for an episode or clip file in its own analytics store: the daily hash, the show and episode, the listener's approximate country, the name of the app that made the request, and how much was delivered. We use it to show how many people are listening right now and to check our daily counts, and Cloudflare keeps it for three months. Show owners see aggregated statistics only, never an individual listener. A listener who reacts to a shared clip is counted without an identifier.

2.6 Connected services

If you connect YouTube, Spotify, Google Drive or Dropbox, or let us submit your show to Apple Podcasts, we receive what those services share for the features you use: channel or account identifiers and names, the identifiers and status of what we published for you, statistics for it where you allow them, and the files you pick to import. The permissions you grant control what we can see. Google user data is covered in detail in section 6 and Dropbox in section 7; Spotify and Apple data is limited to your show's listing and the listening statistics those platforms report for it.

3. Why we use it, and on what legal basis

We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not use your content or any Google or Dropbox data for advertising. We do not make decisions about you by automated means that have legal or similarly significant effects.

4. Automated processing and AI

Transcription, speaker labelling, translation, dubbing, music generation, clip suggestion, drafting, the episode coach, listener kits, course outlines, guest prep and the Ask Rebel assistant are performed by automated systems, including third-party AI providers acting as our processors: ElevenLabs for transcription, dubbing and music, and models on Amazon Bedrock for language and image generation. When Bedrock cannot answer a text request, the request can go instead to a model from Anthropic or OpenAI through OpenRouter; we tell OpenRouter to send it only to model providers that do not keep it or use it to train AI. Your media and text are sent to these providers only to produce the output you asked for, under terms that do not allow them to use it to train their AI. Amazon Bedrock does not keep what we send it. ElevenLabs processes your audio under terms that do not allow it to use your audio to train its AI. It may keep a copy for a limited time under those terms; for dubs, we ask it to delete the project as soon as the dub is ready. Every AI output is a draft you control: nothing is published until you choose to publish it, and you can edit or delete any output.

We do not train AI on your data. We do not use your content, your voice, your transcripts, your survey answers or anything else about you to train or improve our own or anyone else's machine-learning models, and we do not allow our providers to. This includes files you import from Google Drive and Dropbox (sections 6 and 7).

5. Who we share it with

We share personal data only with the companies below, when you direct us to, and when the law requires. Every subprocessor is bound by a written agreement to process data only on our instructions and only for the service it provides. Platforms you publish to or connect (Google/YouTube, Spotify, Apple) and the Podcast Index receive data as independent companies under their own terms and privacy policies.

• Our subprocessors. Amazon Web Services (hosting, storage, media processing, AI models, email), Cloudflare (delivery of published media), Clerk (identity), Stripe (billing and creator payouts), ElevenLabs (transcription, dubbing, music), OpenRouter (a back-up route to AI models), Google (sign-in and Google Drive import), Dropbox (import), PostHog (product analytics, after consent) and Slack (internal support alerts, without your content).
• Other companies that receive data when you use a feature. Google (YouTube publishing and statistics), Spotify and Apple (distribution) and the Podcast Index (finding a show when you import one), each under its own terms and privacy policy. The subprocessors page, the list of companies that handle personal data for us, says what each one does, which data it handles and where, and is where we announce changes.
• At your direction. When you publish to your feed, a public page or a connected platform, share a clip link, forward show email, or invite a team member, the data goes where you sent it, and from then on the receiving platform's or person's own terms apply to that copy.
• Your workspace. Members of a workspace see its shows, episodes, credits, statistics, inbox and, depending on their role, its billing and connections.
• The law. Authorities, courts or others where the law requires it, to enforce our Terms, or to protect the rights, safety and property of Rebel Audio, our users or the public. We tell affected users about legal demands for their data where the law allows, and we challenge requests that are overly broad.
• A successor. In a merger, acquisition, financing or sale of assets, your data may be transferred to the successor under the same protections, and we notify you before it becomes subject to a different privacy policy.
• Aggregated data. We may share statistics that cannot reasonably identify anyone, for example how many shows or episodes Rebel Audio hosts.

6. Google user data (Google sign-in, YouTube and Google Drive)

This section explains what Rebel Audio accesses when you sign in with Google or connect YouTube or Google Drive, what we do with it, how we store it and how you can remove it. It applies to all information we receive from Google APIs ("Google user data"). Nothing elsewhere in this policy permits a use of Google user data that this section rules out.

(a) Sign in with Google. If you choose to continue with Google, Google shares your name, email address, profile picture and Google account identifier with us through our sign-in provider, Clerk (Google's basic openid, email and profile permissions). We use them only to create your Rebel Audio account, sign you in, show your name and picture in the app and send you messages about your account. Signing in with Google does not give Rebel Audio access to your YouTube channel, your Google Drive or any other Google data.

(b) YouTube. Rebel Audio uses YouTube API Services. If you connect a YouTube channel in Settings › Connections, we ask for the https://www.googleapis.com/auth/youtube permission and use it only to:

• read the connected channel's identifier, name and upload eligibility, and its playlists, so you can choose where to publish;
• upload the episodes and clips (including Shorts) that you choose to publish, with the title, description and privacy setting (private, unlisted or public) you set in Rebel Audio;
• create a playlist for your show when you ask us to (with your show's artwork), or add your new uploads to an existing playlist you link;
• check the processing status of videos Rebel Audio uploaded and, when you ask, change their title, description or privacy (for example, set a video to Private when you unpublish it) or delete them.

Rebel Audio never edits, hides or deletes videos or playlists it did not create (the only change it makes to a playlist you link is adding your new uploads to it), never changes your channel settings, branding or monetisation, never reads, posts or moderates comments, and never likes, rates or subscribes on your behalf. By connecting YouTube or publishing to YouTube through Rebel Audio, you agree to be bound by the YouTube Terms of Service. Google's use of your information is described in the Google Privacy Policy.

(c) YouTube Analytics (optional). If you also allow the read-only https://www.googleapis.com/auth/yt-analytics.readonly permission, we read daily views, watch time, average percentage viewed and subscribers gained and lost for the videos Rebel Audio uploaded, and show them to you and your workspace in Rebel Audio next to your other show statistics. We never query your channel's other videos and never read revenue reports. Publishing works without this permission.

(d) Google Drive. To import audio or video into an episode, you pick files in Google's own file picker. We ask for the https://www.googleapis.com/auth/drive.file permission, which lets us open only the files you pick: we cannot see, list or open anything else in your Drive. We read each picked file's name, size and type, download a copy once into your episode in our private storage, and never write to, move or delete anything in your Drive.

(e) What we store, and where.

• Access tokens. The OAuth refresh and access tokens for your YouTube and Google Drive connections are encrypted at rest with keys held in AWS Key Management Service, in our Amazon Web Services infrastructure in the United States (US West, Oregon). Only the Rebel Audio service that publishes or imports for you can decrypt them. We keep them until you disconnect, remove our access or confirm that you want to delete your account; then they are deleted at once (see (g) for backups).
• YouTube. The connected channel's identifier and name, the playlist you link, the identifiers, links and status of the videos Rebel Audio uploaded for you and, if you allowed analytics, the daily statistics described in (c). We refresh those statistics every day while you are connected, and delete them if we cannot refresh them for 30 days.
• Google Drive. The identifiers of the files you picked, kept with the import, and the copy of each file, which becomes part of your episode and is kept like any media you upload (see section 10).
• Sign-in profile. Your name, email address and profile picture, kept with your account for as long as it is open.

(f) How we use and share Google user data. We use Google user data only to provide and improve the features described above, which you can see and control in Rebel Audio.

• We do not sell Google user data.
• We do not use Google user data for advertising, including personalised, retargeted or interest-based advertising.
• We do not use Google user data, including files you import from Google Drive, to develop, improve or train generalised or non-personalised artificial intelligence or machine-learning models, and we do not transfer it to anyone for that purpose.
• We transfer Google user data only: to YouTube, when you publish; to the service providers listed in section 5 that host and process it for us under written agreements, only to provide the features you use (for example, when you ask us to transcribe a file you imported from Google Drive); when you ask us to; as necessary to comply with applicable law or to protect the security of our users and the service; or as part of a merger, acquisition or sale of assets, after notice to you.
• People at Rebel Audio do not read Google user data unless you give us permission (for example, in a support request), it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or it has been aggregated and anonymised for internal operations.
• Within your workspace, members with the Editor role or above can publish to a connected YouTube channel; only Admins and Owners can connect or disconnect it.

(g) Removing access and deleting your data.

• Disconnect in Rebel Audio. In Settings › Connections, choose Disconnect. We delete the stored tokens, stop future publishes and imports from that connection, and ask Google to revoke Rebel Audio's access. Because YouTube and Google Drive share one Google grant, the revoke is made when your last Google connection with us is disconnected.
• Remove access at Google. You can remove Rebel Audio's access at any time at https://myaccount.google.com/permissions. Rebel Audio detects the revocation, marks the connection as disconnected and deletes the YouTube statistics it stored.
• What stays. Disconnecting does not remove videos already published to your channel; manage them in YouTube, or delete them from Rebel Audio before you disconnect. The record of what you published stays with your show until you delete the show or your account, or ask us to delete it; the YouTube video identifiers and links in it are then deleted within 7 days. YouTube statistics do not stay: we delete them as soon as you disconnect, remove our access at Google, turn off analytics access or delete the show, and always within 7 days.
• Deleting your account. When you confirm that you want to delete your Rebel Audio account, we do not wait for the 7-day window in which you can still change your mind: we disconnect every YouTube and Google Drive connection you made at once, ask Google to revoke Rebel Audio's access, and delete the stored tokens, your channel's name and identifier, your YouTube statistics and the YouTube video identifiers and links in the record of what you published. The same goes for the workspaces deleted with your account. If you keep your account, you reconnect them in Settings › Connections. The rest of your account, including the rest of that record, your sign-in profile and the files you imported from Google Drive, is erased when that 7-day window ends.
• Asking us to delete it. To have your YouTube data or other Google user data deleted without deleting your account, disconnect in Settings › Connections, which takes effect at once, or email engineering@rebelaudio.ai. We delete it within 7 days of verifying your request.
• What deletion does not touch. Deleting the data Rebel Audio stores does not change anything stored by YouTube or Google: videos on your channel and files in your Drive stay where they are. To delete them, use YouTube or Google Drive.
• Backups. Deleted data can remain in our encrypted database backups for up to 35 days, until those backups expire. We keep backups only to recover the service after a failure and do not use them for anything else.

(h) Limited Use. Rebel Audio's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.

7. Dropbox: files you import

You can import audio and video into an episode from your Dropbox account through Dropbox's own file chooser. The permission Dropbox grants our app is read-only access to your files; we use it only to read the files you pick, we never list, browse, write to, move or delete anything else in your Dropbox, and the chooser is the only way we learn a file exists. For each picked file we read its name, size, type and revision and copy it once into our private storage, where it becomes part of your episode and is kept like any media you upload (section 10). The access token for the connection is encrypted with keys held in AWS Key Management Service and is deleted when you disconnect in Settings › Connections or revoke our access in Dropbox's connected-apps settings; an import in progress from that account then stops. We do not sell data from Dropbox, do not use it for advertising or AI training, and do not share it except with the providers in section 5 that process it for you.

8. Content about other people

Your recordings, your credits and your show's inbox contain personal data about people other than you. By putting it into the Service you confirm that you may do so: that the people in a recording know they are being recorded and published, that the people you credit have agreed to be credited with the details you enter, and that everyone whose words are dubbed has agreed to that. We process this data on your instructions and delete it when you delete the content or your account. If someone asks us to remove their data from your content we refer the request to you and, where the law requires, act on it directly. Where you are the controller, our Data Processing Addendum forms part of the Terms and governs our processing for you.

9. Cookies and browser storage

We use strictly necessary cookies and storage (sign-in, your consent choice, the media and edits kept on your device so a reload does not lose work) without consent, and analytics cookies and session recordings only with it. Google's sign-in prompt loads only on our sign-in pages, and in the EEA, the UK, Switzerland and Brazil only after you accept analytics. We do not use advertising or cross-site tracking cookies. We honour the Global Privacy Control signal. Every item, its purpose and its lifetime are in the Cookie Policy, and you can change your choice any time through "Cookie preferences" in the footer or under Settings › Privacy.

10. How long we keep it

• Your account, content and settings: for as long as your account is open. Content you delete yourself is removed from active systems promptly, usually within minutes.
• After you delete your account: deletion is scheduled with a 7-day grace period in which you can change your mind (connections to YouTube and Google Drive are revoked at once; see section 6). When it ends, your account, workspaces, content, derived content, credits, inbox, survey answers, Ask Rebel conversations, what Rebel remembers and analytics identity are erased across our systems, and we ask our analytics provider to delete the data tied to your account.
• Ask Rebel conversations, AI drafts and the AI tools' results: each message, draft, guest prep, coach report, listener kit and course outline is deleted automatically about 180 days after it was written. Text you save into a show or episode stays with it, and a listener kit you show on an episode page is kept while it is shown.
• What Rebel remembers, and preferences it learned from how you marked drafts: until you forget them in Settings › Rebel AI or delete your account.
• Show email: a message sent to a show's Rebel address, with its attachments, is deleted 90 days after it arrives. Mail held back for review is listed for 14 days. Copies we forward to people are in their own mailboxes, which we cannot delete.
• Music made for an episode (Vibe Scoring): a piece of music you never use in the episode is removed from the episode's choices 30 days after it was made; the music files are deleted with the episode.
• Encrypted backups: deleted data can remain in point-in-time database backups for up to 35 days, used only to recover the Service after a failure.
• Records of what you accepted or consented to, and of privacy requests: for as long as your account is open and then 6 years, so we can show what you agreed to and how we answered you.
• Service and security logs: up to 1 year.
• Listener data: raw delivery logs up to 30 days; hashed, derived records up to 400 days (section 2.5).
• Billing and payout records: 7 years, as tax and accounting law requires.
• Google user data: until you disconnect, remove our access or confirm account deletion, and within 7 days of a request (section 6).
• Legal hold: data subject to a legal hold or a dispute is kept as long as the law requires.

11. Security

Data is encrypted in transit (TLS 1.2 or higher) and at rest with keys managed by AWS; the access tokens for the services you connect are encrypted with keys held in AWS Key Management Service. The media you upload is kept in private storage and served only through short-lived signed links or the destinations you publish to, and media processing runs in isolated environments. Access to production systems is limited to the staff who need it, follows least-privilege permissions, requires multi-factor authentication on our cloud consoles and is logged. We review our security practices regularly and keep incident response procedures. No system is perfectly secure; if we learn of a breach that affects you we notify you and the authorities as the law requires. If you believe your account has been compromised, email engineering@rebelaudio.ai with the subject "Security".

12. Where your data is processed

Rebel Audio is based in the United States and processes and stores data there (Amazon Web Services' data centres in Oregon), with some providers operating globally. Amazon Bedrock may answer an AI request from an Amazon data centre in another region or country; the request is not stored there. If you use the Service from the European Economic Area, the United Kingdom or Switzerland, we process your data in the United States under the GDPR, the UK GDPR and the Swiss FADP, which apply to us directly. Where you are the controller, our Data Processing Addendum forms part of the Terms and governs our processing for you. Our providers use their own transfer safeguards, such as the Standard Contractual Clauses or the EU-US Data Privacy Framework. You can ask us at engineering@rebelaudio.ai for details of the safeguards that apply to you.

13. Your rights

13.1 Everyone

Wherever you live, you can:

• see and correct the data in your account, in Settings or by asking us;
• export a copy of your content and account data ("Request my data" in Settings › Privacy, or by email);
• delete your account from Settings (section 10). If you still own shows, the app asks you to delete or move them out first; if you would rather we delete the account and its shows for you, email engineering@rebelaudio.ai and we will, after confirming it is you;
• change your analytics choice at any time through "Cookie preferences" or Settings › Privacy, and unsubscribe from marketing email with the link in each one;
• disconnect any connected service in Settings › Connections.

To exercise a right you cannot exercise in Settings, email engineering@rebelaudio.ai. We confirm receipt, may ask you to verify that you are the account holder, and answer within 30 days (or the shorter time your law requires). You may use an authorised agent; we will ask the agent for proof of authority and may verify your identity with you directly. We never discriminate against anyone for exercising their rights. If we refuse a request you may appeal by replying "Privacy rights appeal", and you may complain to the data protection or consumer authority where you live.

13.2 European Economic Area, United Kingdom and Switzerland

You have the right to access, rectify, erase and receive a portable copy of your personal data, to restrict or object to processing based on our legitimate interests, and to withdraw (take back) your consent at any time; what we did before you took it back stays lawful. The legal basis for each purpose is in section 3. You may lodge a complaint with your supervisory authority: for the EEA, the authority listed at edpb.europa.eu/about-edpb/board/members_en; for the UK, the Information Commissioner's Office at ico.org.uk; for Switzerland, the Federal Data Protection and Information Commissioner.

13.3 California

In the last 12 months we collected the categories of personal information listed in section 2 (identifiers, account and billing information, audio and visual information, internet and usage activity, approximate location, professional information you volunteer in onboarding, and inferences drawn from usage), from you, your devices and the services you connect, for the purposes in section 3, and we disclosed them for business purposes only to the service providers in section 5. We do not sell personal information and we do not "share" it for cross-context behavioural advertising, and we have not done so in the past 12 months; we have no actual knowledge of selling or sharing the personal information of anyone under 16. We honour the Global Privacy Control signal as an opt-out. You have the right to know, to delete, to correct, to limit the use of sensitive personal information (we collect sensitive personal information, namely account log-in details and the contents of messages sent to your show's email address, and use it only to provide the Service and for the other purposes the law allows, so we do not offer a separate right to limit), and not to be discriminated against. We answer verifiable requests within 45 days, extendable once by 45 days with notice.

13.4 Other US states

Residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and other states with comprehensive privacy laws have the rights to access, correct, delete and obtain a portable copy of their personal data, to opt out of targeted advertising, sale and profiling (we do none of these), and to appeal a refusal. Exercise them as in section 13.1.

13.5 Biometric privacy (Illinois, Texas, Washington and similar laws)

We do not collect or keep biometric identifiers. We create none from speaker labelling, and dubbing uses ready-made AI voices and clones no voice (section 2.2). We never sell, lease or trade voice data. We disclose recordings to the dubbing provider only to make the dub you asked for. We keep nothing from them once the dub is made beyond the dubbed audio itself, which you control like any other content, and we ask the provider to delete the project as soon as the dub is ready. If we ever offer dubbing in a speaker's own voice, we will first give the notice and ask for the written release these laws require, from each speaker.

13.6 Your privacy choices (do not sell or share)

We do not sell your personal information and we do not share it for cross-context behavioural advertising, so there is nothing you need to opt out of. Analytics cookies and session recordings start only after you accept them, and you can change that choice at any time through "Cookie preferences" in the footer or under Settings › Privacy. When your browser sends a Global Privacy Control signal, we do not count your visits without cookies either, and in the United States we record the signal as your refusal of analytics and as an opt-out of any sale or sharing; analytics then starts only if you turn it on yourself. Questions: engineering@rebelaudio.ai.

14. Children

You must be at least 18 to have an account. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we delete it and close the account. If someone tells us they are under 18 when they accept our Terms, we block the account and offer to delete it. If you believe someone under 18 has an account, email engineering@rebelaudio.ai. Recordings you publish may of course feature children with the consent the law requires; you are responsible for that consent (section 8).

15. Changes to this policy

We post changes here and update the version and date above. When a change is material — a new purpose, a new category of data, a new kind of subprocessor, or less protection for you — we tell you in the app or by email at least 14 days before it takes effect where practical, and sooner only where the law requires the change. Earlier versions are available on request.

16. Contact

Privacy questions, requests and complaints, and everything else: engineering@rebelaudio.ai. By post: Rebel Audio, Inc., 1103 Tulloss Road, Franklin, TN 37067, United States, Attn: Privacy.