Last updated: 9 November 2026
This policy explains what Metaphona does with personal data: the data of the people who use it, and the personal data in the videos organizations upload.
Who is responsible
Metaphona is provided by [Operator: company name and address].
Each organization decides which videos it uploads and why; we store and process them on its behalf, to provide the service. For accounts, requests for access and invoices, we decide how the data is used.
What we collect
We collect only what the service needs:
- Account: name, email address, role, interface language and sign-in times. Passwords are stored only as a one-way hash.
- Organization: its name, plan, minutes used, invoices and payment records (amount, method and reference), and the billing details it gives us.
- Content: uploaded videos and what is made from them — extracted sound, transcripts, speakers, translations, glossaries, new voices, mixes and dubbed videos.
- Voice consent: for voice profiles, the speaker’s name, the authorized use, its dates, whether reuse is allowed and the evidence file; for cloning, who confirmed the organization’s rights and when.
- Requests for access: name, email address, organization, country, intended use, message and language. The network address of the request is kept only as a hash, to limit abuse.
- Activity log: sign-ins and administrative actions, with who did what and when.
- Technical logs: the web server records requests, including the network address, for security. Application logs never contain media content or passwords.
Why we use it
To provide the service (process and dub your videos), to keep accounts secure and the activity log complete, to send and follow up invoices, to answer requests for access and support questions, and to prevent abuse.
We do not sell personal data, we do not use it for advertising, and we do not use your content to train models.
Where data is processed and who else receives it
Videos and data are stored and processed on our own private server: [Operator: hosting provider and country of the server]. Only your project’s members and the platform’s administrators can see them.
Two parts of the work go to other companies, and only when they are used:
- RunPod: when a project uses cloned voices, short voice samples from the video and the lines to say are sent to a GPU server in a European data centre (RunPod Secure Cloud). The server’s disk is deleted when it stops.
- OpenAI: when AI translation is set up, the text of the lines is sent to OpenAI to be translated, with their timing, speaker labels and the project’s glossary — never the video or the sound. Without it, the built-in translator runs on our server and nothing is sent.
How long we keep it
We keep data only as long as it is useful, and clean up automatically:
- Original videos, transcripts and translations: until the video or the project is deleted by its owner.
- Dubbed videos (exports): deleted 30 days after they are made, unless the platform sets another period. Download links stop working 15 minutes after they are created.
- Unfinished uploads: deleted after 24 hours. Working files of older processing runs are deleted when a newer run exists; temporary files after a day.
- Backups: made every night on the same server; copies of the database are kept for 14 days and copies of the media for 7 days, so deleted data disappears from backups after that time.
- Web server logs: 14 days. Application logs: 7 days.
- Accounts, the activity log, invoices and requests for access: as long as the organization uses the service, and afterwards as long as the law requires.
How we protect it
We protect data with technical and organizational measures, among them:
- encrypted connections (HTTPS) for every page and download;
- private storage that is never reachable from the web; downloads only through signed links that expire, or while signed in;
- roles in each organization and project, and strict separation between organizations;
- one-way hashed passwords and limits on failed sign-in attempts;
- an activity log of sign-ins, administrative actions and consent decisions;
- a database and cache reachable only from the server itself.
Your rights
You can ask to see the personal data we hold about you, to correct it, to delete it, to receive a copy, or to object to its use. Depending on where you live, the law may give you other rights, including complaining to your data protection authority.
Organization owners can correct and delete most data directly in the app, for example by deleting a video or a project. Members can ask their organization’s owner, and anyone can write to us: [Operator: contact email address].
Children
The service is made for organizations and their adult staff. It is not for children’s accounts, and only an adult can authorize the use of their voice.
Changes and contact
We may update this policy; the date at the top shows the latest version. Important changes are announced in the app and may also be sent by email.
Questions about your data: [Operator: contact email address].