Privacy Policy

Your Privacy Matters to Extropolis

This Privacy Policy governs your relationship with Extropolis Corp. (“Extropolis,” “we,” “our,” or “us”). Protecting our users (“you,” “your,” or “their”) and their privacy is a core principle of NeuralSpeaker. This Privacy Policy helps you understand:

• What information we collect and why
• How your voice data flows through our system
• How we protect your privacy and sensitive data
• Your rights regarding your information

This Privacy Policy governs your access to and use of the NeuralSpeaker website, iOS application, and any related digital mediums owned and maintained by Extropolis (collectively, the “Platform”), as well as the assistive speech technology services provided through the Platform (collectively, the “Services”).

By accessing and using the Platform and Services, you acknowledge that you have read and understood this Privacy Policy. Where we process data to perform the services you have requested, the legal basis is performance of a contract. Where we process data for security and infrastructure purposes, the legal basis is our legitimate interest in operating a secure service.

NeuralSpeaker is a consumer assistive communication technology. We are not a HIPAA Covered Entity and do not operate as a Business Associate of any healthcare provider. Consumer health data we collect is governed by the FTC Health Breach Notification Rule and applicable state consumer health privacy laws.

I. Our Privacy-First Design

How NeuralSpeaker Works

NeuralSpeaker processes sensitive voice data and is designed with privacy as a foundational principle. Here is how your data flows through our system:

1. Account Creation (Clerk): You create an account through Clerk, our authentication provider. We receive your basic profile information (name, email) to identify your account.
2. Voice Recording: You record audio samples of your voice through our web application or iOS app. Audio is uploaded and stored securely in Cloudflare R2 cloud storage.
3. Transcription (AI Processing): Your audio recordings are sent to our backend (Modal.com) for AI-powered transcription using OpenAI Whisper models. Transcriptions are stored in our database (Supabase) and linked to your account.
4. Model Training: When you train a voice model, your audio dataset is processed on GPU infrastructure (Modal.com) to fine-tune AI models. Trained models are stored in Cloudflare R2 and associated with your account.
5. Text-to-Speech: When you use text-to-speech, your text input is processed by your trained model to generate audio output. Generated audio is delivered to your browser or device.

Our Privacy Commitments

• Your voice data belongs to you. You retain full ownership of your voice recordings, datasets, and any speech generated by your trained models.
• No data selling. We do not sell your voice data, personal information, or any user data to any person or company.
• Purpose-limited processing. Your voice data is processed solely to provide the Services you have requested (transcription, model training, text-to-speech).
• No cross-user training. Your voice data is never used to train models for other users or for general-purpose AI training.
• Deletion on request. You can request deletion of your account and all associated data at any time.
• Encryption in transit. All data transmitted between your device and our servers is encrypted using TLS/SSL.

II. Information We Collect

Account Information

When you create an account, we receive the following information from our authentication provider (Clerk):

Voice and Audio Data

When you use the recording and transcription features, we collect:

Usage Information

We may collect information about how you use the Platform:

Information from Internet Use

Our servers may automatically log standard connection information such as IP addresses and request timestamps as part of normal web server operation. These server logs are used solely for infrastructure monitoring and security (e.g., detecting abuse or denial-of-service attacks) and are not linked to any user identity for tracking purposes.

Cookies: NeuralSpeaker uses cookies necessary for authentication (session management via Clerk) and essential Platform functionality. We do not use analytics cookies, advertising cookies, or any third-party tracking cookies.

Do Not Track: NeuralSpeaker does not track users across third-party websites. Because we do not engage in cross-site tracking, “Do Not Track” browser signals are not applicable to our Services.

III. Sensitive Data Considerations

We recognize that voice data is inherently personal and may be considered sensitive data, particularly when associated with a medical condition or disability. We take the following additional precautions:

• Voice biometric data: Your voice recordings contain unique biometric characteristics. We process this data solely for the purpose of providing the assistive speech Services you have explicitly requested.
• Health-related context: While NeuralSpeaker is designed for individuals with speech impairments, we do not collect or store medical diagnoses, treatment plans, or other health records. We do not require you to disclose the nature of any medical condition.
• Minimal data principle: We collect only the data necessary to provide the Services. We do not request or store information about your medical history, healthcare providers, or insurance.

IIIa. Biometric and Consumer Health Data

Voice data processed for the purpose of training a personalized speech model constitutes biometric data — it encodes physiological characteristics of your vocal tract that can uniquely identify you. For users with speech impairments, voice recordings may also qualify as consumer health data under applicable law. The following disclosures apply in addition to the rest of this Privacy Policy.

Granular Consent

We require separate, opt-in consent for each of the following uses of your voice data — bundled acceptance is not sufficient:

You may withdraw optional consents (model training and platform improvement) at any time from Settings → Privacy → Privacy & Consent. Withdrawal does not affect processing that occurred before withdrawal.

Transcription consent is a condition of account access and cannot be withdrawn independently. If you wish to revoke transcription consent, you must delete your account (Settings → Privacy → Delete My Data).

Illinois Residents — BIPA Disclosure

New signups from Illinois are not currently accepted as an additional risk-reduction measure while our biometric consent process is reviewed. This disclosure remains here for any existing account holders located in Illinois.

Under the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/, we are required to inform you that:

• If you consent to Personalized Voice Model Training, we collect and store your voiceprint (a biometric identifier as defined by BIPA).
• We will not sell, lease, trade, or profit from your biometric data.
• Biometric data will be destroyed within the earlier of: (a) three years from your last interaction with NeuralSpeaker, or (b) when the purpose of collection has been fulfilled.
• A publicly available Biometric Data Retention Policy is maintained at /legal/biometric-retention-policy.

Texas Residents — CUBI Disclosure

Under the Texas Capture or Use of Biometric Identifier Act (CUBI), Bus. & Com. Code Ch. 503, biometric identifiers collected for model training will be destroyed within the earlier of: (a) one year from your last interaction, or (b) when the purpose has been fulfilled.

Washington Residents — MHMDA Disclosure

Under the Washington My Health MY Data Act (MHMDA), your voice recordings may constitute consumer health data given their connection to a speech-related health condition. We collect this data only pursuant to a valid authorization (your explicit, granular consent above). You have the right to:

• Access consumer health data we hold about you
• Delete consumer health data — our internal SLA is 7 days for biometric data and 30 days for other personal data (the statutory MHMDA maximum is 45 days, but we commit to a faster timeline)
• Withdraw authorization at any time

We will not sell your consumer health data without a separate explicit authorization.

For a complete list of subprocessors who may receive your consumer health data, see Section V (Third-Party Service Providers) of this policy.

Washington Residents — RCW 19.375 (Biometric Identifier Act)

Under the Washington Biometric Identifier Act (RCW Chapter 19.375), we are required to inform you, before collecting a biometric identifier, of the specific purpose and the length of time for which it will be collected, stored, or used.

Purpose: If you enable Personalized Voice Model Training, we collect and store your voiceprint (a biometric identifier as defined by RCW 19.375) solely to train a speech synthesis model personalized to your voice and to generate text-to-speech output in your voice. Your voiceprint is not processed for any other purpose.

Duration: Your voiceprint is retained until the earlier of: (a) you withdraw consent for Personalized Voice Model Training, (b) you close your account, or (c) seven (7) days after we determine the original purpose has been fulfilled. See Section VII (Data Retention) for the complete schedule.

No sale: We will not sell, lease, or trade your biometric identifier to any third party for any purpose.

Your consent under RCW 19.375 is obtained through the granular consent mechanism described above, which you must accept before any voice recording for model training commences.

EU / EEA Residents — GDPR Article 9

Voice data processed to build a personalized voice model is special-category biometric data under GDPR Article 9. We process it only on the basis of your explicit consent (Article 9(2)(a)). You may withdraw consent at any time; withdrawal does not affect the lawfulness of prior processing. For international transfers of biometric data to our US-based processors, we rely on appropriate safeguards including Standard Contractual Clauses under GDPR Article 46(2)(c).

IV. Disclosure to Law Enforcement and Government Authorities

We may disclose information we possess to governmental or law enforcement authorities if we believe in good faith that disclosure is: (a) required by applicable law, regulation, or legal process; (b) necessary to respond to a lawful request from public authorities; (c) necessary to protect the rights, property, or safety of Extropolis, our users, or the public; or (d) necessary to detect, prevent, or address fraud, security issues, or technical problems.

We will make reasonable efforts to notify you of any such disclosure unless prohibited by law or court order.

V. Third-Party Service Providers (Subprocessors)

The following subprocessors may receive your data as part of providing the Services. Each is bound by a data processing agreement and may not use your data for their own purposes.

Clerk (Authentication)

• Clerk Privacy Policy
• Clerk Terms of Service

Supabase (Database)

• Supabase Privacy Policy

Cloudflare R2 (File Storage)

• Cloudflare Privacy Policy

OpenAI (Practice Phrase Generation — Text Only)

We use the OpenAI API solely to generate text-based practice phrases that users may read aloud when building their dataset. No voice recordings, audio files, biometric data, or health-related information are transmitted to OpenAI.

VI. How We Use Your Information

We use the information we collect for the following purposes:

We do not use your information for: selling to third parties; advertising or marketing profiling; training general-purpose AI models; or any purpose beyond providing and improving the Services.

VII. Data Retention

When you delete your account, we will delete all associated data from our active systems within thirty (30) days. Biometric data (voice models and raw audio used for biometric identification) is targeted for deletion within seven (7) days. Encrypted backups are purged within ninety (90) days as required for disaster recovery.

Third-party retention: Subprocessors (Clerk, Supabase, Cloudflare R2, Modal.com, OpenAI) maintain their own retention schedules as described in their respective privacy policies.

VIII. Data Security

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS/SSL.
• Authenticated access: All API endpoints require authentication via Clerk. Users can only access their own data.
• Row-level security: Database queries are protected by row-level security policies in Supabase, ensuring data isolation between users.
• Access controls: Audio files and models stored in Cloudflare R2 are protected by access controls and are only accessible through authenticated API requests.
• Admin access: Administrative access to user data is restricted to authorized Extropolis personnel and is used only for customer support and Platform maintenance.

While we take reasonable precautions to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

Breach Notification: In the unlikely event that we become aware of a security breach affecting your data, we will notify affected users via the email address associated with their account within 30 days of discovery (per RCW 19.255, Washington’s breach notification law) and take all steps required by applicable breach notification laws in other jurisdictions.

IX. Children’s Privacy

NeuralSpeaker is not intended for use by children under the age of 13 (or 16 in the EEA/UK). We do not knowingly collect information from children. If you believe a child has created an account or provided us with personal information, please contact us immediately and we will promptly delete the account and all associated data.

X. Links to Other Websites

The Platform may include links to third-party websites (such as Clerk, Supabase, and others). This Privacy Policy applies only to NeuralSpeaker. We are not responsible for the privacy practices of other websites.

XI. Your Rights

All Users

You have the following rights regarding your data on NeuralSpeaker:

Illinois Residents (BIPA)

Under BIPA, you have the right to request destruction of your biometric data at any time by contacting [email protected]. We will complete destruction within 7 days of a verified request. We will not discriminate against you for exercising this right.

Washington Residents (MHMDA & RCW 19.375)

Under the MHMDA, you have the right to access, correct, and delete consumer health data we hold about you within 45 days of request. You may withdraw authorization for processing consumer health data at any time from Settings → Privacy → Privacy & Consent. We will not sell your consumer health data.

Under RCW 19.375 (Washington Biometric Identifier Act), you have the right to request destruction of your biometric identifier (voiceprint) at any time. We will complete destruction within 7 days of a verified request. We will not sell, lease, or trade your biometric identifier. Contact [email protected] to exercise this right.

California Residents (CCPA)

Under the California Consumer Privacy Act (CCPA), California residents have rights including: knowing what personal information is collected, opting out of its sale, requesting deletion, and non-discrimination. We do not sell personal information. To exercise your CCPA rights, contact us at [email protected]. We will verify your identity through your authenticated account before processing any request.

EEA, UK, and Switzerland Residents (GDPR)

If you are a resident of the European Economic Area, the United Kingdom, or Switzerland, you may have rights under the GDPR including: access, rectification, erasure, restriction of processing, data portability, and the right to object.

We process your data based on: (a) performance of a contract (providing the Services you requested); (b) legitimate interest (maintaining security and improving the Platform); and (c) your explicit consent for biometric and special-category data.

If you believe our processing of your data is inconsistent with your rights under the GDPR, you have the right to lodge a complaint with the Data Protection Supervisory Authority of your country. For purposes of the GDPR, Extropolis Corp. is the “controller.”

Geographic Restriction — EU / EEA / UK Notice

NeuralSpeaker is currently available to residents of the United States only. Access from the European Economic Area, the United Kingdom, Switzerland, and other regions outside the United States is not available at this time. Requests from those regions receive an HTTP 451 (“Unavailable For Legal Reasons”) response.

Why we restrict access: NeuralSpeaker processes special-category biometric data (voice recordings and voiceprint models). Compliant service delivery to EU/EEA residents under GDPR requires additional legal infrastructure — including executed Standard Contractual Clauses with all relevant subprocessors and a validated legal transfer mechanism — that we have not yet completed. Rather than process EU residents’ biometric data without the required safeguards, we have chosen to restrict access until that infrastructure is in place.

GDPR Article 13/14 — Information for affected users: If you attempted to access NeuralSpeaker and received a 451 response, we are not collecting or processing any of your personal data as a result of that request (beyond standard server-infrastructure logging which is purged within 30 days per Section VII). There is no NeuralSpeaker account for you to access, correct, or delete, because no account was created.

Incorrectly blocked? If you believe you are a US resident and were blocked in error, please contact us at [email protected] with the subject line “Geo-block error”. We will investigate and, if appropriate, provide an access path within 5 business days.

International availability: We intend to open NeuralSpeaker to EU/EEA and other international users once the required legal infrastructure is in place. We do not have a specific timeline for this at present. To be notified when international access becomes available, email [email protected] with subject “International waitlist”.

International Visitors

The Platform is hosted in the United States. If you access the Platform from outside the United States, please be aware that your information (including voice recordings and personal data) may be transferred to and processed in the United States. We rely on Standard Contractual Clauses (for EU/EEA) and other appropriate safeguards for international data transfers. The United States may not have the same data protection laws as your country of residence.

XII. Updates to This Privacy Policy

We may update this Privacy Policy from time to time. Changes are effective upon posting to the Platform. For material changes, we will make reasonable efforts to notify you via the email address associated with your account. Your continued use of the Platform after any changes constitutes acceptance of the updated Privacy Policy.

This Privacy Policy supplements, but does not replace, the Terms of Service. In the event of a conflict between this Privacy Policy and the Terms of Service regarding privacy matters, this Privacy Policy shall govern.

XIII. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us at:

Extropolis Corp.
Email: [email protected]

We will promptly investigate and respond to your inquiry.

Changelog