Boldfizz Privacy Policy
Last updated: October 24, 2026
This Privacy Policy explains what personal data Boldfizz ("Boldfizz", "we", "us") collects when you use the Boldfizz website and web application at boldfizz.com (the "Service"), why we collect it, which companies process it for us, and the rights you have. It forms part of our Terms of Service.
The Service is in beta. How it works, and therefore what data it needs and which providers it uses, may change while it is developed. We will update this policy when it does (see section 12).
1. Who Is Responsible for Your Data
The controller of your personal data is:
Boldfizz, boldfizz.com
Email: [email protected]
2. What We Collect
Account data. Your name, email address, a securely hashed password, whether your email address is confirmed, the dates your account and sessions were created, when you agreed to these terms and this policy, and, if you did, when you agreed to have examples made in a voice like yours. If you sign in with Google, where it is offered, we receive your name, email address and profile picture from Google.
Trying it without an account. If you try a free review without an account, we make a guest account for you with no name or email address, and keep the video you send, its review and your practice tries with it, as for an account (see section 7 for how soon it is deleted).
Videos. The videos you upload to the Service and the recordings of practice attempts at a single passage ("tries"). A video contains your voice, your face, body and surroundings, and anything else that can be seen or heard in it.
What we derive from your videos. Transcripts of what you said, word timings, measurements of your delivery (such as speaking rate, pauses, volume, pitch, hand position and the direction of your gaze), the reviews, notes and lessons produced from them, and whether each practice try worked.
Usage data. Pages you view, features you use, and events in the app (for example, choosing a video, sending it, opening a review), with the time they happened, linked to your user ID, name and email address once you are signed in. Your browser and device type, operating system, screen size, language, the page you came from, the campaign tags of the link you first arrived by, and your approximate location derived from your IP address.
Technical and security data. Your IP address, request logs, error logs, and, when you create an account or a guest account, the result of an automated check that you are a person (Cloudflare Turnstile).
Data stored on your device. A session cookie that keeps you signed in, analytics identifiers stored in cookies or local storage, and the campaign tags of the link you first arrived by (see section 8).
Messages you send us. If you email us or answer a survey, the content of that message.
We do not ask for, and you should not include in your videos, sensitive information such as health details, government ID numbers or financial information.
Your voice and face are not used to identify you. We analyse videos to describe how you speak and move. We do not create voiceprints or face templates to recognise or authenticate you, and we do not try to infer your emotions, personality or health.
3. Why We Use It, and Our Legal Basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Creating and running your account or guest account, signing you in | Account, technical | Performance of our contract with you (Art. 6(1)(b)) |
| Reviewing your videos and producing feedback, lessons and practice | Videos, derived data | Performance of our contract with you (Art. 6(1)(b)) |
| Producing an example of a passage in a voice like yours (only after you agree to it separately) | A sample of your video's audio and its transcript | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Sending service emails (address confirmation, password reset, important notices) | Account | Performance of our contract with you (Art. 6(1)(b)) |
| Understanding how the beta is used and improving the Service, including how accurate our feedback is | Usage data, derived data, videos | Our legitimate interest in developing a working product (Art. 6(1)(f)) |
| Keeping the Service secure, stopping fake sign-ups, checking uploaded files are safe, preventing abuse | Technical, videos (as files) | Our legitimate interest in security (Art. 6(1)(f)) |
| Complying with the law and defending legal claims | Any data needed | Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, you can object (see section 9).
We do not sell your personal data, and we do not use it for advertising.
4. How Your Videos Are Processed
When you send a video, it is first checked for safety in an isolated, disposable environment on our hosting provider, then converted into a playable recording. Its audio is then sent to the speech-recognition and AI providers listed in section 5 to transcribe it and to judge how it sounds. Transcripts and measurements (text and numbers, not audio) are sent to a language-model provider to help write your feedback.
The picture is analysed on our own servers. Hand and gaze measurements are made by software we run ourselves; video frames are not sent to the AI providers.
Practice tries are not kept as recordings. A try's recording is deleted once it has been reviewed. We keep only the outcome (whether it worked).
5. Companies That Process Your Data
We use the following companies ("processors" or "sub-processors") to provide the Service. Each processes personal data only on our instructions and for the purpose described, under a data processing agreement with us, except where noted as an independent controller.
By using the Service, you acknowledge that your personal data, including your videos, will be shared with and processed by the companies below for the purposes described in this policy.
| Company | What it does for us | Data it receives | Location |
|---|---|---|---|
| Railway Corporation | Hosts the Service: our servers, database, file storage for videos, and the isolated environments that check uploads | All data described in section 2 | United States |
| Deepgram, Inc. | Speech-to-text: transcribes your videos into words with timings | Audio of your videos and tries | United States |
| Google LLC (Gemini API) | AI listening: judges how passages of your video sound (tonality, pitch, pauses) | Audio clips of your videos and tries, and their transcripts | United States |
| OpenAI, L.L.C. | Language model: helps judge delivery and write feedback from transcripts and measurements | Transcripts, word timings and measurements | United States |
| Hanabi AI Inc. (Fish Audio) | Voice synthesis: speaks a passage the way a note suggests, in a voice like yours (only when you use that feature) | A short sample of your video's audio, its transcript, and the passage text | United States |
| PostHog, Inc. | Product analytics: page views and app events | User ID, name, email, usage data, device and browser data, IP address (for approximate location) | United States |
| ActiveCampaign, LLC (Postmark) | Sends service emails | Name, email address, email content (including confirmation and reset links) | United States |
| Cloudflare, Inc. (Turnstile) | Checks that a new account or guest account is made by a person, not a bot | IP address, browser and device signals during sign-up | United States and global network |
Google sign-in. If you sign in with Google, where it is offered, Google LLC (or Google Ireland Limited in the EEA/UK) acts as an independent controller of the data it processes for that sign-in, under Google's own privacy policy. We receive only your name, email address and profile picture.
Use of your data to train AI models. We use the providers above through their business APIs. Under their API terms, the data we send them is not used to train their models. Providers may keep data for a limited period to detect abuse, as set out in their terms.
Other recipients. We may also disclose personal data: to professional advisers (such as lawyers and accountants) under confidentiality; to authorities, courts or others where required by law or to protect our rights, users or the public; and to a buyer or successor if we are involved in a merger, acquisition, reorganisation or sale of assets, who will be bound by this policy.
We may change the providers we use while the Service is in beta. We will update this list before a new provider starts processing your data, and tell you about material changes as described in section 12.
6. International Transfers
Several of the companies above are in the United States, so your data is transferred outside the European Economic Area, the United Kingdom and Switzerland. Where we do this, we rely on the recipient's certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) where available, or on the European Commission's Standard Contractual Clauses and equivalent UK and Swiss safeguards, together with additional measures where needed. You can ask us for a copy of the relevant safeguards at [email protected].
7. How Long We Keep It
- Account data: for as long as your account exists, then deleted within 30 days of the account being closed.
- Guest accounts: deleted, with their videos, reviews and tries, about an hour after the guest session ends, unless you create an account from it first, which then keeps them.
- Videos, transcripts and reviews: for as long as your account exists, or until you ask us to delete them. During the beta, we may also delete them earlier (see the Terms).
- Practice tries: the recording is deleted once it has been reviewed; the outcome is kept with your account.
- Original uploaded files: deleted once the file has been checked and converted.
- Analytics data: up to 12 months, after which it is deleted or made anonymous.
- Logs and security data: up to 90 days, unless needed to investigate an incident.
- Copies held by AI providers: according to each provider's retention terms for API data (typically up to 30 days for abuse monitoring, or none).
- Backups: deleted on their normal cycle, up to 30 days after the original.
We may keep data for longer where the law requires it or to establish, exercise or defend legal claims. We may keep aggregated or de-identified information that no longer identifies you.
8. Cookies and Similar Technologies
- Strictly necessary: a session cookie that keeps you signed in, and the cookie Cloudflare Turnstile sets during sign-up. These are needed for the Service to work.
- Analytics: PostHog stores an identifier in a cookie or your browser's local storage so it can recognise your visits. Analytics events are sent through our own domain.
- Local storage: your browser keeps the campaign tags of the link you first arrived by, so that we can tell which of our posts and messages people come from.
9. Your Rights
Depending on where you live, and in particular if you are in the EEA, the UK or Switzerland, you have the right to:
- access the personal data we hold about you and receive a copy;
- correct data that is inaccurate or incomplete;
- delete your data ("right to be forgotten");
- restrict how we use your data;
- port your data, receiving it in a structured, machine-readable format;
- object to processing based on our legitimate interests, including analytics;
- withdraw consent at any time, where we rely on consent, without affecting processing that happened before; and
- lodge a complaint with a data protection authority, in particular in the country where you live or work, or where you think the law was broken.
If you are a California resident, you also have rights under the CCPA/CPRA, including to know, delete and correct personal information and not to be discriminated against for using these rights. We do not sell or share personal information for cross-context behavioural advertising.
To use any of these rights, email [email protected] from the address on your account. We will answer within one month (which we may extend by two months for complex requests, and will tell you if we do). We may need to confirm your identity first.
While the Service is in beta, account and video deletion is handled by email request; we will delete your data from our systems and ask our processors to do the same.
10. Security
We protect your data with measures appropriate to the risk, including encryption in transit (HTTPS), hashed passwords, separate storage for unchecked uploads, checking uploaded files in isolated, disposable environments, access controls, and rate limits on sign-in. No service is completely secure, and as a beta the Service may contain security weaknesses. If we become aware of a breach that affects your personal data, we will notify you and the relevant authorities where the law requires it.
11. Children
The Service is not intended for anyone under 16 (or the age of digital consent where they live). We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to This Policy
We will update this policy as the Service changes, including when we add or remove a company in section 5. We will post the updated version with a new "Last updated" date. If a change is material, we will tell you in advance by email or in the Service, and, where the law requires it, ask for your consent again.
13. Contact
Questions about this policy or your data: [email protected]