How Podcaas handles your personal data, and the rights you have over it under the GDPR and equivalent laws.
Last updated 26 July 2026
Podcaas, [Registered address line 1], [Postcode, City], [Country] (company number [Company registration number]) is the data controller. For any privacy question, or to exercise the rights below, write to privacy@yaysoftware.com.
| Data | Why | Lawful basis |
|---|---|---|
| Email, display name, password hash | Create and secure your account | Performance of a contract |
| Prompts, documents, links and audio notes you submit | Generate the episodes you ask for | Performance of a contract |
| Generated audio, scripts, artwork | Store and serve your episodes | Performance of a contract |
| Voice samples, where you use voice cloning | Create a synthetic voice at your request | Your explicit consent |
| Plan, credit balance, billing status | Operate your subscription | Performance of a contract |
| Server logs, generation task records | Keep the service working and prevent abuse | Legitimate interests |
| Listening activity on episodes | Play counts and your listening history | Legitimate interests |
We do not sell personal data, and we do not use your content to train our own models.
A recording of someone's voice is biometric data. We only process a voice sample where you actively choose to clone a voice, and doing so is your explicit consent under Article 9(2)(a) GDPR. You must have the consent of the person whose voice it is. Deleting a cloned voice deletes the sample and the derived voice model. Withdrawing consent does not affect processing carried out before you withdrew it.
We use the processors below. They act on our instructions and are bound by contract. Some are outside the EEA; those transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.
| Processor | Purpose | Data shared |
|---|---|---|
| Google Cloud Platform / Firebase | Hosting, authentication, database, file storage | Account details, generated content, audio files |
| Stripe | Payment processing and subscription billing | Email, payment details (held by Stripe, never by us) |
| Google (Gemini) | Script generation and speech synthesis | Prompts, source text, scripts |
| Perplexity AI | Research and source retrieval for news formats | Topic and search prompts |
| ElevenLabs | Speech synthesis and voice cloning | Scripts, and voice samples where you use voice cloning |
| Stability AI | Episode cover image generation | Image prompts derived from episode titles |
| Qwen / Voxtral TTS (self-hosted on Google Cloud Run) | Standard-quality speech synthesis | Scripts, and voice samples where you use voice cloning |
We never receive or store your card number. Stripe handles payment details directly.
Account data and content are kept while your account is open. When you delete your account we remove your profile, episodes, audio files, voice samples and cloned voices. Backups are cycled out within 30 days. We keep billing and invoice records for as long as tax law requires, typically seven years, and minimal abuse-prevention records where we have a legitimate interest in doing so.
Episodes you chose to publish publicly may remain in podcast directories or caches that we do not control after deletion from our systems.
You have the right to access, correct, delete, restrict or object to the processing of your personal data, to withdraw consent, and to receive your data in a portable format.
You can exercise access, portability and erasure yourself from Account settings: export downloads a machine-readable copy of your data, and delete removes your account. For anything else, write to privacy@yaysoftware.com; we respond within one month.
If you are unhappy with how we handled your request, you can complain to your local data protection supervisory authority.
We use only strictly necessary cookies and equivalent local storage: your Firebase authentication session, your language and playback preferences, and - during checkout - cookies set by Stripe to process payment and prevent fraud. These are required for the service to work, so they do not need consent.
We do not currently run advertising or third-party analytics cookies. If that changes, we will ask for your consent first and you will be able to decline without losing access to the service.
Data is encrypted in transit and at rest by our hosting provider. Access to production data is limited to those who need it. No system is perfectly secure; if a breach affects your rights we will notify you and the relevant authority as the law requires.
We will post any change here and update the date above. For material changes we will notify you by email before they take effect.