Privacy Policy

1. Operator and scope

Aivell, the trading name of an individual operator in Japan, processes the following information for Pigeon Suite. This is a draft before formal effect. Contact [email protected] for inquiries and privacy requests.

The personal information handling business operator's legal name and address are provided without delay upon the individual's request. Contact [email protected].

2. Information and purposes

Account email, Google-authorized name, email and profile, user and organization IDs, membership and authentication information are used for identification, login, organization access control and contact. We do not receive your Google password.

Input text, recordings, voice settings, generated audio and history support generation, storage, playback, downloads and troubleshooting. Obtain necessary rights and consent before sending another person's data or voice. Voice registration records the submitting user ID, confirmation time, statement version and recording SHA256. This is an attestation, not independent speaker verification. The associated attestation becomes eligible for deletion with its voice.

To evidence agreement to terms and acknowledgement of privacy and processing explanations, we retain user and selected organization IDs, document versions, text and hashes, statements, request identifiers and confirmation/withdrawal times. Acknowledgement is distinct from legally required foreign-transfer consent. Records are held as necessary to evidence terms and notices; deletion requests can be sent to support.

Plan, order, payment, refund, usage, credit grant, consumption and reservation records support subscription management, payment reconciliation and abuse prevention. Card details are entered on the payment provider's screen.

IP addresses, browser information, cookies and communication, activity and error records may be processed to maintain sessions, security and service operations. Inquiry details and contact information are used to respond and resolve issues.

3. External services and processing

Clerk supports login, user and organization management; Google authenticates Google accounts; Stripe and its payment infrastructure handle subscriptions and payments. Each receives the account, subscription or usage information needed for its function.

Render runs the web app and maintenance. Prisma Postgres stores text, organization and audio metadata. Cloudflare relays web traffic and provides DNS and geographic restrictions. R2 stores recordings, generated audio and encrypted backups. Modal generates audio from text and reference voices. Hugging Face distributes models; ordinary generation does not send it users' text or recordings.

Cloudflare processes IP addresses, login traffic, text and audio traffic. Access is restricted by source-IP country/region. Render runs in Singapore, the production DB is in Tokyo, and R2 uses an APAC location hint; authentication, AI, relaying and operations are not restricted to Japan. Foreign-transfer grounds, safeguards and subprocessors remain to be finalized before general release. Listing providers does not mean these checks are complete.

Except where law permits, disclosures beyond the stated purposes require an assessment of the purpose and required procedures. Also review each provider's own terms and privacy policy.

4. Cookies and safeguards

Cookies support login and sessions. Restricting cookies may prevent login or other functions. Language preference is also stored in a cookie. If advertising analytics or cookies are introduced, their purposes and necessary consent procedures will be explained.

Safeguards include authentication, organization access control, encrypted transport, private audio storage and encrypted backups. Relevant records may be examined to address outages or unauthorized access.

5. Retention and deletion

Generated audio, input text and history are retained for 30 days from creation on Starter and trial, and 90 days on Creator and Pro. After subscription end, retrieval ends at the earlier of the original deadline or 30 days later. Custom voices and original recordings become eligible for deletion 90 days after paid subscription end.

Deletion is periodic with retries. Encrypted backups are retained for 30 days, with a policy to remove deleted data from backups within 90 days. Access restriction and physical deletion at every destination may occur at different times.

Input text and history follow audio retention; text is removed from reconciled terminal jobs, including history whose audio was already deleted. Identifiers and usage needed for billing, refunds and trial abuse prevention are retained separately. Account and record deletion requests are assessed after identity verification, considering legal requirements and unresolved transactions. Legally required information may be retained for the necessary period.

6. Access, correction and deletion requests

Contact [email protected] for access, disclosure, correction, suspension or deletion requests. We verify identity and respond according to law and record status, explaining refusals where applicable. Do not send passwords, API keys or card numbers.

Deleting audio or a voice in the app is separate from requesting deletion of an account or billing records. Specify what your request covers.

7. Changes to this notice

Changes to information, purposes or providers will be explained with their effective date, and consent obtained where legally required. This document is a draft; its formal effective date is not yet fixed.