- Your scripts, voices, projects and API keys stay on your computer. We don’t receive them.
- We keep what we need to run your account: email, a password hash, device activation and subscription status.
- Payments are handled by Polar. We never see your card details.
- Affiliate attribution uses a referral cookie only with your consent. IP addresses are never stored in plain form, only as keyed hashes.
- No advertising trackers, no analytics cookies, and we never sell your data.
1. Who is responsible for your data
The data controller is Angel Cardona Hernández, trading as Unbound Engine, C/ Secundino Alonso 29, 35600 Puerto del Rosario, Las Palmas, Spain, NIF 78595681N. Contact us about privacy at privacy@unbound-engine.com.
2. What we collect and why
| DATA | WHY WE USE IT | LEGAL BASIS (GDPR ART. 6) |
|---|---|---|
| Account: email, password (stored only as a salted scrypt hash), account creation date, role, Terms version accepted | Create and secure your account, sign you in, contact you about the Service | Contract (6(1)(b)) |
| Sessions and security: session tokens (hashed), CSRF tokens, rate-limit counters (hashed keys), keyed hashes of the networks you connect from (your IPv4 address, or your IPv6 /64 network), administrative audit logs | Keep accounts secure, prevent abuse and fraud | Legitimate interests in security (6(1)(f)) |
| Device activation: the public key of your computer’s hardware-protected key, activation date | Enforce one active computer per account, authorise updates and template downloads | Contract (6(1)(b)) |
| Subscription: plan status, billing period, order amounts, refunds, and a customer reference shared with Polar | Provide Pro, keep accounting records, calculate affiliate commissions | Contract; legal obligation for tax records (6(1)(c)) |
| Affiliate (if you share a link): your referral code, click and download counts (with keyed IP hashes, the referring website’s domain, and whether the click came from paid advertising), the accounts you referred, commission ledger, payout account email and method and its change history, Affiliate Terms acceptance | Attribute referrals, calculate and pay commissions, prevent self-referral and fraud | Contract (6(1)(b)); legitimate interests in fraud prevention (6(1)(f)) |
| Affiliate tax details: legal name, address, tax residence country, tax ID, VAT number, US-person status, self-billing agreement, and a copy kept with each payout statement. All are encrypted at rest. | Issue commission statements, withhold tax where required, and file the tax reports that apply to us | Legal obligation (6(1)(c)); contract (6(1)(b)) |
| If you were referred: which affiliate referred you, how (link, code or installer) and when | Credit the creator who invited you | Legitimate interests (6(1)(f)); referral cookie only with consent (ePrivacy rules) |
| Consent records: your cookie choice, date, policy version and a keyed IP hash | Prove and respect your cookie choice | Legal obligation (6(1)(c)) |
| Support messages you send us | Help you | Contract; legitimate interests |
What stays on your computer. Projects, scripts, narration audio, cloned voice references, channel styles, video palettes and provider API keys are stored locally. Keys are encrypted with your operating system’s credential protection. When you use a provider such as ElevenLabs, Fish Audio, MiniMax, OpenAI, Anthropic or DeepSeek, the content you choose is sent directly from your computer to that provider under its own privacy policy. We are not involved in that processing.
We do not use your data for advertising or profiling, and we do not make decisions about you using only automated means that significantly affect you. Our fraud checks flag referrals for a human to review. They never refuse anything automatically.
3. Affiliate attribution in detail
- When someone opens an affiliate link, our server counts the click and stores a keyed hash of the visitor’s network (IPv4 address or IPv6 /64), so clicks aren’t counted twice and self-referrals can be spotted. The key is kept separately from the database, so the hashes can’t be reversed from the database alone. We also keep a 12-month history of these hashes for each account, to detect people referring themselves.
- A 60-day referral cookie is set only if the visitor accepts it in our cookie banner. Without consent, the referral code is only carried in the links of that visit, and nothing is stored on the device.
- Windows installers downloaded through a referral include the code in their file name. The desktop app reads it on first launch, then asks whether you want to credit that creator. It sends the code to our server only if you agree.
- Affiliates see aggregate counts and a numbered label (for example “Referral 3”) for each person they referred, never their email or payment details.
4. Who we share data with
- Polar Software, Inc.: merchant of record for payments, invoices and taxes. Polar processes payment data under its own privacy policy and shares subscription and order status with us.
- Hosting and network providers: Hetzner Online GmbH (servers in Falkenstein, Germany, EU), and Cloudflare, Inc. as content delivery network and security proxy when enabled. They act as our processors under data processing agreements.
- Payout providers (PayPal or Wise): your payout email and the amount, when we pay affiliate commissions.
- Authorities and advisers, when the law requires it or to protect our rights, and professional advisers under confidentiality.
- A successor in a merger or acquisition, who must keep protecting your data under this policy.
We never sell or rent personal data.
5. International transfers
Some recipients, such as Polar and Cloudflare, may process data outside the European Economic Area, including in the United States. Where that happens, we rely on an adequacy decision (such as the EU–US Data Privacy Framework for certified companies) or the European Commission’s Standard Contractual Clauses, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
6. How long we keep data
- Account data: while your account is open, then deleted within 30 days of closure, except as listed below.
- Sessions expire after 30 days (1 hour for administrators). Rate-limit entries last about one minute.
- Billing and commission records: as long as tax and accounting law requires (usually 6 to 10 years).
- Affiliate click and download events: 26 months. Network history: 12 months after last seen.
- Affiliate tax details and payout statements: as long as tax law requires after the last payout.
- Consent records: 3 years after your last choice.
- Security audit logs: up to 24 months, unless needed for an ongoing investigation.
7. Your rights
Under the GDPR and similar laws, you can ask to access, correct, delete or export your data, restrict or object to processing based on legitimate interests, and withdraw consent at any time. You can change your cookie choice using the “Cookie settings” link in the footer. Withdrawing consent doesn’t affect processing that already happened. Email privacy@unbound-engine.com. We reply within one month.
You can also complain to a data protection authority, for example the one where you live or work. In Spain this is the Agencia Española de Protección de Datos (aepd.es).
8. Security
We use HTTPS with HSTS, AES-256-GCM encryption for tax details, strict content security policies, hashed passwords and tokens, hardware-bound device keys, short-lived signed challenges, signed releases, rate limiting and access logging for administrators, who also need multi-factor authentication. No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as the law requires.
9. Children
The Service is not intended for anyone under 18, and we don’t knowingly collect their data. If you believe a minor has created an account, contact us and we will delete it.
10. Changes
We will post any changes here with a new version date. If a change is material, we will tell you by email or in the app before it takes effect.