1. Introduction

Welcome to Bond by Voice, a mobile application and web platform owned and operated by App Merchant, Inc. (“we,” “our,” “us”).

We are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, and share your information when you use the Bond by Voice app,including our use of in-app tracking and analytics technologies. Our website is a simple pass-through page directing you to download the app and does not collect personal information.

2. About This Policy

This Policy explains:

What data we collect
Why we collect it
How we use it
Who we share it with, including our named voice-processing subprocessors
Your rights, including California privacy rights
How in-app tracking and analytics technologies work
Additional provisions that apply if you are located in the United Kingdom, the European Economic Area,Canada, or Brazil (Section 15)

3. Your Rights

You may:

Request access to your data
Request corrections
Request deletion
Object to certain processing
Request data portability
Opt out of the sale or sharing of personal information, and limit the use of sensitive personal
information, where applicable under state law (see Section 10)
Withdraw consent to biometric processing at any time (see Section 5B)

To exercise these rights, contact: contact@bondbyvoice.com

4. Data Storage and Security

We use reputable, industry-leading cloud infrastructure providers, including Amazon Web Services (AWS),to store data securely. Our providers maintain industry-standard security certifications and safeguards.While we and our providers follow industry standards, no system is completely secure. By using our Service, you acknowledge this risk.

5. Data We Collect

We may collect:

Name, email, and account details
Usage data and interactions
Voice recordings and voice samples (see Section 5B, “Voice Data and Biometric Information”)
Device and technical data
Payment-related data (handled by Apple/Google)
In-app tracking and analytics data

5A. Email Collection and Marketing

Our website is a pass-through page that directs you to download Bond by Voice from the Apple App Store or Google Play Store. It does not collect your email address and does not use cookies or tracking technologies.

When you register for an account in the app, we collect your email address. We use this to:

Send account-related and service updates
Send promotions and marketing emails
Improve our marketing efforts and user experience

Registering an account does not guarantee specific promotions or offers. You may unsubscribe anytimevia email links or by contacting us.

We may use third-party tools and service providers, including email platforms, analytics providers, hosting providers, and other technology partners to operate and improve our services.

We do not sell your data.

5B. Voice Data and Biometric Information

Voice recordings you provide to Bond by Voice — including short voice samples used for standard voice personalization and longer recordings submitted for the optional Professional Voice Cloning (“PVC”)add-on — may constitute biometric identifiers or biometric information under certain state and international privacy laws, including the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), Washington’s biometric privacy law, and the EU/UK GDPR’s provisions on special category data.

What we collect.
Depending on the features you use, we may collect:

A short voice sample recorded in-app used to create your standard personalized voice
Voice audio you record in-app or upload as MP3 files for the optional Professional Voice Cloning add-on (minimum 30 minutes, up to 3 hours)
Voice data captured through our Read & Record (“R&R”) feature, which records your own narration directly rather than generating synthetic speech
Generated story audio — the personalized narration produced using your voice profile or Professional Voice Cloning model. Once generated, this audio remains accessible for playback even if your subscription later lapses or is canceled (see our Terms of Use, Section 4), separately from the retention schedule described below for the underlying voice profile and voice model.

We do not accept voice recordings of any person under 18 years of age, from any source. See Section 14.

How we use it.
‍Voice recordings and samples are used solely to create and deliver the personalized voice and story features of the Service — including generating a synthetic voice profile, training a Professional VoiceCloning model (if purchased), and producing personalized audio content. We do not use your voice data totrain general-purpose AI models unrelated to the Service, and we do not sell, rent, or license your voicedata to third parties for their own independent use.

Who processes it — named subprocessors.
‍We disclose voice recordings and voice models only to the following subprocessors, solely to deliver the voice personalization feature you requested:

Google LLC (Google Cloud) — processes voice recordings to generate standard personalized voice profiles using Google’s Chirp 3 Instant Custom Voice technology. As part of the standard voice recording process, Google requires you to speak a short consent phrase identifying Google Cloud as the technology provider; this phrase is part of your recording and is disclosed to you in-app before you record.
ElevenLabs, Inc. — processes voice recordings to create and generate audio from your Professional Voice Cloning (PVC) model, if you purchase that add-on.
Amazon Web Services, Inc. (AWS) — provides encrypted storage and hosting for voice recordings,generated voice models, and generated audio.

‍Each subprocessor is bound by a written agreement requiring it to protect biometric data using a reasonable standard of care, to process it only on our instructions and only for the purposes described above, to refrain from selling or independently using it, and to delete it on our instruction. We will update this Policy if we add, replace, or remove a subprocessor with access to biometric data. No other party —including the analytics and advertising partners listed in Section 9 — receives voice recordings or voice models.

Retention
‍This schedule applies to voice recordings, voice samples, and derived voice models — not to generated story audio, which is addressed separately above.

We retain voice recordings, voice samples, and derived voice models according to the following schedule:

While your account and associated voice profile remain active, we retain this data to provide the Service.
If you cancel your subscription, we retain your voice profile and associated voice models for up totwelve (12) months in case you resubscribe, after which they are scheduled for deletion.
In all cases, we will delete voice recordings, samples, and derived voice models no later than three (3)years after your last interaction with Bond by Voice, or sooner upon your deletion request or when the purpose for collection has been satisfied, whichever occurs first.
Residual copies in backup systems are purged on our standard backup cycle, not to exceed ninety (90)days after deletion from primary systems.

‍You may request earlier deletion at any time as described below or as applicable law requires.

Your voice data rights.
‍In addition to the general rights described in Section 3, you may specifically request:

Deletion of a raw voice recording or sample
Deletion of a trained voice model created from your recording (including any Professional Voice Cloning model)
A description of the voice data we hold about you

‍To exercise these rights, email contact@bondbyvoice.com. We will confirm what was deleted and, where technically feasible, the date by which deletion will be completed. Deleting a trained voice model means it can no longer be used to generate new content; it does not retroactively remove audio you have already downloaded or saved outside the app.

Consent.
By recording or uploading your voice, or a voice you have obtained valid consent to submit on behalf of another person, you provide explicit, separate consent to its processing as described in this Section 5Band in our Terms of Use. You may withdraw this consent at any time by deleting your voice profile in the app or by emailing contact@bondbyvoice.com; withdrawal results in deletion as described above. Where required by law, we will provide the specific disclosures required under applicable biometric privacy law at the time of collection.

6. How We Use Your Data

We use data to:

Operate and improve the Service
Personalize content
Communicate updates and offers
Process subscriptions
Maintain security

7. Sharing Your Data

We may share data with:

Our named voice-processing subprocessors — Google LLC and ElevenLabs, Inc. — and our cloud storage provider, Amazon Web Services, Inc. (see Section 5B)
Other hosting, technology, subscription billing (e.g., RevenueCat), and analytics service providers
Apple App Store / Google Play (payments)
Marketing & Analytics Partners
Legal authorities when required

8. Data Retention

We retain data as long as necessary for service operation or legal obligations. For voice recordings, voice samples, and derived voice models specifically, see Section 5B above.

9. App Tracking and Analytics Technologies

This section explains the tracking and analytics technologies Bond by Voice uses within the app, the role they play in helping us operate and improve the Service, and the choices you have regarding them.Because Bond by Voice is a mobile app rather than a website, we do not use browser cookies; instead, we and our partners may use mobile analytics SDKs, advertising identifiers, and similar in-app technologies.

9.1 What Are App Tracking Technologies?

App tracking technologies are tools built into the app (often through third-party software development kits, or“SDKs”) that help us and our partners understand how the app is used and measure the effectiveness of our marketing. These may include:

Mobile advertising identifiers (such as Apple's IDFA or Android's Advertising ID)
In-app analytics events (such as which screens are viewed or which features are used)
Attribution data that helps us understand which marketing channel led to an app install

9.2 Categories of App Tracking We Use

Strictly Necessary
Necessary to operate the Service as you have requested — for example, recognizing your subscription tier and account status.

Performance / Analytics
Used to understand how the app is accessed, used, and performing, so we can maintain, operate, and improve it.

Advertising / Attribution
Used to deliver and measure the effectiveness of advertisements promoting Bond by Voice, and to understand which marketing channels are working. As described in Section 9.5 and Section 14, this category does not operate on screens where a child may be listening to or viewing content.

9.3 App Tracking and Analytics Partners

Below is a list of companies whose SDKs or tracking technologies may be integrated into the Bond by Voice app for analytics or advertising purposes. This list may change from time to time as our partners change; because these companies may share information they collect with other third parties, those third parties may also receive data in connection with the Service.
‍
• Google / Firebase / Youtube — https://firebase.google.com/
• Apple — https://www.apple.com/
• RevenueCat — https://www.revenuecat.com/
• Meta (Facebook/Instagram) — https://www.facebook.com
• X (formerly Twitter) — https://www.x.com/
• TikTok — https://www.tiktok.com/

9.4 Managing Your App Tracking Preferences

Platform-required permission. On platforms that require it (such as iOS App Tracking Transparency), we will request your permission before using your device's advertising identifier or other tracking data for cross-app or cross-website advertising purposes. You can grant or deny this permission when prompted, and can change your choice at any time in your device settings.

‍Device-level controls. Your mobile operating system provides additional options to limit ad tracking or reset your advertising identifier — for example, “Allow Tracking” permissions and “Reset Advertising Identifier” on iOS, or “Opt-out of Ads Personalization” on Android. We recommend reviewing your device’s privacy settings directly for the most current options.

Analytics that don't require this permission. We use attribution technologies from Google/YouTube, Meta, TikTok, and X to report app install and in-app purchase events back to those platforms, so we can measure the effectiveness of advertising campaigns we run on their platforms. We do not display third-party advertising within the app. These attribution events fire in connection with account registration and subscription purchase; they do not run continuously and are not triggered during story, song, or lullaby playback. See Section 14 for more on how we treat children’s use of the Service.

9.5 Advertising Technologies and Children

Advertising and attribution technologies described in this Section operate solely in connection with account registration, subscription purchase, and marketing communications directed at the registering adult. They are not deployed on in-app screens where a child may be listening to or viewing story, song, or lullaby content. See Section 14 for more on how we treat children’s use of the Service.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California PrivacyRights Act (collectively, “CCPA”), gives you additional rights described below.

‍Categories of information.
We collect the categories of personal information described in Section 5,including identifiers, account information, usage data, device data, and biometric information (voicerecordings and voice models, described in Section 5B). Under the CCPA, biometric information isclassified as Sensitive Personal Information.

‍Your rights.
You may request to: know what personal information we collect, use, disclose, and sell orshare about you; delete your personal information; correct inaccurate personal information; opt out of thesale or sharing of your personal information; and limit the use of your Sensitive Personal Information topurposes necessary to provide the Service. We will not discriminate against you for exercising these rights.

‍Sale and sharing.
We do not sell personal information for money. We work with advertising and attribution partners identified in Section 9.3 (for example, Meta, TikTok, and X) to promote Bond by Voice andmeasure the effectiveness of that promotion; this activity may be considered “sharing” for cross-context behavioral advertising under the CCPA. We do not share voice recordings or voice models with these partners. You can opt out of this sharing at any time by using your device’s advertising tracking controlsdescribed in Section 9.4, or by emailing contact@bondbyvoice.com.

‍Sensitive Personal Information. We use voice recordings and voice models only to provide the voice personalization features you request — not to infer characteristics about you or for any purpose unrelated to the Service. You may still request that we limit this use by emailing contact@bondbyvoice.com.

Global Privacy Control.
Where our website collects data covered by Section 10 (for example, through future functionality), we will honor a Global Privacy Control (GPC) signal received from your browser as a valid request to opt out of sale or sharing for that browser or device. Because our website is currently a pass-through page that does not collect personal information, GPC currently has no practical effect on our website, but we will honor it if and when that changes.

How to exercise these rights.
Email contact@bondbyvoice.com. We may need to verify your identity before completing certain requests. You may designate an authorized agent to make a request on your behalf as permitted by law.

11. International Data Transfers

Your data may be processed outside your country by us or by our service providers, including the voice and speech-processing providers described in Section 5B, with appropriate safeguards in place as required by applicable law. Where personal data of EU/UK users is transferred to the United States, we rely on Standard Contractual Clauses or an equivalent approved transfer mechanism with each recipient.

12. Security

We use industry-standard protections, but no system is 100% secure.

13. Security Incident Notification

If we become aware of a breach of security compromising personal information, including biometric data,we will notify affected users and, where required, applicable regulators without unreasonable delay and in accordance with applicable law — including, where applicable, within seventy-two (72) hours under GDPR,and within any time frame required under applicable U.S. state breach notification laws. Notification will describe the nature of the incident and the steps we recommend you take, to the extent known at the time of notice.

14. Children’s Privacy

Bond by Voice content — stories, songs, and lullabies — is created for young children, ages 0–5, to listen to. The app itself, however, is designed to be operated exclusively by adults: parents, grandparents, and other caregivers. Children do not create accounts, record or upload voices, make purchases, or interact with advertising within the app. All account registration, voice recording, subscription management, and settings are performed by the registering adult, not the child.

We do not collect biometric voice data from or of any person under 18 years of age, from anysource. Our Terms of Use expressly prohibit submitting the voice of a minor — including by that minor’s own parent or legal guardian — and if we become aware or reasonably believe that a submitted voice belongs to a person under 18, we remove the recording and any derived voice model and may suspend or terminate the account.

We do not knowingly collect personal information directly from children under 13 within the meaning of the Children’s Online Privacy Protection Act (COPPA). Personal information — including voice recordings submitted by an adult for the purpose of creating stories for a child — is submitted by the registering adult on the child’s behalf, not by the child.

Because Bond by Voice content is intended for young children, we limit advertising and non-essential tracking technologies to adult-facing portions of the app — account registration, subscription purchase,and marketing communications — and do not deploy them on screens where a child may be listening to or viewing content, as described in Section 9.5.

Bond by Voice is for entertainment purposes only and is not a medical or therapeutic tool.

If you are located outside the United States, additional child-data protections may apply, including the UK Children’s Code and the age-of-consent and parental-consent rules described in Section 15.

15. International Users and Jurisdiction-Specific Provisions

Bond by Voice is available in multiple countries. This Section adds provisions that apply if you are locatedin the jurisdictions below, in addition to — not instead of — the rest of this Policy. If you are in a jurisdictionnot specifically addressed below, we comply with that jurisdiction’s applicable data protection andchildren’s privacy laws to the extent they apply to our processing of your data, and we will update thisSection before or promptly after making the Service available there.

15.1 United Kingdom
Because Bond by Voice is likely to be accessed by children under 18, the Service falls within the scope of the UK Information Commissioner’s Office (ICO) Children’s Code (Age Appropriate Design Code), which sits alongside the UK GDPR. Consistent with the Children’s Code, we apply high-privacy defaults to settings relevant to a child user, do not use nudge techniques to encourage additional data disclosure, do not use geolocation to track a child’s location, and do not deploy advertising or tracking technologies on screens where a child may be listening to or viewing content (see Section 9.5). We conduct and maintain a Data Protection Impact Assessment (DPIA) for the voice personalization features of the Service in light oftheir likely access by children, consistent with ICO guidance.

UK Representative. Because App Merchant, Inc. is not established in the United Kingdom, Article 27 of the UK GDPR requires us to designate a UK representative. Our UK representative is: Muhammad Umar, reachable at admin@bondbyvoice.com. This designation is made pursuant to a written mandate between App Merchant, Inc. and the individual named above.

Age of consent. Under the Data Protection Act 2018, the minimum age at which a person may independently consent to data processing in the UK is 13. Below this age, consent must be given or authorized by a holder of parental responsibility. See Section 15.5 for additional detail.

15.2 European Economic Area
If you are located in the European Economic Area, our processing of your personal data, including voice and biometric data, is governed by the GDPR as described throughout this Policy, including Section 5B(biometric data) and Section 11 (international transfers).

‍EU Representative. Because App Merchant, Inc. is not established in the European Union, Article 27 of the GDPR requires us to designate a representative established in an EU Member State where our users are located. [App Merchant, Inc. has appointed / is in the process of appointing] such a representative; the representative’s name and contact details will be published in this Section once appointed. The Service will not be made available through EU Member State app store listings until this designation is complete.

Age of consent. Under Article 8 of the GDPR, the default age at which a minor may independently consent to data processing is 16. EU Member States may lower this age, to no lower than 13, by national law. See Section 15.5 for country-specific detail.

15.3 Canada, Including Quebec
If you are located in Canada, our processing of your personal data is governed by the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, if you are located in Quebec, by Quebec’s Act Respecting the Protection of Personal Information in the Private Sector, as amended by Law25.

‍Privacy Officer. Pursuant to Quebec Law 25, our Privacy Officer is Kevin Sutherland, Founder and CEO of App Merchant, Inc., reachable at contact@bondbyvoice.com. The Privacy Officer oversees data subject requests, breach reporting, and privacy impact assessments for the Service.A French-language version of this Policy is available for Quebec residents. Where a conflict exists between the English and French versions as applied to a Quebec resident, the French version controls tothe extent required by Quebec law.

15.4 Brazil
If you are located in Brazil, our processing of your personal data, including voice recordings, is governed by the Lei Geral de Proteção de Dados (LGPD).

‍Children’s data (Article 14). If a user is identified as under 12 years of age, we obtain specific and prominent consent from at least one parent or legal guardian before processing that child’s personal data,through a distinct consent step separate from general account registration. We do not condition a user’s participation in the Service on providing personal information beyond what is strictly necessary for the specific feature requested. We make reasonable efforts, considering available technology, to verify that such consent has been given by a parent or legal guardian.

‍Sensitive data (Article 11). Voice recordings and voice models constitute biometric data, a category of sensitive personal data under LGPD Article 5(II). We obtain specific, highlighted consent for the processing of this data, presented separately from general consents and describing the specific purpose(voice personalization), consistent with Section 5B of this Policy.

Data Protection Officer.
The table below reflects our understanding of the minimum age at which a user may independently consent to data processing in select jurisdictions, current as of the date of this Policy. It is illustrative and not exhaustive. Implementing legislation varies by country and is subject to change, including a pending EU proposal to standardize the threshold at 15 across Member States. Where a jurisdiction is not listed, or where you are uncertain of the applicable age, we treat parental or guardian consent as required for any user under 16 as a protective default.

Jurisdiction	Minimum Age	Basis / Note
United Kingdom	13	Data Protection Act 2018
Brazil	12	LGPD Art. 14 — fixed threshold; parental consent required below this age, not a sliding floor
United States (COPPA)	13	Applies to children directly, not a GDPR-style consent floor; see Section 14
Germany	16	GDPR Art. 8, national implementation
Netherlands	16	GDPR Art. 8, national implementation
Spain	14*	*Sources vary 13–14; confirm before launch in this market
France	15*	*Some authority indicates parental consent is required regardless of age; confirm before launch in this market
Other EEA states	13–16	Set by each Member State under GDPR Art. 8; confirm the specific country before launch there

Where consent as a legal basis is not used (for example, where a parent or guardian directly operates the account, as described in Section 14), these thresholds do not independently apply, but the underlying protections for children’s data in this Policy still do.

15.6 Other Jurisdictions
‍If Bond by Voice becomes available in a jurisdiction not specifically addressed above, we will assess and comply with that jurisdiction’s applicable data protection and children’s privacy requirements as they apply to our processing of voice and biometric data, and will update this Policy accordingly.

16. External Links

We are not responsible for third-party websites or services.

17. Changes to This Policy

We may update this Policy at any time. You are responsible for reviewing updates. Continued use means acceptance. Material changes affecting how we handle voice, biometric, California-protected, or other jurisdiction-specific data described in Section 15 will be highlighted at the top of this Policy and, where required by law, you will be notified directly.

18. Contact Us

 📧 contact@bondbyvoice.com

19. Parental Responsibility