Privacy Policy
Effective date: July 11, 2026
Last updated: July 11, 2026
This Privacy Policy explains how Read Aloud Text collects, uses, stores, shares, and protects personal data when you visit or use https://readaloudtext.com (the “Service”).
1. Who controls your personal data
Read Aloud Text is operated by Hasitha Chandrasekara, an individual based in Sri Lanka (“Read Aloud Text,” “we,” “us,” or “our”).
For privacy questions or requests, contact:
- Email: support@readaloudtext.com
- Website: https://readaloudtext.com
- Country: Sri Lanka
Hasitha Chandrasekara is the data controller for personal data processed to operate the Service. Certain providers, including Creem for checkout and payment processing, may act as separate controllers for the activities they independently determine.
2. Scope
This Policy applies to the website, user accounts, text-to-speech generation, document processing when available, saved projects, generated audio, audio-sharing links, voice cloning, Multi-Voice Studio, customer support, and related features.
It does not govern third-party websites or services that you access independently. Those services have their own privacy notices.
3. Personal data we collect
3.1 Account and authentication data
When you create an account or sign in, we may process:
- your email address;
- your display name and Google profile information, if you use Google Sign-In;
- an internal user identifier;
- authentication status and security information;
- age or eligibility confirmations; and
- account settings, plan, credit balance, and subscription status.
Email/password and Google authentication are provided through Google Firebase. We do not receive your Google password. Password credentials used for email login are handled by the authentication provider rather than stored by us in readable form.
3.2 Text, documents, audio, and project data
Depending on the features you use, we process:
- text, scripts, prompts, and pronunciation instructions;
- uploaded documents and extracted document text, when document processing is available;
- selected language, voice, speed, speaker, and generation settings;
- generated speech, timestamps, word-highlighting data, and project metadata;
- Multi-Voice Studio projects and speaker assignments;
- generation history and saved projects; and
- share-link identifiers and the audio, text, and highlighting data made available through those links.
The Service is not intended for highly confidential, classified, or regulated information. Do not upload information you are not authorized to process or disclose.
3.3 Voice-cloning data
When you use voice cloning, we may process:
- voice recordings or uploaded voice samples;
- consent or authorization confirmations;
- transcripts and technical characteristics of a voice sample;
- a voice embedding, cloned voice model, or provider voice identifier; and
- generated audio created with the cloned voice.
Voice recordings and voice models can identify or relate to a person and may be sensitive. You may submit a voice only when you are the speaker or have clear, legally valid permission from the speaker. Voice cloning is available only to adults.
Our application does not keep its original copy of a voice sample after the cloning request has been completed. A voice provider may process or retain training, verification, security, or model artifacts as described in its terms and privacy documentation. The user-accessible cloned model remains available until you delete it or your account is deleted, subject to limited backup, fraud-prevention, legal, and provider-integrity retention.
3.4 Payment and subscription data
Creem acts as merchant of record for web purchases. Creem collects and processes payment details, billing information, tax location, and transaction information. We do not receive or store your full payment-card number.
We may receive from Creem:
- customer and transaction identifiers;
- purchased product or plan;
- subscription status and renewal dates;
- payment, refund, dispute, and chargeback status;
- country or tax-related transaction information; and
- amounts, fees, credits, and entitlement information needed to provide the Service.
Creem’s processing is also governed by its own buyer terms and privacy notice.
3.5 Usage, device, and log data
We and our infrastructure providers may automatically process:
- IP address and approximate location derived from it;
- browser, operating system, device type, and language;
- dates and times of access;
- pages viewed and feature interactions;
- generation counts, characters or credits used, and error events;
- security, fraud-prevention, and rate-limit signals; and
- server, application, and diagnostic logs.
3.6 Analytics and cookies
We use essential cookies or similar storage for authentication, security, preferences, sessions, and Service operation. We use Google Analytics to understand visits and improve the Service.
Where applicable law requires consent, non-essential analytics will be disabled until you consent. You can withdraw consent through the cookie controls made available on the Service or through your browser. Blocking essential storage may prevent account or security features from working.
We do not use personal data for third-party behavioral advertising and do not sell personal data.
3.7 Communications
If you contact us, we process your email address, message contents, attachments, support history, and information needed to respond. Zoho Mail is used for email and customer-support communications.
4. Why we use personal data
We use personal data to:
- create and secure accounts;
- provide text-to-speech, document, voice, sharing, and studio features;
- generate, store, synchronize, and deliver audio;
- create and manage cloned voices at your request;
- provide word highlighting and share-link playback;
- apply plan limits, credits, and entitlements;
- process subscriptions, refunds, disputes, and account changes;
- answer support and privacy requests;
- maintain performance, reliability, and security;
- prevent fraud, abuse, unauthorized voice use, and violations of our Terms;
- comply with tax, accounting, court, regulatory, and other legal obligations;
- establish, exercise, or defend legal claims; and
- analyze aggregated or de-identified usage and improve the Service.
5. AI model training
Read Aloud Text does not use your text, documents, voice samples, generated audio, or cloned voice models to train its own generalized AI models.
We configure available provider controls and agreements so that Customer Content is not authorized for generalized model training. Providers may still process content to perform the requested generation, maintain a user-specific voice model, prevent abuse, comply with law, or protect service integrity. Provider practices can differ by product, account tier, configuration, and feature.
Before sending production Customer Content to a provider that makes training optional, we enable the available opt-out or obtain contractual terms that prohibit generalized training. If this practice changes, we will update this Policy before applying the change to newly submitted content and obtain consent where required.
6. Legal grounds for processing
Where the GDPR, UK GDPR, or similar law applies, we rely on the following legal grounds:
- Contract: to create your account and provide the features, storage, credits, and support you request.
- Legitimate interests: to secure, maintain, troubleshoot, and improve the Service; prevent fraud and abuse; protect users and third parties; and administer our business, where those interests are not overridden by your rights.
- Consent: for non-essential analytics, optional communications, and processing that law requires to be based on consent. Voice cloning is initiated only at your explicit request and requires your confirmation of authority.
- Legal obligation: to retain transaction records, respond to lawful requests, and comply with accounting, tax, consumer, and regulatory duties.
- Legal claims and vital interests: where necessary to protect safety, investigate serious misuse, or establish, exercise, or defend legal claims.
7. When we share personal data
We disclose data only as needed for the purposes described above.
7.1 Service providers
Our current provider categories include:
| Provider | Purpose and data involved |
|---|---|
| Google Firebase and Google Cloud | Hosting, authentication, database, storage, application infrastructure, and related security and logs |
| Cloudflare | Content delivery, network security, traffic management, abuse prevention, and limited request data |
| Google Analytics | Website and product analytics, subject to consent where required |
| Creem | Merchant of record, checkout, subscription administration, invoicing, tax handling, refunds, fraud prevention, and payment records |
| ElevenLabs | Text-to-speech and voice-related processing, depending on the voice selected |
| Microsoft Azure | Text-to-speech and voice-related processing, depending on the voice selected |
| Cartesia | Text-to-speech and voice-related processing, depending on the voice selected |
| Zoho Mail | Transactional email, support, and privacy communications |
These providers may process data in the United States, European Economic Area, Sri Lanka, or other countries where they or their subprocessors operate.
7.2 Shared audio
An audio-sharing link is an unlisted link, not a private access-control system. Anyone who obtains the link may be able to play the audio and view the associated text and synchronized highlighting. Recipients may further distribute the link. Do not create a share link for confidential, restricted, or unlawfully disclosed material.
7.3 Legal, safety, and business disclosures
We may disclose information when reasonably necessary to comply with law or legal process; respond to regulators or law enforcement; enforce our Terms; investigate fraud, security incidents, impersonation, or voice-cloning misuse; protect a person’s rights or safety; or complete a sale, transfer, restructuring, or succession of the Service subject to appropriate safeguards.
8. Data retention
We use the following operational retention schedule, unless a longer period is required for law, security, fraud prevention, disputes, or legal claims:
| Data | Retention |
|---|---|
| Guest text and generated audio | Processed transiently and not saved to an account or retained in our primary application storage after the request completes |
| Free registered-account projects, extracted text, generation history, generated audio, and share links | 72 hours from generation |
| Lite-plan projects, extracted text, generation history, generated audio, and share links | One month from generation |
| Plus and Premium projects, extracted text, generation history, generated audio, and share links | Until the user deletes them or the account is deleted; downgrading does not automatically delete existing items |
| Original voice sample in our application | Deleted after the cloning request completes; provider-side processing and limited artifacts are governed by provider configuration and terms |
| User-accessible cloned voice model | Until the user deletes the model or account, subject to limited residual security, integrity, legal, and backup retention |
| Core account and profile data | While the account remains active and then deleted or anonymized following account deletion, subject to required records |
| Google Analytics user-level event data | Up to 14 months |
| Routine application and security logs | Up to 12 months; longer where necessary to investigate abuse or security incidents |
| Support communications | Up to 24 months after the matter is closed, or longer for an active dispute |
| Billing, refund, tax, and accounting records | At least five years from the relevant transaction, or longer where legally required or proceedings remain open |
| Backups containing deleted data | Rotated or overwritten within approximately 90 days, unless isolated for security or legal preservation |
Deleting your account permanently removes access to remaining projects, generated audio, share links, saved data, top-up credits, and cloned voices. Deletion may not immediately remove records that must be retained for tax, payment, fraud-prevention, security, backup, dispute, or legal purposes.
9. Your choices and rights
You can use account controls to delete projects, audio, share links, and cloned voices. You may also delete your account through the available account settings.
Depending on applicable law, you may have rights to:
- be informed about processing;
- access and receive a copy of your personal data;
- correct inaccurate or incomplete data;
- delete personal data;
- restrict processing;
- object to processing based on legitimate interests;
- withdraw consent at any time;
- receive portable data in a structured, commonly used format;
- complain to a data-protection authority; and
- obtain information about safeguards for international transfers.
Email requests to support@readaloudtext.com. We may ask for information reasonably necessary to verify your identity. We will respond within the period required by applicable law.
10. International transfers
We operate from Sri Lanka and use providers that process data internationally. When required, international transfers are supported by appropriate mechanisms such as adequacy decisions, contractual safeguards, the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism. No transfer method can eliminate every risk associated with processing in another country.
11. Security
We use reasonable technical and organizational safeguards appropriate to the nature of the Service, including encrypted transport, provider access controls, authentication controls, restricted administrative access, security monitoring, and backups. No online system is completely secure. You are responsible for protecting your credentials and for promptly reporting suspected unauthorized access.
12. Children
Account creation is available only to users who are at least 16 years old. A user who is under the age of legal majority where they live must have permission from a parent or legal guardian.
Children under 16 may listen to a teacher- or guardian-provided share link under adult or school supervision, but they must not create an account, upload content, submit personal data, purchase a plan, or use voice cloning. Voice cloning is restricted to users aged 18 or older.
We do not knowingly collect account information from children under 16. If you believe a child has provided personal data contrary to this Policy, contact us so that we can investigate and delete it where appropriate.
13. Changes to this Policy
We may update this Policy to reflect changes in the Service, providers, or law. We will post the revised version and update the date above. If a change materially affects how we use personal data, we will provide additional notice or request consent where required.
14. Contact
For questions, complaints, or rights requests:
Hasitha Chandrasekara
Sri Lanka
support@readaloudtext.com
https://readaloudtext.com