1. Who is responsible for your data
The controller of your personal data is ENNOVAQ (SMC-PRIVATE) LIMITED ("Ennovaq", "we", "us"), a company registered in Pakistan under CUIN 0352959, with its registered office at Chandia House, Street No. 1 East, Rehman Colony, Khanpur, Rahim Yar Khan, Punjab, Pakistan.
This policy covers ennovaq.com and every product we run: EchoClone, ReVidGen, SpikeGuru and Guftagu, including their apps, APIs and support channels (the "Services").
Contact us about privacy at info@ennovaq.com, or by post at our registered office.
2. When we act for a business customer
If a business uses our Services to process personal data about other people, for example a company that voices its training videos with EchoClone, that business decides how the data is used and we process it on its behalf. Our Data Processing Addendum governs that processing. If you are the person whose data a business has uploaded, please contact that business first; we will help it respond.
3. What we collect
Information you give us
- Account details: name, email address, password or the sign-in method you choose, and your preferences.
- Enquiries and support: what you send us by email or on WhatsApp, including any screenshots.
- Billing details: the plan you bought, invoices and payment status. For local payments in Pakistan, we keep the payment reference and the payer details shown on your receipt so we can confirm it. Card details are handled by our payment providers; we never see full card numbers.
Content you submit
Depending on the product: text and prompts, documents and files, conversations and memories (Guftagu), audio recordings and voice samples (EchoClone and ReVidGen), photos and videos that show faces (ReVidGen avatars), and video or channel addresses you ask us to analyse (SpikeGuru). We also store the Outputs we generate for you.
Information from services you connect
If you connect a YouTube channel to SpikeGuru, we receive read-only channel data from Google, as described in section 11. If you sign in with a third-party account such as Google, we receive your name, email address and profile picture from that provider.
Information collected automatically
- Technical data: IP address, browser and device type, pages and features used, timestamps and error reports, used to run, secure and fix the Services.
- Analytics: ennovaq.com uses cookieless analytics that count visits in aggregate without identifying you. Product apps use cookies only as described in our Cookie Policy.
Information from payment providers
When you buy through a Merchant of Record such as Paddle or Lemon Squeezy, it shares the order, your email address, country and payment status with us, but not your full payment details.
4. Voice and face data
Voice recordings and images of faces need extra care, so we apply these rules to them:
- Purpose. We use voice samples and face images only to provide the feature you request, such as creating your voice model or your avatar. We do not use them to identify people, and we do not sell or share them for advertising.
- Consent. You may upload another person's voice or face only with their explicit, written consent, as our Acceptable Use Policy requires. Where the law treats this data as sensitive or biometric, we rely on that explicit consent.
- Security. Samples and the models built from them are encrypted at rest and accessible only to the account that created them and to staff who need access to run or protect the Services.
- Deletion. You can delete a voice model, an avatar or the underlying samples at any time. We erase them within 30 days of your request or of account deletion, and in any event within three years of your last interaction with us, unless the law requires us to keep them longer.
5. Why we use your data, and our legal basis
Where the GDPR or UK GDPR applies, we rely on these legal bases:
| Purpose | Legal basis |
|---|---|
| Providing the Services: creating your account, processing your Inputs, generating Outputs | Performance of our contract with you |
| Voice cloning and avatar features | Your explicit consent, and performance of the contract |
| Billing, invoices and tax records | Performance of the contract, and our legal obligations |
| Support and service messages | Performance of the contract, and our legitimate interest in helping you |
| Security, fraud prevention and enforcing our Acceptable Use Policy | Our legitimate interests in protecting users and the public, and legal obligations |
| Improving the Services with aggregated usage data | Our legitimate interest in making better products |
| Replying to enquiries before you become a customer | Steps taken at your request before a contract, and legitimate interests |
| Product news and marketing emails | Your consent, or our legitimate interest for existing customers, with an opt-out in every email |
| Complying with the law and responding to lawful requests | Legal obligation |
Where we rely on legitimate interests, we have weighed them against your rights; you can object at any time (see section 9).
6. AI processing
To generate a response, a voice or a video, we send the relevant part of your content to the AI model providers listed on our Sub-processors page. They process it only to return a result and may not train their models on it. We do not use your content to train AI models made available to anyone else.
Automated safety checks may flag content for human review under our Acceptable Use Policy. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
7. Who we share data with
- Service providers that process data on our behalf under written agreements, such as hosting, storage, email and AI model providers. Each is listed on our Sub-processors page.
- Payment providers, including Merchants of Record such as Paddle and Lemon Squeezy and local payment providers in Pakistan, which act as independent controllers under their own privacy policies.
- Professional advisers, such as lawyers and accountants, under a duty of confidentiality.
- Authorities, when the law requires it, or when we believe in good faith that disclosure is needed to prevent fraud or serious harm, or to protect someone whose voice or likeness has been misused.
- A buyer or successor, if all or part of our business is sold or reorganised, under the same protections as this policy.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
8. International transfers
We are based in Pakistan, and our providers operate in other countries, including the United States, the United Kingdom, the European Union and, for Guftagu's optional lower-cost tier, China. Pakistan does not have an adequacy decision from the European Commission or the UK.
When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we use the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and equivalent safeguards, together with additional measures such as encryption. Contact us for a copy of the relevant safeguards.
9. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and get a copy;
- correct inaccurate data;
- delete your data;
- restrict or object to certain processing, including direct marketing;
- receive your data in a portable format;
- withdraw consent at any time, without affecting earlier processing; and
- complain to a data protection authority, such as the one where you live or work.
If you live in California, you also have the right to know, delete and correct personal information, and to be free from discrimination for exercising your rights. We do not sell or share personal information, and we use sensitive personal information only to provide the Services you ask for.
We honour these requests wherever you live. Use the settings in the product, or write to info@ennovaq.com. We will verify your identity before acting and reply within one month, or within the time your law requires.
10. How long we keep data
| Data | How long we keep it |
|---|---|
| Account details | While your account is open, then deleted within 30 days of closure |
| Inputs, Outputs, conversations and files | Until you delete them or close your account, then within 30 days. EchoClone keeps generated audio for download for 30 days. |
| Voice samples, voice models and face images | Until you delete them; at most three years after your last interaction with us |
| Billing and tax records | Seven years, to meet tax and accounting obligations |
| Enquiries and support conversations | Up to two years after our last contact |
| Records of serious policy violations | As long as needed to prevent repeat abuse and meet legal obligations, without more identifying detail than necessary |
| Security and server logs | Up to 90 days |
Deleted data can remain in encrypted backups until those backups are overwritten on their regular rolling schedule.
11. SpikeGuru and your YouTube data
SpikeGuru uses YouTube API Services. If you connect a channel, we request read-only access (the youtube.readonly and yt-analytics.readonly scopes) to show you your own channel profile, statistics and analytics. We do not sell this data, use it for advertising, or use it to train AI models. The only Google credential we store is an OAuth refresh token, encrypted at rest.
Google's processing of your data is covered by the Google Privacy Policy. You can disconnect your channel in SpikeGuru, or revoke access at any time on Google's security settings page; when you do, we delete the stored token and stop retrieving your data.
SpikeGuru's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
12. Security
We protect data with encryption in transit, encryption at rest for uploaded files and voice data, access controls with the least privilege needed, monitoring and regular updates. No system is perfectly secure; if a breach affects you, we will tell you and the relevant authorities as the law requires. Report a vulnerability to info@ennovaq.com.
13. Children
The Services are not for children under 13, and we do not knowingly collect their data. Where a product allows users aged 13 to 17, they need the consent of a parent or guardian. Voice cloning and avatar features are for adults only, and nobody may upload the voice or face of a child. If you believe we hold a child's data without consent, write to info@ennovaq.com and we will delete it.
14. Cookies
ennovaq.com sets no tracking cookies. Our Cookie Policy explains the cookies that product apps use and your choices.
15. Pakistani law
We process personal data in line with the laws of Pakistan, including the Prevention of Electronic Crimes Act, 2016, and will update this policy as Pakistan's data protection legislation develops.
16. Changes to this policy
We will post any update here with a new date. If a change materially affects how we use your data, we will tell you by email or in the product at least 30 days before it takes effect.
17. Contact
Write to info@ennovaq.com or to ENNOVAQ (SMC-PRIVATE) LIMITED, Chandia House, Street No. 1 East, Rehman Colony, Khanpur, Rahim Yar Khan, Punjab, Pakistan.