Privacy Policy
Last Updated: August 12, 2026
This Privacy Policy is the master privacy and data-protection notice for ScriptVoiceStudio ("ScriptVoiceStudio", "we", "us", or "our"), operated by KYC Global Pte. Ltd. It explains how we handle information when you use our app, website, checkout flows, support channels, and related services.
ScriptVoiceStudio is a bring-your-own-key ("BYOK") tool. You use your own ElevenLabs account and API key to request voice generation. KYC Global charges for its independent workflow software and does not provide, pool, transfer, resell, or sublicense ElevenLabs credits.
1. Organisation and Contacts
ScriptVoiceStudio is operated by KYC Global Pte. Ltd.. For privacy questions, access requests, correction requests, deletion requests, withdrawal of consent, complaints, or abuse reports, contact:
- Privacy and data protection: dpo@kycglobal.one
- Support, billing, security, and abuse reports: support@kycglobal.one
2. Scope and Supported Markets
This policy applies to users in the markets we initially support: Singapore, Taiwan, Malaysia, the Philippines, the United Arab Emirates, India, the United States, the United Kingdom, Canada, Australia, New Zealand, Indonesia, Kenya, and South Africa. If local law gives you additional rights, we will respect those rights where that law applies to us.
Our Regional Data Protection Notices provide country-specific information for these markets.
3. BYOK Model and ElevenLabs Processing
- Your ElevenLabs API key is transmitted through ScriptVoiceStudio's backend to ElevenLabs to authenticate requests that you initiate. It is not intended to be retained after the active session or generation flow, and application logs should redact credentials.
- Your scripts, extracted text, selected voice identifiers, language and generation settings are transmitted to ElevenLabs when you request generation. ElevenLabs returns generated audio and related response data.
- Depending on the account and processing context, ElevenLabs may act as an independent controller for its account, security, product, research, legal, and business purposes, or as a processor under an applicable data-processing agreement. KYC Global does not control ElevenLabs' independent processing.
- ElevenLabs states that it may moderate input and output for trust, safety, fraud prevention, and policy enforcement, and may share relevant data with service providers or safety partners for those purposes.
- ElevenLabs states that content and personal data may be used to research, develop, train, or improve its models and services, subject to its terms, applicable law, and account-level choices. ElevenLabs provides a training opt-out through the Data use settings in eligible accounts; that choice is controlled through your ElevenLabs account, not ScriptVoiceStudio.
- ElevenLabs may suspend or terminate accounts, refuse or remove content, preserve information, or disclose information where permitted by its terms or required by law.
Review the applicable ElevenLabs Terms of Service, including the EEA, Switzerland, and UK Terms where applicable, the ElevenLabs Prohibited Use Policy, and the ElevenLabs Privacy Policy before submitting information.
Do not submit confidential, sensitive, regulated, or third-party personal data unless you have confirmed that the processing by both ScriptVoiceStudio and ElevenLabs is lawful, that you have provided all required notices and obtained all required rights and consents, and that any required provider agreement is in place. Do not submit protected health information regulated by HIPAA unless an appropriate HIPAA business associate agreement with ElevenLabs permits it.
4. Data Processing Summary
| Data category | Purpose | Legal / consent basis | Recipients / processors | Retention |
|---|---|---|---|---|
| Account and contact data, such as email, sign-in identifiers, plan status, policy-acceptance records, and support contact details. | Create accounts, authenticate users, manage access, document acceptance, send service messages, and provide support. | Service contract, steps requested before contract, consent where required, legitimate service and security needs where recognised, and legal compliance. | Authentication, hosting, email, support, security, and operations providers. | Account life plus applicable legal, tax, accounting, dispute, security, consent-evidence, and support periods. |
| BYOK API credentials and session authentication state. | Authenticate user-initiated requests to ElevenLabs and generate requested audio. | Your explicit submission and service request, performance of the service contract, and security needs. | ElevenLabs and hosting or backend providers that transiently process the request. | Not intended to be retained after the active session or generation flow. Logs should redact secrets. You should revoke or rotate a key if you suspect exposure. |
| Scripts, prompts, uploaded files, extracted text, filenames, selected voices, language choices, and generation settings. | Validate and segment inputs, send generation requests, produce audio, troubleshoot user-requested jobs, and investigate reported misuse. | Your request, performance of the service contract, consent where required, and legitimate security or abuse-prevention needs where recognised. | ElevenLabs, hosting providers, security tools, and support providers where needed. | KYC Global retains this data only as long as needed to generate and deliver output unless longer retention is required for support, abuse, legal, security, or user-requested purposes. ElevenLabs applies its own retention practices. |
| Generated files, MP3 files, ZIP downloads, captions, and temporary project files. | Deliver downloads, enable app features, support troubleshooting, and respond to abuse or takedown reports. | Your request, performance of the service contract, and legal or claims handling where needed. | ElevenLabs for provider-generated output; hosting, storage, delivery, support, and security providers where applicable. | ScriptVoiceStudio temporary files are intended to be short-lived and cleaned automatically or when the session is cleared unless longer retention is required. |
| Payment, billing, tax, subscription, refund, chargeback, and fraud-prevention records. | Process checkout, subscriptions, invoices, taxes, refunds, chargebacks, fraud checks, and accounting. | Service contract, legal obligations, payment security, and user request. | Payment processors such as Stripe, banks, card networks, tax, accounting, and fraud-prevention providers. | As required for tax, accounting, anti-fraud, dispute, refund, chargeback, and legal-record purposes. |
| Technical, security, and operational data, such as IP address, device/browser data, timestamps, audit IDs, diagnostics, error reports, and abuse-prevention signals. | Secure the Service, prevent misuse, apply rate limits, debug issues, investigate incidents, and maintain reliability. | Security, service operation, legal compliance, and legitimate operational needs where recognised. | Hosting, logging, monitoring, security, diagnostics, and abuse-management providers. | For the period needed for security, diagnostics, audit, and incident purposes, with longer retention only where justified. |
| Cookies, local storage, session storage, and similar app technologies. | Keep the app functional, remember settings, support authentication, prevent abuse, and improve reliability. | Essential service operation and consent where non-essential technologies require consent. | Hosting, authentication, security, and analytics providers where enabled. | Session-based or until cleared by the user unless a longer configured duration is necessary and disclosed. |
5. Sharing and International Transfers
We may share personal data only where appropriate for the Service or required by law, including with ElevenLabs, hosting and infrastructure providers, authentication providers, payment providers, support and operations providers, professional advisers, regulators, courts, or law enforcement. We do not intentionally sell personal data or disclose it for cross-context behavioural advertising.
ScriptVoiceStudio-related personal data may be transferred outside your country, including to Singapore and locations used by our providers. ElevenLabs currently states that it maintains hosting or server locations in the United States, the Netherlands, and Singapore, and that personal data is transferred to the United States for storage. Provider locations and safeguards may change, so review the current ElevenLabs Privacy Policy before use.
Where transfer restrictions apply to KYC Global, we use reasonable contractual, technical, and organisational safeguards designed to protect transferred data consistently with applicable law. ElevenLabs is responsible for the safeguards applicable to transfers it controls.
6. Your Rights and Provider Requests
Depending on where you live and which law applies, you may have rights to request access, copies, correction, supplementation, deletion or erasure, withdrawal of consent, cessation or restriction of processing, objection, portability, grievance handling, information about recipients or transfers, and complaint handling.
To exercise rights concerning data controlled by KYC Global, email dpo@kycglobal.one with your country, account email, the right you want to exercise, and enough detail for us to locate the data. We may verify identity before acting.
Requests concerning an ElevenLabs account, ElevenLabs training preferences, ElevenLabs retention, provider moderation, or data independently controlled by ElevenLabs must generally be submitted directly to ElevenLabs using the routes in its Privacy Policy. Deleting ScriptVoiceStudio data does not automatically delete data held independently by ElevenLabs or another provider.
We aim to respond as soon as reasonably possible and generally within 30 calendar days unless a different period applies under local law, the request is complex, or verification is incomplete.
7. Breach Notice and Incident Response
If we become aware of a suspected personal-data breach affecting data in our possession or control, we will assess the incident, take reasonable containment and remediation steps, preserve appropriate records, and notify affected users, regulators, providers, or law enforcement where required by applicable law. Incidents controlled by ElevenLabs are handled under ElevenLabs' policies and legal obligations.
8. Adults Only
ScriptVoiceStudio is available only to people who are at least 18 years old and have reached the age of legal majority where they live. The Service is not available to minors, including with parental or guardian consent. We do not knowingly collect children's personal data or permit children's voice data to be submitted for generation. Contact us if you believe a minor has provided data so that we can investigate and take appropriate action.
9. Security
We use reasonable technical, organisational, and administrative safeguards designed to protect information, including transport security, access controls, secret-redaction practices, least-privilege provider access, abuse controls, and operational monitoring where appropriate. No system is perfectly secure. You are responsible for protecting and appropriately restricting your API keys and account credentials and for revoking or rotating them if exposure is suspected.
10. Changes to This Policy
We may update this Privacy Policy, including to reflect changes in provider practices. If a change materially affects how we handle personal data, we will provide notice and request renewed consent where required by law.
Questions? Contact dpo@kycglobal.one.