OndaLabs Privacy Policy

1. Introduction

Welcome to OndaLabs, an AI studio for text to speech, two-speaker dialogue, voice cloning and voice design, speech to text, images, video and music. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website, our iOS app, and our services, which AI providers process your requests, and where your data is sent. By using OndaLabs, you agree to the terms of this Privacy Policy.

One account everywhere: the same OndaLabs account, plan, credits and library work on the web and in our iOS app, so this policy covers both.

If you do not agree with any part of this Privacy Policy, please do not use OndaLabs. If you have any questions about this policy, please contact us at hello@ondalabs.app.

2. Information We Collect

2.1. Information You Provide

• Account details: your name, last name and email address. If you sign in with Google or Apple, we receive your name and email address from them (with Apple, this can be a private relay address).
• What you create with: the text and scripts you write, prompts and lyrics, audio you record or upload for transcription, reference images and first frames you upload, and the voice samples and consent recordings you provide to clone a voice.
• What you create: the speech, transcripts, images, videos and music generated for you, and the projects you save.
• Usage records: for each generation, the tool, the model, its settings and the credits it used. These power your Usage page and your credit balance.
• Messages: what you send us when you contact support or leave feedback.

2.2. Information Collected Automatically

Our website uses PostHog, hosted in the European Union, for product analytics. It records pages you visit, interactions such as clicks, errors, and general device and browser information, so we can see which features work and fix problems. Our servers also keep short technical logs (for example, IP addresses and request times) for security and rate limiting. Our iOS app has no analytics or advertising SDKs.

We don't use advertising trackers, we don't track you across other apps or websites, and we don't sell or rent your data.

2.3. Payment Information

Payments on the web are handled by Stripe, and purchases in our iOS app by Apple through RevenueCat. We never see or store your card details; we keep only what we need to manage your plan, such as your customer and subscription identifiers.

3. How We Use Your Information

We use the information we collect to:

• Generate the speech, transcripts, images, video and music you ask for
• Manage your account, plan, credits and purchases
• Show your library, usage history and credit balance
• Send you important emails (e.g., sign-in codes, confirmations, security updates)
• Prevent abuse, such as fraud, disposable sign-ups and content that breaks our Terms
• Understand how OndaLabs is used so we can improve it
• Comply with legal obligations

We do not sell or rent your personal data.

4. How We Use AI

Every tool in OndaLabs is powered by AI models from other companies. When you generate something, the content needed for that request (your text, prompt, audio or images) is sent to the provider of the model, only to produce your result:

Text to speech and dialogue

Google Gemini (our Onda Lite and Onda Flash voices)

Voice design and voice cloning

Google Gemini

Speech to text

Groq (Whisper), with OpenRouter as a backup

Improve with AI

OpenAI

Images

Google (Nano Banana), OpenAI (GPT Image), xAI (Grok Imagine), ByteDance through OpenRouter (Seedream)

Video

Google (Gemini Omni), xAI (Grok Imagine Video), ByteDance through OpenRouter (Seedance)

Music

Google (Lyria)

Cover art for music tracks

OpenAI (GPT Image)

• No training by us: OndaLabs does not train AI models on your content.
• Providers' handling: we use these providers' paid business APIs, which generally don't use API requests to train their models. Each provider processes your requests under its own terms and privacy policy, and may keep them for a limited time for safety and abuse monitoring.
• Automated processing: results are produced automatically by AI, and providers' automated safety systems may block a request. We don't make decisions with legal or similarly significant effects about you through AI.
• Labels: some providers embed invisible watermarks (such as Google's SynthID) or provenance metadata (C2PA) in what they generate, so it can be identified as AI-made.
• Human access: we don't routinely look at your content. Authorized staff may access it only when needed to provide support you ask for, investigate abuse, or comply with the law.

5. Where Your Data Is Sent

Your account and files are stored in the European Union (Frankfurt, Germany). To run each request, we work with these service providers:

When data is transferred outside the European Economic Area, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or the provider's certification under the EU-U.S. Data Privacy Framework.

6. Our iOS App

The iOS app uses the same account and servers as the website, so everything above applies to it. In addition:

• Signing in: with an email code, with Google (in a secure browser window), or with Sign in with Apple. Your session token is stored in the iOS Keychain on your device.
• Camera: used only when you scan printed text. The text is recognized on your device with Apple's Vision framework; the photos are not uploaded. Only the text you choose to keep is used in your script.
• Microphone: used only when you record audio to transcribe or to clone your voice. That recording is uploaded and processed as described above.
• Photos: the app only sees the photos you pick as references or first frames, and asks for permission to add the images and videos you create to your library.
• Purchases: handled by Apple. RevenueCat receives your OndaLabs account ID and your App Store purchase history so your plan works across devices.
• No tracking: the app has no advertising or analytics SDKs, doesn't use push notifications, and doesn't track you across other apps. If you choose to share analytics with app developers in iOS Settings, Apple may share crash reports with us.

You can turn camera, microphone and photo access off at any time in iOS Settings › OndaLabs.

7. Your Files, Share Links and Custom Voices

• Files: the audio, images and videos you generate, and the reference images and first frames you upload, are stored on Amazon S3 in Frankfurt at long, unguessable links. Anyone who has a file's link can open it, so share links with care.
• Share links: when you create a share link for a clip, it gets a public page (ondalabs.app/s/…) where anyone with the link can play and download it. Deleting the clip removes the page.
• Custom voices: to clone a voice, the sample and a spoken consent statement are sent to Google to create the voice. We don't keep those recordings. Deleting the voice, or your account, deletes it at Google too. We only process voice samples to create the voice you asked for, never to identify anyone.

8. Cookies

Our website uses a session cookie to keep you signed in, and PostHog uses a cookie and your browser's local storage to tell visits apart for analytics. We don't use advertising cookies. The iOS app doesn't use cookies.

9. GDPR and Data Protection

OndaLabs is committed to complying with the General Data Protection Regulation (GDPR) and other applicable privacy laws. We process your personal data based on:

• Your consent (for example, the consent recording for a cloned voice)
• The need to perform a contract (e.g., delivering our services)
• Our legitimate interests (e.g., preventing abuse and improving the platform)
• Legal obligations

You have the right to access, correct, delete, or restrict the use of your personal information. You can also object to processing, withdraw your consent, or request data portability where applicable, and you can complain to your local data protection authority.

To make a request, contact us at: hello@ondalabs.app

We will respond within the timeframes required by law (typically 30 days).

10. Data Security

We use industry-standard security practices to protect your personal data. This includes:

• Encrypted connections (HTTPS and encrypted database links)
• Secure storage of your data, and of your sign-in on iOS
• Restricted access to authorized personnel only

While no system is 100% secure, we take reasonable steps to protect your information from unauthorized access, loss, or misuse.

11. Data Retention

• While your account is open: we keep your account data and library. Deleting an item removes it from your library.
• When you delete your account: we delete your account details and library, and your custom voices at Google. We keep a minimal record (your email address, billing identifiers, plan and credits used) to prevent abuse of free credits and for accounting and legal obligations.
• Stored files: files can stay in storage after you delete them from your library. To have them erased, email us at hello@ondalabs.app and we will delete them.
• Technical data: rate-limit counters expire within 24 hours; server logs are kept only for a short period.
• AI providers: keep requests according to their own policies, as described in section 4.

12. Children's Privacy

OndaLabs is not intended for users under the age of 13 (or the age of digital consent in your country). We do not knowingly collect personal information from children. If we become aware that we've collected data from a child, we will delete it promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example when we add tools or AI providers. If we make significant changes, we will update the "Last Updated" date and notify you when appropriate. Continued use of OndaLabs after changes means you accept the updated policy.

14. Refund Policy

We want you to be satisfied with OndaLabs. We offer refunds under specific conditions:

• Refund Eligibility: Refunds are available only if you have used less than 10% of the credits included in your purchase
• Refund Amount: 100% money back for eligible requests
• Time Limit: Refund requests must be submitted within 30 days of purchase
• iOS App: Purchases through our iOS app are refunded by Apple under the App Store refund policy (reportaproblem.apple.com)

To request a refund for a web purchase, contact us at hello@ondalabs.app with your account email and reason for the request.

Note: Subscriptions bought in the iOS app are billed and managed by Apple; subscriptions bought on the web are billed by Stripe.

15. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, contact us at: hello@ondalabs.app