ଗୋପନୀୟତା ନୀତି

This Privacy Policy explains how Horanadu Corporation Pvt. Ltd. ("Mayantar", "we", "us") collects, uses, shares and protects personal data when you use the Mayantar voice-cloning and text-to-speech platform (the "Service"). It is published with regard to the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025 as their provisions become applicable, the Information Technology Act, 2000 and other privacy laws that apply where we offer the Service. This Policy is a notice, not a substitute for consent: where consent is required, we request it through a clear affirmative action for specified purposes.

Voice recordings are inherently personal — a voice can identify a person. We treat voice data with a higher standard of care than ordinary account data, as described in Section 3.

• Account data — phone number, e-mail address, display name, authentication identifiers (for example, when you sign in with Google), India/outside-India region selection, plan and preferences.
• Voice data — audio you record or upload as a reference sample, the derived voice representations (embeddings) used to create your Voice Clones, and metadata such as the language and name you assign.
• Content data — the scripts and text you submit for generation, and the generated Output audio and its metadata (language, tier, timestamps).
• Avatar video data — the script you write for an avatar video, the stock face and voice you choose, the language, and the finished video and its metadata. Avatar videos use only AI-generated stock faces we provide; we do not collect photographs of people for them.
• Payment data — plan, transactions, and billing identifiers processed by our payment providers. We do not store full card numbers or UPI credentials; those are handled by the payment provider.
• Usage and device data — log data such as IP address, device and browser type, app language, pages viewed, feature usage, error reports and approximate location derived from IP.
• Communications — support requests, abuse reports and consent records you provide.
• Device notification data — if you turn on notifications in our mobile app, a push token that identifies the app on your device, the device platform (Android or iOS), the app language, and which notifications you want. We use it only to tell you that your audio or video is ready.
• Safety-verification data — evidence of identity, authority or permission that we request where necessary to verify a voice-cloning right or investigate misuse. Provide only the information requested and redact unrelated identifiers.

• Consent first — we process a voice sample only after you confirm that the voice is yours or that you have the owner's explicit consent, as required by our Terms & Conditions.
• Third-party voice data — if another user submits your voice, we may receive it indirectly from that user. You may contact us to dispute the upload, request restriction or deletion, and provide information needed to locate it.
• Purpose limitation — your reference samples and voice embeddings are used only to create and operate the Voice Clones in your account, for safety and abuse-prevention checks, and to comply with law.
• No cross-user use — we do not use your voice samples to create voices for other users, and we do not sell voice data to anyone.
• Model training — we do not use your voice samples or Voice Clones to train our general models without your separate, explicit opt-in consent.
• Watermarking — generated Output may carry audible or inaudible watermarks and provenance metadata identifying it as AI-generated; we may process Output to apply and verify these signals.
• Deletion — when you delete a Voice Clone or your account, the associated reference samples and embeddings are deleted from active systems within a reasonable period, subject to Section 6 (retention) and legal holds.

• To provide the Service — creating Voice Clones, generating Output and avatar videos, storing your history and saved videos, and operating your account (performance of our contract with you / your consent).
• Safety and abuse prevention — detecting non-consensual cloning, impersonation, fraud and violations of our Acceptable Use Policy, including automated and manual review of samples and Output where warranted (legitimate purpose / legal obligation).
• Billing and accounting — processing payments, invoices and taxes (contract / legal obligation).
• Service improvement — aggregate analytics, debugging and quality measurement, using data minimised or de-identified where feasible (legitimate purpose).
• Communications — service, security and billing notices; marketing messages only with your consent and with the ability to opt out at any time.
• Legal compliance — responding to lawful requests from courts and authorities, enforcing our Terms, and establishing or defending legal claims.

We do not sell personal data. We share it only with:

• Service providers (data processors) — cloud hosting, storage, GPU inference, analytics, communications and customer-support providers, bound by contracts limiting their use of the data to providing services to us.
• For avatar videos specifically: your script is checked by our content-safety provider (Google) before narration; the narration audio and the chosen stock face are sent to our GPU rendering provider (RunPod) to make the video; and the finished video is stored with our cloud storage provider (Cloudflare R2). The AI models that render the video run on our own workers; your scripts, voices and videos are not sent to the companies that publish those models. See /legal/model-credits for the models and their licences.
• Payment providers — to process payments and prevent payment fraud.
• Notification providers — Google (Firebase Cloud Messaging) and, on iPhone, Apple (Apple Push Notification service) deliver notifications to your device. They receive the push token and the notification text.
• Authorities — where required by applicable law, legal process or binding government request, or where necessary to prevent serious harm.
• Business transfers — in connection with a merger, acquisition, financing or sale of assets, in which case this Policy will continue to apply to the transferred data.
• With your direction — when you share, publish or download Output, or connect third-party services yourself.

• Account data is retained for as long as your account exists and thereafter as needed to comply with legal, tax and accounting obligations.
• Voice samples and embeddings are retained while the corresponding Voice Clone exists in your account, and deleted after you delete the clone or your account, subject to limited backup cycles and legal holds.
• Generated Output and history are retained per your plan's retention rules and deleted thereafter.
• Avatar videos and the scripts they were made from are kept until you delete them or delete your account, up to the number your plan allows you to keep at once. Deleting a video removes the video file and its record.
• Push tokens are kept until we remove them: our app asks our servers to delete a device's token when you sign out on that device, and we delete it when the notification provider reports it is no longer valid, when you register more than ten devices (the oldest is removed), or when you delete your account.
• Abuse-related records (including content and consent records connected to a violation or investigation) may be retained longer as necessary for safety, legal compliance and defence of claims.
• Security and access logs are retained for the period required by applicable law and incident-response needs. Data under a valid legal hold or preservation request is isolated and retained only for the required period.

Subject to applicable law (including the DPDP Act for users in India, and the GDPR or similar laws where they apply to you), you have the right to:

• access a summary of the personal data we process about you and the processing activities;
• correct inaccurate or incomplete data, and update your account information;
• erase your personal data, including your voice samples and Voice Clones, subject to legal retention requirements;
• withdraw consent at any time, with effect for future processing (withdrawal may mean parts of the Service no longer work for you);
• grievance redressal — raise a complaint with our Grievance Officer (Section 12) and, if unresolved, with the Data Protection Board of India or your local supervisory authority;
• nominate another individual to exercise your rights in the event of death or incapacity, as provided by the DPDP Act.

To exercise any of these rights, use the in-app settings where available or e-mail privacy@bimbient.com. We will verify your identity before acting on a request and respond within the time required by applicable law.

Requests should identify the account or disputed voice without including unnecessary sensitive documents. We may ask for proportionate verification to prevent someone else from accessing or deleting your data. If we refuse or limit a request, we will provide the reason and available grievance route where required by law.

We use reasonable technical and organisational safeguards appropriate to the sensitivity of the data — including encryption in transit, access controls, processor safeguards, backups, monitoring and logging — to protect personal data against unauthorised access, loss and misuse. No system is perfectly secure; you are responsible for keeping your credentials confidential. When a personal-data breach triggers a legal notification duty, we will notify affected users and the competent authority without delay and provide the information and updates required by applicable law.

The Service is not intended for persons under 18, and we do not knowingly collect personal data from them. Do not upload the voice of a minor. If you believe a minor has provided us personal data or that a minor's voice has been uploaded, contact us at the address in Section 12 and we will delete it.

Mayantar is a global service. Although parts of our app plane may be hosted in India, generation providers — including RunPod or replacement GPU providers — may receive and process reference audio, scripts, model inputs and generated audio in countries other than India or your country. Payment, communications, security and support providers may also process limited data internationally. We do not claim that all personal or voice data remains in India.

Where a cross-border transfer is permitted, we limit the data sent to what the provider needs, use contractual and security controls, apply deletion or retention instructions, and comply with government restrictions and additional safeguards required by applicable law. Provider locations can change with capacity and configuration; contact us before submitting voice data if you require processing in a particular country. If we cannot meet that requirement, do not upload the data.

We use cookies and similar technologies that are necessary to run the Service (such as session authentication and language preference) and, with consent where required, analytics cookies to understand usage. You can control cookies through your browser settings; disabling essential cookies may break parts of the Service.

Grievance Officer contact: grievance@bimbient.com, Horanadu Corporation Pvt. Ltd., Lucknow, Uttar Pradesh, India. Privacy requests: privacy@bimbient.com. We acknowledge complaints within 24 hours and resolve them within the timelines prescribed under applicable law.

We may update this Policy from time to time. Material changes will be notified to you before they take effect (for example, by e-mail, SMS or an in-app notice), and the “Last updated” date above will be revised. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.