1. Introduction

SILMA.AI LLC ("SILMA", "we", "us", "our") is a Delaware limited liability company that builds voice AI models — text-to-speech, voice cloning, and pronunciation control — for developers and voice-agent companies.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, how long we keep it, and what choices you have. It applies to:

• our website at silma.ai;
• our voice studio at app.silma.ai;
• our developer portal at dev.silma.ai;
• our APIs and SDKs; and
• our sales, support, and marketing activities.

Together we call these the "Services".

This policy does not apply to open-source models you download and run yourself from GitHub or Hugging Face. When you run a model on your own hardware, no data reaches us.

If you use a product built by one of our customers on top of the SILMA API, that customer — not SILMA — decides what data is collected and why. Please read their privacy policy. Section 4 explains our role in that situation.

2. A Note on Voice Data

Voice is personal. A recording of someone speaking can reveal who they are, and in some places recordings used to identify a person count as biometric information under law.

Because of that, we treat voice data with particular care:

• We do not train our models on your audio or your text by default. Training on customer content requires your separate, specific, opt-in consent (Section 6).
• Voice cloning requires consent from the speaker. Our Terms of Service require you to obtain and keep written consent from anyone whose voice you clone. That obligation is yours, and it is a condition of using the feature.
• You can delete your voices from the platform at any time by sending a deletion request to [email protected].

If you are an individual whose voice may have been cloned by one of our customers without your consent, see Section 12.

3. Information We Collect

3.1 Information you give us

3.2 Information we generate

• Generated audio (Output) — the speech files the Services produce from your Input.
• API keys and their metadata (creation date, last use, permissions).

3.3 Information we collect automatically

• Usage data — API calls, endpoints used, model and voice selected, minutes of audio generated, character counts, request timing, latency, error rates, concurrency, and quota consumption.
• Device and connection data — IP address, browser type and version, operating system, device identifiers, language settings, and time zone.
• Log data — timestamps, request identifiers, referring URLs, and pages viewed.
• Cookies and similar technologies — see Section 10.

3.4 Information from third parties

• Payment processors — confirmation of payment, the last four digits of your card, and fraud signals.
• Identity and sign-in providers — if you sign in with a third-party account, we receive your name, email, and profile identifier from that provider.
• Analytics and infrastructure providers — aggregated usage and performance data.
• Publicly available sources — for business-to-business sales outreach, such as company websites and professional networks.

3.5 Information we do not want

Please do not submit special-category or sensitive personal data — health information, government identification numbers, financial account numbers, precise location, information about children, or data revealing race, religion, political opinions, or sexual orientation — through the synthesis API or the studio, unless you have a lawful basis and have told us in advance under a written agreement. The Services are not designed to receive that kind of data.

4. Our Role: Controller and Processor

Our role depends on the data.

We act as a controller for information about you as our customer or website visitor: your account details, billing records, usage metrics, support conversations, and marketing data. We decide why and how that data is processed, and this Policy governs it.

We act as a processor (a service provider) for the content you send through the Services — your Input text, reference audio, Custom Voices, and Output. We process that content on your instructions, to deliver the Services to you. If that content contains personal data about your own end users or about a person whose voice you cloned, you are the controller and you are responsible for:

• having a lawful basis and, where required, consent for that processing;
• giving those individuals the notice their laws require;
• honoring their rights requests; and
• flowing down appropriate obligations to your own users.

If you need a Data Processing Agreement, write to [email protected] and we will provide our standard DPA.

5. How We Use Information

We use personal information for the following purposes:

To provide the Services Authenticate you, generate speech from your Input, create and store Custom Voices, apply pronunciation overrides, deliver Output.

To bill you Meter usage, calculate charges, process payments, issue invoices and receipts, manage subscriptions, and handle refunds and disputes.

To support you Answer your questions, diagnose faults, and follow up on your reports.

To keep the Services secure and prevent abuse Detect and investigate fraud, credential compromise, denial-of-service attempts, quota circumvention, and violations of our Terms of Service — including reports that a voice was cloned without consent, or that the Services were used for impersonation, fraud, or other prohibited content. This may involve a human reviewer at SILMA listening to a specific piece of audio or reading specific Input, but only where it is necessary to investigate a specific report or signal, and only by employees bound by confidentiality.

To operate and improve our business Monitor performance and capacity, debug and fix errors, understand which features are used, and plan our roadmap. Wherever possible we do this with aggregated or de-identified data that does not identify you or any individual.

To communicate with you Send service announcements, security alerts, billing notices, changes to our terms, and — where you have opted in or where permitted by law — product news and marketing. You can unsubscribe from marketing at any time; you cannot unsubscribe from essential service messages while you hold an account.

To comply with law Meet tax, accounting, and regulatory obligations, respond to lawful requests, and establish, exercise, or defend legal claims.

5.1 Legal bases

Where a law requires us to identify a legal basis for processing, we rely on: performance of a contract with you (providing and billing for the Services); our legitimate interests in securing our platform, preventing abuse, improving our products, and marketing to business contacts, balanced against your rights; your consent where we ask for it (for example, optional analytics cookies, marketing emails, or training on your content); and compliance with legal obligations.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that already happened.

6. Model Training

We do not use your Input, your reference audio, your Custom Voices, or your Output to train, fine-tune, or otherwise improve our models.

We will only do so if you give us separate, specific, opt-in consent — for example by enabling a data-sharing setting or signing an agreement that says so. That consent is always optional, is never a condition of using the Services, and can be withdrawn at any time.

Two honest caveats about withdrawal:

1. Withdrawal applies going forward. Content already incorporated into a trained model generally cannot be extracted from it.
2. Withdrawal does not affect aggregated statistics that no longer identify you or any individual, such as counts of requests per model.

Our models are otherwise trained on data we license, data we record with the consent of paid voice talent, and publicly available or open datasets that we believe we have the right to use.

7. How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We share information only in these situations:

7.1 Service providers

We use third parties to run the business. They may process personal data on our behalf, under contract, only on our instructions, and only for the purposes we specify. The categories are:

• Cloud hosting and compute — servers and GPUs that run the models and store data.
• Payment processing — to take payments and manage subscriptions.
• Email and communications — transactional and marketing email delivery.
• Customer support tooling — ticketing and helpdesk software.
• Analytics and monitoring — product analytics, error tracking, and uptime monitoring.
• Security — fraud detection, bot mitigation, and content-abuse screening.
• Professional advisors — lawyers, accountants, and auditors, under a duty of confidence.

A current list of our subprocessors is available on request from [email protected], and enterprise customers can ask to be notified of changes.

7.2 Legal and safety disclosures

We may disclose information where we believe in good faith that it is necessary to:

• comply with a law, regulation, subpoena, court order, or other lawful request from a public authority;
• enforce our Terms of Service, including investigating suspected violations;
• detect, prevent, or address fraud, security, or technical issues; or
• protect the rights, property, or safety of SILMA, our users, or the public.

Where we are legally permitted, we will notify you before disclosing your data in response to a legal request, so you have an opportunity to object. We will not voluntarily hand over customer content to authorities without valid legal process.

Child safety exception: we report suspected child sexual abuse material to law enforcement, and we do so without notice to the account holder.

7.3 Business transfers

If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction. We will require the recipient to honor this Policy for data transferred, and we will notify you if the practices governing your data would materially change.

7.4 With your direction

We share information with anyone you tell us to, including integrations you connect.

7.5 Aggregated and de-identified data

We may publish or share aggregated or de-identified information — for example, benchmark results, latency statistics, or the total volume of audio generated on the platform. This information cannot reasonably be used to identify you, and we will not attempt to re-identify it.

8. How Long We Keep Information

Where we are required to keep information longer for legal, tax, or dispute-resolution reasons, we keep only what is necessary and restrict its use to that purpose.

9. Security

We take reasonable and appropriate technical and organizational measures to protect personal information, including:

• Access controls — least-privilege access for our staff, individual accounts, and multi-factor authentication for administrative systems.
• API key security — keys are shown once at creation, stored hashed, and can be rotated or revoked by you at any time.
• Network protection — firewalling, rate limiting, and abuse detection.
• Logging and monitoring of access to production systems.
• Vendor review before engaging providers that process personal data.
• Confidentiality obligations and security training for personnel.

No system is perfectly secure. We cannot guarantee absolute security, and you are responsible for protecting your credentials — see the account security section of our Terms of Service.

If we become aware of a breach affecting your personal information, we will notify you and any relevant regulator without undue delay, as required by applicable law.

10. Cookies and Similar Technologies

We use cookies and similar technologies on our website and in the studio for:

• Strictly necessary purposes — signing you in, keeping your session, load balancing, and security. These cannot be turned off, because the Services will not work without them.
• Preferences — remembering your language, theme, and settings.
• Analytics — understanding how the site and studio are used, so we can improve them.

Where the law requires consent for non-essential cookies, we ask for it before setting them, and you can change your choice at any time through the cookie settings on our site. You can also block or delete cookies in your browser, though strictly necessary cookies are needed for the Services to function.

We do not use cookies for cross-site advertising.

11. Your Rights and Choices

Depending on where you live, you may have some or all of the following rights over your personal information:

• Access — ask what we hold about you and get a copy.
• Correction — have inaccurate or incomplete information fixed.
• Deletion — ask us to delete your information, subject to our legal obligations to keep some records.
• Portability — receive certain information in a structured, machine-readable format, or have it sent to another provider.
• Objection and restriction — object to processing based on our legitimate interests, or ask us to pause processing while a dispute is resolved.
• Withdraw consent — where we rely on consent, withdraw it at any time.
• Opt out of marketing — unsubscribe from any marketing email, or write to us.
• Opt out of sale or sharing — we do not sell or share personal information for advertising, so there is nothing to opt out of, but you may confirm this with us.
• Non-discrimination — we will not deny you service, charge you a different price, or give you a lower quality of service because you exercised a privacy right.

11.1 Using your rights

Most account and content changes you can make yourself in the platform: edit your profile, delete pronunciation overrides, rotate or revoke API keys, and close your account.

For anything else, write to [email protected] with the subject line "Privacy Request" and tell us what you want. We will:

• verify your identity, usually by confirming you control the email address on the account, and may ask for more information where the request is sensitive;
• respond within 30 days, or tell you if we need longer (we will not take more than 90 days in total); and
• act free of charge, unless a request is manifestly unfounded or excessive.

You may use an authorized agent where the law allows, provided they show us written authority.

If you are not satisfied with our response, you may have the right to complain to your local data protection or consumer protection authority. We would appreciate the chance to address it first.

12. If Your Voice Was Cloned Without Your Consent

If you believe someone used the SILMA platform to create or use a synthetic version of your voice without your permission, contact us at [email protected] with the subject line "Voice Takedown Request".

Please include, if you can:

• a description of where you encountered the synthetic voice (a link, a file, or a recording);
• confirmation that the voice is yours; and
• a way for us to contact you.

We will investigate. Where a report is credible, we may disable or delete the Custom Voice and associated generated audio, suspend the account that created it, and require the account holder to produce evidence of consent. We will tell you the outcome. Depending on the circumstances, we may also refer you to the customer who created the voice, since they are the controller of that content and may hold information we do not.

We take these reports seriously and act on them promptly.

13. International Data Transfers

We operate from the United States, and our infrastructure providers may process and store data in the EU and in other countries. If you are located outside the United States, your information may be transferred to and processed in a country whose data protection laws may differ from those of your own.

When we transfer personal information across borders, we use appropriate safeguards, which may include standard contractual clauses, adequacy decisions, or equivalent mechanisms recognized by the relevant regulator, together with contractual and technical protections in our agreements with providers.

Enterprise customers with data residency requirements should contact [email protected] to discuss regional or on-premises deployment options.

14. Children's Privacy

The Services are for business and professional use and are not intended for anyone under 18. We do not knowingly collect personal information from children.

You must not submit a child's voice as a reference recording for voice cloning, and you must not submit personal information about children through the Services.

If you believe a child has provided us with personal information, or that a child's voice has been submitted to the platform, contact [email protected] and we will delete it promptly.

15. Automated Decision-Making

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

We do use automated systems to detect abuse, fraud, and content that violates our Terms — for example flagging unusual usage patterns or screening for prohibited content. A flagged account may be automatically rate-limited or temporarily restricted, but a human at SILMA reviews the matter before any permanent suspension or termination, and you may contest a decision by writing to [email protected].

16. Third-Party Links and Services

Our website and documentation link to third-party sites, including GitHub, Hugging Face, and Google Colab. Those services have their own privacy policies, and we are not responsible for their practices. Please read them before providing information.

17. Changes to This Policy

We may update this Policy as our Services and the law change. When we do, we will update the "Last Updated" date at the top.

For material changes — for example, a new purpose for using your information, or a new category of recipient — we will give you at least 30 days' notice by email or through the platform before the change takes effect, and where the law requires it, we will ask for your consent.

We keep previous versions available on request, so you can see what changed.

18. Contact Us

SILMA.AI LLC A Delaware limited liability company

Privacy enquiries and rights requests: [email protected] (subject line: "Privacy Request") Voice takedown requests: [email protected] (subject line: "Voice Takedown Request") Data Processing Agreement requests: [email protected] Website: https://silma.ai