Privacy Policy
Last updated: 17 August 2026
This Privacy Policy explains how Doubtful Sound BV, with registered office at Het Schoemeken 1, 2970 Schilde, Belgium ("Vokals", "we", "us"), processes your personal data when you use https://www.vokals.studio (the "Service").
We are the data controller for the processing described below. Contact: support@vokals.studio.
This Policy should be read together with our Terms of Service. Capitalized terms (Uploads, Outputs, Credits) have the meaning given there.
1. What data we collect
Account data. When you register, we collect your name, email address, and login credentials. Authentication is handled by our identity provider (Clerk), which may also process your IP address and device information for security purposes.
Uploads and Outputs. The audio you provide (instrumentals, reference material), your lyrics and text prompts, your generation settings, and the audio generated for you. Note that Uploads may contain voices or other content relating to you or to third parties; you are responsible for having the right to upload such material.
Payment data. Purchases are processed by our payment provider (Plug&Pay) and the payment methods it supports. We receive confirmation of your purchase, your billing details, and invoice data required for our accounting. We never see or store your full card number.
Usage and technical data. Log data such as IP address, browser and device type, pages visited, features used, Credit consumption, and error reports — used to operate, secure, and improve the Service.
Communications. Emails you send to support, survey responses, and your newsletter/marketing preferences.
Cookies and similar technologies. We use cookies and tracking pixels as described in Section 7.
2. Why we process your data, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Providing the Service: account, generation, storing your projects, downloads | Account data, Uploads, Outputs, usage data | Performance of a contract (Art. 6(1)(b)) |
| Payment processing, invoicing, accounting, VAT | Payment data | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Security, fraud and abuse prevention, enforcing our Terms | Account, usage, technical data | Legitimate interest (Art. 6(1)(f)): keeping the Service safe |
| Improving the Service: debugging, performance, feature usage analysis | Usage and technical data | Legitimate interest (Art. 6(1)(f)) |
| Transactional email (receipts, service announcements, security notices) | Email address | Contract (Art. 6(1)(b)) |
| Marketing email and newsletters | Email address, preferences | Consent (Art. 6(1)(a)) — withdraw any time via the unsubscribe link |
| Advertising measurement (e.g. Meta Pixel / Conversions API) | Cookie and event data | Consent (Art. 6(1)(a)) |
| Responding to legal requests, establishing or defending claims | As relevant | Legal obligation (Art. 6(1)(c)) or legitimate interest (Art. 6(1)(f)) |
We do not use your Uploads or Outputs to train our own AI models, and we do not sell your personal data.
3. AI processing and third-party providers
Vokals does not run its own AI models end-to-end. To fulfil your generation requests, your Uploads, prompts, settings, and the resulting Outputs are transmitted to and processed by third-party AI infrastructure providers (currently including Replicate, Inc., which hosts the models we use).
We share only what is needed to run your job, and we select providers with published data-protection commitments. However, these providers process data under their own terms and privacy practices, which we do not control and cannot fully audit. We are transparent about this rather than promising more than we can verify. If a provider's data practices change in a way that affects you, we will update this Policy and, where required, seek your renewed consent or offer alternatives.
Other processors we use to operate the Service:
- Clerk — authentication and account management
- Convex — application database (projects, Credits, settings)
- Plug&Pay — checkout and payment processing
- Vercel — website hosting, storage and delivery of files, and privacy-friendly web analytics
- GoHighLevel (HighLevel Inc.) — transactional and marketing email, and customer relationship management
- Meta Platforms — advertising measurement
An up-to-date list of processors is available on request via support@vokals.studio.
4. International transfers
Several of our providers (including Replicate, Clerk, Convex, Vercel, GoHighLevel, and Meta) are based in or process data in the United States or other countries outside the European Economic Area. Where personal data is transferred outside the EEA, we rely on safeguards recognized under GDPR Chapter V — the EU–US Data Privacy Framework where the provider is certified, and/or the European Commission's Standard Contractual Clauses — supplemented where appropriate. You can request more information about the safeguards applicable to a specific transfer via support@vokals.studio.
5. Retention
We keep personal data no longer than necessary for the purposes above:
- Account data, Uploads, Outputs, projects: retained for as long as your account exists. This is a feature of the Service, not just a policy: keeping your projects and past generations available lets you re-download, revisit, and modify older work at any time. If you delete individual content or your entire account, it is removed from production systems within 30 days; residual copies in backups are rotated out within 90 days.
- Invoicing and accounting data: retained as required by Belgian law (generally 7 years).
- Support correspondence: up to 2 years after the ticket is closed.
- Marketing consents and email data: until you withdraw consent or after prolonged inactivity.
- Security logs: typically 12 months.
Data processed by our AI providers to fulfil a generation job is retained by them according to their own retention policies; we do not instruct them to retain it beyond job fulfilment.
6. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and receive a copy;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten"), including by deleting your account;
- Restrict processing in certain circumstances;
- Data portability — receive data you provided in a structured, machine-readable format;
- Object to processing based on legitimate interest, and to direct marketing at any time;
- Withdraw consent at any time, without affecting prior processing.
To exercise any right, email support@vokals.studio. We respond within one month. We may ask you to verify your identity before acting on a request.
You also have the right to lodge a complaint with a supervisory authority — in Belgium, the Gegevensbeschermingsautoriteit / Autorité de protection des données (www.gegevensbeschermingsautoriteit.be) — or with the authority of your own EU country of residence. We would appreciate the chance to address your concern first.
7. Cookies
We use:
- Strictly necessary cookies — login sessions and security. These do not require consent.
- Analytics — we use Vercel Web Analytics, which is cookieless and does not track you across sites; it gives us aggregated, anonymized usage statistics.
- Advertising cookies/pixels (e.g. Meta Pixel) — to measure and improve our advertising.
You can control cookies through your browser settings. Refusing non-essential cookies does not limit your use of the Service.
8. Security
We apply appropriate technical and organizational measures, including encryption in transit, access controls, and reliance on established infrastructure providers with strong security practices. No system is perfectly secure; if a data breach occurs that is likely to result in a risk to you, we will notify the supervisory authority and, where required, you, in accordance with GDPR.
9. Children
The Service is intended for users aged 18 and over. We do not knowingly process personal data of children. If you believe a minor has provided us personal data, contact support@vokals.studio and we will delete it.
10. Changes to this Policy
We may update this Policy from time to time — for example, when we change providers or features, or when the data practices of our third-party AI providers change. Material changes will be announced by email or in-app before they take effect. The date at the top tells you when this Policy was last revised.
Doubtful Sound BV · Het Schoemeken 1, 2970 Schilde, Belgium · +32456894193 · support@vokals.studio