Privacy Policy
Last updated: 2 October 2026 · ภาษาไทย
1. Who we are
In short: NarrateHQ is run by Gasidid Saovanai, who is the data controller.
NarrateHQ is operated by Gasidid Saovanai, an individual based in Nakhon Sawan, Thailand ("we", "us"). We are the data controller for the personal data described in this policy, under Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA"). Contact us about privacy at [email protected].
2. What we collect
In short: your account details, what you submit to be narrated or transcribed, the files we generate, billing and usage records, and basic technical data.
- Account data: email address, a hashed password, or your Google account identifier, email, and name if you sign in with Google; your plan; and the version and date of the Terms you accepted.
- Content you submit: scripts, pronunciation-dictionary entries, voice and quality preferences, and audio or video files you upload for transcription.
- Clone Voice recordings: recordings you upload to create a cloned voice, and the resulting voice. See section 3.
- Generated content: audio, subtitle, and transcript files produced for you.
- Usage and billing records: characters and credits used, job history, plan and payment status, invoices, and refunds. Card details are collected and stored by Stripe; we never see your full card number.
- Technical data: IP address, browser and device information, and server logs of requests to the Service.
- Cookies: see section 10.
- Referral data: if you arrive through a referral link, a signed referral cookie and the resulting attribution, reward, refund, dispute, and review records.
- Messages: what you send us through the support form or by email.
3. Voice recordings for Clone Voice
In short: we create a cloned voice only with explicit consent, delete the source recording once the voice exists, and delete the voice when you ask.
A recording of a person's voice, and a voice created from it, can identify that person and may be treated as biometric data, a sensitive category under PDPA section 26. We process it only to create the voice you request and to generate speech with it for you, and only after you confirm, for every identifiable speaker, that they have given explicit consent. If the speaker is not you, you are responsible for obtaining their consent before uploading.
- We delete the source recording once the voice has been created. If creation fails, we keep it so you can retry, until you delete the voice.
- The cloned voice is kept until you delete it or close your account. Deleting it also asks the speech engine that holds it to delete it, where that engine supports deletion; an engine that cannot delete a voice may keep it under its own terms, and we tell you before you create a voice with such an engine.
- You can withdraw consent at any time by deleting the voice; this does not affect audio already generated.
- If your voice was uploaded by someone else without your consent, email [email protected]. We will suspend the voice while we review your request.
4. Why we use your data, and on what legal basis
In short: mostly to provide the Service you signed up for; for analytics cookies and Clone Voice, only with your consent.
- To provide the Service (create your account, generate and store your audio, transcribe uploads, send service emails such as verification, receipts, and job notices): performance of our contract with you.
- To bill you and keep accounting records: contract, and our legal obligations under tax and accounting law.
- To keep the Service secure and prevent abuse and fraud, including referral fraud checks and server logs: our legitimate interests, and our obligation under the Computer-Related Crime Act to retain computer traffic data.
- To understand how the site is used with cookie-free Plausible analytics: our legitimate interests. With Google Analytics cookies: only with your consent (section 10).
- To create and use a cloned voice: your explicit consent (section 3).
- To respond to you, and to establish or defend legal claims: our legitimate interests and legal obligations.
We do not use your scripts, recordings, or generated audio to train AI models, we do not sell personal data, and we do not send marketing email. Where we rely on consent, you can withdraw it at any time without affecting processing that took place before.
5. Who processes your data
In short: a small set of service providers that run the Service for us, and authorities only when the law requires.
We share personal data only as needed with providers that process it on our behalf:
- Speech engines: cloud text-to-speech, speech-to-text, and voice-cloning providers receive the text, audio, or recordings needed for the job you request. Some engines keep a record of each request for a limited time under their own terms (up to 30 days); where an engine lets us, files we send it or it creates for a job are set to expire within an hour.
- Hosting and storage: Railway (application servers and database) and Cloudflare (network delivery and file storage).
- Payments: Stripe.
- Email: Resend, for service emails.
- Error monitoring: technical error reports, configured to exclude script content.
- Analytics: Plausible (cookie-free), and Google Analytics through Google Tag Manager if you accept analytics cookies.
- Sign-in: Google, if you choose to sign in with Google.
Each provider processes data under its own terms and privacy policy, which may allow limited retention for security or abuse monitoring. We may also disclose personal data when required by law, a court order, or a competent authority, to protect our rights, or to a successor if the business is transferred.
6. International transfers
In short: the Service runs on servers in the United States, so your data leaves Thailand.
Our application servers are located in the United States, and several of the providers in section 5 process data in the United States and other countries. These countries may not have data protection standards equivalent to Thailand's. We transfer personal data to them as permitted by PDPA section 28, because the transfer is necessary to provide the Service you request under our contract with you, or with your consent, and we choose providers that apply security measures appropriate to the data.
7. How long we keep data
In short: scripts until you delete them, generated audio for a period set by your plan, and records the law requires for as long as it requires.
- Scripts and transcripts: until you delete them or close your account.
- Generated audio and subtitles: Free 7 days; Starter 30 days; Creator 180 days; Pro 365 days; Studio while subscribed. Files are deleted automatically afterwards.
- Uploads for transcription: deleted as soon as the job finishes, whether it succeeds or fails.
- Clone Voice recordings and voices: as described in section 3.
- Server logs: at least 90 days, as the Computer-Related Crime Act requires.
- Referral risk signals: kept in keyed, non-reversible form for up to 90 days, then deleted.
- Account, billing, and accounting records: while your account is open, and afterwards for as long as tax and accounting law requires (generally 5 years).
When you close your account, we delete your content and account data, except records we must keep by law. Referral-facing identity links are removed where practical, while billing, reward, and audit entries are kept for the legal periods that apply.
8. Security
In short: we protect data with measures suited to the risk, and report breaches as the law requires.
We use technical and organizational measures appropriate to the risk, including encrypted connections, hashed passwords, and access controls. No system is perfectly secure. If a personal data breach is likely to risk your rights, we will notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it, and notify you without delay when the risk is high, as PDPA section 37 requires.
9. Your rights
In short: you can access, export, correct, or delete your data, object, and complain to the regulator.
Under the PDPA, and subject to its conditions, you have the right to:
- access your personal data and get a copy of it;
- receive it in a commonly used machine-readable format, or have it sent to another controller;
- have inaccurate data corrected;
- have your data deleted or anonymized;
- restrict how we use it, and object to processing based on our legitimate interests;
- withdraw consent where processing is based on consent; and
- complain to the Office of the Personal Data Protection Committee.
You can download your scripts and audio and delete your account yourself from your account page. For anything else, email [email protected]. We may need to verify your identity, and will respond within 30 days.
10. Cookies
In short: essential cookies always; Google Analytics cookies only if you accept.
- Essential: a session cookie that keeps you signed in, a security (CSRF) cookie, a cookie that remembers your light or dark theme while signed out, and a cookie that remembers your cookie choice. These are needed for the Service to work.
- Referral: when enabled, a signed referral cookie that lasts up to 30 days and is used only to attribute a new account.
- Analytics: Plausible measures usage without cookies and cannot track you across sites. Google Analytics, loaded through Google Tag Manager, sets cookies only after you accept them in the cookie banner. Until then it runs with storage denied.
You can change your choice at any time from "Cookie settings" at the bottom of every page, or in your account settings.
11. Children
The Service is not directed at children. Users under 18 need a parent or guardian's consent (see the Terms). If you believe a child has given us personal data without that consent, contact us and we will delete it.
12. Changes to this policy
We may update this policy. The "Last updated" date shows the current version, and we will notify you by email of material changes. This policy is published in Thai and English with the same meaning; if they conflict, the Thai version prevails for users in Thailand.
13. Contact
Gasidid Saovanai (NarrateHQ), Nakhon Sawan, Thailand. Email: [email protected]