Voice & Biometric Consent
DRAFT — pending review by qualified Spanish/EU counsel. Bracketed [PLACEHOLDERS] must be completed before this document is relied upon in production. The English version governs; other languages are provided for convenience only.
Effective date: [EFFECTIVE DATE] Last updated: [EFFECTIVE DATE]
Please read this notice carefully before you record your voice. This is a separate, explicit consent for a specific kind of processing that European data-protection law treats with special care: biometric data. You are not required to accept it in order to hold a SleepyCuddle account — it is entirely your choice. If you would rather not, you can still create and read your family's personalised story text, and (where offered) have stories narrated with standard, non-cloned voices; you simply will not be able to have stories narrated in your own voice.
By ticking the box that accompanies this notice and starting a recording, you give SleepyCuddle your explicit consent to the processing described below, under Article 9(2)(a) of the General Data Protection Regulation (GDPR).
Table of contents
- Who is asking for your consent
- What we ask you to provide
- What is created from your recording, and why it is "biometric"
- The single, specific purpose
- What we will never do with your voice
- Your promise: only your own voice
- Who processes the data and where it goes
- International transfers and safeguards
- Security and breach notification
- How long we keep it, and deletion of your data
- Withdrawing your consent
- The consent is free, specific, informed and explicit
- Your rights and how to contact us
- What you are agreeing to
1. Who is asking for your consent
The data controller — the person who decides how and why your voice data is processed — is:
- [OPERATOR FULL NAME], a self-employed individual (autónomo) operating the SleepyCuddle service
- NIF: [NIF]
- Address: Av. de les Corts Valencianes 26, 46015 Valencia, Spain
- Contact e-mail: [CONTACT EMAIL]
- Website: sleepycuddle.com
Throughout this notice, "we", "us" and "SleepyCuddle" mean the controller named above.
2. What we ask you to provide
We ask you to record a sample of your own speaking voice using your device's microphone, following the short on-screen prompts. That audio recording is the only biometric input we need from you.
You are the only person with an account and the only person who decides to make this recording. Children do not have accounts, never sign in, and are never asked to record anything.
3. What is created from your recording, and why it is "biometric"
From your recording, a third-party voice-synthesis (text-to-speech) provider creates a voiceprint and a voice clone: a mathematical and generative model of the distinctive characteristics of your voice.
Because this model is produced by specific technical processing of your voice and is capable of uniquely identifying and reproducing you as a natural person, it is biometric data and therefore a special category of personal data under Article 9 of the GDPR. Special-category data receives heightened legal protection, which is exactly why we ask for your explicit consent on this separate page rather than bundling it into our general Terms.
The processing of your voice on our behalf is carried out by third-party voice-synthesis (text-to-speech) providers. Some of these providers create the voiceprint and voice clone from your recording and can also turn approved story text into audio in your voice; others do not create your voiceprint or clone, but process your voice and approved story text to generate the audio narration of a story.
These providers act as our processors under written data-processing agreements and may only process your voice data on our documented instructions.
4. The single, specific purpose
Your voice recording, voiceprint and voice clone are processed for one purpose only:
To narrate your own family's personalised bedtime stories in your voice, for your own children.
Concretely, this means: when you generate a story and approve its text (every story is shown to you as text first and passes automated safety checks before any audio is produced), we use your voice clone to produce an audio narration of that specific story so your child can hear it read in your voice.
The lawful basis for processing this special-category data is your explicit consent under Article 9(2)(a) GDPR, together with your consent under Article 6(1)(a) GDPR. Because you can use SleepyCuddle without a cloned voice, this processing is optional and depends entirely on your consent — we do not treat it as necessary to perform our contract with you, and we do not rely on any other basis for your biometric data.
5. What we will never do with your voice
We commit that your voice recording, voiceprint and voice clone are never:
- sold, rented or licensed to anyone;
- used to identify, match or impersonate any other person, or to authenticate you anywhere outside SleepyCuddle;
- used for advertising — SleepyCuddle shows no ads and does no behavioural advertising of any kind.
We instruct our processors, through their data-processing agreements, to process your voice data only on our documented instructions and not for their own purposes. Whether — and to what extent — each voice provider is contractually barred from using your voice data to train its general-purpose or foundation AI models is governed by that provider's specific commitments, which are: [PLACEHOLDER — provider-specific training/retention commitment to be inserted verbatim before production].
Your voice clone is used to voice your family's stories and nothing else.
6. Your promise: only your own voice
You may only record your own voice — the voice of the adult account holder giving this consent.
You must not record the voice of a child, or of any other person. By proceeding, you confirm that the voice you are about to record is your own. This protects other people whose voices are, like yours, biometric data.
7. Who processes the data and where it goes
We host and process your data using the following processors, each bound by a data-processing agreement:
| Processor | Role in voice processing | Location |
|---|---|---|
| Third-party voice-synthesis (text-to-speech) providers | Create the voiceprint + voice clone and/or generate the audio narration (voice recording, voiceprint, story text → audio) | Outside the EEA (including the United States); transfers covered by EU SCCs |
| Our cloud hosting provider | Application hosting (application data at rest) | EU — Frankfurt, Germany |
| Cloud storage and content-delivery (CDN) providers | Storage + CDN delivery of generated audio | Global edge network |
For completeness, other processors support the wider service (for example our third-party payment processor for payments, a third-party authentication provider (when you choose social sign-in), third-party AI language-model providers for story-text generation, and the mobile platform's push-notification service); these are described in our main Privacy Policy. This consent concerns your voice data specifically, which is handled by the processors listed above.
8. International transfers and safeguards
Some of the providers that create or use your voice clone are located in the United States. When your voice data is transferred outside the EU/EEA, that transfer is protected by EU Standard Contractual Clauses (SCCs) approved by the European Commission, so that your data continues to benefit from GDPR-level protection.
Your application data at rest is hosted within the EU (Frankfurt, Germany). Generated audio — which is a derived output of your cloned voice — may be delivered from a global content-delivery network so that playback is fast for you. Where that delivery involves a location outside the EU/EEA, the transfer is likewise covered by EU Standard Contractual Clauses (SCCs).
9. Security and breach notification
We apply appropriate technical and organisational measures to protect your voice recording, voiceprint and voice clone against unauthorised access, loss or misuse, and we require our processors to do the same under their data-processing agreements. Access to your voice data is limited to what is needed to provide the service to you.
If a personal-data breach affecting your voice data occurs, we will act in accordance with our obligations under Articles 33 and 34 of the GDPR: we will notify the Spanish Data Protection Agency (AEPD) where required, and we will inform you without undue delay where the breach is likely to result in a high risk to your rights and freedoms.
10. How long we keep it, and deletion of your data
We keep your voice recording and voice clone only for as long as you keep them in your account — that is, for as long as you want to be able to have stories narrated in your voice.
You can delete your entire account from the app at any time. When you do, all associated personal data is permanently erased — including your voice recording and voice clone, your children's profile information, and the stories generated for them (subject to the limited legal retention described below). As part of that process:
- we stop using your voice clone, and
- we instruct our processors to delete the recording and derived voiceprint/voice clone.
If you would prefer to remove your voice data without deleting your whole account — for example, to withdraw your consent for the voice specifically — contact us at [CONTACT EMAIL] and we will action it as a data-subject request. We may retain non-voice records (such as billing and tax records) only where the law obliges us to. This legal-retention carve-out never applies to your voiceprint or voice clone — we never keep those for tax, accounting or any other retention purpose.
11. Withdrawing your consent
Your consent is withdrawable at any time, and it is just as easy to withdraw as it was to give.
To withdraw, either:
- delete your account from the app, which erases your voice recording and voice clone along with your other personal data; or
- e-mail us at [CONTACT EMAIL] and ask us to delete your voice data (a data-subject request we will action without deleting your whole account).
Withdrawing your consent stops all future processing of your voice data and triggers deletion of the recording and voice clone. Withdrawal does not affect the lawfulness of processing already carried out before you withdrew (for example, story narrations already produced). Withdrawing consent does not, by itself, close your account — you may continue to use SleepyCuddle without a cloned voice.
12. The consent is free, specific, informed and explicit
We want this to be a genuine choice:
- Free — you are not required to consent to use SleepyCuddle, and refusing has no consequence other than that stories cannot be narrated in your own voice.
- Specific — this consent covers only the biometric voice processing described here, for the single purpose in Section 4.
- Informed — this notice tells you what data is created, by whom, where it goes, how it is secured, and how long it is kept.
- Explicit — you give it by an affirmative act (ticking a dedicated box and starting the recording); it is separate from accepting our general Terms of Service.
13. Your rights and how to contact us
Under the GDPR and Spanish data-protection law you have the right to access, rectify, erase, restrict or object to the processing of your voice data, to data portability, and to withdraw consent as described above. We aim to respond to your request within one month, as provided by the GDPR (extendable where the law permits, in which case we will tell you).
Generating a story and running our automated safety checks do not produce legal or similarly significant effects on you, and you are not subject to a decision based solely on automated processing that does so.
To exercise any of these rights, contact:
- Controller: [OPERATOR FULL NAME] — [CONTACT EMAIL]
- Address: Av. de les Corts Valencianes 26, 46015 Valencia, Spain
You also have the right to lodge a complaint with the Spanish supervisory authority:
- Agencia Española de Protección de Datos (AEPD)
- C/ Jorge Juan 6, 28001 Madrid, Spain
- www.aepd.es
The governing law of this consent and of the service is Spanish law.
14. What you are agreeing to
By ticking the box below and starting your recording, you confirm that you have read and understood this notice and that you give your explicit consent to the following:
- ☑️ I consent to SleepyCuddle recording my voice and to third-party voice-synthesis (text-to-speech) providers creating a voiceprint and voice clone from it — biometric special-category data — under Article 9(2)(a) GDPR and Article 6(1)(a) GDPR (consent), and processing my voice and approved story text to generate audio narration.
- ☑️ I understand this data will be used only to narrate my own family's stories in my voice, will never be sold, and will never be used to identify anyone else.
- ☑️ I confirm the voice I am recording is my own.
- ☑️ I understand my voice data may be processed by providers in the United States under EU Standard Contractual Clauses, and stored and delivered as described above.
- ☑️ I understand I can withdraw this consent at any time — by deleting my account, or by contacting [CONTACT EMAIL] — and that this deletes my recording and voice clone, without affecting processing already carried out.
Consent record: account holder e-mail, date and time of consent, and the version of this notice ([EFFECTIVE DATE]) are logged as evidence of your consent.