What we do with your data

The short answer: process it and hand it back. Nothing else. Uttera is not an archive or a backup: the audio you send comes in, becomes what you asked for, goes out and disappears.

We don't train on your data, and we don't aggregate it

This section exists because it's where almost everyone keeps a door open for themselves. The usual formula is "we don't use your personal data" and, underneath it, permission to use that same data once aggregated or "anonymized". That door isn't here:

• Your audio and your text train no model, ours or anyone else's.
• They are not aggregated into statistics, quality metrics or study sets.
• They are not "anonymized" for reuse in any form. An audio file with the customer's name stripped is still a person's voice, and going on using it would be exactly what we say we don't do.
• They are not reviewed by hand, or by sampling, or "to improve the service".

And it doesn't depend on our good intentions. A promise not to use something you have stored is worth only as much as whoever signs it. Here the promise is stronger because it's a consequence: no copy survives to do it with. Audio is processed in memory and discarded when we answer; the only thing that survives an hour is the audio we generate for you, and it deletes itself.

The models learn nothing from what passes through them: every request begins and ends without leaving a trace in the model.

What this does not say

It pays to be exact, because the short sentence — "we don't train models" — says more than we mean. This is not a promise never to train. Training a model is legitimate and it is how this technology advances.

If one day we fine-tune a model of our own, it will be for what is actually needed: better pronunciation — Spanish from Spain has sounds that open models tend to swallow — better intonation, the way people actually speak, and better delivery of what the text asks for. And it will be with lawfully obtained material: public-domain corpora, purchased licenses, or recordings commissioned and paid for by us. It will be said here when it happens.

The line that is not crossed is the other one, above: what passes through a customer's API never goes in there — not with implicit permission buried in some terms, not aggregated, not "anonymized". That distinction is precisely the one almost nobody makes, and it's the one we care about.

The voice cache lasts one hour

When you turn text into speech, we keep the resulting audio for 60 minutes. If within that hour you ask for exactly the same thing — same text, same voice, same format — we serve it from disk in a few milliseconds instead of generating it again, and it costs you 10%. The response tells you so with the X-Cache: HIT header.

The file name is a hash of the request, not a customer identifier. It is computed from the text, the voice and the parameters, and that's all there is: nothing on disk says who asked for it. Two customers asking for the same text with the same voice share the entry, which is why the cache cannot know whose it is — it isn't anyone's.

What the file does contain is what was said, because it is the audio. That's why it is treated as data and not as something harmless: it lasts an hour and is deleted.

It exists for a concrete reason: in a real integration the same announcement, the same menu or the same welcome sentence gets asked for hundreds of times. Regenerating them every time would be slower for your user and more expensive for you.

After the hour, the file is deleted from disk. It is not marked expired and left there: a periodic process removes it. The difference matters — an "expired" file still on disk is still stored data — and that's why the deletion is real.

Where the system is

Everything — the API, the models, the graphics cards doing the work and the little disk that gets used — is in our own data centers in Andalusia, southern Spain, inside the European Union. There is nothing on another continent, nothing in a third-party cloud, and no "just in case" replica in another jurisdiction.

This matters more than it seems. When a vendor processes personal data outside the European Economic Area, the transfer needs its own legal basis — standard contractual clauses, impact assessments, and the uncertainty they've carried since Privacy Shield fell. Here that problem doesn't exist: there is no international transfer to justify because no data leaves.

Nothing is sent to third parties

Your audio and your text do not leave our infrastructure. Not to transcribe, not to translate, not to summarize. Specifically:

The summary deserves its own paragraph, because it is where nearly everyone ends up calling somebody else's API. We don't: the language model is installed on our machines and only listens on its local interface. There is no call to OpenAI, to Anthropic, to Google or to anyone. The network route to make one doesn't even exist.

Everything encrypted in transit

The connection between your system and ours runs over HTTPS with TLS 1.2 and 1.3, with a certificate issued by a public authority. Cleartext traffic is not accepted: port 80 only redirects to 443.

Inside our facility, traffic between the edge and the compute nodes runs over a private network that is not routed to the internet and that nobody outside can reach. The edge also runs isolated in its own container, without access to the rest of the machine hosting it.

What we do keep, and why

No serious system runs without logs. Ours are designed so we can answer "what happened to this request" without keeping what was inside it:

That log is kept for 180 days and then destroyed. The usage counters store numbers — how many requests, how many credits, how many seconds of audio — never what was in them.

And it is kept deliberately. It is the only way to investigate an incident: an abuse, an attempted fraud, a customer asking what happened to a particular request, a node that failed at three in the morning. A service that cannot answer "this is what happened" isn't more respectful of your data, it's simply worse. The GDPR doesn't prohibit it: network security is an expressly recognized legitimate interest (art. 6(1)(f) and recital 49). What it requires is that the period be defined and proportionate. Six months is: it's the period commonly used for security logs, and it comfortably covers the time in which an incident is detected, investigated and closed, without becoming a historical archive.

The X-Request-Id header returned by every request is the thread that ties your report to our log. It is also the reason we can help you without keeping your content: the identifier is enough.

Why this complies with the GDPR

"We comply with the GDPR" is something everyone says. This is what's behind it, article by article:

Special categories of data

This is worth saying plainly because almost nobody warns about it: tone analysis and speaker profiling produce inferences about a person from their voice. Depending on what they're used for, they can come close to what the GDPR calls special categories (art. 9).

Our position is the one already written in the documentation of those services: they are acoustic estimates, they get things wrong, and they must not be used for anything with consequences for a person — not for hiring, not for scoring, not for deciding who gets served. If your use case comes near that line, it's a case that calls for an impact assessment before an integration.