UtteraUttera

Legal notice
and privacy

⚠ This is a translation for convenience. The binding version of this document is the Spanish one at uttera.ai/legal. If the two ever disagree, the Spanish text governs. The section numbers and anchors are the same in both, so you can cite either.
⚠ Two things still pending: the tax ID and the commercial registry entry, because the company is being incorporated, and a review by our data protection advisor. The technical content does reflect what the system actually does.

This page brings together everything that governs the use of uttera.ai and the service behind it. It is written to be understood, not to avoid being understood.

1. Who operates this

In compliance with article 10 of Spanish Law 34/2002, on information society services and electronic commerce (LSSI-CE):

Company nameUttera Labs S.L. (hereinafter, "Uttera")
Tax ID (CIF)pending: company being incorporated
Registered officeCalle Corazón de María 2, 28002 Madrid, Spain
Commercial registrypending: company being incorporated
Contact emailsupport@uttera.ai
Websitehttps://uttera.ai

2. Terms of use of the site

2.1 Purpose and acceptance

These terms govern access to and use of the uttera.ai website and its subdomains. Browsing the site means accepting them. If you don't agree with them, don't use it.

2.2 Access

Access to the site is free and requires no registration. The documentation, the prices, the blog and the public demo are available without an account. An account is only needed to use the API and to subscribe to a plan.

Uttera is not responsible for the cost of your internet connection or for the equipment you use to access it.

2.3 Proper use

You agree to use the site in accordance with the law and with these terms. The following is expressly prohibited:

  • Using it for unlawful purposes or in ways harmful to Uttera or to third parties.
  • Introducing or spreading malicious code, or anything that could damage the systems.
  • Unauthorized access, penetration attempts, vulnerability scanning, or mass automated extraction of content.
  • Reproducing or transforming the site's content without authorization, except as allowed by the license of the published code.
Security research. If you've found a security flaw and want to tell us, write to support@uttera.ai with [seguridad] in the subject, without publishing it in the meantime. We will not take action against anyone researching in good faith, without degrading the service, without accessing third-party data, and without extracting information beyond what is needed to demonstrate the problem.

2.4 Intellectual property

The texts, the design, the "Uttera" trademark and the logos are the property of Uttera or of its licensors.

The engine code is a different matter, and it's worth saying so here: the transcription and synthesis servers are published at github.com/uttera under the Apache 2.0 license, and you may use, modify and deploy them under that license, including commercially. The third-party models used with them carry their own licenses, stated in each repository.

2.5 Links

The site links to third-party pages (GitHub, Stripe and others). We are not responsible for their content or their policies, and a link implies neither endorsement nor a commercial relationship.

2.6 Availability

We make a reasonable effort to keep the site up and current, but the website itself carries no availability commitment. The availability commitment for the service — the SLA — depends on your plan and is in the documentation.

3. Terms of the service

3.1 What the service is

Uttera is an API that transcribes audio, generates speech from text, translates and summarizes recordings. It is subscribed to in plans with a monthly allowance of credits and billed per second of audio processed.

3.2 Your account and your key

Using the API requires an account and at least one key. The key is yours and it is your responsibility. Anything done with it is deemed done by you and billed to your account.

  • Don't write it into source code, or into a configuration file that ends up in a repository, or into a phone system's dialplan.
  • If you think it has been compromised, revoke it from your account page: the cut is immediate.
  • You can restrict each key to specific IP addresses. It's the cheapest defense there is and almost nobody uses it.

3.3 Billing, renewal, cancellation and refunds

Payments are handled by Stripe Payments Europe, Ltd. Uttera never sees or stores your card details.

Automatic renewal. Your subscription renews automatically at the end of each period —monthly or annually, whichever you choose— at the then-current price, until you cancel.

Cancellation. You can change or cancel your plan at any time from your account. Cancellation takes effect at the end of the period you have already paid for: you keep your plan and credits until that date and then move to Free. There is no minimum term or penalty.

Subscription credits. The credit allowance is monthly and does not carry over: each month you get your plan's credits for that month, and whatever you don't use does not roll into the next month. On the annual plan you receive that monthly allowance every month for twelve months. If you exhaust the allowance, the service keeps serving you as billable overage, and the response tells you so with the X-Credits-Overage header.

Plan changes. An upgrade is charged pro-rata when you change; a downgrade is scheduled for the end of the current period.

Right of withdrawal (consumers). If you contract as a consumer —a natural person acting outside their trade or profession— you have 14 calendar days from the initial subscription to withdraw. By subscribing and starting to use the service you request its immediate performance. If you have not consumed any credits, we refund you in full; if you have consumed credits, the proportionate value already provided is deducted (email us at support@uttera.ai and we will settle it). Automatic renewal does not open a new withdrawal period: it counts once, at the initial subscription.

Refunds. Outside that period —or if you contract as a company or professional, who has no right of withdrawal— amounts for a period already started are not refunded; you keep your plan and credits until the end of the paid period.

Price changes. If we change the price, we will notify you before the next renewal and you can cancel before it applies.

3.4 Service level

The availability commitment depends on the plan and is published in the documentation. The free, startup and developer plans carry no SLA, and that is also stated on the pricing page before you subscribe.

3.5 Limitation of liability

Uttera provides an automated audio processing service. The results are automatic and may contain errors: a transcript can get things wrong, a summary can omit something relevant, and an acoustic estimate can be incorrect.

You are responsible for reviewing the output before making decisions based on it, especially where those decisions affect people. To the extent permitted by law, Uttera's liability is limited to the amount invoiced in the twelve months preceding the event giving rise to it, and does not extend to lost profits or indirect damages.

Uttera is not a medical device, nor a biometric identification system, nor a tool for assessing people. It must not be used to diagnose, to decide on anyone's hiring or dismissal, or to evaluate a person from their voice. See section 4.

3.6 Suspension

We may suspend an account that breaches these terms, that puts the service at risk, or whose use is manifestly unlawful. Unless urgency or the law prevents it, we will give notice first and say why.

4. Prohibited uses

What follows isn't a defensive lawyer's list: it's what we don't want done with this. Using Uttera for the following is prohibited:

ProhibitedWhy
Impersonating a person with a cloned voice in order to deceive someone: "child in trouble" scams, CEO fraud, defeating voice verification. It's a crime (fraud, art. 248 of the Spanish Criminal Code; and possibly usurpation of civil status, art. 401).
Cloning the voice of an identifiable person without their consent, even if the source material is public. Voice is protected by art. 7.6 of Spanish Organic Law 1/1982. A video being accessible is not a license.
Transcribing unlawfully obtained recordings: conversations recorded without being a party to them, wiretaps without legal basis, hidden microphones. Art. 197 of the Criminal Code. Our processing it does not make it lawful.
Identifying people by their voice, or building a register of voiceprints. That is biometric processing, a special category under art. 9 GDPR. We don't offer it and we don't want it built on top of us.
Making decisions about people from tone analysis or speaker profiling: hiring, rejecting, scoring, prioritizing support. They are acoustic estimates and they get things wrong. It also brushes against art. 22 GDPR.
Generating disinformation: fake audio of real people about events that did not happen, or material presented as authentic when it isn't. Beyond the harm, art. 50 of Regulation (EU) 2024/1689 requires disclosure. See section 5.3.
Harassment, threats, or generating sexual content with a real person's voice.This needs no explanation.
Reselling the service as your own without an agreement, or using it to train a competing model from its outputs. If you want to run it yourself, the code is open: do it.
And a warning in the other direction. What a transcript returns is untrusted text: it comes from audio that neither you nor we control, and someone may have deliberately said a sentence shaped like an instruction. If you're going to pass our output to an agent, a CRM, or any automation with permissions, treat it as data, never as instructions.

5. Cloned voice and recordings under Spanish law

This section exists because it's where most people get themselves into trouble without knowing it, and because we'd rather explain it than hide behind "the customer is responsible".

5.1 Whose voice you may clone

Yes, with peace of mind:

  • Your own voice. To dub yourself into a language you don't speak, so you don't have to re-record a voiceover every time a sentence changes.
  • Someone who has given you written permission, for a specific and bounded use: a hired voice actor with an express assignment, a colleague who agrees to voice the internal assistant.
  • A voice that belongs to no real person, or one licensed for the purpose.

No:

  • The voice of an actor, a presenter or a politician because public material exists. Accessible is not authorized.
  • The voice of a customer or an employee because you have it recorded from a call. Recording for quality assurance is not collecting a voice model.
  • The voice of a recognizable person, to make it look like they said something they didn't.

The practical test, which is almost always right: would the person that voice belongs to be comfortable seeing what you're about to generate with it? If the answer is "they'll never find out", you have your answer.

5.2 Which recordings you may process

Uttera processes the audio you send it; it does not check where it came from, and that check is yours.

  • Recording a conversation you are part of is not a crime in Spain. Distributing it can be, and processing it for purposes other than those that justified it also has consequences.
  • Recording a conversation between others, where you are not a party, is a crime (art. 197 of the Criminal Code).
  • Recording calls in a company requires informing both parties in advance, having a legal basis and a defined retention period. If you also record your employees, see arts. 89 and 90 of the LOPDGDD.
  • Special category data. A clinical recording is health data (art. 9 GDPR). Processing it is not prohibited — it is done every day — but it requires its own legal basis and, frequently, an impact assessment.

5.3 The duty to disclose generated audio

Since 2 August 2026, article 50 of Regulation (EU) 2024/1689, the AI Act, has been in application. As it affects you as a user of Uttera:

  • If you generate audio that imitates a real person and could lead someone to believe it is authentic — what the Regulation calls a deep fake — you must disclose it clearly and visibly.
  • If the synthetic audio informs the public on matters of public interest, the same applies.
  • If your system converses with a person, that person must know they are talking to a machine, unless it is obvious.

That duty is yours, because you are the one publishing. Ours, as providers of the system that generates the audio, is to enable technical marking of synthetic content: article 50(2) requires outputs to be marked in a machine-readable format and the marking to be detectable.

5.4 Our marking timeline

These are the dates, so you can plan around them:

WhenWhat
2 August 2026Article 50 becomes applicable.
2 December 2026End of the adaptation period for systems placed on the market before August. That is the deadline that applies to us.

In July 2026 the European Commission published interpretive Guidelines — not binding — and there is a Code of Practice on Transparency of AI-Generated Content that providers may sign up to.

5.5 How we mark, since 16 September 2026

All audio Uttera generates carries a watermark, in both voices — standard and cloned — and in every format we serve. It is not optional and cannot be turned off: no API parameter allows it.

We use AudioSeal, by Meta, under the MIT licence. It is an imperceptible mark embedded in the sound samples themselves, not a file metadata field: it survives re-encoding, compression, trimming and format conversion. It is applied before encoding, so it travels in the audio you receive, whether wav, mp3, opus, flac or pcm.

WhatHow
What the mark saysThat the audio was machine-generated, and nothing else.
What it does not sayNot who requested it, nor when, nor under which account, nor any identifier that could trace it back to a person. This is deliberate: the technical marking the law requires signals the artificial origin of the content, not who commissioned it.
Can it be removedOnly by destroying the audio. It is designed to withstand compression and re-editing.
Can it be verifiedYes, and we will publish the tool so that you can do it yourself.

Every audio response from our API also carries the X-Watermark header, declaring which scheme was used. If you ever receive audio from us without that header, that is a failure on our side and we want to hear about it.

5.6 How far the mark holds

A watermark is worth something if it survives the road the audio actually travels. These are our own measurements, on audio that came out of our engines:

What the audio goes throughStill detected?
Compressed to mp3, opus or flacYes
Recompressed three times overYes
Landline (G.711), ISDN (G.722)Yes
2G mobile (GSM 06.10)Yes
PBX compressing to 16 kbps (G.726)Yes
Cut to telephone band (300–3400 Hz)Yes
Played through a speaker and picked up by a microphoneYes
G.723.1 at 6.3 kbps (legacy VoIP codec, largely obsolete)No

We state it with its limit up front, including the case where it fails. A mark presented as infallible is not a mark, it is advertising.

5.7 On C2PA metadata

C2PA is a signed manifest that travels inside the file and that some platforms read to label content. We do not implement it, and we explain why, rather than leaving it as an open-ended "coming soon":

  • It is not needed for compliance. Article 50(2) requires machine-readable, detectable marking. The watermark is exactly that, and it is in all five formats. C2PA is one way to comply, not the way.
  • It protects against nothing. It is container metadata: any re-encode strips it, and so does any platform that transcodes. Anyone out to impersonate a voice is not going to send you a signed file.
  • The standard does not support opus or raw pcm, two of the five formats we serve. Verified by us, not read off a documentation page.

C2PA does bring interoperability — a platform labelling the content by itself instead of treating it as unknown provenance — and that is real value. But it does not pay for itself: a manifest you can strip with one ffmpeg command proves nothing, and what has to be proven here is that a recording came out of a machine. The watermark does that, and it keeps doing it after a phone call. This is not a postponement: it is a decision. If the facts change — if the standard starts supporting opus, if platforms begin requiring it — we will revisit it and say so here.

5.8 How to check it yourself

We do not build a verification tool, and that is deliberate. We prefer something sounder: that you can verify it with Meta's public code, depending neither on us nor on us keeping anything running. A check is worth more when the interested party is not the one performing it.

pip install audioseal

from audioseal import AudioSeal
det = AudioSeal.load_detector("audioseal_detector_16bits")
prob, _ = det.detect_watermark(audio, sample_rate)   # mono audio, float32

That is the official AudioSeal detector, MIT licensed. Nothing of ours in between.

ResultWhat it means
Above 0.5The audio carries our mark. In our measurements marked audio never drops below 0.733 (worst case, mp3).
Below 0.5It does not carry our mark. In our measurements unmarked audio never exceeds 0.016.
A low result does NOT mean the audio is genuine. It only means it is not ours, and there are two possible reasons: that we did not generate it, or that we did and the audio has been degraded below what the mark withstands (see 5.6).

And above all: no tool can tell you whether an audio was generated by an AI. Watermarks are not interoperable — every provider uses its own and nobody reads anyone else's — so audio watermarked by another system will come back as "unmarked" in any checker but that provider's. Google warns exactly the same about its SynthID detector: it is a first-party provenance tool, not a universal AI detector.


The deadline that applies to us is 2 December 2026: article 50 applies from 2 August 2026, but systems placed on the market before that date have an adaptation period running to December.

6. Privacy policy

This explains what we do with your data: your account and your browsing. What we do with the audio you send us is a different matter and goes in section 7, because there we are not the controller but the processor.

6.1 Controller

ControllerUttera Labs S.L. — tax ID pending: company being incorporated
AddressCalle Corazón de María 2, 28002 Madrid, Spain
Contactsupport@uttera.ai

6.2 What data we process, for what, and on what basis

DataPurposeLegal basisRetention
Email address and identifier from the sign-in provider (Google or GitHub, if you use one)Create and maintain your account, and give you accessPerformance of the contract (art. 6(1)(b) GDPR)As long as you have an account
API keys (stored as a cryptographic hash, never in the clear) and their IP restrictionsAuthenticate your requestsPerformance of the contractUntil you revoke them
Usage: seconds processed, service used, timestampBilling and showing you your spendPerformance of the contract and legal obligationTax and commercial retention periods
Billing dataIssuing invoicesLegal obligation (art. 6(1)(c)) 6 years (art. 30 of the Spanish Commercial Code)
Technical logs: IP, date, path, response code, request identifierSecurity, diagnostics and abuse preventionLegitimate interest (art. 6(1)(f)) 1 year
Emails you send to supportHelping youPerformance of the contract or legitimate interestAs long as the matter requires, and 1 year after

6.3 What we do NOT do

6.4 Who else is involved

These are all the third parties involved, and there are no others:

WhoFor whatWhere
Stripe Payments Europe, Ltd.Payments and invoicing. Your card details go straight to Stripe; we never see them.Ireland (EU)
Google or GitHubOnly if you choose to sign in with them. We receive your email address and an identifier; nothing else.Outside the EU, under their own safeguards

There is no third party anywhere in the audio path. Transcription, translation, summarization and synthesis all run on our own machines, in Spain.

6.5 Where the data is

On our own infrastructure in Andalusia, Spain. There are no international data transfers other than sign-in with Google or GitHub, which only exists if you choose that way in, and Stripe's, within the EU.

6.6 Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to support@uttera.ai. We will respond within one month.

Two of them are already handled without you having to ask:

If you believe we haven't handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es). We'd appreciate hearing from you first, so we can try to fix it.

7. Data processing agreement

This section is the one that matters if you're a company and you're going to send us recordings containing other people's data.

7.1 Who is who

With respect to the audio and text you send us, you are the controller and Uttera is the processor (art. 28 GDPR). We process that data solely to provide you the service and following your instructions, which are the requests you make to the API.

This serves as a data processing agreement. If you need a signed contract — many organizations require one — write to us and we'll sign it.

7.2 What we do with that content

7.3 Asynchronous mode (opt-in): what we store and for how long

Section 7.2 —"processed and discarded"— is the rule and the default behaviour. It has one exception, and only if you turn it on: asynchronous mode (async=1), meant for the deepest audio intelligence analyses, which do not fit within the time of a single connection. If you don't ask for it, none of this happens.

When you submit an asynchronous job:

Outside that minimal window, everything in 7.2 still holds: we do not train models on your content, we do not aggregate it, we do not review it by hand, and there are no sub-processors in the audio path.

7.4 Security and obligations

8. Cookie policy

8.1 Summary

We use no analytics cookies, no advertising cookies, and no third-party cookies. That's why you won't see a cookie banner: there is nothing to consent to. What we store in your browser is technical and necessary for the site to work — or for a service you request, such as the help chat — and it is exempt from consent under art. 22(2) of the LSSI.

8.2 What there is, exactly

NameTypeFor whatDuration
sessionFirst-party cookie, technicalKeeping you signed in. It only exists if you sign in to your account; it is encrypted and marked Secure and SameSite=Lax.14 days
uttera-temaLocal storage, not a cookieRemembering whether you prefer the light or dark theme. It is never sent to the server: it stays in your browser.Until you clear your browser data
_chatwoot_sessionFirst-party cookie, technical (help chat)Created only if you open the help chat, by clicking the bubble: it keeps that conversation while you use it. No analytics, no tracking. If you don't open the chat, it is never created.For the duration of the chat session

If you only browse the public site — home, documentation, blog, pricing — absolutely nothing is stored except your theme preference, if you change it (and, if you open the help chat, that chat's session).

8.3 How to remove them

From your browser settings, like any other. Note that if you block the session cookie you won't be able to stay signed in.

8.4 If this changes

If we ever add analytics, there will be a banner and there will be prior consent, and this table will say so before it happens. While this page says there is none, there is none.

9. Changes and governing law

We may modify these terms. Changes are published on this same page with their date. If a change is substantial and affects you as a customer, we will notify you by email with reasonable advance notice before it takes effect.

These terms are governed by Spanish law. For any dispute, the parties submit to the Courts of Madrid, unless the law imposes another venue — in particular, if you are a consumer you keep yours.

If you are a consumer resident in the European Union, you may use the European Commission's online dispute resolution platform: ec.europa.eu/consumers/odr.

Last updated: 15 September 2026