UtteraUttera

Legal notice
and privacy

⚠ This is a translation for convenience. The binding version of this document is the Spanish one at uttera.ai/legal. If the two ever disagree, the Spanish text governs. The section numbers and anchors are the same in both, so you can cite either.
⚠ Two things still pending: the tax ID and the commercial registry entry, because the company is being incorporated, and a review by our data protection advisor. The technical content does reflect what the system actually does.

This page brings together everything that governs the use of uttera.ai and the service behind it. It is written to be understood, not to avoid being understood.

1. Who operates this

In compliance with article 10 of Spanish Law 34/2002, on information society services and electronic commerce (LSSI-CE):

Company nameUttera Labs S.L. (hereinafter, "Uttera")
Tax ID (CIF)pending: company being incorporated
Registered officeCalle Corazón de María 2, 28002 Madrid, Spain
Commercial registrypending: company being incorporated
Contact emailsupport@uttera.ai
Websitehttps://uttera.ai

2. Terms of use of the site

2.1 Purpose and acceptance

These terms govern access to and use of the uttera.ai website and its subdomains. Browsing the site means accepting them. If you don't agree with them, don't use it.

2.2 Access

Access to the site is free and requires no registration. The documentation, the prices, the blog and the public demo are available without an account. An account is only needed to use the API and to subscribe to a plan.

Uttera is not responsible for the cost of your internet connection or for the equipment you use to access it.

2.3 Proper use

You agree to use the site in accordance with the law and with these terms. The following is expressly prohibited:

  • Using it for unlawful purposes or in ways harmful to Uttera or to third parties.
  • Introducing or spreading malicious code, or anything that could damage the systems.
  • Unauthorized access, penetration attempts, vulnerability scanning, or mass automated extraction of content.
  • Reproducing or transforming the site's content without authorization, except as allowed by the license of the published code.
Security research. If you've found a security flaw and want to tell us, write to support@uttera.ai with [seguridad] in the subject, without publishing it in the meantime. We will not take action against anyone researching in good faith, without degrading the service, without accessing third-party data, and without extracting information beyond what is needed to demonstrate the problem.

2.4 Intellectual property

The texts, the design, the "Uttera" trademark and the logos are the property of Uttera or of its licensors.

The engine code is a different matter, and it's worth saying so here: the transcription and synthesis servers are published at github.com/uttera under the Apache 2.0 license, and you may use, modify and deploy them under that license, including commercially. The third-party models used with them carry their own licenses, stated in each repository.

2.5 Links

The site links to third-party pages (GitHub, Stripe and others). We are not responsible for their content or their policies, and a link implies neither endorsement nor a commercial relationship.

2.6 Availability

We make a reasonable effort to keep the site up and current, but the website itself carries no availability commitment. The availability commitment for the service — the SLA — depends on your plan and is in the documentation.

3. Terms of the service

3.1 What the service is

Uttera is an API that transcribes audio, generates speech from text, translates and summarizes recordings. It is subscribed to in plans with a monthly allowance of credits and billed per second of audio processed.

3.2 Your account and your key

Using the API requires an account and at least one key. The key is yours and it is your responsibility. Anything done with it is deemed done by you and billed to your account.

  • Don't write it into source code, or into a configuration file that ends up in a repository, or into a phone system's dialplan.
  • If you think it has been compromised, revoke it from your account page: the cut is immediate.
  • You can restrict each key to specific IP addresses. It's the cheapest defense there is and almost nobody uses it.

3.3 Billing

Payments are handled by Stripe Payments Europe, Ltd. Uttera never sees or stores your card details.

Credits are assigned per billing cycle and do not carry over from one cycle to the next. If you exhaust the allowance, the service keeps serving you as billable overage, and the response tells you so with the X-Credits-Overage header.

You can change or cancel your plan at any time from your account. Cancellation takes effect at the end of the current cycle; there is no minimum term.

3.4 Service level

The availability commitment depends on the plan and is published in the documentation. The free, startup and developer plans carry no SLA, and that is also stated on the pricing page before you subscribe.

3.5 Limitation of liability

Uttera provides an automated audio processing service. The results are automatic and may contain errors: a transcript can get things wrong, a summary can omit something relevant, and an acoustic estimate can be incorrect.

You are responsible for reviewing the output before making decisions based on it, especially where those decisions affect people. To the extent permitted by law, Uttera's liability is limited to the amount invoiced in the twelve months preceding the event giving rise to it, and does not extend to lost profits or indirect damages.

Uttera is not a medical device, nor a biometric identification system, nor a tool for assessing people. It must not be used to diagnose, to decide on anyone's hiring or dismissal, or to evaluate a person from their voice. See section 4.

3.6 Suspension

We may suspend an account that breaches these terms, that puts the service at risk, or whose use is manifestly unlawful. Unless urgency or the law prevents it, we will give notice first and say why.

4. Prohibited uses

What follows isn't a defensive lawyer's list: it's what we don't want done with this. Using Uttera for the following is prohibited:

ProhibitedWhy
Impersonating a person with a cloned voice in order to deceive someone: "child in trouble" scams, CEO fraud, defeating voice verification. It's a crime (fraud, art. 248 of the Spanish Criminal Code; and possibly usurpation of civil status, art. 401).
Cloning the voice of an identifiable person without their consent, even if the source material is public. Voice is protected by art. 7.6 of Spanish Organic Law 1/1982. A video being accessible is not a license.
Transcribing unlawfully obtained recordings: conversations recorded without being a party to them, wiretaps without legal basis, hidden microphones. Art. 197 of the Criminal Code. Our processing it does not make it lawful.
Identifying people by their voice, or building a register of voiceprints. That is biometric processing, a special category under art. 9 GDPR. We don't offer it and we don't want it built on top of us.
Making decisions about people from tone analysis or speaker profiling: hiring, rejecting, scoring, prioritizing support. They are acoustic estimates and they get things wrong. It also brushes against art. 22 GDPR.
Generating disinformation: fake audio of real people about events that did not happen, or material presented as authentic when it isn't. Beyond the harm, art. 50 of Regulation (EU) 2024/1689 requires disclosure. See section 5.3.
Harassment, threats, or generating sexual content with a real person's voice.This needs no explanation.
Reselling the service as your own without an agreement, or using it to train a competing model from its outputs. If you want to run it yourself, the code is open: do it.
And a warning in the other direction. What a transcript returns is untrusted text: it comes from audio that neither you nor we control, and someone may have deliberately said a sentence shaped like an instruction. If you're going to pass our output to an agent, a CRM, or any automation with permissions, treat it as data, never as instructions.

5. Cloned voice and recordings under Spanish law

This section exists because it's where most people get themselves into trouble without knowing it, and because we'd rather explain it than hide behind "the customer is responsible".

5.1 Whose voice you may clone

Yes, with peace of mind:

  • Your own voice. To dub yourself into a language you don't speak, so you don't have to re-record a voiceover every time a sentence changes.
  • Someone who has given you written permission, for a specific and bounded use: a hired voice actor with an express assignment, a colleague who agrees to voice the internal assistant.
  • A voice that belongs to no real person, or one licensed for the purpose.

No:

  • The voice of an actor, a presenter or a politician because public material exists. Accessible is not authorized.
  • The voice of a customer or an employee because you have it recorded from a call. Recording for quality assurance is not collecting a voice model.
  • The voice of a recognizable person, to make it look like they said something they didn't.

The practical test, which is almost always right: would the person that voice belongs to be comfortable seeing what you're about to generate with it? If the answer is "they'll never find out", you have your answer.

5.2 Which recordings you may process

Uttera processes the audio you send it; it does not check where it came from, and that check is yours.

  • Recording a conversation you are part of is not a crime in Spain. Distributing it can be, and processing it for purposes other than those that justified it also has consequences.
  • Recording a conversation between others, where you are not a party, is a crime (art. 197 of the Criminal Code).
  • Recording calls in a company requires informing both parties in advance, having a legal basis and a defined retention period. If you also record your employees, see arts. 89 and 90 of the LOPDGDD.
  • Special category data. A clinical recording is health data (art. 9 GDPR). Processing it is not prohibited — it is done every day — but it requires its own legal basis and, frequently, an impact assessment.

5.3 The duty to disclose generated audio

Since 2 August 2026, article 50 of Regulation (EU) 2024/1689, the AI Act, has been in application. As it affects you as a user of Uttera:

  • If you generate audio that imitates a real person and could lead someone to believe it is authentic — what the Regulation calls a deep fakeyou must disclose it clearly and visibly.
  • If the synthetic audio informs the public on matters of public interest, the same applies.
  • If your system converses with a person, that person must know they are talking to a machine, unless it is obvious.

That duty is yours, because you are the one publishing. Ours, as providers of the system that generates the audio, is to enable technical marking of synthetic content: article 50(2) requires outputs to be marked in a machine-readable format and the marking to be detectable.

5.4 Our marking timeline

These are the dates, so you can plan around them:

WhenWhat
2 August 2026Article 50 becomes applicable.
2 December 2026End of the adaptation period for systems placed on the market before August. That is the deadline that applies to us.

In July 2026 the European Commission published interpretive Guidelines — not binding — and there is a Code of Practice on Transparency of AI-Generated Content that providers may sign up to.

Once marking is in place, we will publish here and in the documentation how we mark and how it is verified, so that you can check an audio file we generated on your own. Until then, this page says what there is.

Current state, said plainly: the audio Uttera generates does not yet carry a watermark or machine-readable synthetic-content metadata. It is in development and will be published here as soon as it exists, explaining how we mark and how it is verified.

The deadline that applies to us is 2 December 2026: article 50 applies from 2 August 2026, but systems placed on the market before that date have an adaptation period running to December. We state it with the date up front rather than keeping quiet, because anyone who has to comply with article 50 needs to know today what they can count on.

6. Privacy policy

This explains what we do with your data: your account and your browsing. What we do with the audio you send us is a different matter and goes in section 7, because there we are not the controller but the processor.

6.1 Controller

ControllerUttera Labs S.L. — tax ID pending: company being incorporated
AddressCalle Corazón de María 2, 28002 Madrid, Spain
Contactsupport@uttera.ai

6.2 What data we process, for what, and on what basis

DataPurposeLegal basisRetention
Email address and identifier from the sign-in provider (Google or GitHub, if you use one)Create and maintain your account, and give you accessPerformance of the contract (art. 6(1)(b) GDPR)As long as you have an account
API keys (stored as a cryptographic hash, never in the clear) and their IP restrictionsAuthenticate your requestsPerformance of the contractUntil you revoke them
Usage: seconds processed, service used, timestampBilling and showing you your spendPerformance of the contract and legal obligationTax and commercial retention periods
Billing dataIssuing invoicesLegal obligation (art. 6(1)(c)) 6 years (art. 30 of the Spanish Commercial Code)
Technical logs: IP, date, path, response code, request identifierSecurity, diagnostics and abuse preventionLegitimate interest (art. 6(1)(f)) 90 days
Emails you send to supportHelping youPerformance of the contract or legitimate interestAs long as the matter requires, and 1 year after

6.3 What we do NOT do

  • No profiling and no automated decisions with legal effects on you.
  • We do not sell or share your data with anyone.
  • We don't send you marketing unless you ask for it. The only automatic emails are service ones: access, billing and account notices.
  • We use no third-party analytics. There is no Google Analytics, no pixels, no trackers.

6.4 Who else is involved

These are all the third parties involved, and there are no others:

WhoFor whatWhere
Stripe Payments Europe, Ltd.Payments and invoicing. Your card details go straight to Stripe; we never see them.Ireland (EU)
Google or GitHubOnly if you choose to sign in with them. We receive your email address and an identifier; nothing else.Outside the EU, under their own safeguards

There is no third party anywhere in the audio path. Transcription, translation, summarization and synthesis all run on our own machines, in Spain.

6.5 Where the data is

On our own infrastructure in Andalusia, Spain. There are no international data transfers other than sign-in with Google or GitHub, which only exists if you choose that way in, and Stripe's, within the EU.

6.6 Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to support@uttera.ai. We will respond within one month.

Two of them are already handled without you having to ask:

  • Portability (art. 20): your data is available in machine-readable form at /cuenta/datos.json, from your own account and immediately.
  • Erasure: you can delete your account from the account page. Only the billing data the law requires us to keep is retained, blocked.

If you believe we haven't handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es). We'd appreciate hearing from you first, so we can try to fix it.

7. Data processing agreement

This section is the one that matters if you're a company and you're going to send us recordings containing other people's data.

7.1 Who is who

With respect to the audio and text you send us, you are the controller and Uttera is the processor (art. 28 GDPR). We process that data solely to provide you the service and following your instructions, which are the requests you make to the API.

This serves as a data processing agreement. If you need a signed contract — many organizations require one — write to us and we'll sign it.

7.2 What we do with that content

  • It is processed and discarded. Audio is handled in memory and discarded when we answer. The transcript, the analysis and the summary travel in the response and are not stored.
  • The only thing written is the audio we generate, kept for one hour in an exact-match cache, with effective deletion on expiry. You can disable it on every request, and then nothing is written.
  • We do not train models on it, nor aggregate it into statistics, nor "anonymize" it for reuse, nor review it by hand.
  • There are no sub-processors in the audio path.

7.3 Security and obligations

  • All traffic is encrypted in transit. Keys are stored as cryptographic hashes.
  • Staff with access are bound by a duty of confidentiality.
  • We will notify you without undue delay of any security breach affecting your data, with what we know and what we are doing.
  • At the end of the relationship there is nothing to return or destroy as regards the content, because none is retained.
  • We will assist you, within reason, with impact assessments and with rights requests you receive from your own data subjects.

8. Cookie policy

8.1 Summary

We use no analytics cookies, no advertising cookies, and no third-party cookies. That's why you won't see a cookie banner: there is nothing to consent to. The only two things we store in your browser are technical and necessary for the site to work, and they are exempt from consent under art. 22(2) of the LSSI.

8.2 What there is, exactly

NameTypeFor whatDuration
sessionFirst-party cookie, technicalKeeping you signed in. It only exists if you sign in to your account; it is encrypted and marked Secure and SameSite=Lax.14 days
uttera-temaLocal storage, not a cookieRemembering whether you prefer the light or dark theme. It is never sent to the server: it stays in your browser.Until you clear your browser data

If you only browse the public site — home, documentation, blog, pricing — absolutely nothing is stored except your theme preference, if you change it.

8.3 How to remove them

From your browser settings, like any other. Note that if you block the session cookie you won't be able to stay signed in.

8.4 If this changes

If we ever add analytics, there will be a banner and there will be prior consent, and this table will say so before it happens. While this page says there is none, there is none.

9. Changes and governing law

We may modify these terms. Changes are published on this same page with their date. If a change is substantial and affects you as a customer, we will notify you by email with reasonable advance notice before it takes effect.

These terms are governed by Spanish law. For any dispute, the parties submit to the Courts of Madrid, unless the law imposes another venue — in particular, if you are a consumer you keep yours.

If you are a consumer resident in the European Union, you may use the European Commission's online dispute resolution platform: ec.europa.eu/consumers/odr.

Last updated: 15 September 2026