Last updated: 30 October 2026
This policy describes how Fynqcast collects, uses, stores and protects your biometric voice data. Voice cloning requires your explicit and separate consent. Please read this document carefully before recording your voice.
Voice biometric data (or "voiceprint") are unique characteristics of your voice that can be used to identify you. This includes:
Note on classification: the raw voice recording/sample is personal data. The processed voice features and the derived voice model are also personal data and may constitute biometric data under Art. 9 GDPR when they result from specific technical processing aimed at uniquely identifying a person (voice identification/authentication). The voice cloning/synthesis we offer is not intended to uniquely identify you, but we nonetheless apply, as a precaution, the same safeguards provided for biometric data, including those of BIPA (Illinois) on "biometric identifiers".
We collect your voice biometric data exclusively for the following purposes:
To generate podcasts with your cloned voice
To create podcasts and audiobooks with your voice
We do NOT use your biometric data for:
Before collecting your voice biometric data, we will ask you to:
Consent for the collection of biometric data is separate from and independent of acceptance of the general Terms of Service. It is not possible to use the voice cloning feature without providing this specific consent.
For each consent, we retain:
This section applies specifically to residents of the State of Illinois, in accordance with the Biometric Information Privacy Act (740 ILCS 14/).
We hereby inform you in writing that Fynqcast collects, captures and retains your biometric data (voiceprint) for the purposes described in this policy.
Retention Period
Your biometric data is destroyed early when the purpose for which it was collected no longer applies, when you withdraw consent or when the voice profile is deleted, according to the applicable process. The maximum retention limit currently configured by Fynqcast is 1095 days from consent. This internal limit does not extend the term provided by BIPA (740 ILCS 14/15(a)): destruction when the initial purpose of collection has been satisfied or within 3 years of the last interaction, whichever occurs first. Legal provisions requiring earlier deletion remain unaffected.
Data Destruction
Destruction includes audio samples and derived voice profiles, including the cloned voice held by the voice synthesis provider. Withdrawal of consent or a deletion request starts the applicable deletion process.
Fynqcast will NOT sell, lease, trade or otherwise profit from your biometric data.
Before collecting your biometric data, you will be asked for written consent in electronic form, recorded by Fynqcast, confirming your informed consent to the collection and use of your biometric data.
| Data Type | Retention | Destruction |
|---|---|---|
| Original audio samples | Max 1095 days from consent* | Upon early end of the purpose, upon withdrawal or deletion of the profile, or upon expiry of the internal maximum |
| Voice profiles (voiceprint) | Max 1095 days from consent* | As above |
| Recording metadata | Max 1095 days from consent* | As above |
| Consent records | For the period necessary for accountability purposes, compliance with legal obligations and protection of rights | Applying the principle of minimization |
* Consent records are retained separately from biometric data. Biometric data is destroyed before the stated terms when the purpose ceases, consent is withdrawn or the profile is deleted (see section 4.2).
Account ban: if we ban the account linked to your identity, your cloned voice is revoked immediately on the FYNQCAST accounts linked to the same identity and deleted, as a rule, within 30 days of the ban. Only the record of the consent remains, without any audio, kept as described for consent evidence.
Your voice biometric data may be shared with the following service providers, who process the data in accordance with their respective terms and, where applicable, data processing agreements:
Fynqcast
ControllerWe process audio samples to generate synthetic audio content, protected by appropriate technical and organizational measures.
ElevenLabs Inc.
ProviderReceives the voice sample to create and generate the cloned voice (voice synthesis). For this activity ElevenLabs operates under its own terms and the applicable data processing agreement.
Didit
ProviderPerforms the identity verification (document and selfie/liveness) required as a security precondition to enable voice cloning. Fynqcast does not directly retain the document, the selfie, the verification video or the full Didit report: retention at Didit depends on the service configuration and the applicable terms. Fynqcast determines the purpose of the identity verification; Didit operates on behalf of Fynqcast under the applicable service agreement and data processing agreement. When we complete a request to delete all biometric data or to delete the account, we ask Didit to delete the verification sessions associated with your account; the request is not marked as completed if deletion at Didit fails.
The contractual relationships and guarantees applicable with the providers listed above (including, where applicable, data processing agreements under Art. 28 GDPR) are managed in accordance with the law and the specific terms of each provider. We do not transfer, sell or share your biometric data with other parties outside of what is described in this policy. Some providers may also operate outside the European Economic Area: where applicable, Fynqcast uses the transfer mechanisms provided by current legislation and by the applicable contractual agreements. Further information is available in the Privacy Policy.
We implement technical and organizational security measures to protect your biometric data:
Encryption: data is protected in transit and at rest according to the technical measures adopted by the infrastructure providers (database and storage) we use.
Access control: access to biometric data is limited to authorized personnel and systems.
Logs: we record consent events (collection, withdrawal) and relevant security events related to voice biometric data.
Anti-deepfake detection: not currently active in the enrollment flow; we are evaluating the adoption of a dedicated measure.
Withdrawal of Consent
You can withdraw consent at any time. Withdrawal does not affect the lawfulness of prior processing.
Access
You can request a copy of your biometric data in a readable format.
Deletion
You can request the deletion of your biometric data and your voice profile, in the cases and according to the timeframes provided by the applicable law and policy.
Portability
You can request your data in a structured and interoperable format.
To exercise your rights, go to Settings → Voice Profiles in your account, or contact us at privacy@fynqcast.com.
When you withdraw consent or delete a voice profile:
The voice profile is immediately deactivated and can no longer be used
The original audio samples are deleted according to the applicable deletion process
Voice profiles and derived data, including the cloned voice at the voice synthesis provider, are deleted according to the same process
Once deletion is complete you will receive confirmation by email
Note: Podcasts already generated with your voice will remain available, but it will not be possible to generate new content.
Audio content generated using your cloned voice is produced with artificial intelligence. FYNQCAST already applies certain transparency measures (technical metadata) to part of the audio content generated (podcasts); we are completing the uniform technical implementation of marking/provenance on all final audio files, including audiobooks, in accordance with the applicable obligations of the EU AI Act (Art. 50).
The metadata currently applied may no longer be present if the file is re-converted or if the metadata is removed using third-party tools. We do not claim full technical compliance of the Service with EU AI Act Art. 50: we are working to strengthen and standardize over time the robustness of these markers.
For questions about the handling of your biometric data or to exercise your rights:
Data controller
Codimpronta di De Vercelli Federico · sole proprietorship
VAT No. IT04284360361 · 41030 Bomporto (MO), Italy
We will respond without undue delay and in any case within one month of receiving the request; the term may be extended in the cases and within the limits provided by the GDPR.