Privacy Policy

1. Introduction

Fynqcast ("we", "our" or "Company") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and protect your information when you use our AI-based podcast generation platform.

This policy applies to all users of our website, mobile application and related services.

2. Data Controller

The controller of personal data processing is:

3. Data We Collect

3.1 Account Data

• Full name
• Email address
• Password protected by hashing
• Account preferences

3.2 Biometric Data (Voice)

• Audio recordings of your voice
• Voice profiles (voiceprint) derived from the recordings
• Recording metadata (duration, date, device)

3.3 Usage Data

• Podcasts created and related content
• Access and activity logs
• Device and browser information
• IP address

3.4 Payment Data

Payments are handled by Stripe. We do not directly store your credit card data. We retain only the Stripe customer ID and the transaction history. Depending on the activity carried out, Stripe may act as a processor or as an independent controller under its own terms and applicable agreements.

Confirmation given at payment: before you are sent to the payment page, we record your express request that the service start immediately (version and exact text of the declaration you accepted, date and time, plan and the Stripe identifiers of the payment and of the subscription). Refunds and payment exceptions: when we refund a payment, after a withdrawal or as an exception, we record the amount, the type (full or partial), the reason, what happens to the plan and the Stripe identifiers of the payment and of the refund. We process these data to document your requests and the payments and to protect our rights in case of dispute (performance of the contract, legal obligation and legitimate interest, Art. 6(1)(b), (c) and (f) GDPR). Invoices and receipts are issued through Fatture in Cloud on the basis of the payment data held by Stripe: the electronic invoice for companies contains company name, VAT number and address; the receipt for private customers contains only the country, the amount and the payment reference (legal obligation).

Discount codes: we may send a discount code by email, also to people who are not registered on FYNQCAST. The code is created on Stripe, which also keeps, in the data of the code, the email address it was sent to; the email is sent through Resend. We use the address only to send you the code and to know to whom we sent it. The address remains in the data of the code on Stripe, also after the code has expired.

3.5 Content reports and withdrawal requests

If you report content using the "Report content" form, we process the URL, the reason, the name and email, the date and the outcome. Name and email are normally required; they may be omitted only in the specific exception provided for in Art. 16(2)(c) of Regulation (EU) 2022/2065 (information relating to the offences in Arts. 3-7 of Directive 2011/93/EU), which the reporter explicitly declares in the form. We process this data to examine the report, confirm receipt to you and communicate the decision to you (legal obligation, Art. 6(1)(c) GDPR, and Art. 16 of Regulation (EU) 2022/2065). If you exercise the right of withdrawal, we process the reference to your account, to the subscription contract, the declaration, the date and the outcome, in order to manage the request and document it (performance of the contract and legal obligation).

When you send a withdrawal request, an internal alert with your name, email, plan, the reference of the contract and the date and time of the request is sent by email to a dedicated FYNQCAST mailbox, with a link to the request in our restricted console; while the request remains open, reminders with the data of the request are sent to the same mailbox. The alerts serve only to handle your request on time (same legal bases as above).

3.6 Acceptance of the Rules of Use

When you accept the rules of use of the service, we record, linked to your account, the version of the rules, the language in which you read them, the text accepted and the date and time of acceptance. This record does not include your IP address or browser. We use these data only to demonstrate that you accepted the rules.

3.6 Enterprise sales requests (Contact us)

If you contact us through the Enterprise form, we process the data you enter (company name, VAT number, country, registered address, billing email and phone; first name, last name and email of the legal representative who signs the contract and, if the person filling in the form is someone else, also that person's first name, last name and email; estimated minutes of use, preferred contract language and message, plus the language of the site) to answer your request and, if you wish, to prepare an offer (pre-contractual measures, Art. 6(1)(b) GDPR). The request is sent to our sales team and kept in FYNQCAST's restricted console; we send a confirmation email to the address you entered, without the content of your message. A copy of the request also reaches our sales mailbox by email: the deletion periods in the table apply to the console; the email copies and the related business correspondence are managed separately and kept only as long as needed to handle the request and the negotiation or, for correspondence relating to contracts, for the periods required by law.

3.7 Statistics on the use of the site (Google Analytics)

Only if you accept the "Analytics" category of the cookie banner, we use Google Analytics 4 on the public pages of the site (not in the account area, in the dashboard, on the administration and sign-in pages, on private listening links or on invitations, except as indicated below). Google Analytics processes pseudonymous data: a random identifier stored in the _ga cookies, the pages visited (address without parameters, except the campaign parameters utm_*), the site you come from (its name only), date, time and duration of the visit, device, browser, language and approximate location (country and city). To determine the location your IP address is transmitted to Google; according to Google, for users in the European Union it is used only for this purpose and is not logged or stored. We use these data in aggregate form, to know how many people visit the site and which pages they view, and, only if you also accept the "Marketing" category, for Google Ads (see section 3.8): we do not link them to your account and we do not send your name, email or other data that identify you directly. Google signals are disabled and ad personalisation is disabled unless you accept the "Marketing" category. Without your consent Google Analytics is not loaded; you can withdraw consent at any time.

The only exception to the public pages: when you complete a registration (registration page) or a purchase (purchase confirmation page), an event reports it, without your name, email or other data that identify you directly (for a purchase, the plan and its price).

3.8 Advertising (Google Ads)

Only if you accept the "Marketing" category of the cookie banner (together with "Analytics"), we use Google Ads, linked to Google Analytics, to measure which of our ads lead to a registration, a purchase (plan and price) or an Enterprise request, and to show our ads on Google services to people who have visited the site (remarketing, a form of profiling for advertising purposes). Google processes the identifiers in the advertising cookies (on our site the _gcl_* and _gac_* cookies, and its own cookies on its domains), the identifier of the ad click (gclid, gbraid or wbraid), the pages and events recorded by Google Analytics, device, browser and approximate location. We do not send your name, email or other data that identify you directly, and we do not upload customer lists to Google. For the collection on our site and the transmission to Google we act as joint controllers with Google (Art. 26 GDPR); for the subsequent processing for its advertising services Google acts as an independent controller under the Google Ads Controller-Controller Data Protection Terms. Without the "Marketing" consent your data are not used for personalised advertising nor linked to ad clicks; you can withdraw consent at any time and manage the ads Google shows you at myadcenter.google.com.

4. Legal Basis for Processing

We process your personal data on the basis of the following legal bases (Art. 6 GDPR):

• Consent (Art. 6(1)(a) and Art. 9(2)(a))

  For the collection and processing of voice biometric data

• Consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Personal Data Protection Code)

  For the statistics on the use of the site (Google Analytics) and the related cookies, only if you accept them in the cookie banner; withdrawing consent does not affect the lawfulness of the processing carried out before the withdrawal

• Consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Personal Data Protection Code)

  For advertising measurement and remarketing (Google Ads) and the related cookies, only if you accept the "Marketing" category; withdrawing consent does not affect the lawfulness of the processing carried out before the withdrawal

• Performance of the contract (Art. 6(1)(b))

  To provide our podcast generation services

• Legitimate interest (Art. 6(1)(f))

  To improve our services and prevent fraud

• Legal obligation (Art. 6(1)(c))

  For tax and regulatory compliance

5. Data Sharing

We share your data with the following service providers. The privacy role of each provider depends on the activity carried out and on the applicable data processing terms and agreements: in general they act on our behalf as processors (Art. 28 GDPR), while for some activities they may act as independent controllers.

The contractual relationships and guarantees applicable with the providers listed above (including, where applicable, data processing agreements under Art. 28 GDPR) are managed in accordance with the law and the specific terms of each provider. For information on the updated status of these contractual guarantees, write to privacy@fynqcast.com.

6. International Transfers

Some of our service providers also operate outside the European Economic Area (e.g. in the United States). For transfers of data outside the European Economic Area (EEA), we rely on the transfer mechanisms provided by applicable law (e.g. Standard Contractual Clauses approved by the European Commission), to the extent applicable to the individual provider. The specific contractual safeguards adopted by each provider are managed according to their respective terms; we do not state that a transfer impact assessment (TIA) has already been completed for each of them.

Google Analytics and Google Ads data may be transferred to Google LLC in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Art. 45 GDPR); in addition, Google's data protection terms include the Standard Contractual Clauses approved by the European Commission.

7. Data Retention

Deletion of the account

When you delete your account, we delete the account data and the cloned voice of the account at once, cancel the subscriptions still active, delete your customer profile on Stripe and ask Didit to delete your identity verification sessions. Your files (podcasts, audiobooks and Studio productions) are deleted after 7 days. We keep only: withdrawal requests, refunds and confirmations given at payment, for 10 years from their closure, to document them in case of dispute; invoices and receipts, kept by Fatture in Cloud for the periods required by tax law; the records of an Enterprise contract (for example its acceptance), as contractual proof; security logs, with the IP address until their 12 months have passed and then only the record of the action. The payment records that Stripe must keep under its own legal obligations remain with Stripe, under its terms.

8. Your Rights

Under the GDPR, you have the following rights:

To exercise your rights, contact us at privacy@fynqcast.com. We will respond without undue delay and in any case within one month of receiving the request; this term may be extended by a further two months in the cases provided for by Art. 12 GDPR.

9. Data Security

We implement appropriate technical and organizational security measures, including:

• Encryption of data in transit (HTTPS/TLS) and encryption-at-rest measures provided by our infrastructure providers
• Secure password hashing (bcrypt)
• OTP verification via email for signup, password reset and email change
• Security audit logs
• Role-based access for staff
• Backup and recovery managed according to the technical and organizational measures provided by the infrastructure provider

10. Cookies and Similar Technologies

We use essential technical cookies, necessary for the operation of the site, which do not require your consent, and preference cookies that we save only if you enable them from the banner. Only if you accept the "Analytics" category do we use Google Analytics cookies on the public pages of the site (see section 3.7), and only if you accept the "Marketing" category do we use Google Ads cookies for advertising measurement and remarketing (see section 3.8). The site loads the Google Identity Services script to allow sign-in with Google. You can manage your preferences at any time via the "Cookie Settings" icon. For the detailed list, see the Cookie Policy.

11. Minors

Our services are intended exclusively for users who are at least 18 years old, without exception. We do not knowingly collect personal data from minors under 18. If you believe that a minor has provided us with personal data, contact us to request its deletion.

12. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by appropriate means (e.g. a notice on the site or by email). The date of the last update is shown at the top of this page.

13. Complaints

You have the right to lodge a complaint with the Italian Data Protection Authority, the Autorità Garante per la Protezione dei Dati Personali (www.garanteprivacy.it), if you believe that the processing of your data violates the GDPR.