Privacy
Policy.

Effective: November 9, 2026

1 Who we are and what this Policy covers

NextGen Speech AI, LLC, a Delaware limited liability company (the Company, we, us or our), provides Ramsa Speech. Our business address is 2261 Market Street, Suite 10059, San Francisco, CA 94114, USA. You can contact us about privacy at Legal@ramsaspeech.ai.

This Privacy Policy explains how we handle personal information in connection with the Ramsa Speech public website at https://ramsaspeech.ai (the Website), inquiries and business communications, Ramsa Speech Studio (Studio), custom voice creation and APIs for real-time speech (the Services). It applies to Website visitors, organizational representatives, authorized users, speakers and other people whose personal information is processed through these activities.

The Services are offered to businesses and organizations. A Customer is the organization obtaining the Services, and an Authorized User is someone it authorizes to use them. Personal information means information relating to an identified or identifiable individual, together with any other information protected as personal information under applicable law.

Managed production and dedicated deployments are governed by separate agreements. Their specific privacy notices and data-processing arrangements govern the processing they describe. This Policy continues to apply to our Website and ordinary business communications unless a specific notice states otherwise.

Our Terms of Service at https://ramsaspeech.ai/terms govern use of the Website and Services. This Policy does not grant additional rights to use Customer content or expand the permitted-use, confidentiality, AI-training or retention provisions of those Terms. Nothing in this Policy or the Terms limits rights or obligations that applicable privacy law does not permit the parties to waive.

2 Our role and the role of the Customer

We determine the purposes of processing personal information for our Website, inquiries, business relationships, account administration, billing, security, permission and compliance checks, and legal obligations. For those activities, we act as a controller or business where the applicable law uses those terms.

Where we process personal information in Customer content on an organization's behalf and under its instructions, that organization determines the purposes of the processing and we act as its processor or service provider, as applicable. Customer content includes scripts, text, recordings and other material supplied through the Services, and speech generated for the Customer.

The organization is responsible for providing required notices and establishing the permissions and lawful grounds for information it supplies and its use of generated speech. We remain responsible for the obligations that apply to our own processing. A data-processing agreement accepted by both parties governs the processing it covers; this Policy does not replace a required data-processing agreement.

If your employer, client or another organization gives you access to the Services or supplies information about you, its own privacy notices and instructions may also apply. Section 14 explains how to make a request about that information.

3 Information we receive

Inquiries and communications

We receive the information you provide when contacting us, including your name, business email address, organization, telephone number, preferred language, message and subsequent correspondence. Please do not submit passwords, payment credentials, government identifiers, health information or other sensitive or confidential material through the public Website inquiry form.

Accounts and organizational access

Account information includes names, email addresses, organization and agency memberships, roles, invitations, verification and account status, authentication information and access records. Organizational records may include company and billing contacts and the people authorized to manage the account.

Scripts and generated speech

We process the text submitted for speech generation, including any personal information it contains, together with project and Campaign information, selected voices, pronunciation and delivery settings, previews, generated audio, exports and related usage and delivery records. Those records may include the user who created the work, its duration, processing status and an export recipient's email address.

For real-time speech APIs, we process the submitted text and parameters, the resulting speech and request information needed to authenticate, operate, support and account for the service. An API integration determines what information the Customer sends to us; we do not receive every part of a Customer's wider system merely because it uses our speech API.

Custom voices and permissions

Custom voice information includes source recordings, reference transcripts, the speaker and voice information supplied by the Customer, evidence of permission when requested, and information derived to create and operate the requested custom voice. Voice recordings, generated speech and information associated with a custom voice can be personal information when they relate to an identifiable person.

Payments and transactions

Billing information includes billing contacts, subscription and purchase records, usage balances, invoices, payment status and payment-provider identifiers. Payments made through Stripe are processed through Stripe's payment services. We receive information needed to administer the transaction, which may include limited payment-method details such as card brand, last four digits and expiry. Please enter payment credentials only through the designated payment process.

Support and feedback

Support information includes requests, troubleshooting correspondence, voice-quality feedback, pronunciation phrases and notes, relevant scripts or project context, and sample recordings submitted with a request. Support requests and their attachments may be delivered to our support team by email as part of handling the request.

Technical information

We and our infrastructure providers process technical information needed to deliver, protect and troubleshoot the Website and Services. This can include IP addresses, browser and device information, request times, referring pages, requested pages or endpoints, session identifiers, actions, processing and delivery status, and security, audit and error records. Website measurement and browser storage are described separately in Section 9.

4 Where information comes from

We receive information directly from you; from the Customer, its administrators, Authorized Users and authorized agencies; from people who contact us or supply recordings and permissions; from your interactions with the Website and Services; and from providers supporting those activities, such as payment and email-delivery providers. For example, an organization may invite you to Studio, submit a speaker's recordings or include personal information in a script.

Please provide only information needed for the requested activity and ensure that you are authorized to provide another person's information. Information required for account access, billing or a requested service must be provided for us to carry out that activity; optional information may be omitted.

5 How we use personal information

We use personal information for the following purposes, as relevant to your interaction:

• Responding to inquiries and taking requested steps concerning demos, quotations, partnerships, media and potential business relationships.
• Creating and administering organizational accounts, invitations, permissions, authentication and access.
• Providing requested speech generation, previews, exports, delivery, custom voice creation and API services.
• Administering subscriptions, usage, payments, invoices and corrections to confirmed export or billing errors.
• Providing support, investigating reported pronunciation or voice-quality issues, and troubleshooting service operation.
• Checking voice permissions and compliance with campaign licensing and acceptable-use restrictions under the Terms.
• Protecting accounts and systems, detecting misuse and fraud, maintaining appropriate operational records, and complying with law or handling legal claims.
• Understanding Website use as described in Section 9 and improving Website content and service operation using relevant technical and usage information.
• Sending business and marketing communications where permitted by law, with a way to opt out of marketing.

Our use of Customer scripts, text, recordings and generated audio remains limited by the Terms. General references in this Policy to support, improvement, security or business operations do not authorize unrelated reuse of that content or training prohibited by Section 6.

6 Custom voices and AI training

We will not use Customer scripts, text, voice recordings or generated audio to train or fine-tune general, shared or other customers' AI models. Source recordings supplied for custom voice creation may be used to train the specific custom voice requested by that Customer.

The supplied samples are the reference for the custom voice's style, pace, tone and delivery. The resulting custom voice is exclusive to the Customer's organization, including while its subscription is inactive. Our intellectual property rights in an AI model do not remove a speaker's privacy or other legal rights in their voice or identity.

Customers must obtain and maintain the rights and authorizations required by the Terms, including any consent required by applicable privacy law. We may request evidence of those authorizations. Providing a recording, accepting the Terms or using the Website does not, by itself, constitute every individual's consent to all processing of their personal information.

Where the required authorization is absent or evidence is not provided when requested, we may restrict or disable the affected voice, suspend or refuse voice creation, or delete the custom voice as provided in the Terms. Privacy requests and legally required restrictions or deletion are addressed under applicable law. Depending on the data, technical processing and applicable law, voice-related information may receive additional protection as sensitive or biometric information.

7 Confidentiality and organizational access

Nonpublic Customer scripts, text, voice recordings and generated audio are protected by the confidentiality provisions of the Terms. We use that information only for permitted purposes, apply at least reasonable care to protect it, and limit access by employees, contractors, advisers and service providers to those who need it for those purposes and are bound by confidentiality obligations. The exceptions and legally compelled disclosure provisions in the Terms continue to apply.

Within an organizational workspace, account and team information and workspace content may be available to administrators and other Authorized Users according to their access rights. This may include authorized agency personnel managing linked Customer accounts. Your organization's administrators control user access. Removing a person's access does not, by itself, delete work belonging to the organization.

Confidentiality obligations continue after cancellation or termination for as long as the information remains confidential. Confidentiality does not require us to retain information beyond the retention provisions in Section 11.

8 How we disclose information

Providers supporting the Website and Services

We disclose information as needed to providers supporting hosting, computing, storage, speech-processing infrastructure, security, email, payments and other service operations. Access to confidential Customer content remains subject to Section 7 and the Terms.

Our Website inquiry form is processed on our servers using Amazon Web Services, including Amazon Simple Email Service to deliver inquiries to our team. Email export delivery also uses email infrastructure to send generated audio to the designated recipient. Stripe processes payment information and provides transaction and billing information to us. Google receives the Website measurement information described in Section 9. The provider categories used for a particular activity depend on the service and its configuration.

You can read Stripe's privacy information at https://stripe.com/privacy and Google's privacy information at https://policies.google.com/privacy. Google's explanation of sites using its services is at https://policies.google.com/technologies/partner-sites. A provider's own notice may apply to processing it determines for its own purposes; it does not expand our contractual rights to Customer content.

Organizations and recipients

Information may be made available within the Customer's organization and to its authorized agency as described in Section 7. If an Authorized User requests email delivery or otherwise directs an export, we disclose the relevant information to that recipient and the providers needed to deliver it. The Customer is responsible for selecting authorized recipients and for its subsequent publication or distribution of the audio.

Advisers and legal requirements

We may disclose relevant information to professional advisers, such as lawyers, accountants and insurers, where needed and subject to appropriate confidentiality obligations. We may also disclose information when required by law or binding legal process. For confidential Customer content, we disclose only what is required and provide advance notice where legally permitted and reasonably practicable, as stated in the Terms. Any other disclosure to protect rights or safety must have a lawful basis and comply with our confidentiality obligations.

Business changes and approved publicity

Information may be disclosed in connection with a merger, reorganization or sale of the relevant business, subject to applicable law and the confidentiality and transfer provisions that apply under the Terms. This does not give a recipient unrestricted rights to use Customer content.

Use of organizational names and logos follows the publicity provisions of the Terms. Publishing Customer or client audio, a testimonial or a case study requires the prior written approval described there and any further permission required by law.

9 Website measurement and functional browser storage

Public Website analytics

We use Google Analytics 4 through Google Tag Manager to understand visits to the public Website and improve its content. Google tags load when you visit. Before you make a choice, and if you reject analytics cookies, Google receives limited cookieless signals about page views, page language, consent status and enabled automatic interactions, such as scrolling, outbound-link clicks, file downloads and video engagement where available. In that mode, Google Analytics does not read or write analytics cookies.

These signals can support statistical measurement and modeling. They do not provide an exact count of every visitor and should not be treated as anonymous or as involving no personal information. Google receives technical request information, including IP address, browser and device information, request time and referrer information.

If you accept analytics cookies, Google can use browser and session identifiers for fuller measurement. We also send our additional events for quotation or contact options, Studio links and successfully submitted inquiries. Automatic site-search and form-interaction measurement are disabled. The page and referrer values we configure for analytics exclude URL query strings and fragments. Our events do not include inquiry-form contents, passwords, or account and invitation tokens.

Rejecting analytics cookies does not prevent browsing or contacting us. Limited cookieless measurement continues when you decline or withdraw this permission. This Website measurement setup does not measure activity inside Studio.

Choices and other browser storage

You can change your analytics-cookie choice through Cookie preferences in the Website footer. We store that choice in your browser for 180 days. Withdrawal stops analytics-cookie use and our additional interaction events and removes accessible Google Analytics cookies; it does not itself delete information already received by Google. You may contact us about previously collected information. Details of Website cookies and storage are in the Cookie Statement at https://ramsaspeech.ai/cookies.

Studio uses functional browser storage and session identifiers to maintain sign-in and organizational context, support ongoing work and recovery, and prevent duplicate operations. This may include account and role information and identifiers associated with an operation. These technologies are separate from the public Website's optional analytics-cookie choice. Clearing browser storage or ending a browser session does not itself delete information held on our servers or in an organizational workspace.

Advertising and browser signals

For the public Website, we do not sell personal information or share it for cross-context behavioral advertising. We do not use the Website to serve targeted advertisements. Its analytics setup does not enable advertising tags, remarketing or Google Signals. Customer content supplied through the Services may be used only for the purposes permitted in the Terms; this Policy does not authorize its sale or use for behavioral advertising.

The Website uses the analytics-cookie choice you make in Cookie preferences. A Do Not Track or similar browser signal is not treated as permission to enable analytics cookies or our additional interaction events. Limited cookieless measurement continues as described above. Where applicable law requires us to honor an opt-out preference signal, including Global Privacy Control, we will do so for the processing to which that requirement applies.

10 Legal grounds where EEA or UK data protection law applies

For processing for which we determine the purposes, we rely on the following grounds where applicable:

• Contractual necessity, where processing is necessary to perform a contract with you as an individual or take steps you request before entering that contract.
• Legitimate interests in communicating with business contacts, carrying out business marketing where permitted by law, understanding public Website use through the limited cookieless measurement described in Section 9, improving Website content, operating and supporting organizational services, administering accounts and billing, protecting systems, preventing fraud, checking permissions and licensing, and establishing or defending legal claims, where those interests are not overridden by your rights and interests.
• Compliance with legal obligations that apply to us.
• Consent where required, including for optional analytics cookies and our additional Website interaction events. If additional conditions apply to sensitive information, the relevant condition must also be satisfied.

A legitimate interest does not replace consent where applicable law requires consent for a particular activity.

When we process Customer content on the Customer's behalf, the Customer is responsible for identifying the lawful grounds for its processing and instructions, and we comply with the obligations applicable to our role. An organization's acceptance of the Terms is not a substitute for consent from an individual where that consent is required.

You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal. Analytics choices are described in Section 9; for other consent-based processing, contact Legal@ramsaspeech.ai. Withdrawal may affect a function that depends on the relevant processing. We do not treat continued use of the Website or Services as general consent to optional processing.

11 Retention and deletion

We keep personal information for as long as needed for the purpose for which it is held, subject to the specific commitments below, applicable law and any relevant agreed data-processing arrangement. We consider the nature and sensitivity of the information, the requested service, the ongoing relationship, security and permission issues, recordkeeping requirements, disputes and legal holds. We delete or de-identify personal information when it is no longer needed for a permitted purpose.

Website inquiries and business records

We generally retain Website business inquiries for up to 24 months after the last interaction to respond, maintain relationship history and manage our business. We may retain relevant information longer when reasonably needed for legal obligations, disputes, fraud prevention, security or a legal hold.

Account, billing, usage, security, support and permission records have their own operational and legal purposes. Their retention depends on those purposes and the criteria above. Technical records may also be subject to the relevant providers' operational and security schedules. A support email or attachment is not automatically deleted merely because an associated Studio file is deleted.

Studio scripts and generated audio

We manage each organization's Studio audio storage settings. Turning off storage initiates deletion of saved generated audio and associated scripts. Future exports are delivered by email and are unavailable for later playback or download in Studio. Turning storage back on does not restore deleted content.

Temporary copies may be needed to generate, prepare, deliver or retry delivery of an export. Storage-off processing does not mean that all information is deleted immediately: relevant account, usage, billing, security and delivery records can remain for their permitted purposes. Copies delivered to an authorized recipient are also outside the Studio storage setting.

Once cancellation of a Studio subscription takes effect at the end of the current paid period, we do not guarantee continued retention or availability of saved scripts, project drafts or generated audio files. We reserve the right to delete that content at any time after that date, without prior notice. The corresponding provisions apply when access ends following Company termination or service closure under the Terms. Cancellation, trial expiry or removal of an individual user does not automatically delete every account or operational record.

The absence of a guaranteed file-retention period does not authorize indefinite retention of personal information. The necessity criteria in this Section and applicable deletion rights continue to apply.

Custom voices and source recordings

We will retain a custom voice model for at least six months after the applicable subscription becomes inactive, for possible reactivation. Its associated source recordings are retained for as long as the custom voice model is retained. After six months of inactivity, we reserve the right to delete the model and associated source recordings without prior notice.

These provisions do not prevent earlier action under the voice-authorization provisions of the Terms or deletion required by law. Temporary working copies used to prepare or operate a voice may be removed separately; that does not change the commitment concerning the retained custom voice model and its associated source recordings.

12 Security

We use reasonable administrative, technical and organizational measures designed to protect personal information and apply the confidentiality safeguards described in Section 7. Measures include access controls and protection of authentication information. No system or transmission method is completely secure, and we cannot guarantee absolute security.

Customers and Authorized Users should protect login credentials and API keys, manage organizational access and promptly report suspected unauthorized use. Please contact Legal@ramsaspeech.ai if you believe personal information has been accessed or disclosed improperly. Any notifications required by applicable law remain subject to that law.

13 International processing

The Company is based in the United States. Our service providers may process information in the United States and other countries whose data protection laws may differ from those where you live. The locations involved depend on the service and the applicable deployment arrangements; this Policy does not promise processing solely in one country.

Where applicable law requires a legal mechanism or safeguards for an international transfer, we will use the mechanism or safeguards required for that transfer. You may contact Legal@ramsaspeech.ai for information about a relevant transfer and the safeguards that apply, including a copy or explanation where required by law. Any expressly agreed requirements for a particular deployment continue to apply.

14 Privacy rights and requests

Depending on the applicable law and the circumstances, you may have rights to:

• Learn whether and how your personal information is processed and obtain access to it or a copy.
• Correct inaccurate information and request deletion.
• Request restriction of processing, object to processing, or receive portable information where those rights apply.
• Withdraw consent where processing relies on consent.
• Opt out of a sale, sharing, targeted advertising or certain profiling, and limit specified uses of sensitive information, where applicable law provides those rights.
• Appeal a decision concerning a privacy request and complain to a competent privacy regulator.
• Exercise applicable privacy rights without unlawful discrimination.

To make a request, email Legal@ramsaspeech.ai or write to NextGen Speech AI, LLC, 2261 Market Street, Suite 10059, San Francisco, CA 94114, USA. You do not need to create a Ramsa account to contact us. Describe the request and your relationship to the information so that we can locate it. Please do not send identity documents or sensitive information unless we request them through an appropriate process.

We may verify identity and authority where necessary and permitted, using information reasonably needed for verification. An authorized agent may submit a request where allowed by law, subject to verification of the relevant authority. We respond within applicable legal time limits and explain any refusal or limitation as required. Rights may be subject to lawful exceptions, including protection of another person's information and recordkeeping obligations.

Where we process information on an organization's behalf, that organization is generally responsible for decisions about the request. You may contact it directly or contact us so that we can direct the request appropriately and assist as required. This does not restrict requests concerning processing for which we are responsible or rights that applicable law gives you directly against us.

If applicable law gives you a right to appeal our response, email Legal@ramsaspeech.ai stating that you wish to appeal and explaining your concern. You may also complain to the regulator with jurisdiction, including the relevant EEA supervisory authority, the UK Information Commissioner's Office or a competent US authority, as applicable.

You can opt out of marketing communications using the method in the communication or by emailing us. We may still send administrative, service, security, billing and legal notices relevant to your relationship with us.

15 California information

Where California privacy law applies, California residents may request information about the categories and specific pieces of personal information collected, their sources, purposes and recipient categories, and exercise the applicable rights described in Section 14. Those rights are not limited to paying customers or excluded merely because information relates to a business contact.

The information described in Section 3 may include identifiers and contact information; account credentials; commercial and transaction information; professional or organizational information; internet and network activity; and audio, scripts and voice-related information. Some information may be sensitive personal information under the applicable law. The relevant sources, purposes, disclosures and retention criteria are described in Sections 4, 5, 8, 9 and 11.

For our public Website, the preceding-12-month disclosure covers the identifiers and internet or network activity described in this Policy and disclosure to providers for the Website purposes described here. We have not sold that Website personal information or shared it for cross-context behavioral advertising.

Section 9 explains Website advertising practices, cookie choices and browser signals. You may use the contact methods in Section 14 for a California privacy request, including a request about applicable limits on the use of sensitive personal information.

16 Children and information about other people

The Website and Services are intended for business and organizational use and are not directed to children under 13. We do not knowingly invite children under 13 to create accounts or submit personal information directly. If you believe a child has provided information directly to us, contact Legal@ramsaspeech.ai so that we can address it.

An organization that supplies information about another person, including a voice recording, is responsible for the required notices, lawful grounds and authorizations, including any additional requirements arising from that person's age. This does not remove our own obligations under applicable law.

17 Third party services

The Website may link to third-party websites, and Customers may connect the Services with their own systems or distribute audio through third-party channels. Those parties' own privacy notices apply to their independent handling of information. Their practices are not controlled by this Policy. This does not reduce our obligations for providers processing information on our behalf.

18 Changes and contact

This version applies from November 9, 2026 and replaces the previous Ramsa Speech public-website Privacy Policy for the activities described here. We may update it as our activities or legal obligations change. We will publish the revised Policy, identify when it takes effect, and give any notice or obtain any consent required by law before a relevant change applies.

Updates to this Policy do not themselves change the contractual confidentiality, content-use, AI-training or retention commitments in the Terms. Changes to those commitments must follow the Terms and applicable law.

For privacy questions, requests or concerns, contact Legal@ramsaspeech.ai or write to NextGen Speech AI, LLC, 2261 Market Street, Suite 10059, San Francisco, CA 94114, USA.