Privacy Policy

This Privacy Policy describes how Utopia Audio ("Company," "we," "us," or "our") collects, uses, shares, and protects your personal information when you use our AI-powered real-time translation services, including our website at utopia.audio, browser extensions, mobile applications, APIs, and any related services (collectively, the "Services").

This Privacy Policy applies to users worldwide and is designed to comply with applicable privacy laws in all jurisdictions where we operate, including but not limited to the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), Lei Geral de Proteção de Dados (LGPD), Personal Information Protection and Electronic Documents Act (PIPEDA), and other regional privacy regulations.

1.1 Information You Provide Directly

When you use our Services, you may provide us with the following information:

1.2 Information Collected Automatically

When you use our Services, we automatically collect certain information:

1.3 Audio and Video Data

1.4 Information from Third Parties

We may receive information from third parties including:

• Social Login Providers: If you sign in using Google, Apple, or other social authentication, we receive your name, email, and profile picture
• Payment Processors: Transaction status and limited billing information from Stripe
• Analytics Providers: Aggregated, anonymized usage data

2.1 Primary Purposes

We use your information for the following primary purposes:

2.2 Legal Bases for Processing (GDPR)

Under GDPR, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide our Services to you (Article 6(1)(b))
• Legitimate Interests: Processing for our legitimate business interests, such as improving services and preventing fraud (Article 6(1)(f))
• Consent: Processing based on your explicit consent, such as marketing communications (Article 6(1)(a))
• Legal Obligation: Processing necessary to comply with legal requirements (Article 6(1)(c))

2.3 AI and Machine Learning

Our Services use artificial intelligence and machine learning to provide translations. We may use anonymized, aggregated data to improve our AI models. Individual translation content is NOT used to train our models without explicit consent, and your personal viewing habits are never linked to AI training data.

3.1 Service Providers

We share information with trusted service providers who assist in operating our Services:

• Cloud Infrastructure: Secure data storage and processing (e.g., AWS, Google Cloud)
• Payment Processing: Stripe for secure payment transactions
• Email Services: For transactional and marketing communications
• Analytics: Anonymized usage analytics to improve our Services
• Customer Support: Help desk and support ticket systems

All service providers are bound by data processing agreements and are prohibited from using your data for any purpose other than providing services to us.

3.2 Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Valid legal processes (subpoenas, court orders, legal requests)
• Requests from law enforcement or government authorities
• Protection of our rights, property, or safety
• Prevention of fraud, security threats, or illegal activities

Where permitted by law, we will notify you of such requests unless prohibited from doing so.

3.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your personal information becomes subject to a different privacy policy.

3.4 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

After the retention period, data is either deleted or anonymized. We may retain anonymized, aggregated data indefinitely for statistical and analytical purposes.

Depending on your location, you may have various rights regarding your personal information. We honor all applicable privacy rights regardless of whether they are legally required in your jurisdiction.

5.1 Universal Rights

All users have the following rights:

5.2 Regional Privacy Rights

5.3 How to Exercise Your Rights

To exercise any of your privacy rights:

• Email: Contact us at privacy@utopia.audio
• Account Settings: Manage many preferences directly in your account dashboard
• Response Time: We will respond to your request within 30 days (or as required by applicable law)
• Verification: We may need to verify your identity before processing your request

We operate globally and may transfer your personal information to countries other than your country of residence. When we transfer data internationally, we implement appropriate safeguards to protect your information:

6.1 Transfer Mechanisms

• Standard Contractual Clauses (SCCs): We use EU-approved Standard Contractual Clauses for transfers from the EEA/UK
• Data Processing Agreements: All service providers are bound by strict data processing agreements
• Adequacy Decisions: Where applicable, we rely on adequacy decisions by relevant authorities
• Your Consent: In some cases, we may rely on your explicit consent for transfers

6.2 Data Storage Locations

Our primary data centers are located in the United States and European Union. We select data center locations to optimize performance while maintaining security and compliance with applicable laws.

We implement robust technical and organizational measures to protect your personal information:

7.1 Compliance Standards

Our security practices are designed to comply with:

• SOC 2 Type II standards
• HIPAA requirements for applicable data
• ISO 27001 information security principles
• PCI DSS for payment data (via Stripe)

7.2 Security Incident Response

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authorities within the timeframes required by applicable law (72 hours under GDPR).

8. Children's Privacy

Our Services are not intended for children under the age of 18 (or the applicable age of majority in your jurisdiction). We do not knowingly collect personal information from children.

• If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately
• We will promptly delete any such information from our records
• We comply with COPPA (Children's Online Privacy Protection Act) in the United States and similar laws in other jurisdictions

9. Third-Party Links and Services

Our Services may contain links to third-party websites, services, or applications that are not operated by us. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access. We are not responsible for the privacy practices of third parties.

10. Do Not Track Signals

Some browsers include a "Do Not Track" (DNT) feature. Because there is no industry standard for DNT signals, we do not currently respond to DNT signals. However, we do not track your online activities across third-party websites for advertising purposes.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make changes:

• We will update the "Last Updated" date at the top of this policy
• For material changes, we will provide at least 30 days' notice via email or prominent notice on our Services
• Your continued use of the Services after the effective date of changes constitutes acceptance of the updated policy
• If you do not agree with changes, you should stop using the Services and request deletion of your data

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

13. Supervisory Authorities

You have the right to lodge a complaint with your local data protection authority. Key authorities include:

• EU: Your national Data Protection Authority (list at edpb.europa.eu)
• UK: Information Commissioner's Office (ICO) - ico.org.uk
• USA (California): California Attorney General - oag.ca.gov/privacy
• Canada: Office of the Privacy Commissioner - priv.gc.ca
• Australia: Office of the Australian Information Commissioner - oaic.gov.au
• Brazil: Autoridade Nacional de Proteção de Dados (ANPD)
• Singapore: Personal Data Protection Commission (PDPC)
• South Africa: Information Regulator