Privacy Policy and GDPR Information

Version dated October 13, 2026, v1.2.

1. Who is responsible for your data

The controller of personal data processed by Pleofon is Bryza Media Gracjan Jeschke, Tax ID PL5833495749.

For matters concerning privacy, your rights, or the processing of personal data by Pleofon, you can contact us at contact@pleofon.ai.

2. Key information

Editing analysis performed by Pleofon takes place locally on your computer.

We process data required to operate your account, license and applicable usage limits, certain technical telemetry, and diagnostic information.

The Pleofon Improvement Program is optional and disabled by default. No materials are sent to the Program unless you enable it yourself. Refusing to participate does not restrict Pleofon functionality, change your usage limits, or affect the price.

If you enable the Pleofon Improvement Program, Pleofon may upload full source audio and information about editing decisions for the purpose of training, testing and improving models responsible for editing and cutting decisions.

You can disable the Program at any time in Settings. Disabling it stops new uploads. You can separately delete previously uploaded materials and withdraw your consent to their further processing using the Delete my data function or by contacting us.

3. Account, license and operation of Pleofon

Account and license

We process your email address, account identifier, and information concerning the activation, type, status and validity of your license. We also use your email address to send login links and messages necessary to operate your account and license.

The legal basis for this processing is performance of a contract under Article 6(1)(b) GDPR.

Device identifier and free usage limit

Pleofon uses a secret stored in the operating system (macOS or Windows) to generate a device identifier. A hash of that identifier is stored on our servers.

The identifier is used to enforce the free usage limit assigned to a computer and to prevent circumvention of that limit by creating additional accounts or deleting an existing account.

We do not use this identifier to track activity outside Pleofon or for advertising.

We treat the identifier and the usage counter associated with it as personal data even if they are not linked to an email address.

Processing necessary to calculate and enforce the current usage limit is based on Article 6(1)(b) GDPR. Limited processing intended to prevent circumvention of the limit is based on our legitimate interest under Article 6(1)(f) GDPR.

Usage counters and telemetry

We process the number of analysis minutes used during the current period and information required to determine the status of your usage limit.

Pleofon may also send limited technical telemetry, including an account or installation identifier, event type, event timestamp, license activation information, and information about critical errors.

To check how Pleofon performs on different computers, the application also sends information about the computer's configuration (operating system, processor, amount of memory and graphics card), the result of the performance measurement carried out during the first analysis (which component computes faster and the measured times), and for each analysis the cutting model used, the mode, the length of the material and the analysis time. This information does not include the content of your recordings, file names or file paths.

Telemetry is used to maintain the service, diagnose technical problems, and assess application reliability. The legal basis is our legitimate interest under Article 6(1)(f) GDPR.

We do not use telemetry for advertising or for creating advertising profiles.

Bug reports and suggestions

If you submit a bug report or suggestion through the application, we may receive the contents of the report, contact information or an account identifier, and technical information attached to the report.

If the report concerns performance of the service, the legal basis is Article 6(1)(b) GDPR. Additional diagnostics and analysis of suggestions are based on our legitimate interest under Article 6(1)(f) GDPR.

Submitting a report does not enable the Pleofon Improvement Program and does not constitute consent to use the report or any attached materials for model training.

Updates and network connections

When checking for updates, the application sends information necessary to determine the appropriate version of Pleofon. The server also receives the IP address of the connection.

The legal basis for this processing is Article 6(1)(f) GDPR, namely our legitimate interest in maintaining the security, availability and proper operation of the application.

4. Payments

Payments for Pleofon are processed by Paddle.com Market Ltd as Merchant of Record and as a separate data controller in relation to purchases, payments, taxes and sales documentation.

We do not receive your full payment card number or security code.

We receive from Paddle the information required to associate a purchase with an account, activate a license, and manage a subscription.

Processing necessary to provide the purchased license is based on Article 6(1)(b) GDPR. Data that we are legally required to retain is processed under Article 6(1)(c) GDPR.

Paddle processes data under its control in accordance with its own privacy policy.

5. Pleofon Improvement Program

Participation is voluntary

The Pleofon Improvement Program is disabled by default.

During the initial setup of the application, you may decide whether you want to join. Enabling the Program requires an active action on your part.

Refusing to participate does not restrict Pleofon functionality, affect your available usage limit, prevent you from using a paid or free plan, or affect the price of the service.

You can change the status of the Program at any time in Settings. This means you may disable it before working with material that you do not want to submit and enable it again for another project.

What materials we receive

When the Program is enabled, we may receive:

• full source audio, including fragments later removed or not used,
• information about proposed cut points,
• information about which cuts were accepted, rejected or moved,
• technical data necessary to associate the material with the corresponding editing decisions.

The full recording is required as context for evaluating the quality of editing decisions.

File names and unnecessary metadata are removed or replaced, and materials are assigned random identifiers. We nevertheless retain the technical link required to identify materials submitted by a particular account and delete them later if requested.

How we use the materials

Materials submitted to the Program are used exclusively to prepare data and to train, fine-tune, test and evaluate models responsible for editing analysis, in particular determining cut points and identifying fragments that should be retained or removed.

Models developed in this way may also be used in paid versions of Pleofon products.

Legal basis

The processing of a user’s personal data contained in materials submitted to the Pleofon Improvement Program is based on the user’s consent under Article 6(1)(a) GDPR.

You provide consent by actively enabling the Program after receiving information about how it works.

You may withdraw consent regarding previously uploaded materials at any time using the Delete my data function or by contacting us at contact@pleofon.ai.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

What we do not do with the materials

We do not use materials submitted to the Improvement Program or training data created from those materials for:

• training, fine-tuning or testing generative AI,
• voice synthesis or voice cloning,
• generating new statements or speech,
• biometric identification,
• determining the identity of speakers,
• searching for information about participants in a recording,
• linking participants with external databases,
• advertising or advertising profiling.

We do not publish recordings or training datasets.

Processors acting on our behalf are not permitted to train their own models using Pleofon Improvement Program materials.

Human access to recordings

Materials are processed primarily through automated systems.

Recordings may only be accessed by authorized persons bound by confidentiality obligations when necessary to prepare or verify data, evaluate model quality, or diagnose a technical problem.

Access to materials is restricted and logged.

Materials containing other people

Enabling the Improvement Program does not constitute consent on behalf of other people who may be heard or otherwise identifiable in the submitted material.

Before submitting such material, the user confirms that:

• they are authorized to provide the material to Pleofon for the purposes described here,
• people whose personal data is contained in the material have been informed about processing by Pleofon and about the purpose of the Pleofon Improvement Program,
• those people have given consent to such processing where consent is the applicable legal basis,
• those people have been provided with this privacy notice or equivalent information required under the GDPR.

The source of personal data relating to such people is the user who submitted the material.

A person included in submitted material does not need a Pleofon account in order to exercise their rights. They may contact us directly at contact@pleofon.ai.

If we require additional information to locate a specific recording, we may ask for information necessary to identify it. We do not require a person to provide information that is not necessary to handle their request.

Special categories of personal data

A recording may reveal special categories of personal data, including information concerning health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, sex life or sexual orientation.

If material submitted to the Program contains such data, its processing requires additional conditions under Article 9 GDPR to be satisfied.

Where consent is relied upon, that consent must explicitly cover the processing of such data by Pleofon for the purposes of the Pleofon Improvement Program.

Materials containing personal data relating to criminal convictions or offences within the meaning of Article 10 GDPR should not be submitted to the Improvement Program unless such processing has been individually agreed with Pleofon in advance and an appropriate legal basis exists.

6. Disabling the Program and withdrawing consent

Disabling the Program

Disabling the Pleofon Improvement Program stops new material from being uploaded, including uploads that are waiting to begin.

It does not automatically delete materials submitted previously.

This allows you to temporarily disable the Program for a specific project without deleting materials previously submitted from other projects.

Withdrawing consent for previously submitted materials

If you no longer want previously submitted materials to be processed as part of the Program, select Settings, Pleofon Improvement Program, Delete my data, or contact us at contact@pleofon.ai.

We treat such a request as a withdrawal of consent for further processing of the data covered by the request within the Improvement Program.

After receiving the request, we prevent the relevant materials from being used in new training operations and begin deleting them from active systems and from systems operated by our processors.

Backup copies are deleted in accordance with their retention cycle and remain excluded from ordinary use until deletion. If a backup is restored, the recorded deletion request is applied again.

Deleting Improvement Program data does not delete your account, license, local projects, or current usage counter.

7. Trained models

Source recordings, training data prepared from them, and the parameters of a trained model are separate elements of the system.

Deleting a recording and its training data does not automatically reverse its statistical influence on a model that was trained previously.

Pleofon models covered by the Improvement Program are used to make editing decisions. They are not intended to generate or recreate speech.

We assess whether a model contains personal data based on its architecture, training method, and the realistic possibility of identifying a person or extracting information relating to them.

If a model does not contain personal data relating to the person making the request, deletion of the source material does not require removal of the statistical influence of that material from the model parameters.

If a model were to contain personal data covered by a request, appropriate measures would also be applied to the model.

8. Service providers and transfers outside the EEA

We use service providers required for the operation of Pleofon.

Cloudflare

Cloudflare, Inc. provides part of our network and server infrastructure and stores materials submitted to the Improvement Program.

Training materials are stored in Cloudflare R2 using jurisdictional restrictions to the European Union.

Cloudflare may process certain technical, support or security-related data outside the European Economic Area. Where such transfers require safeguards under Chapter V GDPR, appropriate transfer mechanisms are applied under the applicable data processing agreement, including Standard Contractual Clauses approved by the European Commission.

Resend

Resend provides email delivery services, including login links.

Data processed by Resend may be stored in the United States. Transfers from the EEA are protected using the mechanisms described by Resend, including Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

Paddle

Paddle.com Market Ltd acts as a separate controller in relation to payment processing. Paddle may process data in different countries in accordance with its own privacy policy and applicable transfer mechanisms.

Entities acting as our processors process data under appropriate agreements and only within the scope of the tasks entrusted to them.

Data may also be disclosed to competent public authorities where required by applicable law.

You may obtain information about the transfer safeguards we use, including a copy where applicable, by contacting us at contact@pleofon.ai.

9. How long we retain data

We apply the following retention periods or criteria:

• account and current license data: for as long as the account exists and as needed to provide the rights associated with it,
• Pleofon Improvement Program materials and related training data: until consent is withdrawn, the Program ends, or we determine earlier that the data is no longer required; at least once per year we review whether continued retention remains necessary,
• free plan usage counter and associated anti-abuse identifier: until the end of the period to which the usage relates,
• last activity, activation and error information: no longer than one year,
• reports and diagnostics: no longer than one year, unless longer retention is necessary to handle a particular matter,
• network, update and security logs: no longer than one year,
• transaction data held by Pleofon: no longer than one year, except where applicable law requires us to retain it for longer,
• records concerning the handling of data subject rights and other accountability documentation: for as long as necessary to demonstrate compliance with our legal obligations.

After an account is deleted, a limited record of the device identifier and current usage may remain until the end of the period used to calculate the free usage limit. This exception is not used to retain recordings, Improvement Program data, or additional telemetry.

10. Deleting your account

If you want to delete your account and the personal data relating to you, contact us at contact@pleofon.ai.

Your request may cover account data, license data, telemetry, reports, and Pleofon Improvement Program data.

We may retain only information for which an independent legal basis for continued processing exists, in particular a limited record necessary to enforce the current free usage limit, information required by law, or documentation necessary to demonstrate compliance with legal obligations.

If we retain part of your data after handling your request, we will inform you of the scope, legal basis, and expected retention period.

Deleting your account does not delete projects or materials stored locally on your computer.

Data for which Paddle acts as controller is subject to Paddle’s own procedures.

11. Your rights

To the extent provided by the GDPR, you have the right to:

• obtain information about the processing of your personal data and access that data,
• obtain a copy of your personal data,
• request rectification of your personal data,
• request deletion of your personal data,
• request restriction of processing,
• exercise the right to data portability where its conditions are met,
• object to processing based on Article 6(1)(f) GDPR,
• withdraw consent at any time where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

If your personal data is included in a recording submitted by another user, you may exercise your rights without having a Pleofon account.

If we are unable to locate your data based on the information available to us, we may ask you for additional information necessary to identify it. We do not collect additional information solely for the purpose of being able to identify every person who may appear in training materials.

We respond to requests without undue delay and generally within one month. In cases provided for by the GDPR, that period may be extended by an additional two months. We will inform you about the extension and the reasons for it within the first month.

You also have the right to lodge a complaint with the competent supervisory authority. In Poland, this is the President of the Personal Data Protection Office.

12. Automated decision-making

We do not make decisions concerning you based solely on automated processing that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR.

Automated calculation of usage limits and license activation checks are technical elements of the service. If their result is incorrect, you may contact us to request clarification.

13. Minors

Pleofon is not directed at users under the age of 16 and we do not knowingly collect their personal data as users of the application.

Materials processed by a user may contain personal data relating to minors. The user is responsible for holding all required rights and consents before submitting such material to the Pleofon Improvement Program.

14. Security

We use technical and organizational measures appropriate to the nature of the personal data we process, including access restrictions, permission controls, and safeguards protecting data transmission and infrastructure.

Access to Pleofon Improvement Program materials is restricted to persons and systems that require such access for the purposes described in this Privacy Policy.

15. Changes to this Privacy Policy

We may update this Privacy Policy due to changes in Pleofon, our infrastructure, or applicable law.

We will notify you of material changes concerning the way personal data is processed through the application or by email before those changes take effect where required or appropriate given the nature of the change.

A change to this Privacy Policy does not retroactively expand consent previously given for the Pleofon Improvement Program.

If we wish to use previously collected materials for a new purpose that requires separate consent, we will ask for that consent before beginning such processing.