Privacy policy

Processing of personal data of users of the NCSpeech Studio platform (studio.ncspeech.ai)

Almaty. Edition of 15 October 2026.

This is a translation of the Russian original. If the versions differ, the Russian text prevails.

This Privacy policy (the “Policy”) describes which personal data NCSPEECH Limited Liability Partnership (LLP “NCSPEECH”), BIN 250340013230 (the “Company”, “we”) collects when the NCSpeech Studio platform at https://studio.ncspeech.ai (the “Platform”) is used, what they are for, who they are disclosed to, how they are protected and what rights the user has.

The Policy is prepared in accordance with the Law of the Republic of Kazakhstan dated 21 May 2013 No. 94-V “On personal data and their protection” (the “Law”) and the Rules on measures to protect personal data by the owner and (or) operator and by a third party, approved by order of the Minister of Digital Development, Innovations and Aerospace Industry of the Republic of Kazakhstan dated 12 June 2023 No. 179/НҚ. The Policy is an integral part of the Public offer for access to the Platform.

By signing up on the Platform the user confirms that they have read the Policy and consents to the collection and processing of their personal data on the terms set out in it.

1. Terms

1.1. The following terms are used in the Policy:

• a) User: a natural person, individual entrepreneur or representative of a legal entity who has registered an account on the Platform.
• b) Personal data: information relating to an identified or identifiable natural person, recorded on an electronic, paper or other medium.
• c) User data: audio recordings, texts, word lists, pronunciation dictionaries, voice samples and other data that the User uploads to the Platform for speech recognition or synthesis.
• d) Results: text, synthesized speech and related data that the Platform returns to the User.
• e) Payment service: the FreedomPay and Robokassa internet acquiring services through which bank-card payments are accepted.
• f) Processing: any operations with personal data, including collection, recording, storage, use, disclosure, blocking and destruction.

2. What data we collect

2.1. Account data that the User provides at signup and in settings:

• a) e-mail address (used as login, for notices and for contact);
• b) Google sign-in identifier (e-mail and password or a Google account). If the User signs in with a password, the password is stored at Google as a one-way hash and does not reach the Company’s servers;
• c) name, company name and other details if the User fills them in in the profile at their discretion.

2.2. Payment data. Entry and processing of bank-card details take place on a protected page of the Payment service. The Company does not receive or store the full card number, expiry date or security code. From the Payment service the Company receives and stores:

• a) status, amount, currency, date and time of the payment, transaction identifier;
• b) the card-token identifier for recurring payments (the token itself is stored by the Payment service) and a masked card number (last four digits) for display in the Cabinet.

2.3. Platform-usage data created automatically:

• a) request log: date and time, request type (recognition or synthesis), duration of processed audio or synthesized speech, credits deducted, API-key identifier, response code;
• b) session technical data: IP address, type and version of the browser or API client, date and time of sign-in;
• c) cookies needed for sign-in and to keep the session (see section 9).

2.4. User data. Audio and texts uploaded for processing may contain personal data of the User and of third parties: voice, speech content, names, phone numbers, addresses and other information. The Company does not analyse the content of such data, does not identify people by voice, does not create biometric templates and processes User data only in order to return the Result. The processing procedure is described in section 5.

2.5. Support requests. When the User writes by e-mail, phone or a form on the site, the Company stores the content of the request, contact details and files the User attached.

2.6. The Company does not collect special categories of personal data (health, ethnicity, beliefs, etc.) and does not ask the User for them. If such information is contained in User data, it is processed as part of User data under section 5 and is not extracted by the Company.

3. Why and on what basis data are processed

3.1. The Company does not use the User’s personal data or User data to train its models, for profiling or for automated decisions that have legal effects for the User.

4. Who data are disclosed to

4.1. The Company does not sell personal data and does not disclose them to third parties for those parties’ own purposes. Data are disclosed only to the extent needed to provide the services, to the following recipients:

4.2. Personal data are processed and stored on the Company’s server equipment located in the Republic of Kazakhstan. Cross-border transfer of personal data is not carried out.

4.3. The Company does not engage subprocessors who have logical access to User data. If the list of recipients changes, the Company notifies Users by publishing a new edition of the Policy.

5. How user data are processed

5.1. Audio and texts uploaded for processing are sent to the Platform over a protected channel (HTTPS), processed by the Company’s models, after which the Result is returned to the User. The source file is not stored after processing. Recognition history in the Cabinet (Result text and request metadata) keeps the latest 1,000 records, including API requests: when a new record is saved, the oldest one is deleted. A record is deleted earlier if the User deletes it or the account. Other exceptions are clauses 5.2 and 5.3.

5.2. User voices (clone identifier and name) are stored in the account until the User deletes them or the account is deleted. The voice sample is sent to the synthesis service over HTTPS and is not stored separately by the Company. Word-hint lists are stored together with the recognition-history record.

5.3. If the User attaches audio or text to a support request for error analysis, Company staff get access only to those materials and delete them after the analysis is finished, and in any event no later than 30 (thirty) calendar days from the date of the request.

5.4. Company staff have no access to the content of User data in ordinary operation of the Platform. Processing is performed automatically.

5.5. As to personal data of third parties contained in User data, the User is the owner and (or) operator of the database, and the Company processes such data on the User’s instructions. The User is responsible for having a lawful basis for processing, including consents of data subjects and the consent of the person whose voice is used to create a user voice. On request the Company provides legal entities with a personal-data processing agreement.

6. Retention periods

7. How data are protected

7.1. Organisational measures: a person responsible for organising the processing and protection of personal data has been appointed; internal documents on processing and protection have been approved; the circle of staff with access to server equipment and data has been defined; staff have accepted confidentiality obligations; an incident-response procedure is in force.

7.2. Technical measures: data between the User and the Platform are transmitted only over HTTPS (TLS 1.2 and higher); on e-mail sign-in the password is stored at Google as a one-way hash and does not reach the Company’s servers; request authentication by API keys and accounts with isolation of access between users; administrative access to equipment only over protected channels with multi-factor authentication and logging; regular software updates; encrypted backup of account data on equipment in the Republic of Kazakhstan; isolation of processing of different users’ requests.

7.3. Physical protection: equipment is hosted in a data centre with around-the-clock security, access control and logging, guaranteed power, climate control and fire suppression.

7.4. The full card number, expiry date and security code do not reach the Company’s servers: they are entered on the page of a Payment service certified to PCI DSS. The Company stores only the token identifier and the last four digits of the card (see clause 2.2).

7.5. If a personal-data security breach is discovered (unauthorised access, leak, loss), the Company notifies affected Users at the account e-mail and the competent authority within the time limits set by the Law, describing the nature of the breach and the measures taken.

8. User rights

8.1. The User may:

• a) know which of their personal data the Company processes and obtain a copy;
• b) change and supplement account data in the cabinet;
• c) require blocking or destruction of personal data if they are incomplete, outdated, inaccurate or obtained unlawfully;
• d) withdraw consent to processing of personal data and to receiving mailings;
• e) delete the account in the “Settings” section of the Cabinet (with confirmation of the account e-mail) or by sending a request to info@ncspeech.org from that address;
• f) appeal the Company’s actions to the competent personal-data authority or to a court.

8.2. Requests are sent to info@ncspeech.org from the account e-mail. The Company replies within 10 (ten) business days, or within another time limit if the Law sets one.

8.3. Withdrawal of consent to processing of account data means the services can no longer be provided: the account will be deleted and the data destroyed within the periods in section 6. Withdrawal of consent does not affect data the Company is required by law to keep (payment data and the request log for the set periods).

9. Cookies

9.1. The Platform uses only strictly necessary cookies: for sign-in to the account, keeping the session and protection against request forgery (the SameSite attribute; for data-changing requests from the browser the Origin header is also checked). Such cookies are not used to track the User on third-party sites and are not disclosed to third parties.

9.2. Advertising cookies and third-party trackers are not used on the Platform. If the Company starts using analytics tools, the Policy will be supplemented with a description of those tools and the User will be offered a choice.

9.3. The User may disable cookies in the browser settings, but in that case sign-in to the account will not be possible.

10. Age limits

10.1. The Platform is intended for persons aged 18 or over. The Company does not knowingly collect personal data of minors. If the Company learns that an account was registered by a person under 18, that account and related data will be deleted.

11. Changes to the policy

11.1. The Company may change the Policy. The new edition is published on the Platform with the edition date at least 10 (ten) calendar days before the changes take effect.

11.2. Continued use of the Platform after the new edition takes effect means the User agrees to the changes.

12. Contacts