Data Processing Appendix

1. Each party's role over the data

The role of each party depends on the category of data, not on whether you use the web interface or the API:

• For account, payment, security and service-operation data — sign-in information, transactions, system logs, anti-abuse metrics — Saydi AI is the data controller.
• For text, audio files, voice samples, cloned voices, subtitles, video and output audio you submit through an integration to be processed on behalf of your end users, Saydi AI is the data processor and acts only on your instructions.

As controller, you are responsible for the lawfulness of the input data, for having notified and obtained consent from data subjects and end users, and for the content you submit. As processor, Saydi AI processes data only on your written instructions, does not use it for its own purposes and does not use it to train AI models.

If you are a processor acting for another controller, you are responsible for passing these obligations on to that controller and for ensuring the two of you have an appropriate agreement.

2. Categories of data processed

We process the following four categories:

2.1. Account data

Name, email, profile picture, OAuth identifier when signing in with a third party, sign-in status, plan and remaining allowance, and personal settings. For organisation accounts this can include member information and in-organisation permissions.

2.2. Transaction and payment data

Transaction reference, plan and cycle purchased, amount, time, reconciliation status, activation status and allowance usage history. Saydi AI does not store card numbers or sensitive payment details on its servers; our payment partners handle that part.

2.3. Content data

Text submitted for text-to-speech, reference audio files, voice samples, cloned voices, subtitles, video and output audio, together with generation metadata — voice used, language, speed, timestamp, characters or seconds consumed.

This category is the most likely to contain personal data and sensitive personal data, so it is also the most tightly controlled.

2.4. Security and operational data

IP address, browser and device type, access times, hashed or masked API keys, security logs, anomaly alerts, error codes and operational metrics. This supports system safety and abuse prevention.

3. Purposes of processing

SaydiVoice processes data to: provide text-to-speech, voice cloning, voice design, dubbing and translation; authenticate accounts and manage sessions; meter and deduct allowances; take payment and meet accounting and tax duties; store output when you ask us to; support customers and resolve incidents; secure the system and prevent abuse; comply with lawful requests from competent authorities; and improve reliability and quality using aggregated or anonymised data.

Saydi AI does not use your content data for advertising, does not sell personal data and does not use voice samples or output audio to train AI models.

4. Sub-processors

SaydiVoice uses a number of sub-processors for infrastructure, storage, authentication, payment, measurement and support. They may process data only to the extent needed to provide the service, secure the system or meet a legal obligation, and all of them must commit to confidentiality and must not use the data for their own purposes.

Categories of sub-processor currently in use:

• Compute, storage and database infrastructure — running the website, the API and file storage.
• GPU infrastructure — running the speech generation models on our systems.
• Authentication — Firebase Authentication (Google) for sign-in and session management.
• Payments — partners processing domestic and international transactions.
• Measurement and support — analytics tools (some of which run without personal tracking cookies) and the customer support chat channel.
• Supplementary AI services — only for translation or language processing features, under data-protection commitments and never for training.

When a material sub-processor change significantly alters how data is processed, we update this document and our Privacy Policy, or notify business customers with a separate agreement in an appropriate manner.

5. Security measures

We apply the following technical and organisational measures:

• Secure HTTPS/WSS connections for the whole website and API.
• Role-based access control, granular permissions and a need-to-know rule for operational staff.
• Hashing or masking of sensitive values such as API keys; no plain-text password storage.
• Per-account and per-IP rate limiting, allowance caps and anomaly detection.
• Security logging and a severity-graded incident response process.
• Secrets and infrastructure configuration kept out of application source and out of browser bundles.
• Regular backups and recovery testing.

No system is absolutely secure. If we detect an incident affecting personal data we will make reasonable efforts to contain and mitigate it and to notify as required by applicable law, including notifying affected business customers.

6. Retention and deletion

Content data is kept for as long as needed to provide the service, support users, handle disputes, comply with the law or protect lawful interests:

• Voice samples and cloned voices: until you delete the voice or your account.
• Generation, subtitle and dubbing history: according to your storage settings.
• Output files: stored at your request; you can download and delete them at any time.
• Account data: while the account is active and for a reasonable period afterwards to handle disputes.
• Transaction data, invoices, security logs and abuse evidence: retained for the periods required by law, including after account deletion.

You can request export, correction or deletion through our contact page. For customers with a separate agreement, the retention period and deletion process are set out in that agreement. When a retention period ends, data is deleted or anonymised using appropriate measures.

7. Cross-border transfers

Some of the infrastructure and support services we use have servers outside Vietnam. Where personal data is transferred abroad we meet our duties under Decree 13/2023/ND-CP:

• Preparing the personal data transfer impact assessment dossier.
• Ensuring the recipient applies a level of protection equivalent to Decree 13 and has committed to it in writing.
• Filing the dossier with the competent authority under the statutory procedure.
• Informing you of material transfer points relevant to your project on request.

If you need data processed only within Vietnam, talk to us before putting the service into production — that condition may not be achievable for some features, and we will say so clearly before you commit.

8. Enterprise support

If you need a separate data processing agreement, a detailed sub-processor list, additional security commitments, specific cross-border transfer terms or a custom retention period, contact us before putting the service into production with sensitive data or at scale.

We can support:

• Signing a separate data processing agreement on your template or ours.
• Providing the sub-processor list and each party's role for your project.
• Agreeing storage location, retention period and a deletion process on request.
• Providing documentation to help you complete your own personal data processing impact assessment.
• Discussing sector-specific requirements — financial services, healthcare, education, public sector.

Contact us through our contact page or at contact@saydi.ai.

9. Related documents

This appendix is read together with:

• Privacy Policy — the end-user notice on personal data.
• Terms of Service — contractual rights and obligations.
• Voice consent policy — the mandatory precondition for the voice cloning feature.
• Plan and credit policy — allowances, upgrades, renewals and refunds.

Where this appendix differs from a separate data processing agreement signed between the parties, the separate agreement governs the project it covers.