Voice & Biometric Privacy Notice

Last updated: May 2026 · Effective immediately for all new recordings

1 · What we collect that counts as "biometric data"

When you record yourself on Fablely, two things happen:

• A 30-second consent audio file — your voice reading a phrase that explicitly acknowledges you've read this notice. We store this in our private audio bucket as legal proof of consent.
• A "voice model" — a mathematical representation of your voice's timbre, pitch, and prosody, created by our AI provider (ElevenLabs, Inc.) from that 30-second sample. This model lets us synthesize new speech that sounds like you, including words you never said into the microphone.

Both items qualify as "biometric identifiers" under the Illinois Biometric Information Privacy Act (BIPA, 740 ILCS 14/), the Texas Capture or Use of Biometric Identifier Act (CUBI), Washington's HB 1493, and similar state-level laws that may apply to you depending on your residency.

2 · Why we collect it

The voice model is used only for one purpose:

• Generating personalized audio content (bedtime stories, lullabies, voice letters, time-locked vault messages) on your behalf, narrated in your voice, for your own family.

We do not use your voice for any of the following:

• ❌ Training general-purpose voice AI models that benefit other users
• ❌ Marketing, advertising, or promotional content
• ❌ Identity verification, fraud detection, or any biometric matching
• ❌ Sale, lease, trade, or any commercial transaction involving your voice data
• ❌ Disclosure to law enforcement except as required by a valid court order

3 · Who we share it with

Voice data is shared with exactly one third-party processor:

We never share your voice with advertisers, data brokers, social platforms, or any party other than the one provider above.

4 · How long we keep it

Under BIPA Section 15(a), we are required to publish our retention schedule. Here it is:

• Voice model (at ElevenLabs): retained for as long as your account is active. Auto-deleted 12 months after your last login OR within 7 days of your explicit deletion request.
• Consent recording (in our private Supabase bucket): retained for 3 years as legal audit trail, per BIPA Section 15(b)(3) recommended practice. Encrypted at rest. Inaccessible to anyone except the Fablely backend.
• Generated audio (mp3 files): retained until you delete them, OR if you cancel your account, for 90 days post-cancellation as a grace period to re-subscribe, after which they are permanently deleted.

5 · Your rights — and how to exercise them

6 · Security measures

We protect biometric data with the same standards we apply to passwords:

• Encryption at rest: All audio files (consent recordings + generated stories) are stored in Supabase Storage with at-rest encryption (AES-256). The voice model at ElevenLabs is similarly encrypted per their published security posture.
• Encryption in transit: All traffic to and from our servers uses TLS 1.3.
• Access control: Voice data is accessible only via service-role database credentials held by our serverless functions. No employee has direct access.
• Audit logging: Every voice creation, story generation, and deletion is logged with a timestamp.
• Watermarking: All audio generated from your voice clone is watermarked by ElevenLabs at the codec level, so any misuse can be traced.

7 · Specifically for Illinois residents (BIPA)

If you are a resident of the State of Illinois, the Biometric Information Privacy Act (740 ILCS 14/) gives you the following specific rights:

• Section 15(a): A written, publicly available retention schedule — that's Section 4 above.
• Section 15(b)(1): Written informed consent BEFORE collection — that's the checkbox on the recording page, plus the consent phrase you read into the microphone.
• Section 15(b)(2): Notice of the specific purpose and length of term — covered in Sections 2 and 4.
• Section 15(c): Prohibition on profit from biometric data — we explicitly do not sell, lease, or trade.
• Section 15(d): Disclosure only with consent or as legally required — covered in Section 3.
• Section 15(e): Reasonable security — covered in Section 6.

Illinois residents have a private right of action for BIPA violations. We take this seriously.

8 · Children's data

Fablely is intended for use by parents to create content for their children. We do not knowingly collect voice biometric data from anyone under 18. The 30-second consent recording must be made by a parent or legal guardian. If you believe a minor has recorded a voice on Fablely without parental consent, please contact us at hello@fablely.ai and we will delete it within 24 hours.

9 · Updates to this notice

We may update this notice as the product evolves or as new biometric-privacy laws take effect. If we make material changes, we will notify you by email (for active subscribers) and post a prominent banner on the recording page. The "Last updated" date at the top of this page reflects the most recent change. Your continued use of Fablely after a change constitutes acceptance of the updated notice.

10 · Contact

Questions, requests, or complaints about your voice data?
Email: hello@fablely.ai
Mailing address: (TBD — added before commercial launch)
We respond within 30 days, in most cases within 48 hours.