Privacy policy

Softforge Digital LTD, a company registered in England and Wales under company number 16621737, operates AdFace and is the controller of the personal data described here.

For anything in this policy, including access, correction, export or deletion, write to privacy@adface.ai. If you are in the United Kingdom you may also complain to the Information Commissioner's Office; in the European Economic Area, to your national data protection authority.

• Account data: name, email address, password hash, interface language, workspace membership and role.
• Content you bring: product URLs, imported product pages and images, briefs, scripts, presenter and voice choices, and the ads we render for you.
• Voice recordings: when you record or upload your own voice for a script, we keep that audio, what our transcription of it heard (to check that it says the script and breaks no rule), and the confirmation that the voice is yours or yours to use, with your name and the time you gave it.
• Usage data: credit ledger entries, generation jobs and their provider costs, and technical logs with IP address and user agent.
• Billing data: plan, subscription status, invoices and the customer identifier held at our payment provider. Card details never reach our servers.
• Messages you send us by email.

We use your data to run the service: authenticate you, ingest product pages, generate briefs, scripts and media, keep the credit ledger honest, send transactional email, prevent abuse, and meet our accounting duties.

We do not sell personal data, we do not use your product content or renders to train our own models, and we do not send you marketing email you did not ask for.

Running the pipeline means sending parts of your content to specialised providers, each under a data processing agreement and only for the task at hand:

• Text model provider: product briefs, scripts and moderation checks.
• Speech, lip-sync and video providers: the voice line and the presenter video for a variation. Video generation runs on fal (MiniMax, Seedance) and Kie.
• Transcription and voice conversion: a voice recording you attach is sent to a speech-to-text provider (fal, Whisper) so we can check it, and, only when you ask for that presenter's voice, to the ElevenLabs voice changer, which keeps a copy of the audio it receives.
• Object storage and hosting: your uploads, work files and renders.
• Email provider: verification, password reset and batch notification email.
• Payment provider: subscriptions, top-ups and invoices.

The current list of sub-processors is available on request from privacy@adface.ai.

Where the GDPR applies we rely on: performance of a contract for account, generation and billing data; legitimate interests for security, abuse prevention and product analytics; legal obligation for invoices and tax records; and consent where we ask for it, which you can withdraw at any time.

Intermediate work files, such as voice tracks and presenter clips, are deleted about 30 days after a variation completes. Renders, products and scripts stay until you delete them or close the workspace.

The file you record or upload in the browser is deleted as soon as we have stored the cleaned-up version of it. Replacing or deleting a recording deletes that stored audio too, unless an ad already made from it could still be re-run, in which case it is kept for that. Deleting a campaign or your workspace also erases its stored files — finished ads, uploads, product images, recordings and image ads — usually within minutes, and deleting a script erases its recording. A deleted ad can still play from a copy already in a viewer's browser, and from our content delivery network for up to a day. A recording you did not convert is your own voice inside a finished ad, and a finished ad is served from a public address anyone holding its link can open.

Credit ledger entries and invoices are kept for the period our accounting and tax rules require, even after an account is closed. Technical logs are kept for a short retention window.

You can access and correct your profile in settings, export your data as JSON, and delete your account, which deletes its personal workspace and content.

Depending on where you live you may also have the right to restrict or object to processing, to portability, and to complain to your data protection authority. Write to privacy@adface.ai and we answer within one month.

Our infrastructure and several model providers are located outside the European Economic Area. Where we transfer personal data we rely on the European Commission's standard contractual clauses or another valid transfer mechanism, and we assess each provider before we route content to it.

Traffic is encrypted in transit, secrets are held outside the code base, access to production data is limited to the people who need it, and passwords are stored hashed. Media is served from storage with signed, expiring URLs, and share links can be revoked.

No service is perfectly secure. If a breach affects you we notify you and the relevant authority as the law requires.

AdFace is a business tool and is not intended for anyone under 16. We do not knowingly collect their data; write to privacy@adface.ai if you believe a child has created an account.

We update this policy when the service changes. The date at the top of this page always reflects the current version, and material changes are announced by email or in the app.