Privacy Policy

Last updated: May 16, 2026

VXID is a voice identity verification platform operated by NeuralWeaves Technology Private Limited ("we", "us", "our"), a company incorporated in Bengaluru, India. This policy explains what data we collect, how we use it, and your rights.

  The short version: We collect the minimum data needed to verify voice identities. Voiceprints are irreversible mathematical vectors — the original audio cannot be reconstructed from them. We don't sell your data. You can delete your data at any time.

1. What data we collect

Data type	What it is	Why we need it	How long we keep it
Account data	Email, name, password hash	Account creation and authentication	Until you delete your account
OAuth data	Google ID, profile picture	Social login (if you choose Google sign-in)	Until you delete your account
Voiceprints	192-dimensional numerical vectors	Speaker identity matching	Until deleted via API or account deletion
Audio samples	Uploaded audio clips	Processed to extract voiceprints	Configurable: 24 hours to 30 days, or not stored
Session data	Verification scores, verdicts, timestamps	Audit trail and billing	12 months
Usage data	API call counts, audio minutes processed	Billing and rate limiting	24 months

2. How voiceprints work

A voiceprint is a 192-dimensional numerical vector — a sequence of 192 numbers that represent the unique characteristics of a person's voice. It is extracted from audio using a neural network model (ECAPA-TDNN).

Voiceprints are irreversible. The extraction process is a one-way function — similar to how a cryptographic hash works. You cannot reconstruct the original audio from a voiceprint, hear the person's voice, or determine what they said. The voiceprint captures only the structural characteristics of the vocal tract, not the speech content.

When a voiceprint is deleted (via the API or account deletion), the vector is overwritten with zeros before the record is removed. This ensures complete erasure.

3. Audio handling

Audio samples uploaded to VXID are processed in the following way:

Audio is received, converted to a standard format (16kHz mono WAV), and passed through the speaker verification model.
The voiceprint vector is extracted and stored.
The raw audio may be stored temporarily for quality assurance and dispute resolution, based on the organization's configured retention policy.
Audio is stored encrypted at rest (AES-256) and transmitted over TLS 1.3.
Organizations can set audio retention to 24 hours, 7 days, 30 days, or "do not store" — in which case audio is discarded immediately after voiceprint extraction.

4. How we use your data

We use collected data for:

Providing the service — enrolling voiceprints, verifying speakers, returning verdicts
Billing — tracking audio minutes processed per organization
Security — detecting fraud, abuse, and unauthorized access
Improvement — analyzing aggregate usage patterns (never individual audio or voiceprints) to improve model accuracy
Communication — sending account confirmations, password resets, and service notifications

We do not:

Sell, rent, or share personal data or voiceprints with third parties
Use audio content or voiceprints for advertising
Train our models on individual customer audio without explicit consent
Share voiceprints across organizations (each organization's data is fully isolated)

5. Data isolation

VXID is a multi-tenant platform. Each organization's data — voiceprints, sessions, usage records — is isolated at the database level using row-level security. Organization A cannot access Organization B's voiceprints, sessions, or any other data under any circumstances.

6. Third-party services

Service	Purpose	Data shared
Google OAuth	Social login (optional)	Email, name, profile picture — only when you choose "Sign in with Google"
Resend	Transactional email	Email address — for confirmation and notification emails only
Neon / PostgreSQL	Database hosting	All application data — encrypted at rest and in transit
DigitalOcean	Infrastructure hosting	Application runs on DO servers — no data sharing with DO beyond infrastructure

We do not use analytics services, advertising trackers, or any third-party scripts on our website or dashboard that track user behavior.

7. Cookies

VXID uses no cookies on the marketing website. The dashboard uses browser localStorage to store your authentication token for session persistence. This is not a cookie and is not shared with any third party. You can clear it by logging out or clearing your browser data.

8. Your rights

Under GDPR (EU), DPDPA (India), and applicable privacy laws, you have the right to:

Access — view all data we hold about you (via the dashboard or API)
Delete — delete your voiceprints (DELETE /v1/subjects/{id}), your account, or request full data erasure
Export — download your data in a machine-readable format
Correct — update your profile information
Object — object to processing of your data
Restrict — request restriction of processing

To exercise any of these rights, contact us at [email protected]. We respond within 30 days.

9. Data deletion

When you delete a voiceprint via the API:

The embedding vector is overwritten with zeros (irreversible)
The record is marked as deleted
Associated audio files (if stored) are deleted
This is completed within 72 hours

When you delete your account:

All voiceprints in your organization are deleted (zeroed + removed)
All session records are anonymized
All API keys are revoked
Your user record is deleted
Usage and billing records are retained for 24 months for legal compliance, then deleted

10. Security

All data is encrypted at rest (AES-256) and in transit (TLS 1.3)
API keys are stored as SHA-256 hashes — we cannot see your full key
Passwords are hashed with bcrypt (cost factor 12)
Database access is restricted via row-level security policies
Infrastructure is hosted in DigitalOcean's SOC 2 Type II certified data centers
We conduct regular security reviews of our codebase and dependencies

11. Children's data

VXID is not directed at children under 16. We do not knowingly collect data from children. If you believe a child's data has been submitted to our platform, contact us and we will delete it immediately.

12. Changes to this policy

We may update this privacy policy from time to time. Material changes will be communicated via email to registered users and posted on this page with an updated date. Continued use of the service after changes constitutes acceptance of the updated policy.

13. Contact

For any privacy-related questions, data requests, or concerns:

Email: [email protected]
Company: NeuralWeaves Technology Private Limited
Location: Bengaluru, Karnataka, India