Privacy Policy

This Privacy Policy explains how NOVA2G, operating under the trade name ClonyVoice, handles personal data connected to the website, checkout, account area, download delivery, and customer support.

Last updated: March 21, 2026

1. Data controller

NOVA2G
101 Rue au Bois Marcel, 50000 Saint-Lô, France
RCS: 999 096 829 R.C.S. Coutances
Email: [email protected]

For any question related to data protection, you may contact us at the above email.

2. Scope

This policy applies to the public website (www.clonyvoice.com), Stripe checkout flow, account area, login emails, download delivery, licensing API, and support exchanges. The desktop app itself is designed for local generation on your Windows machine.

Voice samples, generated audio, and local projects remain on your machine by default unless you deliberately send files to us for support.

3. Data we collect and legal bases

Under Articles 6(1) of the GDPR, we process personal data based on the following legal grounds:

Data category	Examples	Legal basis (GDPR Art. 6)
Identity and contact	Name, email, billing email, account credentials	Contract — necessary to create and manage your account (Art. 6(1)(b))
Purchase and license	Order status, payment reference, license keys, machine activations, download tokens, referral attribution	Contract — necessary to deliver the purchased product (Art. 6(1)(b))
Support data	Messages via contact form, troubleshooting details you share	Contract — necessary to provide customer support (Art. 6(1)(b))
Technical and security	IP address, browser data, fraud prevention signals, rate-limit logs, anti-bot checks	Legitimate interest — security, fraud prevention and service protection (Art. 6(1)(f))
Accounting and tax	Invoices, transaction amounts, payment dates	Legal obligation — French tax and accounting law (Art. 6(1)(c))
Analytics and cookies	Cookie preferences, website traffic data (Google Analytics)	Consent — only when you accept analytics cookies (Art. 6(1)(a))

4. Third-party processors

We rely on third-party services that process limited data on our behalf or as independent controllers:

Stripe (USA) — payment processing, fraud detection. Stripe acts as an independent controller for payment data. Stripe Privacy Policy.
Google Analytics (USA) — website analytics, only when consent is granted. Google Privacy Policy.
Cloudflare (USA) — CDN, DDoS protection, and Turnstile anti-bot on forms. Cloudflare Privacy Policy.

For transfers outside the EU/EEA, these providers rely on EU Standard Contractual Clauses (SCCs) or equivalent safeguards as required by GDPR Chapter V.

5. Data retention

Account and license data: retained for the duration of your account, plus 30 days after deletion request (grace period), then anonymized via automated GDPR purge.
Accounting and transaction records: 10 years after the transaction, as required by French commercial law (Code de commerce, Art. L123-22).
Support messages: 3 years after the last exchange, then deleted.
Security logs (IP, rate-limit, fraud signals): 12 months, then deleted.
Analytics data (Google Analytics): 14 months, as configured in our GA4 property.
Cookie consent preference: stored locally in your browser (localStorage); cleared when you reset your browser data.

6. Security

We implement technical and organizational safeguards including: encrypted data at rest (AES-256) and in transit (TLS 1.2+), hashed passwords (bcrypt), encrypted personal data fields (email, name), rate limiting, CSRF protection, and restricted database access. No service can guarantee absolute security.

7. Your rights (GDPR Articles 15-22)

Under the GDPR and French data protection law (Loi Informatique et Libertes), you have the right to:

Access (Art. 15) — obtain a copy of your personal data.
Rectification (Art. 16) — correct inaccurate data.
Erasure (Art. 17) — request deletion of your data (subject to legal retention obligations).
Restriction (Art. 18) — request restricted processing in certain cases.
Portability (Art. 20) — receive your data in a structured, machine-readable format.
Objection (Art. 21) — object to processing based on legitimate interest.
Withdraw consent (Art. 7(3)) — withdraw analytics consent at any time via the cookie settings link in the footer.
Post-mortem directives (French law, Art. 85 Loi Informatique et Libertés) — define instructions for the retention, deletion, or disclosure of your data after your death.

To exercise your rights, contact us at [email protected] with enough information to identify your account. We will respond within 30 days.

If you believe your rights have not been respected, you may lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr.

8. Automated decisions

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you. Fraud detection signals are used only to flag suspicious activity for manual review.

9. Minors

ClonyVoice is not intended for children under 16. We do not knowingly collect personal data from minors. If you believe a minor has provided data, contact us to request deletion.

10. Policy updates

We may update this policy when the product, payment flow, or legal requirements change. The latest public version is always the one published on this page. Material changes will be communicated by email to registered users.