Privacy Policy
1. Introduction & Scope
This Privacy Policy explains how Someone Inc., a Delaware corporation ("Someone," "we," "us," or "our"), collects, uses, stores, shares, and protects your personal information when you use the Someone.app website, application programming interface (API), and all related subdomains including cdn.someone.app (collectively, the "Service").
The Service is an AI character creation platform that enables users to create AI characters and generate content including images, videos, audio, voice clones, and text-to-speech using third-party AI models. By accessing or using the Service, you acknowledge that you have read, understood, and agree to this Privacy Policy. If you do not agree, please do not use the Service.
2. Information We Collect
We collect the following categories of information when you use the Service:
A. Identifiers
Email address, display name, and (if you sign in via Google OAuth) your name and email from Google. We do not access your Google contacts, calendar, or other Google account data. We also collect your IP address for security purposes. If you join through a referral link, we store the referral code and the identifier of the referring user.
B. Commercial Information
Your subscription plan, credit balance, credit transaction history, and payment confirmations from our payment processor. We never see, store, or have access to your full credit card number, CVV, or billing address. We receive only payment status and basic transaction details (amount, date, subscription plan) from the payment processor.
C. User-Created Content
Characters you create, including their parameters (gender, age bracket, ethnicity, skin tone, body build, hair color and style, eye color, art style, and any custom text descriptions); reference images you upload; prompts and settings used for content generation; generated outputs (images, videos, audio); voice samples you upload for voice cloning; audio tracks you create; and any historical likes or interactions retained from public-sharing features.
D. Technical & Usage Data
Browser type, device information, IP address, and user agent string for rate limiting, security, and abuse prevention. API request logs (including IP address, user agent, request path, and response time) are retained for 90 days. Webhook delivery logs are retained for 30 days. We also collect aggregate information about feature usage, generation history, and credit consumption to improve the Service.
E. Biometric Data
If you use our voice cloning feature, we collect voice samples (audio recordings) that you upload. These voice samples are used to create voiceprints and voice models, which are considered biometric identifiers under certain state laws. See Section 15 for detailed information about biometric data handling.
3. Legal Basis for Processing
If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction that requires a legal basis for processing personal data, we rely on the following:
- Contractual necessity — to provide the Service, process payments, manage subscriptions, generate AI content, store characters, and deliver your files
- Legitimate interest — for rate limiting, abuse prevention, security monitoring, aggregate anonymized analytics, and service improvement
- Consent — for processing biometric data (voice cloning) and any future marketing communications
- Legal obligation — for maintaining tax records and responding to lawful requests from authorities
4. How We Use Your Information
- Provide the Service — generate AI content, manage your characters, and deliver your files
- Send your prompts, reference images, character parameters, voice samples, and text to third-party AI providers for content generation (see Section 6)
- Process voice cloning requests by sending audio samples to AI providers
- Process payments for subscriptions and credit top-ups
- Public sharing and Explore are not available at launch. We will update this policy before enabling public display features.
- Send transactional emails — welcome messages, payment receipts, payment failure alerts, and support confirmations
- Track referral attribution when you join through a referral link
- Administer team features — shared credit pools, character libraries, and member management
- Manage API key creation, validation, and request logging
- Improve the Service using aggregate, anonymized usage analytics
- Prevent abuse through rate limiting, content moderation, and security monitoring
- Respond to your support requests
We do not sell your personal information. We do not use your content to train AI models.
6. AI Provider Data Sharing
To generate content, we send certain data to third-party AI model providers. This is a core function of the Service and is necessary to fulfill our contract with you. Here is what we share and with whom:
What data is sent to AI providers
Your text prompts, reference images, character parameters (physical descriptions, art style, mood), voice audio samples (for voice cloning and lip-sync), and text content (for text-to-speech). We send only the data required for the specific generation you request.
AI providers and their jurisdictions
- United States — Google (Gemini), OpenAI, xAI (Grok), FAL, Replicate
- China — Kling (Kuaishou Technology), MiniMax, Qwen (Alibaba Cloud)
The specific models and providers we use may change over time as we improve the Service. We will update this policy to reflect material changes in our provider list.
Provider data retention and training
Each AI provider operates under its own privacy policy and data retention schedule. Someone Inc. cannot control or guarantee how long providers retain the data we send them, or whether providers use input data for model training or improvement. We encourage you to review the privacy policies of the providers listed above. Someone Inc. does not use your content to train any AI models. Provider training practices are governed by their respective terms and policies.
Voice cloning
When you use voice cloning, your audio samples are sent to the voice processing provider (currently MiniMax) to create a voice model. The provider retains the voice model as necessary to provide the service. When you delete a cloned voice from Someone.app, we request deletion from the provider, but we cannot guarantee the timing or completeness of provider-side deletion.
7. International Data Transfers
Your data is processed and stored in multiple jurisdictions:
- United States — primary database, payment processing, billing, email delivery, and US-based AI providers
- Global edge locations — content delivery and media storage
- China — AI content generation via Kling (Kuaishou), MiniMax, and Qwen (Alibaba). Data sent to these providers for content generation may be subject to the People's Republic of China Personal Information Protection Law (PIPL) and other Chinese data protection regulations.
If you are located in the EU/EEA, data transfers to jurisdictions without an adequacy decision from the European Commission are covered by Standard Contractual Clauses (SCCs) or the provider's own transfer mechanisms where available. By using the Service, you acknowledge and consent to the transfer of your data to these jurisdictions as described in this policy.
8. Data Retention
- Account data — retained until you delete your account
- Generated content — retained until you delete it or delete your account
- Historical public-sharing records — retained with generated content under the periods above; public sharing and Explore are not available at launch
- Voice models — retained until you delete the voice or delete your account
- API request logs — automatically deleted after 90 days
- Webhook delivery logs — automatically deleted after 30 days
- Payment records — retained per our payment processor's policies and applicable tax and legal requirements
- Referral data — retained for the lifetime of your account
- AI provider data — retention by third-party AI providers is governed by their respective policies and is outside our control
When you delete your account, all associated data — including characters, generated content, voices, audio tracks, credit history, API keys, and personal information — is permanently removed from our systems. Deletion is irreversible. Data already sent to third-party AI providers is subject to their respective retention and deletion policies.
9. Data Security
We implement appropriate technical and organizational measures to protect your personal data:
- Encryption at rest — your data is encrypted at rest in our database
- Encryption in transit — all data is encrypted in transit between your device and our servers
- Authentication — industry-standard authentication protocols with secure session management
- Access controls — database-level access controls ensure users can only access their own data
- API key security — API keys are securely hashed; only a key prefix is stored for identification
- Payment security — payments are processed by a PCI DSS compliant provider; we never store credit card information
- Rate limiting — server-side rate limiting to prevent abuse and brute-force attacks
No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
10. Data Breach Notification
In the event of a data breach that affects your personal information, we will notify affected users via email within 72 hours of becoming aware of the breach. The notification will include the nature of the breach, the categories of data affected, the measures taken to address the breach, and contact information for further inquiries. We will also notify relevant supervisory authorities and regulators as required by applicable law.
11. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Access — view your profile, characters, and generations from the Settings page. For a full data export, contact us at support@someone.app.
- Rectification — update your profile information at any time via Settings
- Deletion — permanently remove all your data via Settings > Delete Account
- Data portability — download your generated content at full resolution from the Service, or request a machine-readable export by emailing support@someone.app
- Restriction of processing — request that we restrict processing of your data by contacting support@someone.app
- Objection — object to processing based on our legitimate interests by contacting support@someone.app
- Withdraw consent — where processing is based on consent (e.g., voice cloning), you may withdraw consent at any time by deleting the associated voice or contacting us
We will respond to rights requests within 30 days. If you need assistance exercising any of these rights, contact us at support@someone.app.
12. Additional Rights for EU/EEA Residents
If you are located in the European Economic Area or the United Kingdom, you have the following additional rights under the General Data Protection Regulation (GDPR):
- Supervisory authority — you have the right to lodge a complaint with your local data protection supervisory authority
- Automated decision-making — we do not engage in automated decision-making or profiling as defined by GDPR Article 22
For data protection inquiries, please contact us at support@someone.app. We are committed to working with EU/EEA data protection authorities to resolve any complaints that cannot be resolved directly.
13. Additional Rights for California Residents
If you are a California resident, you have the following rights under the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA):
- Right to know — you may request the categories and specific pieces of personal information we have collected about you
- Right to delete — you may request deletion of your personal information
- Right to correct — you may request correction of inaccurate personal information
- Right to limit use of sensitive personal information — character demographic parameters (ethnicity, skin tone, body type) that you provide during character creation are used solely to generate AI content as you direct. We do not use this data for profiling, advertising, or any purpose other than fulfilling your generation requests.
We do not sell or share your personal information as defined by the CCPA/CPRA. We do not use your personal information for cross-context behavioral advertising.
We will not discriminate against you for exercising your CCPA/CPRA rights. To submit a request, email us at support@someone.app.
14. Children's Privacy
The Service is not intended for users under the age of 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected data from a user under 18, we will promptly delete their account and all associated data.
For clarity, the "age" parameter available during character creation refers to the fictional apparent age of an AI character. All characters created on the Service must represent adults who are 18 years of age or older. Creation of characters depicting minors is strictly prohibited.
15. Biometric Data & Voice Cloning
Our voice cloning feature involves the collection and processing of biometric identifiers (voiceprints) as defined under the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), and similar state laws. By using the voice cloning feature, you acknowledge and agree to the following:
- Collection — when you upload a voice sample, we collect a biometric identifier (voiceprint) derived from that audio
- Purpose — voiceprints are used solely to create a cloned voice model for generating speech content at your direction
- Consent — by uploading a voice sample, you consent to the collection, processing, and storage of biometric data as described in this section. If you are uploading someone else's voice, you represent that you have obtained their informed, written consent to the collection and use of their biometric data.
- Processing — voice samples and voiceprints are sent to our AI voice provider (currently MiniMax, China) for voice model creation
- Storage — voice samples and derived models are retained until you delete the cloned voice or delete your account, whichever comes first
- Destruction — upon deletion, biometric data is permanently removed from our systems. We also request deletion from the provider, though provider-side deletion timelines are subject to their own policies.
- No sale or trade — we do not sell, lease, trade, or otherwise profit from biometric data. Biometric data is never disclosed to third parties except as necessary to provide the voice cloning service.
16. Third-Party Services
We use the following third-party services to operate the platform. Your data may be shared with these services as necessary to provide the Service:
Infrastructure & Operations
- Stripe (US) — payment processing
- Cloud infrastructure providers (US, Global) — database hosting, authentication, content delivery, media storage, billing, and email delivery
AI Content Generation (United States)
- Google / Gemini — image and video generation
- OpenAI — content generation
- xAI (Grok) — image and video generation
- FAL — AI model hosting and inference
- Replicate — AI model hosting and inference
AI Content Generation (China)
- Kling / Kuaishou Technology — video generation
- MiniMax — voice cloning, text-to-speech, and video generation
- Qwen / Alibaba Cloud — text-to-speech
Each third-party service operates under its own privacy policy and terms of service. The specific AI providers we use may change over time. We encourage you to review the respective policies of these services.
17. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email to the address on your account and provide at least 30 days' notice before the changes take effect. We will also update the "Last updated" date at the top of this page. Non-material changes (such as formatting or clarifications) may be made without prior notice. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the revised policy.
18. Contact
If you have questions about this Privacy Policy, wish to exercise your data rights, or have concerns about how we handle your data, please contact us at support@someone.app.
Someone Inc., a Delaware corporation