Scope of this document

This is the only privacy policy of Voice Scan Lab, S.L. One data controller, one text, for both sites:

• the informational website voicescanlab.com; and
• the platform app.voicescanlab.com.

Before this version, the public WordPress site had its own, shorter text (portal_wordpress/seed/pages/privacidad.md), with the contact email still pending. That text is replaced by this one, not corrected separately — see EVALUACION_TEXTOS_WORDPRESS.md and PLAN_ARMONIZACION.md. If you ever find a different privacy text on the WordPress site, it is an outdated copy.

Short informational layer

Before the full version, the summary that should be readable in 30 seconds:

• Who processes your data: Voice Scan Lab, S.L. (Tax ID B26702761, Seville, Spain).
• For what: creating your account, letting you use the platform, analysing your sung voice and giving you an educational report on your vocal technique, and — only if you expressly and separately authorise it — keeping your recording anonymously for research for 2 years.
• The report is generated by an artificial intelligence system. We always tell you this visibly, as required by EU AI law.
• Your voice recording is handled with the care of a potential biometric data point: in this service it is not used to identify or authenticate you, only to measure your vocal technique — explained in detail in point 4.
• We do not sell or share your data with third parties for commercial purposes. Only the companies that provide us with services (hosting and, in the future, the payment gateway) can access it, under a data processing agreement.
• You can exercise your rights (access, rectification, erasure, objection, restriction, portability, withdrawing consent) by writing to legal@voicescanlab.com, and complain to the Spanish Data Protection Agency (aepd.es) if you feel we have not handled your request properly.

Full layer

1. Data controller

• Controller: Voice Scan Lab, S.L.
• Tax ID (CIF): B26702761
• Address: Calle Cueva de Menga 3, Portal 7, Local A, 41020 Seville (Spain)
• Privacy / rights contact: legal@voicescanlab.com
• Data Protection Officer: [PENDING — business decision not yet taken, see INFORME_LEGAL.md §1. Until one is formally appointed, legal@voicescanlab.com is the single reference contact for privacy, following the same pattern used by organisations that do have a DPO (one reference mailbox, with or without the formal status) — if a DPO is appointed later, this line will name them with their own contact]

2. What data we process, and about whom

Depending on the type of user:

Any visitor to the public website: basic browsing data and IP address, plus whatever you voluntarily give us in the contact form (name, email, message).

Anonymous guest (/gratis landing page): we do not ask for your email or name. An anonymous contact is created with a sequential internal code, your recording and the analysis result. We do not know who you are unless you later create an account and claim that analysis as yours.

Student with an account: first and last name, email, password (encrypted), history of your analyses and reports, platform usage data.

Sung voice recording, in all cases: the audio you record or upload, and the acoustic parameters our engine extracts from it (pitch, stability, breathing, resonance, and other technical indicators of vocal mechanics).

Teacher / school: in addition to your own account data, the data of the students you manage (registrations, sessions, recordings and analyses), for which you act as the controller of that teaching relationship — see point 8.

Technical data, in all cases: IP address, session identifier, language, and the technical cookies described in COOKIE_POLICY_EN.md.

3. What we use your data for and on what legal basis — purpose by purpose

Each purpose has its own legal basis. We do not ask for a single generic consent for everything.

Purpose	Legal basis	Notes
Creating and managing your account, letting you use the platform	Performance of the service contract (GDPR art. 6.1.b)	Necessary for the service you request; does not depend on a consent checkbox
Analysing your recording and generating your vocal technique report	Performance of the contract — it is the main service you request	See point 4 on the nature of voice as data
Keeping your recording anonymously for 2 years for research and model improvement	Explicit, informed and separate consent (art. 6.1.a, and 9.2.a if art. 9 applies)	Specific checkbox, see RESEARCH_CONSENT_EN.md. Revocable at any time, without retroactive effect on what has already been done
Receiving news and updates by email	Consent (art. 6.1.a)	Optional checkbox, separate from the above
Answering your query from the contact form	Consent, or legitimate interest in handling your request (art. 6.1.a or 6.1.f)	Used only for that, never repurposed
Your teacher managing your sessions and viewing your analyses (if you have an assigned teacher)	Performance of the teaching relationship between you and your teacher/school, in which the platform acts as a technology provider	See point 8
A university blind-panel evaluator assessing your analysis (only if you take part in blind trials)	Specific research consent, on data already de-linked from your identity	See point 8
Security, fraud prevention and compliance with legal obligations	Legitimate interest / legal obligation (art. 6.1.c and 6.1.f)	For example, the GDPR event log in point 10

4. Your voice recording: why we handle it with special care

Voice is always personal data: it identifies, or can come to identify, a person. In addition, the General Data Protection Regulation includes among special category data (art. 9) "biometric data for the purpose of uniquely identifying a natural person". Under the settled criteria on this question (see sources in INFORME_LEGAL.md), voice is only considered biometric data in that strict sense when it is used to identify or authenticate the person — for example, a "voice login" system.

VoiceScan does not use your voice to identify or authenticate you: it uses it to measure acoustic parameters of your singing technique (pitch, breathing, resonance, etc.) and generate educational recommendations. We never compare your recording against a reference template of your identity, or against anyone else's: there is no "is this voice So-and-so's?" step anywhere in the process. For that reason, our working position is that, in the specific use we make of it, it is not biometric data within the meaning of GDPR art. 9 — not even under the stricter criteria the Spanish Data Protection Agency (AEPD) now applies.

This is a reasoned interpretation, not an absolute certainty, and we say so to our own lawyer in INFORME_LEGAL.md too. We are aware that the AEPD tightened its criteria on biometrics in its November 2023 guide (designed for access and attendance control): since then it treats both biometric identification and biometric authentication as special category data. VoiceScan does neither — it does not identify, does not authenticate, does not verify — so we understand it falls outside even that stricter criterion. While this is confirmed by a lawyer, we handle your recording with the same care as if it were special category data: explicit consent for retention for research purposes, minimisation (we delete the raw audio unless you authorise its retention), and we never use it to recognise you or verify your identity against another system.

The report also describes aspects of vocal mechanics (effort, tension, breathing management) that may sound close to health data. They are not: we do not assess your state of health or make a clinical diagnosis, we only describe how you use your vocal instrument from a technical and educational point of view. Even so, we write the report avoiding clinical terminology ("symptom", "pathology") that could suggest that reading.

5. Your report is generated by an artificial intelligence system

Your report is generated by an acoustic analysis engine and a machine learning model (not a person, unless your teacher reviews it before showing it to you). We always tell you this clearly and visibly in the report itself, as required by article 50 of Regulation (EU) 2024/1689 on Artificial Intelligence, in force since 2 August 2026 for this transparency obligation. Voice Scan Lab, S.L. acts here as the "deployer" of the AI system (not as its manufacturer), and it is precisely that status that requires the visible notice to the end user — it is our obligation, not the model builder's.

Pending correction found during this work: as of this version, the report the user sees does not yet include that visible notice. This is an obligation already in force, not a desirable improvement — see INFORME_LEGAL.md §6.

On automated decisions (GDPR art. 22): if no one has reviewed your report before you see it (for example, in the anonymous guest flow, or if you have no assigned teacher), the result you receive comes entirely from automated processing. Although we understand that an educational report does not, by itself, produce "legal effects" or "similarly significant effects" in the strict sense of art. 22, we prefer not to simply assume this and to offer you, in any case:

• information about the logic applied: what acoustic parameters are measured and what kind of model interprets them (at a high level, without revealing the engine's technical secrets);
• the option to request that a person (your teacher, or our team if you have no teacher) review the result if you disagree with it;
• the reminder that the report is an educational support tool, not a final grade.

6. Who we give access to your data

We do not sell your data. Only the following can access it:

• Hetzner (Germany, European Union), as data processor for hosting the platform. Since it is within the EU, there is no international transfer.
• Stripe (United States), once payment for full analyses is active — it is not active today. Stripe is self-certified under the EU-U.S. Data Privacy Framework, so the transfer of your payment data, once it exists, is covered by the European Commission's adequacy decision of July 2023.
• Our transactional email provider [PENDING — to be identified and named here], to send you verification emails and notifications.
• If you take part in the scientific research and it comes to be formalised with a university, that institution will only access data that is already anonymised or pseudonymised depending on the model defined — see RESEARCH_CONSENT_EN.md §3. There is no signed agreement today, so nothing is shared with any university.
• Your teacher or school, if they registered you as a student or if you register under their group — see point 8.
• A blind-panel evaluator, only if you voluntarily take part in validation trials, and always on data already de-linked from your identity.

We never share your data with third parties for advertising or commercial purposes unrelated to the service.

Analytics on the public website: on voicescanlab.com we measure aggregate visits with Umami, an analytics tool we host ourselves (it is not a third party: it runs on our own infrastructure, analytics.voicescanlab.com), does not set cookies and does not generate an identifier that follows you across sites. See the detail in COOKIE_POLICY_EN.md.

7. How long we keep your data

• Account data: for as long as you keep it active, and until you request its deletion.
• Audio recording (the raw file): if you do not authorise its retention for research purposes, it is deleted [PENDING TECHNICAL CONFIRMATION of the exact timeframe: "after the report is generated" is the product intention, but the technical team needs to confirm whether deletion is immediate, batch-processed overnight, or within what maximum margin, so that we can promise a concrete, verifiable timeframe].
• Audio recording with your research consent: kept anonymously for 2 years from the recording date, then automatically deleted.
• Report and derived acoustic parameters (the score, the level, the recommendations): kept linked to your account for as long as the account exists, because they form your progress history — this is part of the service you contracted. If you delete your account, they are deleted too.
• Contact form: 12 months from the last communication.
• Consent events and rights exercised (see point 10): kept beyond the user's account closure, because they are proof that we comply with the GDPR — this is our own obligation, not a detriment to you.

8. If you have a teacher, or if your teacher registers you

When a teacher or school registers you as a student, manages your sessions or logs your recordings, that teaching relationship remains, in essence, the same one you already have outside the platform: the platform is the tool that supports it, not the one who decides what happens to you as a student. For that reason:

• Your teacher is responsible for having a legitimate basis to register you (for example, the lesson arrangement you already have) and, if you are under 14, for holding the authorisation of your parent or guardian — see point 9.
• Voice Scan Lab, S.L. processes that data as your teacher's technology provider for that part of the relationship, and as its own controller for the purposes that are its own and not your teacher's: anonymous retention for research (which still requires your own separate consent, never your teacher's on your behalf) and service improvement.

This is not yet formalised with a data processing agreement between Voice Scan Lab and each teacher or school. This is one of the pending tasks flagged in INFORME_LEGAL.md §11.

9. Minors

Under article 7 of Spanish Organic Law 3/2018 (LOPDGDD), in Spain a minor may give their own consent to the processing of their data from the age of 14. Below that age, the consent of whoever holds parental authority or guardianship is required.

Many singing students are minors. The platform does not yet have any mechanism to verify a student's age or to collect parental consent when a minor under 14 registers directly or is registered by their teacher. This is an open issue flagged as urgent in INFORME_LEGAL.md §4: until it is resolved, every teacher who registers a student under 14 must personally hold the authorisation of the student's parent or guardian, and communicate this to the student and their family through their own usual channel (outside the platform).

10. Your rights, and how we log them

You can exercise your rights at any time to:

• Access: know what data of yours we process.
• Rectification: correct inaccurate data.
• Erasure: ask us to delete your data.
• Objection: object to a specific processing activity.
• Restriction: ask us to temporarily stop processing your data without deleting it.
• Portability: receive your data in a format you can take to another service.
• Withdraw your consent at any time (for research or for informational communications), without affecting what was already done before you withdrew it.
• Request human intervention on an automatically generated report, and challenge it, when you disagree with the result (see point 5).

You can exercise them by writing to legal@voicescanlab.com. Every request is logged internally with its type, date, IP address and status, so that we can demonstrate that we handled it.

If you feel we have not handled your request properly, you have the right to complain to the Spanish Data Protection Agency (Calle Jorge Juan, 6, 28001 Madrid — electronic office at aepd.es).

11. International transfers

Today there is no active international data transfer: our hosting is within the European Union (Hetzner, Germany). Once payment via Stripe is activated, there will be a transfer of your payment data to the United States, covered by the EU-U.S. Data Privacy Framework — this policy will be updated then with the corresponding detail.

12. Security measures

We apply technical and organisational measures proportionate to the risk: encrypted passwords, role-based access control (student, teacher, evaluator, administrator), encrypted connection (HTTPS) and logging of events related to your rights. Full technical detail is not published for security reasons, but is documented internally.

13. Changes to this policy

Any significant change will be announced with reasonable notice and, if it affects a purpose for which you gave consent, we will ask you again. The platform stores the version of the text you accepted at each point in time.

---

Annex — specific collection clauses per form

Short texts to insert alongside each form, in addition to (not instead of) this full policy, which they must link to.

A. Student registration with account

When you create your account we process your name, email and password to give you access to the platform, and your voice recordings to generate your vocal technique reports. You can additionally authorise, separately and voluntarily, that we keep your recording anonymously for 2 years for research purposes. More information in our Privacy Policy.

B. Anonymous landing page (/gratis)

We do not ask you for any identifying data to try VoiceScan. Your recording and the analysis result are stored linked to an anonymous code, not to your identity. If you create an account later, you will be able to claim this analysis as yours. You can voluntarily authorise us to keep your recording anonymously for 2 years for research purposes. More information in our Privacy Policy.

Internal note (updated in v1.1): in v1.0 this checkbox did not yet exist in records_anonimous.twig / the /gratis flow. This work has confirmed that it is already implemented (legal_consents.twig, mode='self', issue #173): the text of this clause now matches what the user actually sees on screen. See DATOS_LEGALES_VOICESCANLAB.md §5.

C. Contact form (public website)

The data you send us in this form (name, email, message) is used only to answer your query, and is kept for 12 months from our last communication. More information in our Privacy Policy.

D. Student registration by the teacher (import)

By registering your student, you confirm that you hold their consent (or, if they are under 14, their parent's or legal guardian's consent) for their data and recordings to be processed in VoiceScan for educational purposes. Voice Scan Lab, S.L. acts as the technology provider for your teaching relationship with your student. More information in our Privacy Policy.

Internal note (updated in v1.1): this work has confirmed that the student registration/import form already shows this declaration (legal_consents.twig, mode='teacher_declaration', issue #173, present in students_edit.twig, students_edit_alternative.twig and in the quick registration inside records_anonimous.twig).

---

Change log

• v1.1 (2026-09-16): contact email (legal@voicescanlab.com) filled in everywhere it was pending; Scope section; nuance on the AEPD's November 2023 biometric criteria (§4); clarification that Voice Scan Lab acts as the AI "deployer" for the purposes of art. 50 (§5), and that the visible notice is not yet implemented; mention of the site's own analytics (Umami) (§6); updated internal notes in annexes A/D: the checkboxes pending implementation in v1.0 now exist in the code (issue

  173); English version (PRIVACY_POLICY_EN.md).

• v1.0 (2026-09-16): initial drafting.

---

Language note: the Spanish version of this document must be translated into the platform's 10 active languages (es, en, de, fr, it, pt, ca, eu, gl, pl), like the rest of the product content, because it is part of the sign-up flow the user accepts in their own language. This English version is the faithful translation used for the en locale.