Your data, handled minimally

This policy explains what we collect, why we collect it, and how we handle it when you use Supral.

Last updated: August 6, 2026

Who is responsible

  • Supral is responsible for the personal data processed to operate this service. You can reach the operator and submit privacy requests through the contact form below.
  • This policy applies to the public generator, private studio, account features, purchases, subscriptions, and support interactions.

Information we collect

  • Account information such as your email address, name, profile image, verification status, and authentication provider identifiers when you create a studio account.
  • Content and generation settings, including affirmations, background, frequency, voice, speed, duration, format, generated file references, and creation dates.
  • When you choose My Voice, a 5- to 15-second voice recording, its technical metadata, your consent record, and private prepared narrations associated with saved generations.
  • Purchase and subscription information such as your Stripe customer ID, subscription status, billing cycle, renewal date, monthly and purchased credit balances, reservations, credit-ledger events, refunds or disputes, and purchased track options. Supral does not store your full payment-card number.
  • Referral information such as your referral code, invitation and qualification dates, the account-to-account referral relationship, milestone progress, and earned-credit history. Referral activity shown to users is anonymised.
  • Basic technical and usage information such as request metadata, security logs, rate-limit data, download activity, and checkout events.

How and why we use it

  • To generate, save, regenerate, enhance, and deliver your personalized audio tracks.
  • To validate, normalize, encrypt, store, and use your voice sample only for the My Voice preparations you request, and to cache the resulting private narration so loops and later downloads do not require another synthesis.
  • To authenticate you through email Magic Links or Google, maintain your private studio, and attach earlier generations made with the same verified email address.
  • To process one-time purchases and Supral+ or Supral Pro subscriptions, maintain plan limits and monthly or purchased credits, prevent double charging and fraud, handle payment reversals, and provide support.
  • To attribute valid invitations, issue and redeem referral rewards, prevent duplicate or self-referrals, and maintain an auditable credit balance.
  • To operate, secure, troubleshoot, and improve the service. Depending on the activity, processing is necessary to provide the service, comply with legal obligations, or support Supral's legitimate interests in security and reliability.

Service providers

  • We do not sell your personal data.
  • MongoDB Atlas stores account, generation, subscription, and operational records.
  • Stripe processes payments, subscriptions, billing details, fraud signals, and related transaction data.
  • Cloudflare R2 stores encrypted source samples and private prepared-narration objects. The production bucket is private and restricted to the European Union jurisdiction.
  • For standard system-voice downloads, Supral sends the required affirmation text to Microsoft's online speech service to synthesize the temporary narration used in the requested audio export.
  • For each requested first My Voice preparation, Supral decrypts the source sample in application memory and sends the reference audio and required narration text to Mistral for speech synthesis. Supral currently sends reference audio per preparation and does not rely on a permanent voice ID stored at Mistral.
  • Google processes information when you choose Google OAuth. Our email providers process the information required to send sign-in links and delivery emails.
  • When configured, Google Tag Manager coordinates Supral's public tracking tags. Google Analytics 4 measures visits and navigation, while Google Ads, Meta, and TikTok can measure campaign performance and support advertising audiences.
  • Hosting, infrastructure, and support providers may process limited data needed to run the service. We may also disclose information where required by law or necessary to protect users and the service.

Storage and international transfers

  • Service providers may process data in countries other than your own. Where required, transfers are handled using the safeguards offered by those providers and applicable law.
  • Voice samples are encrypted by Supral before upload to private object storage and are decrypted only when needed for a requested synthesis or controlled cleanup. Cloudflare also encrypts R2 objects at rest and protects transfers with TLS.
  • No online service can guarantee absolute security, but we use access controls and technical safeguards designed to protect account, generation, and voice data.

Cookies and browser storage

  • Supral uses essential cookies for authentication, OAuth security, and maintaining your signed-in session. These are required for account features to work.
  • A temporary essential referral cookie remembers the first valid invitation opened in a browser for up to 30 days so the invitation can survive email or Google sign-in.
  • Private download pages may use temporary session storage to measure checkout steps, prevent duplicate events, and restore the page after payment. This information is cleared by the browser when the session ends or when the relevant flow completes.
  • When a Google Tag Manager container is configured, the public tracking layer loads when a visitor opens Supral, regardless of browser time zone. Tags configured for Google Analytics 4, Google Ads, Meta, and TikTok may read or store measurement identifiers in the browser.
  • Browser privacy controls, content blockers, and storage settings may limit or remove non-essential measurement storage.
  • Supral does not sell personal data or behavioural profiles.

Retention and track removal

  • Account and subscription records are kept while your account is active and for as long as reasonably necessary for service, accounting, fraud-prevention, dispute, and legal purposes.
  • Saved generations remain in your studio until you remove them or request account deletion. Account deletion removes saved affirmation text and associated regenerable delivery records, subject to necessary backup and legal-retention periods.
  • Your current My Voice source sample remains until you replace it, delete My Voice, or delete your account. Replacing or deleting My Voice removes the retained source object; a failed cleanup remains visible so you can retry it.
  • Deleting the source voice does not automatically delete narrations already prepared for saved tracks. Those private cached narrations remain reusable until you remove the related generation or delete your account.
  • Using Remove in My generations hides the track from your library, statistics, downloads, and upgrades. It is a soft deletion and does not immediately erase the underlying generation or legacy delivery record.
  • You may contact us to request permanent deletion where applicable. Some transaction records may still need to be retained to meet legal or accounting obligations.

Your choices and rights

  • You can use the free generator without creating an account. Creating an account is required for the private studio and subscription features.
  • Google connection is optional. You may continue to use email Magic Links instead.
  • My Voice is optional. Before saving a sample, you must confirm that you have the right to use the recording and consent to its processing for the requested synthetic narration. You can delete the retained source sample from the My Voice page.
  • You can use your browser's privacy and storage controls to limit or remove non-essential measurement storage.
  • Depending on where you live, you may request access, correction, deletion, restriction, objection, or portability of your personal data, and may lodge a complaint with your data-protection authority.

Children and policy changes

  • Supral is not directed to children who cannot legally consent to use of the service in their country.
  • We may update this policy as the service changes. Material updates will be communicated through the site or studio when appropriate.

Contact

To exercise a privacy right, request permanent deletion, or ask a question, use the contact form. We may need to verify your identity before acting on a request.