At a glance
- We do not use advertising or tracking cookies, third-party analytics or social-media pixels.
- Audio you upload to SynVoi Web is stored encrypted for 30 days so the analysis result can be reviewed, then deleted automatically. Only authorised Spiron staff can access it; it is never used for model training.
- In the SynVoi mobile app, audio is sent to the server only for analysis and deleted from the server right after it; it is not listened to and not used for model training. Your analysis history, including a playback copy of the audio, stays only on your phone.
- We do not sell your personal data or share it with third parties for marketing.
- SynVoi is deployed on the customer's own infrastructure; in those deployments audio and results never leave the customer's network.
- SynVoi Web and the server of the SynVoi mobile app run in Germany (Amazon Web Services, Frankfurt). Every case in which data is processed outside Türkiye is listed in Section 7.
1. Scope
This Privacy Policy explains how Spiron Teknoloji A.Ş. (“Spiron”, “we”) processes your personal data when you use the spiron.io website, the access request form on the site, the SynVoi web app offered at spiron.io (“SynVoi Web”) and the SynVoi mobile app (the “App”). Further details are also set out in our KVKK Disclosure Text; the two documents should be read together.
The App and SynVoi Web are separate services: accounts, analysis time and records are kept in separate databases, and an account in one is not valid in the other. Processing specific to the App is described in Section 3.6.
Deployments of our products for customers are outside the scope of this policy; data processed in those deployments is governed by our agreement with the customer. SynVoi is deployed on the customer's own infrastructure (on-premise): the audio, analysis results and logs it processes stay within the customer's network and are not transferred to Spiron; the customer is the data controller for that data.
2. Data Controller
For the purposes of the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and, where applicable, the EU General Data Protection Regulation (“GDPR”), the data controller is:
- Legal name: Spiron Teknoloji Sanayi Ticaret Anonim Şirketi
- Address: Reşitpaşa Mah. Katar Cad. Arı Teknokent 2 Binası B Blok No: 4/2 İç Kapı No: 5, Sarıyer / İstanbul, Türkiye
- Responsible person: Adil Karaküçük
- Tax office and number: Sarıyer Tax Office · 781 117 1793
- Trade registry no.: 1157818
- Central Registration System (MERSİS) No.: 0781117179300001
- Phone: +90 531 380 14 15
- Email: info@spiron.io
3. Personal Data We Process
3.1 When you visit the website
- Connection and security data: IP address, browser and operating-system information, the page requested and the time of access. This data is processed by our hosting provider's servers and content delivery network (CDN) to deliver the site to you and to protect it.
- Preferences: your language and theme choice and whether you have dismissed the information banner. These are kept only in your browser's local storage and are not sent to us.
3.2 When you submit the access request form
- First name, last name, email address, company name and country.
- A hashed value derived from your IP address and the times of your requests, used to prevent abuse of the form.
3.3 When you sign in to SynVoi Web
- Account: your email address (with Google sign-in, the verified email address of your Google account), the full name and the company (organisation) in your profile, account status (pending, approved or blocked), sign-in method, registration, approval, profile and last sign-in times, your analysis allowance and the number of analyses used, your requests for additional analyses (together with your optional short note and the outcome); with Google sign-in, also whether the account is an organisational (Google Workspace) account.
- Sign-in security: your authenticator-app secret (if you use two-step verification; stored encrypted); recovery codes, session tokens and one-time sign-in codes sent by email (stored only as cryptographic hashes); the number of failed attempts and any temporary lock-out time.
- Session records: session start and last-activity times and IP address.
- Security log: sign-in, sign-out, failed code attempts, profile updates, requests for additional analyses and their outcome, account deletion requests, approval and blocking actions. Your email address is masked in these records (e.g. k***@example.com); the IP address and time are recorded.
- Consent record: the time consent was given and the version of the text you accepted.
3.4 When you analyse audio in SynVoi Web
- Audio file and file name: processed for the analysis, then stored encrypted on our server for 30 days so the analysis result can be reviewed, and deleted automatically at the end of that period. Only authorised Spiron staff can listen to it, and every access is logged. It is never used for model training and never shared with third parties.
- Analysis output: synthetic-speech score, verdict, model version used, audio quality class (e.g. narrowband), audio duration and processing time. This output is written to the server's operational log together with your masked email address and IP address; the log contains no audio.
Your voice is not processed as biometric data. A voice constitutes biometric (special category) personal data only when it is processed to verify or identify a person. The purpose of SynVoi Web and the App is not to identify you but to measure whether the audio was artificially generated; no identity matching, voiceprint extraction or speaker recognition is performed.
Only send recordings to SynVoi Web or the App that you are entitled to upload or share. If you analyse a recording containing another person's voice, you are responsible for having the necessary legal basis to do so. Please do not upload recordings containing special category data such as health information.
3.5 When you correspond with us
- Your name, email address and the content of the correspondence.
3.6 When you use the SynVoi mobile app
- Account: your email address (with Google sign-in, the verified email address of your Google account), sign-in method, account status, registration and last sign-in times; with Google sign-in, also whether the account is an organisational (Google Workspace) account. The App does not ask for your name or profile details when you open an account; we do not store the name or profile photo that Google passes on.
- Analysis time: the total time assigned to your account and the time you have used (in seconds).
- Purchases: for each purchase made through Google Play, the product, the time added to your account, the Google Play order number, a cryptographic hash of the purchase token and the time of purchase. Your payment details (such as card details) are processed by Google and never reach us.
- Company details (only if you want to buy a business package): company name and country; tax details (in Türkiye, tax office and tax identification number, or the Turkish national identity number for sole proprietorships; in other countries, a tax or VAT number); the name and phone number of the authorised person; and the times the details were saved and updated.
- Sign-in security and device sessions: one-time sign-in codes sent by email and device session tokens (stored only as cryptographic hashes); the number of failed attempts; for each device session, the device's brand and model name (e.g. “Samsung SM-A546B”), the session's start, last activity and expiry times and the IP address.
- Security log: sign-in, sign-out, sign-in codes sent and failed attempts, purchases, saving of company details, time added to your account by an administrator, and account deletion. Your email address is masked in these records; the IP address and time are recorded.
- Consent record: the time consent was given and the version of the text you accepted.
- Audio: the audio file you choose or share to the App is sent to our server over an encrypted connection, processed in memory only for the analysis and deleted as soon as the analysis ends. In the App, audio is not stored on the server, not listened to and not used for model training; the 30-day retention in SynVoi Web does not apply to the App.
- Analysis output: the output listed in Section 3.4 (synthetic-speech score, verdict, model version, audio quality class, audio duration and processing time) is written to the server's operational log together with your masked email address and IP address. The log contains no audio.
- Data that stays on your phone: your analysis history (up to 200 analyses; for each, the result, file name, time and a copy of the audio so you can listen again), a session token encrypted with Android Keystore and the last known account details. This data is not sent to us and is excluded from Android cloud backup and device-to-device transfer. You can delete the history in the App; it is also deleted when you uninstall the App.
- Permissions: the App does not request microphone, location, contacts, photo or notification permissions. It accesses only the audio you choose or share. The App contains no advertising and uses no third-party analytics or tracking software.
4. Purposes and Legal Bases
| Purpose | Data | Legal basis |
|---|---|---|
| Delivering the website and keeping it running and secure | Connection and security data | KVKK Art. 5/2-f (legitimate interests) · GDPR Art. 6(1)(f) |
| Assessing and responding to access requests | Form data, correspondence | KVKK Art. 5/2-c (entering into a contract) and 5/2-f · GDPR Art. 6(1)(b) and 6(1)(f) |
| Opening and managing your SynVoi Web account; running sign-in and two-step verification; assessing requests for additional analyses and contacting you about your account | Account (including full name and company), sign-in security and session data, requests for additional analyses | KVKK Art. 5/2-c · GDPR Art. 6(1)(b) |
| Opening and managing your SynVoi App account; handling sign-in; keeping track of your analysis time; administrators adding time to your account | App account, sign-in security and device session data, analysis time | KVKK Art. 5/2-c · GDPR Art. 6(1)(b) |
| Verifying in-app purchases, adding the time to your account and preventing the same purchase from being processed twice | Purchase records | KVKK Art. 5/2-c and 5/2-f · GDPR Art. 6(1)(b) and 6(1)(f) |
| Selling business packages: recognising the company account and contacting the authorised person when necessary | Company details | KVKK Art. 5/2-c · GDPR Art. 6(1)(b) |
| Analysing the audio you submit in SynVoi Web or the App and showing you the result | Audio, analysis output | KVKK Art. 5/1 (explicit consent) · GDPR Art. 6(1)(a) |
| Reviewing analysis results: listening to the audio to assess whether the model works correctly (not for model training) | Audio and file name (30 days, encrypted), analysis output | KVKK Art. 5/1 (explicit consent) · GDPR Art. 6(1)(a) |
| Preventing abuse: rate limits, analysis allowance, detection of unauthorised access | IP address, security log, operational log | KVKK Art. 5/2-f · GDPR Art. 6(1)(f) |
| Complying with legal obligations | Relevant data | KVKK Art. 5/2-ç · GDPR Art. 6(1)(c) |
| Establishing, exercising or defending legal claims | Relevant records | KVKK Art. 5/2-e · GDPR Art. 6(1)(f) |
You may withdraw the explicit consent you give for audio analysis in SynVoi Web at any time by writing to info@spiron.io; withdrawal does not affect the lawfulness of processing carried out before it; when you withdraw your consent, your stored audio is deleted as well. You can also withdraw the explicit consent you gave in the App by writing to the same address or by deleting your account; since audio is not stored in the App, withdrawal stops further analyses. We do not use your data for automated decisions or profiling that produce legal effects concerning you.
5. Cookies and Local Storage
We do not use cookies for advertising, tracking or analytics. The items below are used only to make the site and SynVoi Web work and to remember your preferences:
| Name | Type | Purpose | Duration |
|---|---|---|---|
spiron-lang | Local storage | Your language preference | Until you clear it |
spiron-theme | Local storage | Your theme preference | Until you clear it |
spiron-consent | Local storage | That you dismissed the information banner | Until you clear it |
spiron-demo-surum | Local storage (SynVoi Web) | The model version you selected | Until you clear it |
spv_g | Session storage (SynVoi Web) | Security values during “Continue with Google” | Removed on return from sign-in or when the tab is closed |
spv_session | Cookie (SynVoi Web; HttpOnly, Secure) | Recognises your session | Up to 8 hours; deleted on sign-out |
spv_session_csrf | Cookie (SynVoi Web; Secure) | Protection against cross-site request forgery (CSRF) | Up to 8 hours; deleted on sign-out |
When our hosting provider's security layer detects unusual traffic, it may ask your browser to complete a brief automatic check; this check may use the provider's technical cookies.
If you choose “Continue with Google”, you are redirected to Google's sign-in page; cookies on that page are governed by Google's own policy. Unless you choose this option, no Google sign-in or tracking service is contacted. Fonts and interface components are self-hosted; no requests are made to external font or library services.
We do not currently use web analytics. If we start using a cookieless analytics tool in the future, we will update this policy beforehand.
The SynVoi mobile app does not use cookies. Only the data listed in Section 3.6 is kept on your phone.
6. Sharing and Service Providers
We do not sell your personal data or share it with third parties for marketing. To provide the service we work with the providers below, which process data only on our behalf and to the extent the service requires (data processors):
| Provider | Service | Data processed | Location |
|---|---|---|---|
| Hostinger | Website hosting, content delivery network (CDN), forwarding the access request form by email | Connection and security data, form data | Hostinger data centres outside Türkiye; CDN edge servers in regions close to the visitor |
| Amazon Web Services | Infrastructure for SynVoi Web and the SynVoi mobile app: server, load balancer, firewall | Connection data; SynVoi Web and App account, session, purchase, company, security and analysis data; in SynVoi Web, audio and file name (30 days, encrypted); in the App, audio only for the duration of the analysis | Germany (Frankfurt) |
| Microsoft 365 | Corporate email; sending SynVoi Web and App sign-in code emails | Form emails, correspondence, sign-in code emails (your email address and the code) | Microsoft data centres outside Türkiye |
If you choose “Continue with Google”, authentication is performed by Google; for the information shared in that step Google is a separate data controller subject to its own privacy policy.
In the App, “Continue with Google” uses the Google account picker on your phone. From the identity information Google passes on, we use only your verified email address and whether the account is an organisational account.
The SynVoi mobile app is distributed through Google Play, and in-app purchases are made with Google Play Billing. Google collects the payment and processes your payment details; for these operations Google is a separate controller subject to its own privacy policy. To match a purchase with your account, we pass Google a hashed value derived from your account that does not reveal your identity, and we receive from Google the purchase's order number, product and verification data. The Google Play Billing library may also send technical information from your phone to Google in order to carry out the purchase.
Audio recordings are used only for the analysis and for reviewing its result, and are never shared with any third party; they are processed only on our server on Amazon Web Services, by us. In the App, audio is processed on the server only for the duration of the analysis and is not stored there. Your data may be disclosed to competent public authorities and courts only where required by law and to the extent requested.
7. International Data Transfers
Spiron is established in Türkiye. In the cases below your personal data is processed outside Türkiye; these transfers fall under Article 9 of the KVKK:
- SynVoi Web and the SynVoi mobile app: Germany (Amazon Web Services, Frankfurt region).
- Website hosting and CDN: Hostinger data centres outside Türkiye; CDN edge servers may be located in a region close to you.
- Corporate email: Microsoft data centres outside Türkiye.
- Google sign-in: Google's global infrastructure (only if you choose this option).
- In-app purchases: Google Play's global infrastructure (only if you make a purchase).
Our service providers process this data under the data-protection terms of their service agreements with us and only to the extent the service requires. To obtain information about the safeguards we rely on for international transfers, write to info@spiron.io.
If you use SynVoi Web or the App from the European Economic Area (EEA): your SynVoi Web and App data is hosted within the EEA (Germany). Within Spiron, only our authorised personnel, located in Türkiye, access this data, to the extent necessary to operate the service. The European Commission has not adopted an adequacy decision for Türkiye; this access is necessary to provide the service you requested.
If you use our services from outside Türkiye and the EEA: your data is processed on our servers in Germany, and our authorised personnel in Türkiye access it to the extent necessary to operate the service.
8. Retention Periods
We keep your data only for as long as the purpose of processing requires; when that period ends it is deleted, destroyed or anonymised. Where the law requires a longer period (for example, commercial correspondence under the Turkish Commercial Code), that period applies.
| Data | Retention |
|---|---|
| Audio uploaded to SynVoi Web and its file name | 30 days (encrypted), then deleted automatically. Deleted earlier if your account is deleted or you withdraw your explicit consent; you can also ask us to delete a single recording by writing to info@spiron.io. |
| Audio analysed in the App | Not stored on the server: processed in memory only for the duration of the analysis and deleted as soon as it ends. The playback copy exists only in the history on your phone. |
| Analysis output (SynVoi Web and App; in the operational log; no audio) | 12 months, then deleted automatically |
| SynVoi Web account (including your profile and requests for additional analyses) | Until you request deletion or the SynVoi Web service ends; deleted within 30 days of your deletion request. You can request deletion from the Profile section in SynVoi Web or by writing to info@spiron.io. |
| App account, analysis time and company details | Until you delete your account or the service ends. Deleted immediately in the App via Account → “Hesabımı silmek istiyorum” (Delete my account). You can also request deletion by writing to info@spiron.io, in which case it is deleted within 30 days at the latest. Details: spiron.io/legal/delete-account |
| Purchase records | For as long as your account exists. When your account is deleted, the link to the account and the order number are deleted immediately. The remaining record, which is not linked to your identity (purchase token hash, product, time added, time), is kept for 12 months to prevent the same purchase from being processed twice. |
| One-time sign-in code (SynVoi Web and App; hash only) | Valid for 10 minutes and single-use; expired codes are deleted automatically |
| Session cookies and session records | Cookies are valid for up to 8 hours and deleted on sign-out; expired session records are deleted automatically |
| Device session records (device model, IP address, times) | A session expires after 30 days without use and in any case after 180 days at the latest. Records of sessions you signed out of are deleted automatically after 30 days, and those of expired sessions after 1 day; all are deleted immediately when your account is deleted. |
| Analysis history on your phone | Until you delete it or uninstall the App; up to 200 analyses are kept and older ones are deleted |
| Security log (SynVoi Web and App; masked email, IP, time) | 12 months, then deleted automatically |
| Rate-limit counters (SynVoi Web and App) | Deleted automatically after the counter window ends |
| Form rate-limit record (IP hash, request times) | Used only for a one-hour rate limit; times older than one hour are deleted when a new request arrives from the same address |
| Access request form emails | 2 years from the resolution of the request |
| Web server, load balancer and firewall access logs | For the providers' retention periods, up to 12 months |
9. Data Security
- The site and SynVoi Web are served only over encrypted connections (HTTPS/TLS); HTTP requests are redirected to HTTPS.
- The SynVoi mobile app communicates with the server only over an encrypted connection (HTTPS/TLS); unencrypted connections are not permitted.
- The SynVoi Web and App server has no external IP address; it is reachable only through a load balancer and a web application firewall.
- SynVoi Web uses no passwords: you sign in with a one-time code sent to your email address or with your Google account. Two-step verification with an authenticator app is mandatory for administrator accounts; for other accounts, depending on SynVoi Web's registration mode, it is either mandatory or can be turned on optionally from your profile.
- The App uses no passwords: you sign in with your Google account or a one-time code sent to your email. The session token on your phone is encrypted with Android Keystore and excluded from backups.
- Authenticator-app secrets are stored encrypted; session tokens and recovery codes are stored only as cryptographic hashes.
- Accounts are temporarily locked after failed attempts; per-IP rate limits and a per-user analysis allowance apply.
- In-app purchases are processed after Google Play's digital signature has been verified on the server.
- Stored audio is encrypted on the server with AES-256; only authorised administrators can listen to or download it, every access is logged, and the audio is deleted automatically after 30 days.
- Administrative access is restricted to authorised personnel and is logged.
- In the event of a data breach, we notify the Turkish Personal Data Protection Board and the affected individuals within the periods required by law.
10. Automated Analysis
The result in SynVoi Web and the App is the automated output of a machine-learning model and is an estimate of the likelihood that the uploaded audio was artificially generated. The model can make mistakes; the result is not a definitive verdict on its own and is for information only. It is not used to make any decision that produces legal effects concerning you or similarly significantly affects you. If you believe an outcome resulting solely from automated analysis is to your detriment, you may object.
11. Your Rights
Under Article 11 of the KVKK you have the right to: learn whether your personal data is processed; request information if it is; learn the purpose of processing and whether data is used in line with that purpose; know the third parties to whom data is transferred in Türkiye or abroad; request rectification of incomplete or inaccurate data; request erasure or destruction under Article 7 of the KVKK; request that these actions be notified to third parties to whom data has been transferred; object to an outcome to your detriment arising solely from automated analysis; and claim compensation for damage caused by unlawful processing.
If the GDPR applies to you, you also have the right of access, rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interests and to withdraw your consent.
If the data protection law of your country gives you additional rights, those rights are preserved; you can submit your requests through the channels in Section 12.
12. How to Exercise Your Rights
You can send your request, together with information sufficient for us to verify your identity, in the following ways: to info@spiron.io from the email address registered in our system or using a secure electronic signature or mobile signature; or by a signed letter to the address in Section 2. Requests are resolved free of charge within 30 days at the latest, depending on their nature; if the action involves an additional cost, the fee set by the Turkish Personal Data Protection Board may be charged.
If you are not satisfied with our response, you may lodge a complaint with the Turkish Personal Data Protection Board (kvkk.gov.tr). If you are in the EEA, you may also contact the data protection authority of your country.
13. Children's Data
Our website, SynVoi Web and the SynVoi mobile app are not directed at anyone under 18. We do not knowingly collect personal data from children; if we become aware of such data, we delete it.
14. Changes to This Policy
We may update this policy from time to time. The current version and its date appear at the top of this page; we announce material changes on our website.
15. Contact
Spiron Teknoloji A.Ş.
Reşitpaşa Mah. Katar Cad. Arı Teknokent 2 Binası B Blok No: 4/2 İç Kapı No: 5, Sarıyer / İstanbul, Türkiye
Email: info@spiron.io
In the event of any inconsistency between the Turkish and English versions of this policy, the Turkish version prevails.