Joyful Voices

Privacy Policy

Last updated: 12 August 2026

Joyful Voices (“we”, “us”, “our”) operates private vocal coaching (Dubai, UAE and online) and the Joyful Voices Studio app (“the App”). This Privacy Policy explains how we collect, use, store, and protect personal data when you use our website (joyfulvoices.co), book lessons, or use the App.

We aim to comply with the UK GDPR, the Data Protection Act 2018, the EU GDPR where applicable, UAE Federal Decree-Law No. 45 of 2021 (PDPL) principles for UAE users, and COPPA age restrictions for US users. This document is a product-accurate interim draft — not a substitute for counsel review.

1. Data controller and contact

Controller: Joyful Voices (trading name of Eleanor’s vocal coaching practice / Joyful Voices Studio). Registered company details and UK establishment status will be updated here once incorporation is complete.

2. What we collect

2.1 Account and identity

  • Name and email via Google OAuth (we do not receive your Google password)
  • Optional Google profile picture URL
  • Age / date-of-birth confirmation used for the 13+ age gate
  • Optional profile fields (e.g. voice type, vocal range, skill level)

2.2 Voice analysis and practice metrics (App)

  • During practice, the microphone captures audio on your device with your consent. We analyse pitch (Hz), vibrato, timbre / spectral features, dynamics, phrasing, and vocal-strain indicators.
  • Raw audio is not uploaded or stored on our servers for standard pitch practice. Audio is processed in real time (or briefly held in device memory for on-device features) and discarded.
  • We store numerical session metrics and scores (accuracy, stability, strain summaries, progress) in our database so you can track growth.

Under UK GDPR, extracting physiological voice characteristics (pitch, vibrato, timbre) may be treated as special-category / biometric-style data. We obtain separate, withdrawable consent before voice analysis, in addition to account terms.

2.3 On-device machine learning (optional / progressive)

  • Lyric transcription (native): Whisper Tiny (and optional VAD) may run entirely on your device to improve lyric alignment after a session. Processing stays on-device; we do not send audio to a cloud ASR provider for this feature.
  • Eleanor’s Insight (optional): If you enable Enhanced AI Coaching, a small language model downloads to your device. Coaching text is generated on-device from session metrics — audio is not sent to a server for this feature. You can disable it in Settings.
  • On web, equivalent progressive features may use browser APIs when available, still without our cloud LLM pipeline.

2.4 Health and wellness (App)

  • Self-reported fatigue, sleep, hydration logs
  • Auto-derived strain summaries from practice sessions
  • In-app health notifications and warm-up recommendations

2.5 Billing

  • Subscription tier and status on your profile (Free / Pro / Studio), linked via Stripe customer ID after checkout
  • Payment card details are handled by Stripe — we do not store full card numbers

2.6 Website

  • Contact form / email correspondence if you write to us
  • Essential cookies / preference storage (see Cookie Policy)

3. What we do not collect

  • Server-side archives of raw practice audio for pitch sessions
  • Voiceprints intended for identity recognition or authentication
  • Advertising identifiers sold to third parties
  • Device contacts, photos, or unrelated files

4. Why we process data (purposes and lawful bases)

  • Contract / service delivery: account, curriculum progress, subscriptions
  • Consent: microphone access; voice analysis that may be special-category; optional on-device AI coaching
  • Legitimate interests: securing the service, aggregated product improvement (not ad profiling)
  • Legal obligation: tax / accounting records where required

5. Processors and third parties

  • Supabase — authentication, PostgreSQL database, storage
  • Google — OAuth sign-in
  • Stripe — payment processing and customer portal
  • Cloudflare — website CDN / Workers

We do not sell personal data.

6. International transfers

Users may be in the UK, UAE, or elsewhere. Data may be processed in regions where our processors operate. Where UK/EEA data leaves those regions, we rely on appropriate safeguards (e.g. Standard Contractual Clauses) with processors.

7. Retention

  • Account, progress, and practice metrics: while the account is active; deleted within 30 days of confirmed account closure (unless law requires longer)
  • Vocal health logs: typically up to 12 months, then archived or deleted
  • Health notifications: typically up to 90 days
  • Billing records: retained as required for tax / accounting

8. Children’s data and age gate

The App is not for children under 13. We use a self-declared age gate at onboarding. Users 13–17 should have parental or guardian oversight. For under-18 students in private coaching, see our Safeguarding statement.

If you believe we hold data for a child under 13, contact privacy@joyfulvoices.co and we will delete it promptly.

9. Your rights

Depending on your location, you may have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. Contact privacy@joyfulvoices.co. UK users may complain to the ICO (ico.org.uk · 0303 123 1113).

10. Security

  • TLS in transit; processor-managed encryption at rest
  • Supabase Row Level Security so users access only their own rows
  • On-device audio path for analysis and optional ML
  • Service-role keys and Stripe secrets kept server-side (Workers), never in the app bundle

11. Changes

We may update this policy as the product or law changes. Material changes will be signalled in the App or by email where appropriate. The “Last updated” date above reflects the latest draft revision.

Back to home