Privacy Policy

Effective date: 3 August 2026

Last updated: 3 August 2026

This Privacy Policy explains how Antilayers Private Limited (“Antilayers”, “we”, “us”) handles information in connection with Vocalix Studio (the “Service”) — our software for turning Hindi audio and video into English subtitles. It covers the vocalix.org website, the Vocalix Studio application, and our related communications.

We have written this in plain language on purpose. If anything here is unclear, or if you need a data processing agreement for your organisation, write to [email protected].

1. Who we are

Vocalix Studio is a product of Antilayers Private Limited, a company incorporated in India. For the personal data described in this policy, Antilayers Private Limited is the Data Fiduciary (under India's Digital Personal Data Protection Act, 2023) and, where the GDPR applies, the data controller — except in relation to the content you upload, where we generally act on your instructions as described in section 4.

• Registered entity: Antilayers Private Limited
• Registered office: C/o Yogendra Kumar, Phase-2, Yamnotri Enclave, Dehradun City, Dehradun, Uttarakhand, India, 248001
• CIN: U62099UT2026PTC021581
• Contact: [email protected]

2. Scope of this policy

This policy applies to:

• visitors to vocalix.org;
• people who sign in to and use Vocalix Studio;
• representatives of organisations that contract with us for enterprise or pilot work; and
• people who contact us, book a call with us, or receive email from us.

It does not apply to third-party websites or services we link to, which have their own policies.

3. Information we collect

3.1 Account information

We offer Google Sign-In only. We do not create or store passwords for the Service. When you sign in with Google, we receive from Google the information you permit, which is ordinarily your name, your email address, your Google account identifier and your profile picture. We do not receive your Google password, and we do not gain access to your Gmail, Drive or other Google services.

3.2 Content you upload

The audio and video files you submit for subtitling, together with the transcripts, translations, glossaries, edits and subtitle files (SRT, VTT, or video with burned-in captions) generated from them. This is described in more detail in section 4.

3.3 Usage and technical information

• job records — file name, file size, duration, detected language, processing status, timestamps, and any errors;
• log and device information — IP address, browser and operating system, referring page, and the pages or actions performed;
• diagnostic information when something fails, so that we can fix it.

3.4 Billing information

For paid and enterprise accounts: billing contact details, billing address, GSTIN where applicable, purchase orders, invoices and payment records. We do not collect or store full card details. Where card or online payment is used, it is handled by a payment processor and we receive only confirmation and limited transaction metadata.

3.5 Communications

Emails you send us, notes from demo or discovery calls, and details you provide when booking a call (our booking is hosted by Cal.com).

4. Your files and the subtitles we produce

This is the part of the policy that matters most to our customers, so we want to be exact about it.

• You own your content. Uploading a file does not transfer any ownership of it to us. You also own the subtitle output we produce for you, subject to the Terms of Service.
• We process it to do the job you asked for. We transcribe the Hindi speech, translate it into English, time and format the subtitles, apply any glossary you have set, and make the result available to you to review and export.
• Access is restricted. Your files and outputs are visible to your account. Our personnel do not browse customer content; access is limited to the small number of people who need it to operate the Service or to investigate a fault or a support request you have raised, and such access is logged.
• Deletion on request. You can delete a file or a job from your account, or ask us to delete it, and we will do so — see section 8.
• Unreleased material. We understand that footage is often confidential before publication. We treat customer content as confidential and do not disclose it, publish it, or use it in marketing without your specific written permission.

If the content you upload contains personal data about other people (for example, the voice and words of an interviewee), then in relation to that content you are generally the Data Fiduciary or controller and we act as a processor on your instructions. You are responsible for having the rights and permissions needed to upload it — see the Terms of Service.

5. How and why we use information

We do not sell personal data. We do not run behavioural advertising and we do not share your data with advertising networks.

6. We do not train models on your content

We do not use your uploaded audio, video, transcripts, translations or edited subtitles to train, fine-tune or improve any machine-learning model, whether ours or a third party's, unless you have asked us to in writing for your own benefit (for example, a customer-specific glossary or domain adaptation for your own account).

Where a third-party model or infrastructure provider is used in our processing pipeline, we contract for the same restriction, so that your content is not used for their model training. We can name our current providers on request under NDA.

7. Legal grounds for processing

Under India's Digital Personal Data Protection Act, 2023, we process personal data on the basis of your consent, or where a legitimate use permitted by that Act applies — for instance, processing that is necessary to provide a service you have voluntarily signed up for. Where you have given consent, you may withdraw it at any time (section 12).

Where the EU or UK GDPR applies to a customer, our lawful bases are:

• Performance of a contract — to give you the Service you have signed up or paid for;
• Legitimate interests — to secure the Service, prevent abuse, and keep the product working reliably;
• Legal obligation — for tax, accounting and lawful requests;
• Consent — for optional communications, where required.

8. How long we keep things

When you ask us to delete content, we remove it from the live Service promptly and it is then purged from backups in the ordinary backup cycle. We may retain a minimal record that a job existed (for example, minutes billed) where we need it for accounting or legal reasons.

9. Who we share information with

We share information only as described below, and only to the extent needed.

• Infrastructure and hosting providers who run our servers, storage and databases.
• Speech and language processing providers used within our pipeline to transcribe and translate, under contracts that restrict their use of your content to performing that task.
• Google, for the sign-in flow you initiate.
• Cal.com, if you book a call with us through our scheduling link.
• Email and communication providers used to send service notifications and to correspond with you.
• Payment processors, banks, auditors and professional advisers, for billing, accounting and compliance.
• Authorities or other parties where we are required by law, or where it is necessary to establish, exercise or defend legal claims.
• A successor entity, if we are involved in a merger, acquisition or reorganisation — in which case this policy continues to apply to the transferred data until it is replaced by a notified policy that is no less protective.

Some pages of our website load fonts from Google Fonts and Fontshare, and our home page embeds a video player from YouTube. When these load, your IP address and basic request information are received by those providers under their own privacy policies. No Vocalix account data is sent to them.

10. International transfers

We are based in India and our processing is primarily performed in India. Some of the providers listed in section 9 may store or process data outside India. Where we transfer personal data internationally we do so in accordance with applicable law, and we use contractual protections (such as the European Commission's Standard Contractual Clauses, where relevant) with those providers. If your organisation requires processing to remain in a specific jurisdiction, contact us — this can be addressed in an enterprise agreement.

11. Security

We take reasonable technical and organisational measures to protect information, including:

• encryption in transit using TLS, and encryption at rest for stored files;
• access controls, so that files are scoped to the account that owns them;
• least-privilege internal access, with logging of administrative access;
• federated authentication through Google, so that we hold no passwords;
• separation of environments, and restricted production access;
• vendor review before a provider is introduced into the pipeline.

No system can be guaranteed completely secure. If a personal data breach occurs that affects you, we will notify the Data Protection Board of India and affected users as required by the Digital Personal Data Protection Act, 2023, and other applicable law, without undue delay.

12. Your rights

Subject to applicable law, you may:

• access the personal data we hold about you, and obtain a summary of our processing;
• correct or complete inaccurate or incomplete data;
• erase your data and your uploaded content, where we are not required to retain it;
• withdraw consent at any time, where processing is based on consent;
• nominate another person to exercise your rights in the event of death or incapacity, as provided under the Digital Personal Data Protection Act, 2023;
• complain to us and, if unsatisfied, to the Data Protection Board of India;
• where the GDPR applies — port your data, object to or restrict processing, and complain to your local supervisory authority.

To exercise any of these, email [email protected]. We will respond within the period required by law and, in any case, aim to respond within 30 days. We may need to verify your identity before acting. Deleting your content or account may mean we can no longer provide the Service to you.

13. Cookies and similar technologies

We use only what the Service needs to function:

• Strictly necessary cookies — to keep you signed in, maintain your session, and protect against cross-site request forgery.
• Preference storage — to remember basic interface choices.

We do not use advertising or cross-site tracking cookies. Third-party embeds described in section 9 (such as the YouTube player) may set their own cookies when you interact with them. You can clear or block cookies in your browser, but the Service will not work correctly without the necessary ones.

14. Children

The Service is intended for businesses and professional users and is not directed at children. We do not knowingly process the personal data of a child (under 18 in India) without verifiable consent of a parent or lawful guardian as required by law. If you believe a child has provided us personal data, contact us and we will delete it.

15. Changes to this policy

We may update this policy as the Service or the law changes. We will change the “Last updated” date above and, for material changes, notify signed-in users by email or an in-product notice before the change takes effect. Continuing to use the Service after a change takes effect means you accept the updated policy.

16. Grievance Officer and contact

As required under Indian law, the following person may be contacted with any grievance about our handling of your personal data. We will acknowledge and respond within the timelines prescribed by law.

If we cannot resolve your concern, you may escalate to the Data Protection Board of India, or to your local data protection authority where the GDPR applies.

See also our Terms of Service.