Last Update: August 14, 2026
Last Review: August 14, 2026
At Resemble AI, we take your privacy seriously. Please read this Privacy Policy to learn how we treat your personal data. It describes our practices; it does not ask you to consent to them. Where we rely on your consent for a particular activity, we ask for it separately at the time, as described in Section 15.
Who this Privacy Policy applies to. It applies to people who use our Services directly, and also to people who never use them — for example, someone whose voice is submitted for cloning by one of our customers, or someone who attends a meeting in which one of our customers has enabled detection (through Resemble Detect - Deepfake Detection for Meetings). If you use our Services, your use is subject to our Terms of Service, which incorporates this Privacy Policy. If you do not, the Terms of Service do not bind you, but this Privacy Policy still describes how your data is handled. Terms used but not defined here have the meanings given in the Terms of Service.
What our Services do. Resemble AI produces synthetic voices and provides synthetic-media detection services. Our Services include creating custom AI voice models from voice recordings, generating synthetic speech from those models, verifying that the individual whose voice is being cloned has consented, operating real-time voice agents, and analyzing audio, images, video and live meetings to detect synthetic or manipulated media (including meeting detection through Resemble Detect - Deepfake Detection for Meetings, available through our native Microsoft Teams app or Resemble AI’s built-in bot attendant). Sections 2 and 3 explain how we handle voice, meeting and biometric data, which are the most sensitive categories of data we process.
We’re constantly trying to improve our Services, so we may need to change this Privacy Policy from time to time, but we will alert you to any material changes by placing a notice on the Resemble AI website, by sending you an email and/or by some other means. Please note that if you’ve opted not to receive legal notice emails from us (or you haven’t provided us with your email address), those legal notices will still govern your use of the Services, and you are still responsible for reading and understanding them. Use of information we collect is subject to the Privacy Policy in effect at the time such information is collected.
Whether we are a controller or a processor of your Personal Data depends on which Service is involved and how your data reached us.
We are the controller for our own business activities: platform account management and authentication, billing, customer support, marketing and lead generation, website analytics, and consent verification. For those activities we determine why and how your Personal Data is processed, and this Privacy Policy describes that processing.
We are a processor — and our business customer is the controller — for the voice AI services we operate on our customers’ behalf: voice cloning and voice model training, text-to-speech synthesis, real-time voice agents, deepfake detection of audio, images and video, and meeting deepfake detection (through Resemble Detect - Deepfake Detection for Meetings). In those cases we process Personal Data solely on that customer’s documented instructions.
What this means if you attended a meeting. If your employer or another organization enabled our Services (including Resemble Detect - Deepfake Detection for Meetings) for a meeting you attended, that organization — not Resemble AI — determines why your data is processed, what happens to the result, and for how long it is kept. That organization is responsible for telling you that detection is in use and for obtaining any consent the law requires. Please direct requests to exercise your rights to that organization in the first instance; we will assist them in responding, and where we can identify that organization from the request, we will forward any request you send us to them within three business days.
Our Data Processing Agreement, which governs the processing we carry out on behalf of business customers, is available at https://docs.google.com/document/d/1rlgjFE6sN0mB5MCuE_erMgMuXmPu-e_E. A current list of the sub-processors we engage is maintained at https://trust.resemble.ai/subprocessors.
Voice data. When you or our customer provides voice recordings so that a custom voice model can be created, we process those recordings and the resulting model to deliver that service and for no other purpose. We do not use customer voice data to train general-purpose models, and we do not use it for research, aggregated training or any purpose beyond delivering the contracted service.
Consent verification. Before a voice model is created, we may require the individual whose voice is being cloned to record a spoken consent statement, which we analyze to confirm that it is authentic and matches the required script. This analysis is described in Section 12 (Automated decision-making).
Meeting media. Where a business customer enables our meeting detection Services (Resemble Detect - Deepfake Detection for Meetings), we receive audio and video from the meetings that customer designates. This happens in one of two ways: an automated participant (Resemble AI’s built-in bot attendant) joins the meeting, in which case it is identifiable in the participant roster; or the customer’s administrator enables a compliance recording service through our native Microsoft Teams app within the customer’s own environment, in which case no additional participant is visible and the scope of coverage is determined entirely by the policies and group memberships the customer configures. In both cases the customer decides which meetings and which users are in scope.
Biometric identifiers. Where the Services derive voice or facial characteristics from voice data or meeting media (including media processed through Resemble Detect - Deepfake Detection for Meetings) in order to create a voice model, verify consent, or detect synthetic or manipulated media, we do so solely for that purpose and, where we act as a processor, solely on the instructions of our business customer. We do not use biometric identifiers to identify individuals for any other purpose. We do not sell, lease, trade or otherwise profit from biometric identifiers or biometric information.
Destruction of biometric identifiers. Biometric identifiers are permanently destroyed when the initial purpose for collecting them has been satisfied, and in any event no later than three (3) years after they were collected, whichever occurs first. This schedule applies regardless of any contrary instruction from a business customer, except where retention is required by law. Where notice must be given and a written release obtained before biometric identifiers are collected, the business customer that enables the Services is responsible for providing that notice and obtaining that release. Section 11 sets out our retention periods in full.
This Privacy Policy covers how we treat Personal Data that we gather when you access or use our Services. "Personal Data" means any information that identifies or relates to a particular individual and also includes information referred to as "personally identifiable information" or "personal information" under applicable data privacy laws, rules or regulations. This Privacy Policy does not cover the practices of companies we don’t own or control or people we don’t manage.
This table discloses the categories of Personal Data that we collect and have collected over the past 12 months, the business or commercial purposes for which we collect each category, and the categories of third parties to whom we disclose it.
| Category of Personal Data | Examples | Business or commercial purpose | Categories of third parties disclosed to |
|---|---|---|---|
| Profile or Contact Data | First and last name, email address | Providing, Customizing and Improving the Services; Marketing the Services; Corresponding with You | Service Providers |
| Payment Data | Last four digits of payment card, billing address, phone number, email address | Providing, Customizing and Improving the Services; Corresponding with You | Service Providers (currently Stripe, Inc.) |
| Commercial Data | Purchase history | Providing, Customizing and Improving the Services; Marketing the Services; Corresponding with You | Service Providers |
| Device/IP Data | IP address, device type, operating system, browser type | Providing, Customizing and Improving the Services | Service Providers |
| Web Analytics | Page interactions, referral source, request identifiers, interaction statistics | Providing, Customizing and Improving the Services; Marketing the Services | Service Providers |
| Social Network Data | Email address | Providing, Customizing and Improving the Services; Marketing the Services; Corresponding with You | Service Providers |
| Professional or Employment-Related Data | Job title, employer name, team size | Providing, Customizing and Improving the Services; Marketing the Services; Corresponding with You | Service Providers |
| Geolocation Data | Approximate location derived from IP address | Providing, Customizing and Improving the Services | Service Providers |
| Voice Data and Voice Models | Audio recordings of an individual’s voice, transcripts, consent recordings, and the voice models derived from them. Voice recordings and voice models are biometric identifiers and are sensitive personal information. | Providing the Services (creating and operating custom voice models, generating synthetic speech, verifying consent). Not used for improving the Services — see Section 3. | Service Providers (cloud hosting and model infrastructure) |
| Meeting Media and Biometric Identifiers | Audio and video of meeting participants captured through integrations you or your organization enable (including Resemble Detect - Deepfake Detection for Meetings), transcripts and participant identifiers, and voice and facial characteristics derived from that media for the purpose of detecting synthetic or manipulated media. These are biometric identifiers and are sensitive personal information. | Providing the Services (detecting synthetic or manipulated media through Resemble Detect - Deepfake Detection for Meetings). Not used for improving the Services — see Section 6. | Service Providers (meeting-recording infrastructure, cloud hosting and model infrastructure) |
| Detection Results | Assessments of whether media is synthetic or manipulated, confidence scores, and associated metadata | Providing the Services; aggregate, non-identifying detection metrics only for improving the Services | Service Providers (cloud hosting) |
| Third-Party Credentials | Usernames, tokens and account content from third-party services you connect, including calendar and directory accounts | Providing, Customizing and Improving the Services | Service Providers |
Sensitive personal information. Voice recordings, voice models, meeting media (including media processed through Resemble Detect - Deepfake Detection for Meetings) and the biometric identifiers derived from them are sensitive personal information under the California Consumer Privacy Act and comparable state laws, and special category data under the GDPR. We use sensitive personal information only to perform the Services requested by you or by our business customer, and for the purposes permitted by law without a right to limit. Your right to limit our use of sensitive personal information is described in Section 14.
Our role for each category. For Voice Data and Voice Models, Meeting Media and Biometric Identifiers (including data processed through Resemble Detect - Deepfake Detection for Meetings), and Detection Results, we generally act as a processor or service provider on behalf of a business customer, as explained in Section 2. We list those categories here so that you can see everything we handle, not because we determine the purposes for which they are processed.
We will not collect additional categories of Personal Data or use the Personal Data we collected for materially different, unrelated or incompatible purposes without providing you notice or obtaining consent.
In addition, we may use any of the categories of Personal Data described above, and disclose them to government or law enforcement officials or private parties, for the following purposes: to comply with applicable law, regulation, court order or other legal process; to prevent, detect and investigate security incidents and potentially illegal or prohibited activities; to protect the rights, property or safety of you, Resemble AI or another party; to enforce any agreements with you; to respond to claims that any posting or other content violates third-party rights; and to resolve disputes. Biometric identifiers are the exception: we disclose them only where required by law or by a valid warrant or subpoena, and never for the other purposes in this paragraph.
We disclose your Personal Data to the categories of service providers and other parties listed in this section.
These parties help us provide the Services or perform business functions on our behalf, and process Personal Data only on our instructions and under written contracts imposing data protection obligations no less protective than those we owe. They include hosting, cloud infrastructure and model inference providers; meeting-recording and media-relay infrastructure, which joins meetings and relays media on your organization’s behalf (including for Resemble Detect - Deepfake Detection for Meetings); analytics providers for web traffic and product usage; security and fraud prevention consultants; support and customer service vendors; and payment processors.
A current list of our sub-processors, naming each provider and its purpose, is maintained at https://trust.resemble.ai/subprocessors. We give business customers at least thirty (30) days’ prior notice before engaging a new sub-processor, and customers may object on reasonable data protection grounds as set out in our Data Processing Agreement.
Payment card information you voluntarily provide is processed by our payment processing partner, currently Stripe, Inc. We do not store raw payment card details.
These parties provide analytics on web traffic or usage of the Services, and help us understand how visitors find and use them. We do not disclose Voice Data, Meeting Media (including media processed through Resemble Detect - Deepfake Detection for Meetings), biometric identifiers or detection results to analytics partners.
We may disclose Personal Data to third parties for any of the activities described under "Other permitted purposes for processing Personal Data" above.
Personal Data that we hold as a controller may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part). Personal Data we process as a processor belongs to our business customers and would pass only to a successor that continues to process it on those customers’ instructions under the Data Processing Agreement. Biometric identifiers are not transferred as a business asset.
We may create aggregated, de-identified or anonymized data from the Personal Data we collect. We make Personal Data into de-identified or anonymized data by removing information that makes the data identifiable and we will not attempt to reidentify it. We may use and disclose such data for any lawful business purpose. Where the underlying data is data we process as a processor, we create de-identified data from it only to the extent our agreement with the business customer permits, which for Voice Data and Meeting Media (including media processed through Resemble Detect - Deepfake Detection for Meetings) is limited to aggregate telemetry and detection metrics that do not identify any individual or the content of any meeting.
We do not sell your Personal Data, and we do not share it for cross-context behavioral advertising or targeted advertising, as those terms are defined under the California Consumer Privacy Act and comparable state laws. We have not done so in the preceding twelve (12) months. We do not sell, lease, trade or otherwise profit from biometric identifiers or biometric information in any circumstances. We use product and website analytics for our own service-improvement purposes only.
The Services use cookies and similar technologies such as pixel tags, web beacons, clear GIFs and JavaScript (collectively, "Cookies") to enable our servers to recognize your web browser and tell us how and when you visit and use our Services, to analyze trends, learn about our user base and operate and improve our Services. Cookies are small pieces of data – usually text files – placed on your computer, tablet, phone or similar device when you use that device to access our Services.
Non-essential Cookies are set only where you consent to them through our cookie banner, and you may change or withdraw that consent at any time through the same control. Essential Cookies are necessary for the Services to provide features you have requested, such as logging into secure areas; if you disable them, certain features will not work.
Performance and analytical Cookies help us understand how visitors use the Services by collecting information such as the number of visitors, the pages viewed and the time spent on them. Google LLC uses Cookies in connection with its Google Analytics services, subject to the Google Analytics Terms of Use and Google Privacy Policy; you may opt out through Google’s advertising opt-out page or the Google Analytics Opt-out Browser Add-on.
You can decide whether or not to accept Cookies through your browser settings. Most browsers allow you to disable Cookies, reject new Cookies and delete existing ones. Doing so may affect the functionality of the Services. More information about Cookies is available at allaboutcookies.org, or at ico.org.uk if you are located in the European Union. The Services do not currently support "Do Not Track" browser requests.
Session replay. We may use session replay technology to identify and resolve customer issues, to monitor and analyze how you use our Services, to better understand user behavior and to improve our Services. Session replay is not used in connection with Voice Data, Meeting Media (including media processed through Resemble Detect - Deepfake Detection for Meetings) or detection results.
We seek to protect your Personal Data from unauthorized access, use, alteration and disclosure through appropriate physical, technical, organizational and administrative security measures, including encryption in transit using TLS 1.2 or higher, encryption at rest using AES-256, role-based access controls, network controls, logging and monitoring, and documented incident response procedures. Our information security program is maintained in alignment with the SOC 2 Trust Services Criteria and ISO/IEC 27001. You should help protect your data by appropriately selecting and protecting your password, limiting access to your devices and browser, and signing off after you have finished accessing your account. No method of transmission or storage over the internet is completely secure.
Where we are the controller and become aware of a personal data breach, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals. Where the breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, in clear and plain language, and tell you what steps you can take to protect yourself. Where we act as a processor, we will notify the affected business customer without undue delay and in any event within forty-eight (48) hours of becoming aware of the breach, and will assist that customer, as controller, in notifying the supervisory authority and affected individuals. You may report a suspected security issue to security@resemble.ai.
We retain Personal Data about you for as long as necessary to provide you with our Services or to perform our business or commercial purposes for collecting it. When establishing a retention period for specific categories of data, we consider who we collected the data from, our need for it, why we collected it, and its sensitivity. In some cases we retain Personal Data for longer if doing so is necessary to comply with our legal obligations, resolve disputes, collect fees, or is otherwise permitted or required by law. We may retain anonymous or aggregated information that does not identify you indefinitely. Specifically:
Where you or a business customer requests deletion, we complete it within thirty (30) days, except where applicable law requires us to retain the data. Further detail is set out in our Data Retention and Disposal Policy and our Data Processing Agreement.
Our consent verification system uses automated analysis to determine whether a spoken consent statement is authentic and matches the required script. This decision affects whether a voice model can be created from your voice, and is therefore an automated decision with a significant effect on you. The logic involves our proprietary detection models together with a text-match analysis of the spoken consent script; the outcome is a pass or fail result.
You have the right to obtain human intervention in that decision, to express your point of view, and to contest the outcome. To exercise those rights, email privacy@resemble.ai and a member of our team will review the decision.
Detection results produced by our synthetic-media detection Services (including Resemble Detect - Deepfake Detection for Meetings) are probabilistic assessments, not determinations of fact, and may include false positives and false negatives. Our Terms of Service prohibit our customers from relying on a detection result as the sole basis for any adverse action against an individual, including denial of access, disciplinary action, or the termination of employment or candidacy. Where a detection result concerns you, the business customer that enabled the Services determines what is done with it; please direct any question about that decision to that organization.
We do not otherwise engage in automated decision-making or profiling that produces legal or similarly significant effects.
We do not knowingly collect or solicit Personal Data about children under 16 years of age; if you are a child under the age of 16, please do not attempt to register for or otherwise use the Services or send us any Personal Data. If we learn we have collected Personal Data from a child under 16 years of age, we will delete that information as quickly as possible. If you believe that a child under 16 years of age may have provided Personal Data to us, please contact us at privacy@resemble.ai. Where a business customer enables our meeting detection Services (Resemble Detect - Deepfake Detection for Meetings), that customer is responsible for determining whether children may be present in the meetings it designates and for any notice or consent the law requires in respect of them.
If you are a California resident, you have the rights set out below in respect of the Personal Data we hold about you as a controller. Where we hold your Personal Data as a service provider to a business customer, please direct your request to that customer as described in Section 2.
To exercise these rights, email privacy@resemble.ai or write to us at the address in Section 16. We will verify your request by matching it to an existing account or, where necessary, by requesting additional identifying information, and we will respond within the period required by law. You may use an authorized agent to submit a request on your behalf. If we decline a request, we will tell you why and you may appeal that decision by replying to our response.
Separately, under California Civil Code Sections 1798.83–1798.84, California residents may contact us to prevent disclosure of Personal Data to third parties for those third parties’ direct marketing purposes. The Services do not currently respond to "Do Not Track" signals; more information is available at allaboutdnt.com.
Residents of other states with comprehensive privacy laws have comparable rights of access, correction, deletion, portability and opt-out, and a right to appeal a decision we make on a request. Email privacy@resemble.ai to exercise them. We do not sell Personal Data as defined in Nevada Revised Statutes Chapter 603A.
If you are a resident of the European Union, the United Kingdom, Switzerland, Liechtenstein, Norway or Iceland, you may have additional rights under the EU or UK General Data Protection Regulation (the "GDPR") with respect to your Personal Data. Where this section conflicts with any other provision of this Privacy Policy, the more protective provision controls.
Our capacity. Whether we are the controller or a processor of your Personal Data depends on the Service involved, as explained in Section 2. Where we act as a processor, the business customer that engaged us is the controller and is responsible for establishing a lawful basis for the processing, for any condition required under Article 9(2), and for providing the information required by Articles 13 and 14 to the individuals concerned. Please direct requests to that customer; we will assist them in responding.
Contractual necessity. We process the following categories because it is necessary to perform our contract with you; if you do not provide them, we may be unable to provide the Services in whole or in part: Profile or Contact Data; Payment Data; Commercial Data; Device/IP Data; Web Analytics.
Legitimate interests. We process the following categories where we believe doing so furthers our legitimate interests or those of a third party, and where those interests are not overridden by your interests or fundamental rights: Social Network Data; Professional or Employment-Related Data; Geolocation Data; and de-identified or anonymized data. Those legitimate interests include providing, customizing and improving the Services, marketing the Services, corresponding with you, meeting legal requirements, enforcing our terms, and completing corporate transactions. You may object to processing on this basis as described below.
Consent. We process some Personal Data on the basis of consent you have expressly granted at the time of collection, including non-essential Cookies and marketing communications. You may withdraw that consent at any time.
Explicit consent for biometric and special category data. Voice recordings, voice models, meeting media (including media processed through Resemble Detect - Deepfake Detection for Meetings) and the voice and facial characteristics derived from them are special category data under Article 9 of the GDPR. Where we are the controller of such data — principally in our consent verification process — we rely on your explicit consent under Article 9(2)(a), obtained through the recorded consent statement described in Section 3. We do not rely on legitimate interests or contractual necessity as a basis for processing special category data. Where we process such data as a processor on behalf of a business customer, that customer is responsible for establishing the Article 6 basis and the Article 9(2) condition — ordinarily the explicit consent of the individual — and for providing the Article 13 and 14 information.
Other grounds. From time to time we may also process Personal Data to comply with a legal obligation, to protect the vital interests of a data subject, or to carry out a task in the public interest.
Subject to the limits set out below, you have the rights of access, rectification, erasure, restriction of processing, data portability, objection, withdrawal of consent, and the rights in relation to automated decision-making described in Section 12. You also have the right to lodge a complaint with the supervisory authority in your country or EU Member State; a list is available at edpb.europa.eu/about-edpb/board/members_en.
To exercise any of these rights, email privacy@resemble.ai. We will verify your identity before responding, and will respond within one month of receipt, extendable by a further two months for complex or numerous requests, in which case we will tell you within the first month. In some circumstances we may be unable to comply in full — for example where a request is manifestly unfounded or excessive, where it would jeopardize the rights of others, or where the law requires us to retain the data. We will tell you if that is the case and explain why.
The Services are hosted and operated in the United States through Resemble AI and its service providers, principally Google Cloud Platform (us-east4, Virginia), Render (Oregon) and Cerebrium (United States). If you are located in the European Economic Area, the United Kingdom or Switzerland, your Personal Data is transferred to and processed in the United States, where the law may differ from the law where you reside.
We rely on the EU Standard Contractual Clauses set out in Commission Implementing Decision (EU) 2021/914 and, for sub-processors certified under the EU–U.S. Data Privacy Framework, on the adequacy decision applicable to that framework. Supplementary measures include encryption in transit (TLS 1.2 or higher), encryption at rest (AES-256) and access controls, as described in our Data Processing Agreement. Transfer documentation for individual sub-processors is available on request from privacy@resemble.ai. Model processing in a United Kingdom region is available to enterprise customers on request.
If you have any questions or comments about this Privacy Policy, the ways in which we collect and use your Personal Data, or your choices and rights regarding that collection and use, please contact us: