Privacy Policy

Dubsmith is the trading name of Sliverware (UEN 53455047M), a business registered in Singapore, whose registered address is 7 Temasek Boulevard, #12-07 Suntec Tower One, Singapore 038987. It operates the Dubsmith web app and website and is responsible for your personal data under this policy. For questions about this policy, to exercise a right, or to reach the person responsible for data protection, contact contact@dubsmith.io. We treat that address as the business contact for data protection matters, including for the purposes of section 11 of the PDPA and, where the GDPR applies to us, as the point of contact for data subjects.

Your own data. For your account, billing and support data, we decide why and how it is processed. Under the PDPA we are the organisation; under the GDPR we are the controller.

The media you upload. For the video, audio and derived content you put through the service, we act on your instructions and for your purposes. Under the PDPA we are a data intermediary; under the GDPR we are a processor and you are the controller. That means you decide what is uploaded and why, you are responsible for having a lawful basis and the necessary consents, and we process it only to produce the localizations you ask for. The Data Processing Addendum sets out the terms of that role.

Account data. Your name, email address, and authentication credentials — or, if you sign in with Google or Apple, the identity details that provider shares with us. Passwords are stored only as salted hashes.

Your media and everything derived from it. The video and audio files you upload, and what we generate from them: transcripts, speaker diarization, translations, emotion and on-screen text analysis, synthesized and cloned voices, inpainted frames, subtitles, and rendered dubs. Because dubs keep each speaker’s voice, this includes reference audio of each speaker’s voice.

Usage and billing data. Processing metadata (job durations, languages, stages completed, amounts metered), your plan and balance, invoices and transaction records. Payment card details are collected and processed directly by our payment provider and never reach our servers.

Technical data. IP address, browser and device type, and server and application logs generated when you use the site and app. We use these to keep the service running and secure, and to investigate faults and abuse.

Product usage. The pages you view on our website and in the app, and a small set of product events — for example, that a project was created, a job finished or a download started — with the plan, languages and output types involved — and, if you signed up after following a campaign link or another website, its campaign tags and the referring site’s domain. Section 5 explains how this is collected.

Communications. What you send us when you email us, chat with us on the website or in the app, or otherwise contact support, and our replies.

We use personal data only for the purposes below. Under the PDPA we rely on your consent, on deemed consent for what is reasonably necessary to provide a service you asked for, and on the legitimate interests exception where it applies. Where the GDPR applies, the basis is set out in the right-hand column.

Aggregate statistics. We produce aggregate operational statistics — job volumes, stage durations, error rates — that do not identify you or any individual, and use them to run and improve the service.

• We do not train AI models on your content. The providers we use to run the service process your content under their own terms, which may allow them to use it, including to train or improve their AI models. Depending on the step, they receive your source video and audio, the separated dialogue audio, transcripts and translations, image crops of on-screen text, and voice samples of each speaker. They are listed on Subprocessors.
• We do not sell or share personal data for money or for cross-context behavioural advertising.
• We advertise Dubsmith on other services, such as search engines and professional networks, but we place no advertising pixels or trackers on our website or in the app, we do not sell or share personal data with ad networks, and the product shows no ads. Our product analytics (section 5) is first-party: it measures use of Dubsmith only, sets no cookies, and is never used for advertising.
• We do not use your personal data for profiling or automated decision-making that produces legal or similarly significant effects. The localization pipeline is automated, but it acts on the media you submit, not on decisions about you.

We use cookies only to keep you signed in, keep the session secure, avoid offering you sign-in when you are already signed in, and keep a support-chat conversation going. We set no advertising, analytics, or cross-site tracking cookies.

You can block or delete cookies in your browser settings, but the app cannot keep you signed in without the session cookie.

Google sign-in prompt. On our website (except these legal pages) and our sign-in pages we load Google’s sign-in script. If you are signed in to Google in your browser and not signed in to Dubsmith, Google may show a prompt offering to continue with your Google account. Loading the script sends Google your IP address, browser details and the page you are on, and Google handles that under its own privacy policy. Google tells us nothing about you unless you choose an account in the prompt. If you do, we receive the same details as with “Continue with Google” (section 2): your name, email address, profile picture and Google account ID.

Support chat. The chat bubble on our website and in the app is run by Crisp, listed on Subprocessors. When the page loads, Crisp receives your IP address, browser type and the page you are on, so a support agent can see where you are asking from. If you are signed in, it also receives your name, email address and account ID, so we can answer you by email after you leave. It stores the messages and files you send in the chat. It is not used for advertising.

Product analytics. We use PostHog, a product-analytics provider listed on Subprocessors, to measure how the website and app are used. It is set up to collect as little as it can:

• It sets no cookies and writes nothing to your browser’s storage. Its identifier lasts only as long as the open page.
• In your browser it records the pages you view, a few named events (opening a review, downloading an output) and errors the app hits. It does not record your clicks or keystrokes, does not record your screen, and never sends file names, project names, your name or your email address. When you are signed in, events carry your account ID, a random identifier.
• Requests go through our own domain, and PostHog receives your IP address, which it uses to work out an approximate location.
• If your browser sends a Global Privacy Control or Do Not Track signal, the analytics script does not run at all.
• Our servers also record a few account events — signing up, creating a project, starting and finishing a job, and changes to your plan — against the same account ID. These carry no media, transcripts or contact details, and browser signals do not reach them. To object to them, email contact@dubsmith.io.
• If you arrive through a link carrying campaign tags (the “utm_” parameters in an ad or post link) or from another website, we record those tags and the referring site’s domain with your account when you sign up, to measure which campaigns work. Until you sign up they are held only in that browser tab, never in a cookie, and they are not recorded at all when your browser sends a Do Not Track or Global Privacy Control signal.

We do not sell your data. We share it only with the service providers we need to run the service, and only so that they can run it. They process it under their own terms, which may allow them to use it for their own purposes, including to train or improve their AI models (see section 4).

The full list — provider, what it does, what it receives, and where it operates — is published at Subprocessors and kept current.

Other disclosures. We may also disclose personal data to professional advisers under duties of confidence; to law enforcement, regulators or courts where we reasonably believe we are legally required to or where it is necessary to protect our rights, your safety, or the safety of others; and to a buyer or successor in connection with a merger, acquisition, financing, insolvency, or sale of assets, subject to this policy continuing to apply.

Application data (projects, transcripts, review state, account records) lives in Convex. Uploads and finished renders are stored with Cloudflare (R2). During processing, working copies are kept in our pipeline’s storage on Amazon Web Services (and, for the few files our on-screen text removal step exchanges, in Cloudflare R2) so that adding a language reuses them, and are deleted automatically as section 8 describes. Transcription and translation, audio separation, on-screen text detection, font identification, speech synthesis and voice cloning, and on-screen text removal are performed by specialised vendors that receive only what their step requires.

Transfers out of Singapore. Most of these providers operate outside Singapore, principally in the United States. Google Cloud and RunPod may process data in their data centres around the world, and Stripe also processes in Ireland. Alibaba Cloud and MiniMax store data in Singapore but may process it outside it. Before transferring personal data overseas we take reasonable steps, as section 26 of the PDPA requires, to satisfy ourselves that the recipient is bound by legally enforceable obligations to protect it to a standard comparable to the PDPA — in practice, through the data-protection terms in our contracts with them.

Transfers out of the EEA and the UK. Where the GDPR or UK GDPR applies, transfers to countries without an adequacy decision are made under the European Commission’s Standard Contractual Clauses, as varied by the UK International Data Transfer Addendum where relevant, together with supplementary measures where they are needed. You can request details of the mechanism used for a particular transfer at contact@dubsmith.io.

Your media stays in your workspace until you delete it. When you delete a project or video:

• Immediately: the source files you uploaded, every finished output (videos, audio, subtitle and transcript files), the preview images and clips in your library, and the project’s transcripts, translations and review edits. If any file cannot be deleted, the delete fails and the project stays in your list so you can try again — it is never removed from your list while its files remain.
• Within 40 days: working copies made during processing — separated audio tracks, cleaned frames, intermediate renders, analysis files. These are not deleted one by one: our processing storage deletes everything in it automatically within 40 days of it being written.
• Voice models: the cloned voices our speech providers create to dub each speaker are kept for about a day so that further lines can reuse them, then deleted at the provider by a scheduled cleanup, within 7 days of being created.

Residual copies in routine backups are isolated from further processing and cycle out on the normal backup schedule. Other data is kept as follows.

• Media and derived content: until you delete it, or until your account is closed.
• Account records: for as long as your account is open, then deleted when you delete your account (or within 30 days of an emailed request).
• Billing and tax records: retained for as long as accounting and tax law requires, which in Singapore is five years.
• Security and application logs: retained for a limited period for fault diagnosis and abuse investigation, then discarded.

To delete your account and everything associated with it, choose Delete account in your account settings. Your projects and media, your profile and sign-in details, and your workspace are deleted at once; your subscription is cancelled within minutes, and any usage not yet billed goes on a final invoice. You can also email contact@dubsmith.io; we complete emailed requests within 30 days. Either way we keep billing and tax records as described above, a record of the terms you accepted for 12 months as evidence of that agreement, and copies isolated in backups pending their normal expiry; processing working copies expire within 40 days as described above.

We apply technical and organisational measures appropriate to the risk: encryption in transit and at rest, access restricted on a need-to-know basis, authenticated and signed server-to-server calls between our services, secrets held in a managed secret store, and confidentiality obligations on everyone with access.

No system is perfectly secure and we cannot guarantee the security of your data. You are responsible for keeping your credentials safe and for the security of the devices you use to reach the service.

If something goes wrong. If a data breach occurs we assess it promptly. Where it is notifiable under the PDPA we notify the Personal Data Protection Commission within three calendar days of concluding that it is notifiable, and affected individuals where the breach is likely to result in significant harm. Where the GDPR applies we notify the competent supervisory authority within 72 hours and affected individuals where required. Where you are a business customer and the affected data is your customers’, we notify you without undue delay so you can meet your own obligations.

Everyone. You can ask us for a copy of the personal data we hold about you and information about how it has been used, ask us to correct anything inaccurate, delete your account and data (from your account settings, or by asking us), and withdraw any consent you have given. Under the PDPA we will respond to an access or correction request as soon as reasonably possible and in any case within 30 days, and will tell you if we need longer and why. Withdrawing consent may mean we can no longer provide the service.

If the GDPR or UK GDPR applies to you. You additionally have the right to restrict processing, to object to processing based on legitimate interests, to receive your data in a portable machine-readable format, and to lodge a complaint with your supervisory authority — in the UK, the Information Commissioner’s Office. We would appreciate the chance to address your concern first.

If you are a resident of a US state with a privacy law. You may have rights to know, access, correct, delete, obtain a portable copy, appeal a refusal, and opt out of sale, sharing, targeted advertising and certain profiling. We do not sell or share personal data, do not use it for targeted advertising, and do not carry out profiling of the kind those laws address, so those opt-outs have nothing to act on. We do not discriminate against anyone for exercising a right.

How to exercise a right. You can delete your account yourself from your account settings, which asks you to be recently signed in. For anything else, or if you prefer, email contact@dubsmith.io. We will verify your identity, usually by confirming control of the account email, before acting — this protects you as much as us. If a request concerns media a business customer uploaded, we will refer you to that customer, who controls it, and assist them in responding.

Complaints. If you are not satisfied with our response, you may complain to the Personal Data Protection Commission of Singapore, or to the data protection authority where you live.

Some service email is part of providing the service, and you cannot opt out of it while you hold an account: sign-in and password messages, security notices such as a password change, and billing notices, including when your plan’s monthly allowance is used up. Job notifications (a translation ready to review, outputs finished or failed) and the early warning at 80% of your allowance are optional. Turn them off on your account page, or with the unsubscribe link in any of them. Any marketing email carries an unsubscribe link and honours it. We do not send marketing by text message, and we comply with the Spam Control Act 2007 and the Do Not Call provisions of the PDPA.

The service is not directed to anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact contact@dubsmith.io and we will delete it.

If this policy changes materially we will note it here with a new date and, where the change significantly affects you, tell you by email before it takes effect. Questions, requests, or complaints: contact@dubsmith.io.