Privacy Policy

1. Information We Collect

We collect information that you provide directly to us, as well as information generated through your use of the Service.

• Account information: If you create an account, we may collect your name, email address, and authentication credentials. Sign-in is handled through NextAuth with email and password, and optionally Google OAuth when that provider is enabled for our deployment.
• Subscription and billing: Payments are processed by Stripe. We do not store full payment card numbers on our servers.
• User content: For authorized admin or creator tools (such as Story Studio), we may collect prompts, story text, character or setting inputs, and related metadata you submit so we can generate or edit audio stories. For typical listeners, we may store preferences, saved titles, and similar in-app choices tied to your account.
• Usage data: We collect information about how you interact with the Service—for example stories played, listening or engagement signals where we offer those features, pages visited, and general product analytics needed to run and improve the Service.
• Technical data: Such as IP address, device type, browser type, and coarse or inferred location derived from technical signals (not precise GPS from this policy alone).
• Cookies and similar technologies: We use cookies and similar technologies to maintain sessions (including NextAuth session cookies), protect the Service, and improve reliability and user experience.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service and its features.
• Process and deliver audio content, including AI-assisted generation where you use tools that send prompts to our model providers.
• Manage subscriptions, billing, and account status.
• Communicate with you about updates, security notices, and support requests.
• Monitor usage trends to improve performance, accessibility, and UX.
• Detect, investigate, and help prevent fraud, abuse, or security issues.
• Comply with legal obligations and enforce our terms.

3. AI Processing and Third-Party Services

Parts of the Service rely on third-party providers. Depending on how you use Sozo Play, data may be processed by:

• OpenRouter (and underlying model providers) to process prompts and generate or refine story text for authorized workflows.
• ElevenLabs (or similar) for text-to-speech or narration generation when that feature is used.
• Stripe for payment processing and related fraud prevention signals handled by Stripe.
• NextAuth and your chosen identity provider (for example Google) for authentication when enabled.
• Hosting: Our Service is hosted on Vercel. Vercel's privacy policy describes data they process as an infrastructure and hosting provider. See Vercel's Privacy Policy.
• Media storage: Story artwork, audio, and related assets may be stored with cloud object storage providers (for example S3-compatible storage or similar) configured for our deployment.

When you submit prompts or text to AI features, that content is sent to the applicable providers so they can return a result. Each provider applies its own technical and contractual terms; we select providers we believe meet reasonable security and privacy expectations for our use case.

4. Training and Provider Policies

Third-party AI and speech providers maintain their own policies about logging, retention, and whether inputs may be used to improve their models. We do not use your personal User Content to train our own proprietary machine-learning models without your explicit consent.

Because model behavior is governed in part by upstream vendors, you should review their documentation if you need vendor-specific assurances beyond this Policy.

5. Operational Access to Your Information

Authorized members of our team and automated systems may access information you store in the Service—including drafts, generated stories, logs, and support tickets—as reasonably necessary to operate the Service, respond to support requests, prevent abuse or fraud, debug incidents, and comply with the law. We do not treat every creative draft as permanently hidden from all human review if access is required for these purposes.

6. Sharing of Information

We do not sell your personal information.

We may share information only:

• With service providers who process data on our behalf to run the Service.
• To comply with legal obligations or lawful requests.
• To protect the rights, safety, and integrity of our users and the public.
• In connection with a merger, acquisition, or sale of assets, subject to applicable law and notice requirements.

7. Data Retention and Deletion

We retain personal data and User Content for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements.

You may request deletion of your account and associated personal data by contacting us at support@sozoplay.com. We will respond in line with applicable law and verify requests where required.

8. Your Rights

Depending on where you live (for example the EU/UK under GDPR or California under the CCPA/CPRA), you may have some or all of the following rights regarding personal data we hold about you:

• Access: Request a copy of or information about the personal data we process.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request erasure of your personal data, subject to exceptions under law.
• Portability: Request a structured copy of certain data for transfer to another service, where technically feasible.
• Objection or restriction: Where applicable, object to or ask us to restrict certain processing.

To exercise these rights, contact us using the information in Section 14. We may need to confirm your identity before fulfilling a request.

9. Security

We implement technical and organizational measures designed to protect your information, including encryption in transit (such as HTTPS/TLS) for connections to the Service. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

10. Children's Privacy (COPPA and Families)

Sozo Play is designed for families and may be used alongside children under 13 when a parent or guardian is involved. We take children's privacy seriously and aim to comply with applicable laws, including the Children's Online Privacy Protection Act (COPPA) where it applies.

• We do not knowingly collect personal information directly from children without appropriate parental involvement.
• Accounts should be created and managed by a parent or guardian when the listener is a child.
• We limit collection to what we reasonably need to provide the Service.
• Parents or guardians may request access to or deletion of information associated with their family's use of the Service by contacting us.

11. Cookies and Tracking

We use cookies and similar technologies to operate the Service, keep you signed in where you choose to stay logged in, and maintain reliability. We do not use behavioral advertising to profile children for ad targeting.

12. International Users

If you access Sozo Play from outside your home country, your information may be transferred to, stored in, and processed in the United States or other countries where we or our service providers operate. Those countries may have different data protection rules than your jurisdiction.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the revised policy on this page and update the “Last updated” date above. Where required by law, we will provide additional notice.