Legal
NarrateAI is a text-to-speech API service operated by MossForge, a trading name based in England. We are the data controller for personal data processed in connection with this Service.
Contact: support@mossforge.dev
Website: mossforge.dev
If you have any questions about this policy or how we handle your data, please contact us at the above address.
When you register, we collect your email address, a hashed password (we never store plaintext passwords), account creation date, and last login timestamp.
When you use the NarrateAI API, we collect the text you submit for synthesis (processed to generate audio; see retention below), API request metadata (timestamp, character count, job status, response time), and your IP address (retained in API Gateway and Lambda logs).
Payment processing is handled entirely by Stripe, Inc. We do not store your card details. We retain your Stripe customer ID, subscription plan and status, credit balance and transaction history, and billing events (subscription creation, upgrades, downgrades, top-ups).
We use PostHog Cloud to collect anonymised product analytics on our website and dashboard. This may include pages visited, feature interactions, session duration, browser and device type, and IP address (used to derive approximate location; not stored long-term by us). PostHog may use cookies or similar technologies. You can opt out via your browser's Do Not Track setting or by contacting us.
Audio files generated by the Service are stored in Amazon S3 and available for download for 7 days from creation. They are then permanently and automatically deleted. We do not retain copies beyond this window.
| Data | Lawful basis |
|---|---|
| Account data | Contract (necessary to provide the Service) |
| API usage and job data | Contract (necessary to deliver the Service) |
| Billing data | Contract; Legal obligation (financial record-keeping) |
| Analytics data | Legitimate interests (improving the Service) |
| Server / infrastructure logs | Legitimate interests (security, debugging) |
Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms.
We use your data to provide, operate, and maintain the NarrateAI Service; process payments and manage your subscription and credit balance; send transactional emails (account confirmation, job completion, billing events); monitor system performance, investigate errors, and maintain security; analyse product usage to improve the Service; and comply with legal obligations.
We do not sell your personal data to third parties. We do not use your text inputs to train or fine-tune any machine learning model.
| Data type | Retention period |
|---|---|
| Account data | Until account deletion, then 30 days |
| API request metadata | 90 days in application logs |
| Generated audio files | 7 days from creation, then permanently deleted |
| Billing records | 7 years (UK financial record-keeping obligation) |
| Infrastructure / access logs | 30 days (AWS CloudWatch) |
| Analytics data | Per PostHog retention settings (currently 1 year) |
We use the following third-party processors to operate the Service. Each is contractually bound to process your data only on our instructions and in accordance with applicable data protection law.
| Processor | Purpose | Location | Privacy info |
|---|---|---|---|
| Amazon Web Services | Cloud infrastructure (API, storage, compute) | EU (eu-west-1, Ireland) | aws.amazon.com/privacy |
| Stripe, Inc. | Payment processing | USA (SCCs / adequacy) | stripe.com/privacy |
| Postmark | Transactional email | USA (SCCs / adequacy) | postmarkapp.com/privacy-policy |
| PostHog, Inc. | Product analytics | USA / EU (Cloud) | posthog.com/privacy |
Some processors are based outside the UK/EEA (Stripe, Postmark, PostHog). Transfers to these processors are made under UK Standard Contractual Clauses (SCCs) or the UK–US Data Bridge where applicable, providing appropriate safeguards for your data.
You have the following rights regarding your personal data:
To exercise any of these rights, contact us at support@mossforge.dev. We will respond within 30 days. We may need to verify your identity before processing your request.
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk · 0303 123 1113.
We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS 1.2+) and at rest (AWS KMS), API key authentication for all API access, IAM least-privilege policies across AWS infrastructure, and regular review of access controls.
No method of transmission over the internet is 100% secure. We will notify you and the ICO in the event of a data breach that poses a risk to your rights and freedoms, as required by UK GDPR.
Our website may use essential cookies required for authentication and session management. If and when we introduce analytics cookies (via PostHog), we will update this policy and implement a cookie consent mechanism as required by the UK Privacy and Electronic Communications Regulations (PECR).
The Service is not directed at anyone under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a person under 18, please contact us at support@mossforge.dev and we will delete it promptly.
We may update this Privacy Policy from time to time. Where changes are material, we will notify registered users by email before the changes take effect. The "Last updated" date at the top of this page will always reflect the most recent revision. Continued use of the Service after an updated policy takes effect constitutes acceptance of the revised terms.
MossForge
Email: support@mossforge.dev
Website: mossforge.dev
For data protection queries, use the subject line: Data Protection — NarrateAI