Privacy policy

What we do with your data, and with the face and the voice you upload. Written for the UK GDPR and the Data Protection Act 2018.

Last updated 8 September 2026.

1. Who controls your data

Sam Adeniyi, trading as headcast, is the controller of the personal data described here. That means we decide what is collected and why.

Write to [email protected] about anything in this policy, including a request to use your rights under section 9. We do not have a data protection officer, because the law does not require us to have one.

2. What we collect

2.1 What you give us

• Account details. Your email address, a password (we store a scrypt hash of it and never the password itself), and a display name if you set one.
• Security settings. API keys, which we store only as SHA-256 hashes, and if you switch on two-step verification, its secret and your recovery codes.
• Payment details. A customer reference from our payment provider, the brand of your card and its last four digits, and your top-up settings. We never receive or store your full card number.
• Presenters. For each presenter, one photograph of a person's face and a voice sample of that same person, 8 to 30 seconds long.
• Scripts. The text you submit for each video, and the title you give it.
• Beta application. If you apply to test the service, your email address, an optional note and the internet address you asked from.
• Emails to us. Anything you write to us for support.

2.2 What we generate

• The finished video and its thumbnail, which contain the presenter's likeness and a copy of their voice.
• A log of each render, so we can see what happened if a video fails.
• A ledger line for every minute that moves on your account: purchase, reservation, use and refund.

2.3 What we collect automatically

• Sessions. When you sign in we store a hash of the session token, your internet address, your browser's user-agent string and the times the session was created and last used. This is what lets you stay signed in and lets you see your own devices.
• Server logs. Ordinary request records kept for a short time so we can find faults and abuse.

We do not run advertising, and we do not use any third-party analytics on this site.

3. Why we use it, and our lawful basis

What we do	Lawful basis
Make your account work, produce your videos, store them and let you download them	Performing our contract with you
Take payment, hold and settle minutes, handle refunds	Performing our contract with you
Send service email: password resets, a notice when a video finishes or fails, a notice when a new device signs in, and invites	Performing our contract with you
Keep the service secure, spot and stop abuse, fraud and misuse of faces and voices	Our legitimate interests
Find faults and improve the service, using render logs and error records	Our legitimate interests
Hold your beta application until we can invite you	Our legitimate interests, or your consent where you gave it by asking
Keep accounting and tax records	A legal obligation

Where we rely on legitimate interests, we have weighed our interest against your privacy. Our interest is running a small service that is not abused and does not fail silently. The data used for it is limited to security and diagnostic records, not the content of your videos, we do not combine it with anything else, we do not profile you, and none of it is used for marketing. We think a reasonable person expects this from any online service. You can object at any time under section 9.

We rely on consent only where this policy says so. Where we do, you can withdraw it at any time, and that does not affect what we did before you withdrew it.

4. Faces and voices

A photograph of a face and a recording of a voice are personal data about the person shown or heard, even when they are not our customer. We treat them that way.

We process a presenter's photograph and voice sample for one purpose: making the videos our customer asks for. We do not use them to identify anyone. We do not match a face against any database. We do not build a face or voice index across customers, and we do not use them to train our own models.

The law treats data used to identify a person by their physical features as special category biometric data, and that needs the person's explicit consent. We do not use faces or voices for identification, so we do not think we process special category data here. If a court or the regulator took a different view, the lawful basis would have to be the explicit consent of the person shown. That is why our terms require our customer to hold clear written permission from the person in the photograph and the voice sample, and to be able to produce it if we ask. If you believe your face or voice is on our service without your agreement, email [email protected] and we will investigate and remove it.

5. How long we keep it

What	How long
Presenters: the photograph and the voice sample	Until you delete the presenter in the app. Deleting it removes the files.
Scripts, videos and thumbnails	Until you delete the video. You control this.
Render logs	Kept with the video and removed with it.
Sessions	A session ends after 30 days without use, and every session ends after 90 days at the latest. The record is removed when the session ends.
Account record	While your account exists. Ask us to close it and we delete it, apart from the accounting records below.
Ledger, invoices and payment records	Six years, because UK tax and company law requires it.
Beta applications	Until we invite you or you ask us to remove you, and no more than 12 months after that.
Server logs	Up to 90 days.
Backups	Deleted items stay in encrypted backups for a short period and then age out of them.

6. Who we share it with

We do not sell personal data and we do not share it for anyone else's marketing. We do share it with the companies that do parts of the work for us, described by what they do:

What they do	What they get	Where they are
Payment processing	Your email address and the payment itself. They handle the card details; we do not.	Outside the UK, including the United States
Hosting for the application and the database	Everything the service holds	Germany
Rendering	The material needed to build your video	London, United Kingdom
Avatar generation, using HeyGen Avatar IV	The presenter's photograph and the narration	Outside the UK
Voice cloning and speech	The voice sample and your script text	Outside the UK
Picture and clip generation	Scene descriptions taken from your script, and the presenter's portrait	Outside the UK, including the United States and China
Cloud storage for finished videos	Videos and thumbnails	Outside the UK
Email delivery	Your email address and the message	Outside the UK

The current list of named providers is available on request. Email [email protected] and we will send it.

We may also share data with our accountant or a professional adviser, or with the police, a court or a regulator if the law requires it, and with a buyer if the business is ever sold, in which case this policy would continue to apply until we tell you otherwise.

7. Sending data outside the UK

As the table above shows, some of the work happens outside the United Kingdom, including in the United States and in China.

Where we send personal data out of the UK we rely on one of two things. Either the country has been found by the UK government to give adequate protection, or we put in place the UK's International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses, together with a check on the risks in that country. We will tell you which one applies to a given provider if you ask.

8. How we protect it

• Traffic to and from the site is encrypted in transit.
• Passwords are stored as scrypt hashes and API keys as SHA-256 hashes. We cannot read either one back.
• Sessions are held on the server, and the session cookie is limited to this site and is not readable by scripts in the browser.
• Backups are encrypted and held away from the main server.
• Access to the servers and the database is limited to the operator of the service.

No system is perfectly safe. If a breach happens that is likely to be a risk to you, we will tell you and the regulator as the law requires.

9. Your rights

Under the UK GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Rectification, that is correction of anything wrong or incomplete.
• Erasure of your data, where we have no continuing reason to keep it. You can already delete presenters and videos yourself in the app.
• Restriction, meaning we hold the data but stop using it, while a question about it is settled.
• Objection to any use we base on legitimate interests, including on grounds particular to your situation.
• Portability, meaning a copy of the data you gave us in a common machine-readable format, or sent directly to someone else where that is possible.
• Not to be subject to a decision made only by automatic means that has a legal effect on you or affects you in a similarly significant way. See section 13.
• Withdraw consent where we relied on it.

To use any of these, email [email protected] from the address on your account, or tell us enough to find your record. It is free. We reply within one month. If a request is unusually complex we can extend that by two months, and we will tell you if we do. We may ask you to confirm who you are first.

If your face or voice was uploaded by one of our customers, you have these rights too, and you do not need an account to use them.

10. Complaining to the regulator

If you think we have handled your data badly, please tell us first so we can put it right. You can also complain to the UK regulator, the Information Commissioner's Office, at ico.org.uk, or by telephone on 0303 123 1113. Complaining to them does not stop you taking your own legal action.

11. Age

The service is for adults. You must be 18 or over to have an account. We do not knowingly collect data about anyone under 18, and our terms forbid making videos that feature or are about children. If you think a child's data is on our service, email us and we will remove it.

12. Cookies and local storage

We set one cookie and store two things in your browser. None of it tracks you, and none of it goes to anyone else, so there is no consent banner.

Name	Type	What it is for	How long
__Host-ca_session	Cookie, strictly necessary	Keeps you signed in. It holds a session token and nothing else.	Up to 90 days, and it ends when the session ends
ca_draft	Local storage	Keeps the title and script you are typing, so you do not lose them if the page reloads.	Until you clear it or your browser storage
ca_preset and the docs language choice	Local storage	Remembers the presenter you last picked and the code language you last read the API docs in.	Until you clear it or your browser storage

The two local storage items stay in your browser. They are never sent to us as a record of your behaviour.

13. Automated decisions

We do not make any decision about you by automatic means alone that has a legal effect on you or affects you in a similarly significant way. Automatic checks do happen: a card payment is authorised or refused by the payment provider, rate limits refuse requests that come too fast, and an upload check can reject a photograph or a voice sample that is not usable. A person reviews any decision to suspend or close an account, and you can always ask us to look again by email.

14. Changes to this policy

We update this policy when what we do changes. The date at the top always shows the last update. If a change matters to you we will email the address on your account before it takes effect.

15. Contact

Email [email protected] for anything on this page: a rights request, the list of named providers, transfer details, or a concern about a face or a voice.

These documents were prepared for headcast and should be reviewed by a solicitor before launch.