Privacy Policy

This Privacy Policy describes how Pison Labs Ltd. (“Pison Labs”, “we”, “us”, or “our”) collects, processes, stores, and protects personal and technical data when you visit our website, utilize our developer APIs, access our speech synthesis and recognition engines, or contribute to our African language research corpora.

Under the Nigeria Data Protection Act 2023 (NDPA), Pison Labs is formally registered with the Nigeria Data Protection Commission (NDPC) as a Data Controller and Data Processor of Major Importance under the Ultra-High Level tier (NDPC UHL-2026-0417). This classification places statutory fiduciary responsibilities upon our operations, mandating annual independent compliance audits, end-to-end audit trails, and the appointment of a designated Data Protection Officer (DPO).

When enterprise customers or developers process end-user audio through our APIs, Pison Labs acts strictly as a Data Processor (or Service Provider), handling data in accordance with customer instructions, while our enterprise customers remain the respective Data Controllers.

We adhere to the principle of data minimization, collecting only information strictly requisite for operating high-throughput linguistic infrastructure and honoring contractual commitments:

• Account & Identity Information: Your name, organizational affiliation, corporate email address, encrypted authentication credentials, billing records, and tax identifiers collected when you register for an API account or request enterprise onboarding.
• API Payloads & Processing Inputs: Audio streams (e.g., WAV, MP3, OPUS), text prompts, diacritic representations, and target translation strings transmitted to our speech-to-text, text-to-speech, or translation endpoints.
• Biometric Voice & Acoustic Data: For custom voice cloning or speaker enrollment, we process raw voice recordings, acoustic frequency profiles, and timbre embeddings. These are processed exclusively pursuant to verified speaker consent.
• Consented Linguistic Field Corpora: Speech recordings collected during dedicated field campaigns across Nigeria and the African continent, collected with express written consent, fair compensation, and documented provenance.
• Telemetry & Usage Diagnostics: Request identifiers, latency metrics, token and character counts, IP addresses, client SDK versions, and response status codes used to monitor service availability and prevent distributed attacks.

Pursuant to Section 25 of the NDPA 2023, Pison Labs processes personal data strictly under the following lawful bases:

All Pison Labs foundation acoustic and linguistic models are trained exclusively on independently curated, licensed, or field-recorded corpora gathered with explicit, paid contributor consent.

Streaming audio sent to our transcription or synthesis APIs is processed ephemerally in high-speed volatile memory (RAM) and immediately deallocated once the streaming connection terminates, unless a customer has specifically enabled asynchronous batch storage or custom logging inside their enterprise workspace.

Human speech incorporates unique physiological and acoustic signatures. Because voice embeddings constitute sensitive personal and biometric data, Pison Labs implements rigorous safeguards:

• Liveness & Consent Verification: Creating a custom voice clone requires an audible, scripted affirmation read in the speaker’s natural tongue, verifying authorization to synthesize their vocal likeness.
• No Unauthorized Impersonation: We prohibit voice cloning of any living or deceased individual without express verifiable permission. Celebrity, political, or deceptive mimicry triggers instant account revocation.
• Absolute Right of Revocation: Any human voice donor or customer may revoke consent for a voice model at any time by contacting privacy@pisonlabs.com. Upon receipt of verified revocation, the corresponding voice embedding and fine-tuned checkpoints are systematically decommissioned and permanently deleted across all inference clusters within thirty (30) days.

We preserve data only for as long as required to fulfill the legitimate purposes stipulated in this policy:

Pison Labs operates primary infrastructure designed for African data sovereignty, with core data center deployments located in Lagos, Nigeria.

For global availability and ultra-low latency edge inference, certain encrypted technical payloads may transit edge networks in London, the United Kingdom, or regional cloud nodes. All cross-border data transfers comply fully with Sections 41, 42, and 43 of the NDPA 2023.

Transfers to jurisdictions outside Nigeria are executed exclusively under recognized adequacy decisions, Standard Contractual Clauses (SCCs), or explicit contractual data transfer agreements guaranteeing an equivalent standard of protection. Enterprise clients with sovereign compliance requirements may mandate strict in-country Nigerian routing via dedicated private tenancy.

We employ state-of-the-art technical and organizational security controls designed to protect speech assets against unauthorized access, alteration, or interception:

• Encryption in Transit: All HTTP and WebSocket endpoints enforce TLS 1.3 with forward secrecy and strict HSTS headers.
• Encryption at Rest: Customer database records, model checkpoints, and backup archives are encrypted using AES-256 with keys rotated through isolated Hardware Security Modules (HSMs).
• Zero-Trust Network Access: Administrative access to production environments requires hardware security keys (FIDO2/WebAuthn), least-privilege role boundaries, and continuous session auditing.
• Independent Verification: Annual external penetration tests and regulatory compliance audits filed directly with the NDPC.

Under the Nigeria Data Protection Act 2023 and applicable privacy jurisprudence, you hold enforceable rights regarding your personal information:

• Right of Access: You may request confirmation of whether we process your data and receive copies of processed records.
• Right to Rectification: You may correct inaccurate, outdated, or incomplete personal records.
• Right to Erasure (“Right to Be Forgotten”): You may demand the permanent deletion of personal information where processing is no longer legally justified.
• Right to Object or Restrict Processing: You may object to processing premised on legitimate interests or request restricted handling.
• Right to Data Portability: You may receive your personal data in a structured, commonly used, machine-readable format (JSON/CSV).
• Right to Withdraw Consent: Where processing relies on consent, withdrawal may be executed at any time without punitive consequences.
• Right to Regulatory Redress: You have the right to lodge a formal petition with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

If you wish to exercise your data subject rights, submit a voice revocation request, or inquire about our compliance posture, please contact our designated Data Protection Officer directly: