Privacy Policy

Ageless Biography is a service of BrightArks LLC. We take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

1. Information We Collect

Personal Information You Provide

• Name and biographical information shared during voice conversations
• Voice recordings and transcriptions of your conversations with our biographer
• Photos you upload to include in your biography
• Email addresses (for gift purchasers and email notifications)
• Payment information (processed securely by Stripe)

Automatically Collected Information

• Usage data: Pages visited, features used, time spent
• Device information: Browser type, operating system, IP address
• Cookies and tracking: Analytics cookies (with your consent)

2. How We Use Your Information

We use the information we collect to:

• Provide the service: Generate your personalized biography
• Process payments: Handle purchases and issue access codes
• Communicate with you: Send gift codes, biography ready notifications, support responses
• Improve our service: Analyze usage patterns and fix bugs
• Comply with legal obligations: Tax reporting, fraud prevention

3. Third-Party Services We Use

To provide our service, we use the following trusted third-party processors:

4. AI Processing & Your Data

Our AI biographer, Emily, is an artificial intelligence system — not a human. Emily uses AI technology to listen to your stories, ask thoughtful follow-up questions, and help create your biography.

How AI Processes Your Data

During a voice session, your speech is processed by AI services in real time:

• Speech recognition (Deepgram) converts your voice to text
• Conversation AI (Anthropic Claude) generates Emily's responses
• Voice synthesis (Cartesia) converts Emily's responses to speech
• Transcription (OpenAI) creates written records of your conversations

AI Training Opt-Outs

Your stories, voice recordings, and transcripts are used solely to create your biography. We take specific steps to prevent our service providers from using your data for AI model training:

• Deepgram: We have opted out of Deepgram's Model Improvement Partnership, meaning your audio is not used to train their models
• Anthropic: Under Anthropic's commercial API terms, customer data is not used to train their models
• Cartesia: We have opted out of Cartesia's data training program — your data is not used to train their models. Emily's text-to-speech responses are processed by Cartesia, and all personally identifiable information is removed before text reaches Cartesia through our automated redaction pipeline
• OpenAI: Under OpenAI's API data usage policy, data submitted via the API is not used to train their models

Automated PII Redaction

We employ an automated personally identifiable information (PII) redaction pipeline to protect your sensitive data at every stage of processing:

• Before storage: Transcripts are automatically scanned and sensitive details — including phone numbers, email addresses, Social Security numbers, full dates of birth, street addresses, and financial account numbers — are redacted before being saved to our database
• Before AI processing: When transcripts are sent to AI providers (such as Anthropic) for biography generation or session summarization, a second redaction pass removes any remaining PII to minimize the data shared with third-party services
• In generated output: Biography generation prompts instruct the AI to use only first names, city-level locations, and approximate years — never full names of living non-public individuals, exact addresses, or specific dates that could identify someone

This multi-layer approach ensures that even if a data breach were to occur at any point in the pipeline, the exposed data would contain minimal personally identifiable information.

5. Data Retention and Automatic Deletion

• Voice recordings: Retained for 30 days after biography finalization, then permanently deleted
• Transcripts, photos, and biography content: Retained for 30 days after biography finalization, then permanently and automatically deleted from all systems including cloud storage
• Biography PDF: Available for download for 30 days after finalization, then permanently deleted — please download and save a copy during this period
• Account and order data: Retained for 7 years for tax and legal compliance (contains no personal biography content — only purchase records, email, and account identifiers)

After the 30-day retention window, we permanently delete all user-generated content including photographs, conversation transcripts, session recordings, AI-generated enrichments, and biography data (text and PDF). This deletion is automatic and irreversible. You will see a countdown in your dashboard and will be notified by email when your biography is ready with a reminder of this 30-day window.

6. Biometric Data

During voice conversations, your voice characteristics (pitch, tone, and speech patterns) are processed by our third-party services. Under certain state laws, including the Illinois Biometric Information Privacy Act (BIPA), voice data may constitute biometric information.

What We Collect

Voice recordings are captured during your conversation with Emily and processed by Deepgram (speech-to-text), Cartesia (text-to-speech), and OpenAI (transcription). We do not create persistent voiceprint templates or speaker-identification profiles.

Purpose

Voice data is collected and processed solely to provide the biography creation service — converting your spoken stories into a written biography.

Retention & Destruction

• Voice recordings are permanently deleted within 30 days of your conversation
• All derived voice data is destroyed when the biography purpose is satisfied or within 3 years of your last interaction, whichever comes first
• Destruction is performed by permanent deletion from all storage systems

Disclosure

We do not sell, lease, trade, or otherwise profit from your voice or biometric data. Voice data is shared only with the third-party processors named in Section 3 above, solely for the purpose of providing our service.

7. Your California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information. This section describes those rights and how to exercise them.

Categories of Personal Information Collected

As described in Sections 1 and 4 above, we collect the following categories of personal information:

• Identifiers: Name, email address, IP address
• Commercial information: Purchase history and payment records
• Internet or electronic network activity: Browsing history, pages visited, device information
• Audio and visual information: Voice recordings from biography sessions
• Inferences: Information derived from conversations to create your biography

We Do Not Sell or Share Your Personal Information

BrightArks LLC does not sell your personal information to third parties, as defined under the CCPA/CPRA. We also do not share your personal information for cross-context behavioral advertising. We have not sold or shared personal information in the preceding 12 months.

Your CCPA Rights

As a California resident, you have the following rights:

• Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You may request that we delete any personal information we have collected from you, subject to certain exceptions (such as data retained for legal compliance or to complete a transaction you requested).
• Right to Correct: You may request that we correct inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing: Because we do not sell or share your personal information, there is no need to opt out. However, if our practices change, we will provide a “Do Not Sell or Share My Personal Information” link on our website.
• Right to Limit Use of Sensitive Personal Information: We use sensitive personal information (such as voice recordings) only to provide the biography service you requested. You may request that we limit this use at any time.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. We will not deny you our service, charge you different prices, or provide a different quality of service because you exercised your rights.

How to Exercise Your Rights

You can submit a verifiable consumer request by:

• Emailing us at
• Using the account deletion feature in your account settings

You may also designate an authorized agent to make a request on your behalf. The authorized agent must provide written permission signed by you, and we may require you to verify your identity directly.

Verification Process

When you submit a request, we will verify your identity by matching information you provide with the information we have on file. For requests to know specific pieces of personal information, we require a higher degree of verification. We will respond to your verified request within 45 days. If we need additional time, we will notify you of the extension and the reason, up to a maximum of 90 days total.

Do Not Sell My Personal Information

We do not sell, rent, or trade your personal information to third parties. We have never sold personal information and have no plans to do so. If you have any questions or wish to submit a CCPA request, please email us at . We will respond within 45 days as required by the CCPA.

8. Additional State Privacy Rights

Virginia (VCDPA)

If you are a Virginia resident, the Virginia Consumer Data Protection Act provides you with the right to: access your personal data, correct inaccuracies, delete your personal data, obtain a portable copy in a commonly used format, and opt out of the processing of personal data for targeted advertising, sale, or profiling. BrightArks does not sell personal data or use it for targeted advertising or profiling. To exercise your rights, contact us at . If you are unsatisfied with our response, you may appeal by emailing or lodge a complaint with the Virginia Attorney General.

Colorado (CPA)

If you are a Colorado resident, the Colorado Privacy Act provides you with similar rights to access, correct, delete, and obtain a portable copy of your personal data, as well as the right to opt out of targeted advertising, sale of personal data, and profiling. BrightArks does not engage in any of these activities. To exercise your rights, contact us at . You may appeal any denied request, and if unsatisfied with the appeal response, you may contact the Colorado Attorney General.

Connecticut, Utah, and Other States

We are committed to complying with applicable state privacy laws as they take effect. If you reside in a state with consumer privacy legislation (including Connecticut's CTDPA and Utah's UCPA), you may exercise your rights by contacting us at . We will respond to verifiable requests within the timeframes required by your state's law.

9. Your Privacy Rights

You have the right to:

• Access your data: Request a copy of all information we have about you
• Delete your data: Request deletion of your account and all associated data
• Correct your data: Update or correct inaccurate information
• Export your data: Download your biography, photos, and transcripts
• Withdraw consent: Revoke your consent for voice/biometric data processing or analytics cookies at any time
• Request destruction: Request permanent destruction of your voice recordings and biometric data

To exercise these rights, contact us at

10. Data Security

We implement industry-standard security measures to protect your information:

• All data transmitted over HTTPS encryption
• Access codes are one-time use and cannot be reused
• Database access restricted with row-level security
• Regular security audits and updates

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our website. Below is a complete list of every tracking technology we use, what it collects, and how data flows.

Essential Cookies (No Consent Required)

• Supabase authentication cookies (sb-*-auth-token) — Stores your login session. Set by our authentication provider, Supabase. Required for you to stay signed in. Expires when you log out or after session timeout.

Analytics Technologies (Consent Required)

The following tools are loaded only after you click "Accept" on our cookie consent banner. If you click "Decline," none of these tools are loaded and no analytics data is collected.

Managing Your Preferences

You can manage your cookie preferences at any time:

• Cookie consent banner: Appears on your first visit. Click "Accept" to enable analytics or "Decline" to block all analytics tools.
• Clear your choice: Clear your browser's localStorage to reset your consent preference. The banner will appear again on your next visit.
• Browser settings: You can block third-party cookies in your browser settings to prevent Meta Pixel from tracking across sites.

Do Not Track (DNT)

Some browsers transmit "Do Not Track" (DNT) signals. We honor DNT signals by not loading PostHog or Meta Pixel when a DNT signal is detected, regardless of your cookie consent preference. Essential authentication cookies are not affected by DNT signals.

12. International Data Transfers

Your information is processed in the United States where our service providers operate. We ensure appropriate safeguards are in place in compliance with applicable US data protection laws.

13. Children's Privacy

Our service is designed for adults (18+ years). We do not knowingly collect information from children under 18. If you believe we have collected information from a child, please contact us immediately.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a notice on our website. Continued use of the service after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy or how we handle your data, please contact us: