Privacy Policy

We are committed to handling your personal data responsibly and transparently. This Policy explains what we collect, why we collect it, how long we keep it, and what rights you have over it.

We comply with Singapore's Personal Data Protection Act 2012 (PDPA), as amended. Where our users are located in the EU, EEA, or UK, we also comply with the General Data Protection Regulation (GDPR) and UK GDPR. Where applicable, we comply with the California Consumer Privacy Act (CCPA/CPRA).

The data controller for your personal data is:

For GDPR purposes, Extraudinary acts as the data controller for the personal data of EU/EEA/UK users of Extraudinary.

3.1 Data you provide directly

3.2 Data generated automatically

3.3 Data from third parties

When you sign in with Google or another OAuth provider via Clerk, we receive your name and email address from that provider. We do not receive any other data from third-party providers.

3.4 Sensitive data — voice recordings

We do not:

• Sell your personal data to any third party
• Share your data for advertising or marketing purposes
• Use your data to build profiles for sale to third parties
• Use your recordings or transcripts to train AI models. If you set up voice cloning, your voice samples are used only to create your own voice clone
• Make solely automated decisions about you that have legal or similarly significant effects, without human review

5.1 Singapore (PDPA)

Under Singapore's PDPA, we collect, use, and disclose personal data only with your consent or where the PDPA permits us to do so without consent (for example, to evaluate an applicant for employment, or where the data is publicly available). We obtain your consent at registration and at the point of using the voice recording feature. You may withdraw consent at any time (see Section 11).

5.2 EU/EEA/UK (GDPR)

Our lawful bases for processing under GDPR are:

• Contract performance — processing necessary to provide the Service you have signed up for
• Consent — for voice recordings (sensitive data)
• Legitimate interests — product improvement, security, fraud prevention, where your interests and rights do not override ours
• Legal obligation — where we are required by law to process your data

Optional analytics cookies and tracking scripts are used only after you have given consent through our cookie banner.

We share data with the following third-party service providers, only to the extent necessary to deliver the Service. Each is bound by contractual data protection obligations.

If you accept optional analytics cookies, we share limited usage data with Google Analytics and PostHog for product analytics. We do not share your data with advertising networks or data brokers.

We may disclose personal data to law enforcement authorities, regulators, or courts when required by applicable law or a valid legal order. We will notify you of such disclosure where permitted by law.

Extraudinary uses a minimal number of cookies and browser storage mechanisms. We do not use advertising cookies or tracking pixels. Optional analytics scripts run only if you consent to them.

Essential cookies (authentication)

Clerk, our authentication provider, sets session cookies necessary to keep you logged in. These cookies are strictly necessary for the Service to function. They cannot be disabled without breaking your ability to sign in.

For full details on cookies, including how to manage them, see our Cookie Policy.

Extraudinary is based in Singapore. Our third-party service providers are primarily located in the United States. When we transfer personal data outside Singapore, we take steps to ensure that appropriate safeguards are in place in accordance with the PDPA's transfer limitation obligation.

For EU/EEA/UK users, transfers to the US rely on Standard Contractual Clauses (SCCs) with our service providers where applicable. Clerk, Google, and Stripe maintain Standard Contractual Clauses or equivalent data protection agreements.

You may request information about the specific safeguards in place for your data by contacting privacy@extraudinary.com.

You may delete individual recordings at any time from within the Service. To request full account deletion, email support@extraudinary.com.

We apply the following technical and organisational security measures:

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of data at rest using AES-256 (Google Cloud Storage)
• Access controls and authentication requirements for all systems
• Signed, time-limited URLs for accessing stored recordings (files are not publicly accessible)
• Regular dependency security reviews

No system is completely secure. We cannot guarantee absolute protection against all threats. In the event of a personal data breach, we will act promptly: notifying the Singapore PDPC within 3 business days of confirming a notifiable breach, and notifying affected individuals where the breach is likely to cause significant harm — in accordance with the PDPA and any other applicable notification requirements.

If you discover a security vulnerability, please report it responsibly to privacy@extraudinary.com.

11.1 All users (Singapore PDPA)

• Access — request information about personal data we hold about you and how it has been used or disclosed in the past 12 months
• Correction — request correction of inaccurate, incomplete, or misleading data
• Withdrawal of consent — withdraw consent at any time with reasonable notice; note that withdrawing consent for essential processing may affect your ability to use the Service
• Data portability — request transmission of your data in a machine-readable format to another organisation, where applicable under the PDPA

11.2 EU, EEA, and UK users (GDPR)

In addition to the rights above, GDPR users have the right to:

• Erasure — request deletion of your personal data where there is no overriding legitimate interest or legal obligation to retain it
• Restriction — request that we restrict processing while a dispute is resolved
• Object — object to processing based on legitimate interests
• Lodge a complaint — with your local supervisory authority (e.g. the ICO in the UK, or your EU member state's authority)

11.3 California residents (CCPA/CPRA)

California residents have the right to know, access, correct, delete, and opt out of the sale or sharing of personal information. We do not sell your personal data. To submit a CCPA request, email privacy@extraudinary.com. We will respond within 45 days.

How to exercise your rights

Email privacy@extraudinary.com with your name, the email address associated with your account, and a description of your request. We will acknowledge your request within 10 business days and respond substantively within 30 calendar days. We may need to verify your identity before processing the request.

Singapore users may also lodge a complaint with the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.

Extraudinary is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child under 18 has provided us with personal data, please contact privacy@extraudinary.com and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. We will notify you of material changes by email or by a prominent notice in the Service at least 14 days before the changes take effect.

The "Last updated" date at the top of this page reflects the most recent revision. We encourage you to review this Policy periodically. Continued use of the Service after the effective date of changes constitutes acceptance of the updated Policy.

For any privacy-related questions, to exercise your rights, or to raise a concern:

We take privacy concerns seriously and will respond to all legitimate requests as promptly as possible.