Privacy Policy — Teddson

Who we are

Teddson (“Teddson”, “we”) runs Teddson and decides how your personal data is used, which makes us the data controller. We are based in Lagos, Nigeria and follow the Nigeria Data Protection Act 2023 (NDPA). Where the EU or UK GDPR or other privacy laws apply to you, we follow them too.

For any privacy question or request, email you@yourdomain.com.

What we collect

Account details: your name, email address and password. We store only a scrambled (hashed) version of your password, never the password itself.
Your content: the videos, audio, voice samples, photos, links, prompts and scripts you upload or type, and what Teddson makes from them.
Voice and face data: when you clone a voice or animate a photo, the samples and photos you provide. These are sensitive, so we only process them because you choose to and confirm you have the right, and you can delete them at any time.
Usage records: what you create, when, with which AI model, and whether it succeeded, so the Service works and limits can be applied fairly.
Security records: sign-in attempts, lockouts, rate-limit hits and password changes, with the IP address and time, to protect accounts and stop abuse.
Consents: when you accepted these policies, and when you confirmed you had the right to use a voice, face or video.

We use one essential cookie to keep you signed in. We don't use advertising or cross-site tracking cookies.

Why we use it, and our legal basis

To provide Teddson to you (contract): your account, storing your files, running the AI tools you ask for, and sending account emails.
To keep Teddson safe (legitimate interests, and legal obligations): preventing fraud and abuse, enforcing our Terms, and investigating complaints.
Voice cloning and lip sync (your consent): you can withdraw it at any time by deleting the voice or content.
To improve Teddson (legitimate interests): fixing errors and understanding which features are used, from usage records, not by reading your content.

We don't sell your personal data, we don't use it for advertising, and we don't use your content to train our own AI models.

Who we share it with

To make what you ask for, Teddson sends the content needed for that task to these services, which process it for us:

Anthropic, OpenAI and Google (Gemini) to write scripts, research topics, pick clips and suggest titles, using the text and transcripts you give them.
ElevenLabs and Fish Audio to turn text into speech and create voice clones from the voice samples you provide.
fal.ai and Replicate to generate images, video clips and voices from your prompts and reference files.
AssemblyAI to transcribe the audio of videos you upload, word by word.
Pexels, Pixabay, Openverse, Wikimedia Commons, NASA and the Internet Archive to receive search words (never your files or account details) to find stock footage and music.
Our hosting, database, file-storage and email providers to keep the Service running, store your files and send account emails such as password resets.

They may only use your data to provide their service, under their own privacy and security commitments. Some AI tools can run on our own servers instead, in which case your content isn't sent to an outside provider for that task.

We may also share data when the law requires it, to protect people from harm, or as part of a merger or sale of the business (you'd be told first).

International transfers

Several of these providers are in the United States, the European Union and other countries, so your data may be processed outside Nigeria. We only use providers that protect personal data to a standard comparable to the NDPA and GDPR, for example through contractual safeguards, and we record the basis for each transfer as the NDPA requires.

How long we keep it

Account details: while your account is open.
Your content and voices: until you delete them or your account. Deleted files may stay in backups for up to 30 days.
Security records: up to 12 months, unless needed longer to deal with abuse or a legal claim.
Password reset links: they expire after 30 minutes and are deleted once used.

When you delete your account, we delete your content and personal data, except what the law requires us to keep.

How we protect it

Connections are encrypted, passwords are hashed, files are private to your account and served only to you, sign-ins are rate-limited with a lockout after repeated failures, and access to our systems is restricted. No system is perfectly secure; if a breach is likely to put you at high risk, we will tell the Nigeria Data Protection Commission (NDPC) within 72 hours and tell you without delay, as the NDPA requires.

Your rights

You have the right to:

know what we hold about you and get a copy;
correct anything inaccurate;
have your data deleted;
restrict or object to how we use it, including for direct marketing;
withdraw consent at any time (this doesn't affect what was done before);
take your data with you in a common format;
not be subject to decisions with legal or similar effects made only by automated means. Teddson's automatic security measures, such as temporary sign-in lockouts, can be reviewed by a person if you ask.

You can delete content and voices yourself in the app. For anything else, email you@yourdomain.com; we reply within one month. You can also complain to the Nigeria Data Protection Commission (NDPC), or to the data protection authority where you live.

Children

Teddson is only for people aged 18 and over. If we learn that an account belongs to someone younger, we close it and delete its data.

Changes to this policy

We'll post any update here with its date and, for important changes, tell you by email or in the app before they take effect.