Privacy Policy

Effective Date: July 27, 2026

This Privacy Policy explains how Cling AI Inc., doing business as LeapFun AI ("LeapFun," "we," "us," or "our"), collects, uses, discloses, retains, and protects personal information when you access or use our websites, applications, AI voice tools, APIs, and related services (collectively, the "Services").

LeapFun provides artificial-intelligence-powered voice and audio services, which may include text-to-speech, AI voice generation, voice cloning, voice design, voice libraries, audio generation, batch generation, and other related voice and audio tools.

This Privacy Policy includes an integrated Cookie and Similar Technologies Policy and a California Notice at Collection and CCPA/CPRA Privacy Notice.

By accessing or using the Services, you acknowledge the data practices described in this Privacy Policy.

1. Scope

This Privacy Policy applies to personal information we process when:

• you visit or use a LeapFun website, application, or Service;

• you create or manage a LeapFun account;

• you use AI voice, audio-generation, or voice-cloning features;

• you upload text, prompts, audio, voice recordings, reference audio, or other content;

• you create or use AI-generated voices or cloned voices;

• you purchase subscriptions, Credits, or other paid Services; or

• you communicate with us or request customer support.

This Privacy Policy does not apply to third-party websites, applications, or services that we do not control.

For certain enterprise or business customers, LeapFun may process personal information on behalf of the customer as a service provider or processor. In those circumstances, additional contractual terms or a Data Processing Addendum ("DPA") may apply.

2. Definitions

For purposes of this Privacy Policy:

"Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual, as defined by applicable law.

"Customer Content" means content that you submit, upload, process through the Services, or generate using the Services, including text, prompts, audio, voice recordings, reference audio, generated audio, and related files.

"Voice Data" means voice recordings that we process in connection with voice-related Services and information derived, extracted, or otherwise associated with those recordings.

"Input" means content submitted by a user to the Services.

"Output" means content generated by the Services in response to a user request.

3. Information We Collect

We may collect the following categories of information.

A. Account and Contact Information

When you create an account, manage a Workspace, purchase Services, or communicate with us, we may collect:

• name;

• email address;

• account identifiers;

• organization or Workspace information;

• account preferences;

• your communications with LeapFun; and

• customer-support requests.

B. Customer Content

We process Customer Content that you submit to, or generate through, the Services, including:

• text used for text-to-speech generation;

• scripts;

• prompts;

• audio files;

• voice recordings;

• reference audio;

• generated audio;

• voice settings;

• generation parameters;

• uploaded files; and

• other content you choose to submit.

Depending on what you choose to submit, Customer Content may contain personal information. Please do not submit personal information that is unnecessary for your use of the Services.

4. Voice Data

When you use voice cloning, AI voice generation, voice design, or other related features, we may process Voice Data.

Voice Data may include:

• uploaded voice recordings;

• reference voice samples;

• speaking style and vocal characteristics;

• technical representations or embeddings extracted from voice recordings;

• information used to generate synthetic speech;

• cloned or generated voice models; and

• synthetic audio generated using a voice.

We primarily process Voice Data to provide the voice-related Services that you request.

Depending on applicable law, the technical method used, and the purpose of processing, certain Voice Data may be considered:

• sensitive personal information;

• biometric information;

• a biometric identifier;

• a voiceprint; or

• another specially regulated category of information.

LeapFun does not treat all Voice Data as biometric information or a biometric identifier in every circumstance.

Unless we expressly state otherwise, LeapFun does not use Voice Data to verify a person's identity or to determine whether an unknown voice belongs to a particular identified individual.

We do not use Voice Data to infer sensitive characteristics such as:

• race;

• ethnicity;

• religion;

• health status;

• sexual orientation;

• political opinions; or

• similar sensitive personal characteristics.

5. Voice Cloning, Authorization, and Consent

Voice cloning requires special care because a person's voice may be identifying, commercially valuable, or legally protected.

You may upload, submit, clone, or use a voice only if:

• the voice belongs to you; or

• you have obtained all rights, permissions, authorizations, and consents legally required to use that voice for the relevant purpose.

You may not use LeapFun to impersonate another person in a deceptive, fraudulent, unlawful, or unauthorized manner.

Before allowing a user to create or use a cloned voice, LeapFun may require confirmation of:

• voice ownership;

• authorization; or

• applicable consent.

We may retain information reasonably necessary to document authorization or consent, including:

• account identifiers;

• voice or model identifiers;

• the date and time of consent;

• the version of the authorization or consent language presented at the time; and

• related security or audit information.

If applicable law requires us to provide a separate written notice or obtain consent, a written release, or another authorization before collecting, processing, storing, or disclosing certain Voice Data, LeapFun will obtain the required consent, authorization, or permission before conducting that processing.

Where required by applicable law, we may provide additional information about:

• the categories of Voice Data collected;

• the purposes of collection and processing;

• the expected period for which the information will be stored or used;

• the persons or categories of persons to whom the information may be disclosed; and

• applicable retention and destruction requirements.

We may suspend, restrict, disable, or delete a voice model if we reasonably believe that:

• the voice was submitted without appropriate authorization;

• the voice is being used for deceptive impersonation;

• applicable consent requirements were not satisfied;

• the relevant use violates applicable law; or

• the relevant use violates our Terms of Service or other policies.

Additional requirements may be set out in our Terms of Service, Acceptable Use Policy, Voice Authorization and Consent Terms, or other supplemental policies.

6. Biometric Information and Voiceprints

Certain laws may specially regulate biometric identifiers, biometric information, voiceprints, or similar information.

Whether particular Voice Data constitutes biometric information depends on the circumstances, including:

• applicable law;

• the technical characteristics of the data;

• the purpose of processing; and

• whether the data is used to identify, verify, or authenticate an individual.

If Voice Data processed by LeapFun constitutes a biometric identifier, biometric information, voiceprint, or similar regulated data under applicable law, LeapFun will process that data in accordance with applicable legal requirements.

Where required, this may include:

• providing notice regarding collection or storage;

• describing the purpose and expected duration of processing;

• obtaining required consent, a written release, or other authorization before processing;

• limiting disclosure or dissemination;

• applying appropriate security safeguards; and

• establishing and following applicable retention and destruction procedures.

LeapFun does not sell or lease biometric identifiers, biometric information, voiceprints, or Voice Data.

7. Retention and Destruction of Biometric Information and Voice Data

We retain Voice Data only for as long as reasonably necessary to:

• provide the Services you request;

• maintain voice models or projects that remain active;

• support legitimate security and fraud-prevention purposes;

• comply with legal obligations;

• resolve disputes; and

• enforce our agreements.

When you delete a voice model or related content, we will take reasonable steps, consistent with applicable deletion procedures, to delete or de-identify related Voice Data from active systems, subject to:

• limited backup retention;

• fraud and abuse prevention;

• security requirements;

• legal obligations;

• valid legal process; and

• dispute resolution.

Deletion from active systems does not necessarily mean that data will be immediately removed from routine backup systems. Backup copies may remain for a limited period under our backup, security, and disaster-recovery procedures and remain subject to applicable retention and deletion requirements.

If Voice Data constitutes a biometric identifier or biometric information under applicable law, LeapFun will establish and follow the retention and destruction rules required by that law.

If the Illinois Biometric Information Privacy Act ("BIPA") or a similar law applies, LeapFun's policy is to permanently destroy the applicable biometric identifier or biometric information at the earlier of:

1. the date on which the initial purpose for collecting or obtaining the information has been satisfied; or

2. three (3) years after the individual's last interaction with LeapFun.

If applicable law or valid legal process requires a different retention period, we will comply with that requirement. If another applicable law requires destruction on a different schedule, LeapFun will follow that law.

Backup copies containing regulated Voice Data or biometric information will be retained only for a limited period under applicable backup-retention procedures and legal requirements. We will not restore that information to active production systems unless reasonably necessary for disaster recovery, security, legal compliance, or valid legal process.

8. How We Use Information

We may use personal information for the following purposes.

A. Providing and Operating the Services

This includes:

• creating and managing accounts;

• authenticating users and logins;

• managing organizations and Workspaces;

• processing text-to-speech requests;

• processing uploaded audio and voice recordings;

• creating and operating voice clones;

• generating synthetic audio;

• saving projects and generated content;

• providing voice libraries and related features;

• processing subscriptions and Credits; and

• providing Services requested by users.

B. Maintaining and Improving the Services

We may use information to:

• monitor system performance;

• troubleshoot errors;

• improve reliability;

• reduce latency;

• understand feature usage;

• optimize service infrastructure;

• develop new features;

• evaluate generation quality;

• improve AI-model routing; and

• perform internal data analysis.

Where reasonably practicable, we use aggregated or de-identified information for analytics and service improvement.

C. Security, Safety, and Abuse Prevention

We may process information to:

• protect account security;

• detect unauthorized access;

• prevent fraud;

• investigate platform abuse;

• detect deceptive or unauthorized voice cloning;

• investigate impersonation complaints;

• investigate intellectual-property complaints;

• enforce our Terms of Service and related policies; and

• protect the rights and interests of LeapFun, our users, and others.

Where reasonably necessary, we may review Inputs, Outputs, or related account activity for security, user safety, abuse prevention, fraud detection, legal compliance, and platform-policy enforcement.

D. Communicating With You

We may use your contact information to:

• provide customer support;

• send account notices;

• send security notices;

• provide billing or transaction information;

• notify you of material changes to the Services; and

• send marketing communications where permitted by law.

You may unsubscribe from marketing communications. Even after you unsubscribe, you may continue to receive transactional messages, administrative notices, security notices, and other communications necessary to provide the Services.

E. Legal Compliance

We may process personal information where reasonably necessary to comply with applicable law; respond to lawful judicial or governmental requests; establish, exercise, or defend legal rights; enforce our agreements; and protect lawful interests, personal safety, and property.

9. AI Model Training and Service Improvement

LeapFun may use aggregated, statistical, or de-identified information to analyze and improve the Services.

Unless you expressly opt in to a separate data-contribution, research, or model-improvement program, LeapFun will not use your private Customer Content, including private voice recordings and private voice clones, to train LeapFun's own general-purpose AI models.

We may use feedback that you voluntarily provide to evaluate and improve the Services.

LeapFun uses third-party AI models, cloud infrastructure, AI-model inference providers, and other service providers to deliver certain features. When necessary to fulfill your request, Customer Content may be transferred to those providers for processing.

Depending on the feature and provider, information transferred may include:

• text;

• prompts;

• audio;

• reference voice recordings;

• generation parameters; and

• technical metadata.

Third-party service providers' data-retention and model-training practices may vary based on the provider, the particular service used, our contractual arrangement with the provider, and the technical configuration applied.

Where commercially and technically feasible, LeapFun seeks to use APIs, enterprise services, or other contractual arrangements that limit unnecessary use of Customer Content, including use for training general-purpose AI models.

LeapFun does not represent that every third-party provider offers identical retention or model-training terms. We periodically review provider terms and may change providers over time.

Where required by applicable law, contract, or commitments we make to customers, we use appropriate contractual, organizational, and technical measures to manage third-party processing of Customer Content.

10. Payment and Transaction Information

If you purchase subscriptions, Credits, or other paid Services, we and our payment processors may process:

• billing information;

• transaction records;

• subscription information;

• payment-method information;

• billing address;

• purchase amount; and

• payment status.

Payment-card information is generally processed directly by third-party payment processors. LeapFun generally does not receive or store your complete payment-card number.

11. Device, Log, and Usage Information

When you use the Services, we may automatically collect:

• IP address;

• browser type;

• operating system;

• device type;

• approximate location inferred from IP address;

• pages or features accessed;

• login activity;

• dates and times of access;

• AI-generation activity;

• Credits usage;

• error logs;

• performance information;

• security information; and

• fraud-prevention signals.

We use this information to operate, secure, analyze, maintain, and improve the Services.

12. Cookie and Similar Technologies Policy

This section forms part of this Privacy Policy and explains how LeapFun uses cookies, local storage, software development kits ("SDKs"), pixel tags, web beacons, and other similar technologies on our websites, applications, and related online Services (collectively, "Cookies and Similar Technologies").

A. What Are Cookies and Similar Technologies?

Cookies are small data files stored by a website or online service in your browser or on your device. Similar technologies may store or read information in a browser, local storage, mobile application, or server-side record. They may be used to recognize a browser or device, maintain sessions, remember preferences, support security, measure performance, and understand use of the Services.

B. Categories We Use

Category	Primary Purposes and Examples	Typical Duration	Your Choices
Strictly Necessary Cookies	Used for login, authentication, session management, account security, load balancing, fraud prevention, payment flows, and features that you expressly request. Without these technologies, the Services may not function properly.	Generally session-based or retained only as long as necessary for security, authentication, and service functionality. More information about particular technologies and durations may be provided in this Policy, Cookie Settings, or another appropriate notice.	Always active and generally not based on consent. You may block them through your browser, but portions of the Services may not function.
Functional and Preference Cookies	Used to remember language, interface, audio, Workspace, or other personalization settings so your choices can persist across visits.	Varies by Cookie, technology, or provider. More information about specific durations may be provided in this Policy, Cookie Settings, or another appropriate notice.	May be enabled or disabled in Cookie Settings. If disabled, some preferences may not be saved.
Analytics and Performance Cookies	Used to understand page and feature use, measure traffic, diagnose errors, monitor performance, improve reliability, and evaluate product experience. We seek to use configurations that limit unnecessary collection and advertising use.	Varies by analytics tool, technology, and configuration. More information about specific durations may be provided in this Policy, Cookie Settings, or another appropriate notice.	Where required by applicable law, enabled only after consent. You may withdraw consent at any time.
Advertising or Targeting Cookies	LeapFun currently does not use private Voice Data or private voice clones for targeted advertising and does not plan to sell or share personal information through Cookies for cross-context behavioral advertising. If we introduce such technologies, we will update this Policy and provide required consent and opt-out mechanisms.	Not currently applicable. If enabled in the future, we will update this Policy and provide relevant information through Cookie Settings or another appropriate notice.	Not enabled by default at this time. If enabled in the future, we will provide an applicable "Do Not Sell or Share" or equivalent opt-out choice.

C. First-Party and Third-Party Technologies

First-party Cookies are set by LeapFun. Third-party Cookies or Similar Technologies are set or read by providers that support authentication, payment processing, infrastructure, analytics, performance monitoring, security, or other services on our behalf. Third-party providers may process information only in accordance with applicable contracts, configurations, and legal requirements; however, when you interact directly with an independent third party, that party's own privacy policy may apply.

D. Cookie Information and Preference Controls

"Cookie Settings" on our website or in our application is primarily used to provide information about applicable Cookie categories and preference controls. Because the technologies, domains, providers, and retention periods we use may change with service configuration, we may provide additional information about the names, providers, categories, purposes, and durations of specific Cookies or Similar Technologies through Cookie Settings, this Policy, or another appropriate notice. Certain strictly necessary server-side security, session, or infrastructure technologies may not appear as browser-visible Cookies.

E. Consent, Withdrawal, and Changing Preferences

In jurisdictions where applicable law requires consent, we obtain consent before setting or reading non-essential Cookies. Refusing non-essential Cookies will not prevent use of the core features of the Services. You may change your preferences or withdraw consent at any time through Cookie Settings in the website footer or application. Withdrawing consent should be as easy as giving it and will not affect processing lawfully conducted before withdrawal.

F. Browser and Device Controls

Most browsers allow you to review, delete, or block Cookies. You may also clear local storage, reset advertising identifiers, or change device privacy settings. Browser or device controls operate independently from LeapFun's Cookie Settings, and you may need to set preferences separately for each browser, device, or account.

G. Effects of Blocking Cookies

Blocking Strictly Necessary Cookies may prevent you from logging in, maintaining a session, completing a payment, saving a project, using security features, or accessing other core portions of the Services. Disabling Functional or Analytics Cookies generally will not block core Services, but may reduce personalization, preference storage, troubleshooting, and performance-improvement capabilities.

H. Updates to This Cookie Policy

We may update this section when technologies, providers, laws, or the Services change. We will provide notice of material changes as required by applicable law. Cookie Settings, relevant product interfaces, or other supplemental notices may be updated more frequently to reflect technologies currently in use and available preference controls.

13. Online Tracking, Do Not Track, and Global Privacy Control

Some web browsers allow users to transmit a "Do Not Track" ("DNT") signal. Because there is no universally accepted DNT standard that applies across all websites and services, our Services do not currently interpret a general DNT signal as a particular legal request.

DNT is different from Global Privacy Control ("GPC") or another legally recognized opt-out preference signal. For a valid GPC or equivalent signal that applicable law requires us to recognize, LeapFun will treat the signal as a request to opt out of sale and sharing for the relevant browser or device, without requiring you to create an account or submit a verifiable consumer request.

If you are logged in, and applicable law requires it and it is technically reasonably feasible, we may associate the relevant opt-out preference with your account. A browser-level signal generally applies only to the browser or device that transmitted it.

LeapFun currently does not sell personal information as defined by applicable U.S. state privacy laws and does not share personal information for cross-context behavioral advertising. As a result, a GPC signal may not currently change our actual processing. If our practices change, we will update this Policy, Cookie Settings, and applicable opt-out mechanisms.

We do not authorize third parties to use private Voice Data or private voice clones for targeted advertising. Cookie preferences, marketing-communication unsubscribe choices, and GPC are separate controls and may need to be configured separately.

14. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients.

A. Service Providers

We may use third-party companies to assist with:

• authentication;

• cloud hosting;

• computing infrastructure;

• databases;

• file and audio storage;

• AI-model inference;

• AI-content generation;

• payment processing;

• analytics;

• email and communications;

• security;

• fraud prevention; and

• customer support.

These providers may process information to the extent necessary to provide services to LeapFun and are subject to applicable contractual and legal requirements.

B. AI and Model Service Providers

LeapFun may route AI-generation requests to third-party AI, voice, or AI-model service providers. Depending on the feature, we may send those providers text, prompts, audio, reference voice recordings, generation settings, and technical information necessary to complete the request.

We seek to limit transferred information to what is reasonably necessary to provide the feature you request.

If applicable law treats certain Voice Data as biometric information or another specially regulated category, LeapFun will comply with applicable requirements governing disclosure or dissemination, including any required notice, consent, written release, or other permission.

C. Analytics and Technology Service Providers

We may use analytics, performance-monitoring, and technology providers to understand how the Services are used, diagnose technical issues, measure system performance, and improve the Services.

The information those providers receive depends on the technologies and configurations used. Where required by applicable law, we provide appropriate notices, consent mechanisms, or opt-out choices for relevant tracking or analytics technologies.

D. Corporate Transactions

If Cling AI Inc. or LeapFun is involved in a merger, acquisition, financing, corporate reorganization, bankruptcy, asset sale, or similar transaction, personal information may be disclosed or transferred as part of that transaction, subject to applicable law.

E. Legal, Safety, and Policy-Enforcement Reasons

We may disclose relevant information if we reasonably believe it is necessary to comply with law or legal process; respond to lawful government requests; protect the rights and safety of LeapFun, our users, or others; investigate fraud, abuse, impersonation, or unlawful activity; or enforce our agreements and policies.

F. At Your Direction

We may disclose information at your direction or with your authorization. For example, if you choose to publish or share a voice, voice model, audio file, project, or other content, that information may become accessible to other users or the public.

15. We Do Not Sell Voice Data

LeapFun does not sell your Voice Data. We do not sell private voice recordings or private voice clones to data brokers, advertisers, or similar third parties. We do not use Voice Data for targeted advertising.

Under the definitions of "sale" and "sharing" in applicable U.S. state privacy laws, LeapFun currently does not sell personal information and does not share personal information for cross-context behavioral advertising.

If our practices materially change in the future, we will update this Privacy Policy and provide notices and choices required by applicable law.

16. General Data Retention Policy

We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy.

Retention periods depend on factors such as:

• the nature of the information;

• the purpose for which it was collected;

• the duration of your account or subscription;

• whether the content remains part of an active project or voice model;

• security and fraud-prevention needs;

• legal requirements;

• dispute-resolution needs; and

• contractual obligations.

Examples include:

Account Information

We may retain account information while your account remains active and for a reasonable period after account closure.

Transaction Records

We may retain transaction and billing records for accounting, tax, fraud-prevention, financial-reporting, and legal-compliance purposes.

Customer Content

We may retain Customer Content for as long as necessary to provide active projects, voice models, generated content, and Services you request.

Voice Data

Voice Data is also subject to the additional retention and destruction rules described in Section 7.

Security and Technical Logs

We may retain security and technical information for a reasonable period for system security, troubleshooting, abuse prevention, fraud detection, and system integrity.

When you delete content or close an account, we take reasonable steps to delete or de-identify related personal information from active systems, subject to applicable law, valid legal process, security requirements, fraud-prevention needs, dispute resolution, limited backup retention, and reasonable technical limitations.

Backup data is retained only for a limited period under applicable backup and disaster-recovery procedures. We may retain aggregated or de-identified information that can no longer reasonably identify an individual for a longer period.

17. Data Security

We use reasonable administrative, technical, and organizational measures designed to protect personal information against unauthorized access, loss, misuse, unauthorized alteration, unauthorized disclosure, and destruction.

Access to personal information is limited based on legitimate operational needs. Where appropriate, our safeguards may include access controls, authentication measures, encryption in transit or at rest where applicable, monitoring and logging, security-review procedures, and security controls for vendors and service providers.

No method of Internet transmission or electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your account credentials and login information.

18. Your Privacy Rights

Depending on where you reside, you may have rights regarding your personal information, including the right to:

• request access to your personal information;

• request correction of inaccurate information;

• request deletion of information;

• obtain a portable copy of certain information;

• object to certain processing;

• restrict certain processing;

• withdraw consent where processing is based on consent;

• opt out of certain uses of information;

• appeal certain decisions regarding privacy requests; and

• submit a complaint to a data-protection regulator.

These rights may be subject to exceptions or limitations under applicable law. We may need to verify your identity before processing a request.

You may submit a privacy request by emailing support@leapfun.ai. We will process and respond to your request within the time required by applicable law.

19. U.S. State Privacy Rights

Residents of certain U.S. states may have additional rights under applicable state privacy laws.

Depending on the relevant law and whether it applies to LeapFun, these rights may include:

• the right to know or access personal information;

• the right to correct inaccurate personal information;

• the right to request deletion of personal information;

• the right to obtain certain information in a portable format;

• the right to opt out of the sale of personal information;

• the right to opt out of certain sharing or targeted advertising;

• rights relating to certain sensitive personal information;

• the right to appeal certain decisions; and

• the right not to receive unlawful discriminatory treatment for exercising privacy rights.

LeapFun currently does not sell personal information and does not use Voice Data for targeted advertising.

Where legally required and technically applicable, we recognize applicable opt-out preference signals, including Global Privacy Control when the law requires us to recognize it.

Where permitted by law, an authorized agent may submit a privacy request on an individual's behalf. We may take reasonable steps to verify the identity of the individual and the agent's authority.

Detailed disclosures, the Notice at Collection, and instructions for California residents are provided in Section 20. Residents of other states may submit applicable privacy requests using the method listed in Section 18.

20. California Notice at Collection and CCPA/CPRA Privacy Notice

This section applies only to the extent that the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"), applies to LeapFun and the relevant processing activity. This section is both a California privacy notice and a Notice at Collection under the CCPA. Before or at the time we collect personal information, you may access this section directly through a conspicuous link on the relevant page or feature or in the website footer.

Unless otherwise stated, the disclosures below describe the categories of personal information that we collected, used, and disclosed for a business purpose during the twelve (12) months preceding the Effective Date, as well as categories we expect to continue collecting. We collect, use, and retain personal information only to the extent reasonably necessary and proportionate to achieve the disclosed purposes.

A. Notice at Collection: Categories, Sources, Purposes, Recipients, and Retention

None of the personal-information categories listed in the following table are currently sold or shared as those terms are defined by the CCPA. If that practice changes, we will update this Notice before the relevant processing begins and provide applicable opt-out mechanisms.

Category and Examples	Sources	Business or Commercial Purposes and Recipients	Retention Criteria
Identifiers / Name, email address, account or Workspace identifiers, IP address, device or browser identifiers, and contact information in support requests.	Directly from you; automatically from browsers, devices, or authentication services.	Account creation and administration, login authentication, communications, support, security, and fraud prevention. May be disclosed to authentication, hosting, communications, security, and support providers.	For the duration of the account and a reasonable period after closure for security, disputes, audits, and legal compliance. Logs are retained according to security and operational needs.
California Customer Records-type information and payment-related information / Name, email, billing address, transaction and subscription information. Complete card numbers are generally processed directly by payment processors.	Directly from you and from payment processors.	Subscriptions, Credits, payments, refunds, accounting, tax, and fraud prevention. May be disclosed to payment, accounting, hosting, and security providers.	As needed for transactions, tax, accounting, refunds, disputes, and legal requirements. We generally do not store complete card numbers.
Commercial information / Purchases, subscriptions, Credits, transaction status, and records of product or feature use.	Directly from you and from Service usage and payment records.	Transaction fulfillment, plan and credit administration, support, product analytics, and fraud prevention. May be disclosed to payment, hosting, analytics, and support providers.	For the duration of the account or subscription and as needed for accounting, disputes, fraud prevention, and legal requirements.
Internet or other electronic network activity / Browsing history, page and feature interactions, login activity, timestamps, error logs, performance information, and data from Cookies and Similar Technologies.	Automatically from browsers, devices, Cookies, SDKs, servers, and service providers.	Operating, securing, diagnosing, and improving the Services; measuring performance and use. May be disclosed to hosting, analytics, performance-monitoring, security, and anti-fraud providers.	Varies by log type, security need, Cookie duration, and operational purpose. Cookie-duration information is provided through this Policy, Cookie Settings, or another appropriate notice.
Geolocation information / Approximate country, state, or city inferred from IP address. We do not request or intentionally collect precise geolocation.	Inferred from IP address and network information and potentially received from security or analytics providers.	Security, fraud prevention, compliance, service localization, and analytics. May be disclosed to hosting, security, anti-fraud, and analytics providers.	Retained only as needed for security, analytics, compliance, and operations, generally with the related logs.
Audio, electronic, visual, or other sensory information / Uploaded voice recordings, reference audio, generated audio, vocal characteristics, voice models, and related technical representations.	Directly from you and generated through AI voice processing that you request.	Text-to-speech, voice cloning, voice design, generation, storage, security, and abuse prevention. May be disclosed to AI-model, inference, hosting, storage, and security providers.	Retained under Sections 7 and 16. Regulated biometric information is handled under applicable law and our published destruction rules.
Professional or employment-related information / Organization, company, title, Workspace, or business contact information that you choose to provide.	Directly from you or your organization administrator.	Enterprise-account, Workspace, permission, billing, support, and business-communication administration. May be disclosed to authentication, hosting, communications, payment, and support providers.	For the duration of the relevant organization or account relationship and a reasonable period needed for billing, disputes, security, and legal obligations.
Inferences / Product preferences, risk indicators, or usage patterns derived from account information, usage, preferences, feature interactions, or security signals.	Derived from the personal information and Service interactions described above.	Feature personalization, product improvement, security, fraud prevention, and abuse prevention. May be disclosed to analytics, security, and anti-fraud providers.	For as long as necessary for the relevant product, security, or fraud-prevention purpose. Not used to infer the sensitive characteristics listed in Section 4.
Sensitive personal information / Account login credentials; certain voiceprints or biometric information where treated by applicable law as sensitive and used to uniquely identify an individual; payment-account information generally processed by payment processors.	Directly from you and generated through authentication, payment, or voice processing.	Only to provide requested Services, secure accounts, process payments, authenticate users, prevent fraud, and comply with law. May be disclosed to contractually restricted authentication, payment, AI, hosting, and security providers.	Only as long as necessary for Services, security, payments, and legal compliance. Biometric data is additionally governed by Section 7.
Other personal information that may appear in Customer Content / Text, prompts, scripts, files, communications, or audio that you submit may contain protected classifications, education, health, or other personal information, although we do not require information unrelated to the Services.	Directly from you or from users you authorize.	Only to complete the generation, processing, storage, support, security, and legal-compliance activities you request. May be disclosed to AI, hosting, storage, and security providers necessary to complete the request.	Retained according to project, account, deletion-request, backup, security, and legal requirements. Please avoid submitting unnecessary sensitive information.

B. Categories of Sources

We may collect personal information from:

• you, including through account creation, payments, content uploads, voice recordings, support requests, and other direct interactions;

• your browser, device, Cookies, SDKs, server logs, and other automated technologies;

• your organization, Workspace administrator, or authorized team members;

• service providers that support authentication, payments, hosting, AI inference, analytics, security, communications, and customer support on our behalf; and

• third-party services that you direct us to connect or use.

C. Business or Commercial Purposes

Our business or commercial purposes for collecting, using, and disclosing personal information include providing and performing the Services; maintaining accounts and Workspaces; processing payments; authenticating users; providing AI voice and audio features; saving projects; providing support and communications; detecting security incidents, fraud, unauthorized voice cloning, and platform abuse; debugging, maintaining, and improving the Services; internal analytics; legal compliance; enforcement of agreements; and completion of corporate transactions. Additional detail is provided in Sections 8 and 14.

D. Sale, Sharing, and Disclosure for Business Purposes

During the twelve (12) months preceding the Effective Date, LeapFun did not sell personal information as defined by the CCPA and did not share personal information for cross-context behavioral advertising. We do not sell Voice Data, biometric information, or voiceprints.

We may disclose the categories of personal information listed in the table above to service providers or contractors for the business purposes described above. Recipients may include authentication, cloud-hosting, database, storage, AI-model or inference, payment, analytics, performance-monitoring, email, customer-support, security, and anti-fraud providers. We require applicable providers to process information subject to contractual and legal restrictions.

If our sale or sharing practices change, we will update the Notice at Collection and this Policy before the relevant processing begins and provide an applicable "Do Not Sell or Share My Personal Information," GPC, or other opt-out mechanism.

E. Sensitive Personal Information

LeapFun uses or discloses sensitive personal information only as reasonably necessary to provide services an average consumer would expect, secure accounts and the Services, process payments, detect fraud and abuse, comply with legal obligations, and perform other purposes permitted by the CCPA. We do not use Voice Data to infer race, religion, health, sexual orientation, political views, or other sensitive characteristics.

Based on our currently disclosed uses, we do not use or disclose sensitive personal information for additional purposes that trigger the CCPA right to "Limit the Use of My Sensitive Personal Information." If our practices change, we will provide the required limitation mechanism and conspicuous link.

F. California Consumer Rights

To the extent the CCPA applies, California residents may have the following rights:

• Right to Know and Access: request disclosure of the categories and specific pieces of personal information collected, the sources and purposes, and the categories sold, shared, or disclosed for a business purpose;

• Right to Delete: request deletion of personal information collected from you, subject to exceptions that may permit or require retention;

• Right to Correct: request correction of inaccurate personal information we maintain;

• Right to Opt Out of Sale or Sharing: direct us not to sell personal information or share it for cross-context behavioral advertising;

• Right to Limit the Use and Disclosure of Sensitive Personal Information: request limitations when relevant processing extends beyond purposes permitted by the CCPA; and

• Right to Non-Discrimination: not receive treatment prohibited by law for exercising CCPA rights in good faith.

G. How to Submit a Request

You may submit a request to know, access, delete, correct, opt out of sale or sharing, limit sensitive-personal-information use, or exercise another applicable right by emailing support@leapfun.ai.

We may also make a "Privacy Request" or equivalent online request portal available through the website, application, or account settings in the future. If such a portal is available, you may also use it to submit a request.

Where required by applicable law, we will acknowledge receipt of a request to know, delete, or correct within ten (10) business days and generally provide a substantive response within forty-five (45) calendar days. When necessary, we may extend the response period once by up to an additional forty-five (45) calendar days as permitted by law and explain the reason for the extension. Requests to opt out of sale or sharing and requests to limit sensitive-personal-information use will be processed as soon as practicable and no later than the deadline required by applicable law.

H. Identity Verification and Authorized Agents

To protect your information, we may require you to verify your identity or sign back into your account based on the type of request, the sensitivity of the information, and potential risk. We will not require unnecessary identity verification for an opt-out of sale or sharing or a request to limit sensitive-personal-information use.

You may designate an authorized agent to submit a request on your behalf. We may require the agent to provide proof of written authorization signed by you, and we may require you to confirm the authorization directly or verify your identity, except where an agent with a valid power of attorney is not required by law to provide duplicative proof.

I. Denials, Inability to Verify, and Legal Exceptions

We may be unable to fully satisfy a request if we cannot reasonably verify your identity, cannot associate the information with you, determine that the request is manifestly unfounded or excessive, or are permitted by applicable law to deny or limit the request. Where required by law, we will explain our decision and the applicable reason.

J. Minors

LeapFun's standard Services are intended only for persons who are at least 18 years old. We do not knowingly sell or share the personal information of consumers under 16 years of age. Additional restrictions regarding minors' voices and personal information are described in Section 23.

K. Financial Incentives

LeapFun does not currently offer a CCPA financial incentive or price or service difference in exchange for collecting, selling, sharing, or retaining personal information. General promotions, free trials, Credits, or discounts do not necessarily constitute financial incentives. If we introduce a program regulated by the CCPA, we will provide a separate Notice of Financial Incentive and obtain any legally required opt-in consent before enrollment.

L. Data Retention and Annual Updates

We do not retain personal information indefinitely in a manner disproportionate to the disclosed purposes. Applicable retention criteria are described in the table above and in Sections 7 and 16. We review and update this California notice at least once every twelve (12) months, or earlier if there is a material change to our collection, use, sale, sharing, sensitive-personal-information practices, or consumer-rights mechanisms.

21. European Economic Area, United Kingdom, and Switzerland

If you are located in the European Economic Area ("EEA"), the United Kingdom, or Switzerland, applicable data-protection laws may provide additional rights.

Depending on the processing activity, we may rely on the following legal bases.

A. Performance of a Contract

We may process personal information when necessary to provide the Services you request, including account creation, AI voice generation, voice cloning, project management, subscriptions, and payments.

B. Legitimate Interests

We may process personal information when necessary for legitimate purposes such as maintaining and improving the Services, security, fraud and abuse prevention, analytics, customer support, and protection of our legal interests, provided that those interests are not overridden by your rights and interests.

C. Consent

For certain processing activities, we may request your consent. Where processing is based on consent, you may withdraw it at any time. Withdrawal will not affect the lawfulness of processing conducted before withdrawal.

D. Legal Obligation

We may process personal information where necessary to comply with an applicable legal obligation.

E. Special Categories of Personal Data

Certain types of personal information may receive additional protection under applicable data-protection laws.

If certain Voice Data constitutes special-category data, including biometric data processed for the purpose of uniquely identifying an individual, LeapFun will process that data only when an applicable legal condition is satisfied. Where required and appropriate, this may include obtaining the individual's explicit consent before processing.

LeapFun does not automatically treat all information related to a person's voice as biometric or special-category data. Whether Voice Data receives special-category protection depends on the technical processing performed, the purpose of processing, whether the information is used to uniquely identify or authenticate an individual, and applicable law.

If consent is the applicable legal basis for processing special-category data, you may withdraw that consent in accordance with applicable law. You may also have the right to lodge a complaint with the data-protection authority where you live.

22. International Data Transfers

LeapFun is operated by a U.S. company and may use service providers located in the United States and other countries or regions. As a result, your personal information may be transferred to and processed outside the country or region where you reside.

Where required by applicable law, we use appropriate safeguards for international data transfers. These safeguards may include Standard Contractual Clauses ("SCCs"), contractual data-protection obligations, or other lawful cross-border transfer mechanisms.

23. Children and Minors

The Services are intended only for persons who are at least 18 years old.

You may not use the Services to upload, submit, clone, create a voice model from, or otherwise process the voice of any person under 18 years of age.

This restriction applies even if you are the minor's parent or legal guardian.

The only exception would be a separate Service or feature that LeapFun expressly launches in the future to permit such processing and that includes appropriate consent processes, identity or guardian verification, safety protections, and legal-compliance procedures.

LeapFun does not knowingly provide voice-cloning functionality for minors through its standard Services.

If we learn that the voice or personal information of a person under 18 has been submitted to LeapFun in violation of this Policy, we may delete the content, disable or delete the related voice model, restrict or terminate the account, or take other reasonable measures.

If you believe that a minor's voice or personal information has been improperly submitted to LeapFun, contact us at support@leapfun.ai.

24. Third-Party Services

The Services may contain links to or integrations with third-party websites, applications, AI service providers, infrastructure providers, payment providers, analytics providers, or other third-party services.

We do not control the independent privacy practices of third parties. When you interact directly with an independent third-party service, that party's own terms of service and privacy policy may apply.

25. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Services, new features, technology, data-processing practices, service providers, or legal and regulatory requirements.

Where required by applicable law, we will provide notice of material changes. The "Effective Date" at the top of this Privacy Policy indicates when this Policy was most recently updated. We will periodically review the California notice and Cookie Policy in light of applicable law and our actual technical configuration.

26. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or if you wish to exercise an applicable privacy right, contact:

Cling AI Inc.Doing business as LeapFun AI

Email: support@leapfun.ai

When submitting a privacy request, please provide enough information for us to identify your account and understand the specific request.