If you live outside the US, your personal data — including voice recordings — will be transferred to and stored in the United States, where privacy laws provide fewer protections than in the EU or UK.
EU and UK users' voice recordings and personal data are processed in the US, where they lose the direct protection of GDPR, and the policy's reliance on 'consent via using the service' as a transfer mechanism is legally questionable under GDPR Art. 49.
Cross-platform context
See how other platforms handle International Data Transfers and similar clauses.
Compare across platforms →EU and UK users' biometric voice data is being transferred to the US, a country without an adequacy decision equivalent to EU standards for all contexts, and the policy attempts to use blanket consent via service use as the transfer mechanism — which GDPR does not permit as a primary transfer basis.
(1) REGULATORY FRAMEWORK: GDPR Chapter V (Arts. 44–49) governs international data transfers and requires an adequacy decision, Standard Contractual Clauses (SCCs), Binding Corporate Rules, or an Art. 49 derogation; the EU-US Data Privacy Framework (adopted July 2023) provides a current adequacy basis for certified US companies; UK GDPR Chapter V imposes analogous requirements; the policy's reliance on user consent as a transfer mechanism is only permissible under Art. 49(1)(a) for non-repetitive transfers, not for systematic processing of all user data. (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.