Privacy Policy
Updated 5 April 2025
This Privacy Policy ("Policy") explains how Yarn Inc. and our affiliates ("Yarn", "we", "our", or "us") process Personal Data (defined below) of individuals who use our services, including our platform, websites (e.g., yarn.io), applications, and other online services (jointly, the "Services"). This Policy also explains your rights and choices about how we use your Personal Data, including how you can access or update certain information about you.
In this Policy, "Personal Data" means any information relating to an identified or identifiable individual, such as an individual's name, address, telephone number, or email address. In certain jurisdictions, this may also be referred to as "Personal Information."
Data Controller vs. Data Processor
This Policy applies to instances in which we offer our Services and platforms to individual users. For these relationships, Yarn acts as a data controller and is governed by this Policy.
When providing Services to enterprise customers, Yarn acts as a Data Processor, processing data according to the instructions and contractual agreements with our customers who act as Data Controllers. Enterprise customers retain control over their Personal Data and are responsible for compliance with applicable data protection laws. If you are using our Services through an enterprise account, please refer to your organization's privacy policy for information on how they handle your Personal Data.
1. Categories of Personal Data We Collect:
(a) Personal Data You Provide to Us
Contact Details. When you set up an account to use our Services, we ask you to provide your contact details such as your name, email address, phone number, address, and contact preferences.
Video and Image Content. We process any video, images, or other content that you choose to share with us or input into our Services to provide video editing capabilities, as well as any Personal Data that you may decide to include in your content.
Audio Recordings and Voice Data. We collect any audio recordings or voice data that you choose to share with us, which may include Personal Data, to provide voice cloning and other audio-related features within our Services. Voice data used for voice cloning is processed only with your explicit consent and may be considered sensitive or biometric data under applicable laws. Your audio recordings will be shared securely with third-party providers, such as ElevenLabs, exclusively for the purpose of creating voice models.
Profile Information and User Content. When you sign up for our Services, you may indicate how you intend to use the Services (e.g., professional use). We collect other information you may input when you use the Services, upload files or leave feedback.
Feedback/Communications. If you contact us directly or express interest in using our Services, we collect Personal Data including your name, email address, the contents of a message or attachments that you may send to us, and other information you choose to provide. If you subscribe to our newsletter, then we will collect Personal Data from you, such as your name and email address. When we send you emails, we may track whether you open them to learn how to deliver a better customer experience and improve our Services. If you respond to a survey, we will capture your responses and any other Personal Data you provide.
Payment Details. When you register to use any of our paid Services, our third-party payment processor collects and processes your payment-related information, such as your name, email, billing address, credit/debit card or banking information or other financial information.
Other Information You Provide. We may collect other information you may provide to us, such as when you use our alpha or beta products and services, participate in our responsible disclosure program, attend events hosted by us, or interact with us online or offline.
(b) Personal Data We Collect Automatically From You and/or Your Device
Information from Cookies and Similar Technologies. We and our third-party partners may collect information about you using cookies, pixel tags, SDKs, or similar technologies. Categories of information that we may collect using cookies includes:
Location Information. When you use our Services, we infer your general location information, for example by using your internet protocol (IP) address. In some jurisdictions, we will ask for your permission before doing so.
Device Information. We receive information about the device and software you use to access our Services, including IP address, web browser type, operating system version, phone carrier and manufacturer, application installations and versions, device identifiers, mobile advertising identifiers, and push notification tokens.
Usage Information. We receive information about your interactions with our Services, such as the content you view, the actions you take or the features with which you interact when you are using the Services and the dates and times of your visits.
(c) Personal Data We Collect from Third Parties
Information from Third Parties. Where permitted by applicable laws, we may collect publicly available information from third-party sites to enable the development and training of our machine learning and AI models, including voice and video processing systems.
Third-Party Logins. If you choose to register or log in to our Services using your account with third parties, we receive Personal Data about you from such third parties, such as your name, email address, username, and profile picture.
Information from Service Providers. We may receive information that you have shared with certain third-party service providers in relation to our Services.
In some cases, we need to collect your Personal Data to provide you with our Services. In these cases, if you choose not to provide the requested Personal Data, you may not be able to use our Services. We will tell you if providing Personal Data is required by law or under a contract and what are the consequences of failing to provide it.
2. Purposes of Processing Personal Data and Legal Basis:
(a) Purpose and Legal Basis
The table below describes the purposes for which we process your Personal Data when acting as a data controller and the legal bases for such processing. When we rely on legitimate interest as the legal grounds to process your Personal Data, you have the right to object to that processing. Please note that where the legal bases specified are not applicable in your country, we will rely on consent or other available grounds to process your Personal Data.
| Purpose | Description | Legal Ground (where required under applicable law) |
|---|---|---|
| Providing the services | We may process your Personal Data to provide the Services you request from us, as described in the applicable Terms of Service. | The processing is necessary for entering into, or performance of a contract to which you are a party |
| Processing your video, image, and audio content | We collect the video, image, and audio content that you choose to share with us to provide our Services to you. | The processing is necessary for entering into, or performance of a contract to which you are a party |
| Voice cloning and audio processing | We may process audio recordings that you provide to us to create voice models for voice cloning as part of our video editing Services. Audio recordings will be shared with third-party providers such as ElevenLabs for voice modeling purposes. | For standard audio processing: The processing is necessary for entering into, or performance of a contract to which you are a party. For voice cloning: You have provided your explicit consent. |
| Personalizing your experience | With your permission, we may process your Personal Data to personalize your experience when you access our Services, including suggesting content and features that could be of interest to you. | We, or a third party, have a legitimate interest in using your Personal Data for the purpose of personalizing your experience. |
| Communicating with you | We may process your Personal Data to communicate with you, provide you with updates and other information relating to our Services, provide information that you request, respond to your comments and questions, and otherwise, provide customer support. | We have a legitimate interest in using your Personal Data for communicating updates and providing support. In addition, such communications may be necessary in accordance with our contract with you. |
| Marketing communications | For potential users, we may process your Personal Data to send Marketing Communications including emails to provide information regarding products or Services that may interest you. | You have provided your consent. |
| Billing and accounting | We may process your Personal Data to handle any payments from you as described in the applicable Terms of Service, including keeping records of payments. | The processing is necessary for entering into, or performance of a contract to which you are a party. |
| Preventing fraud | We may process your Personal Data to protect against and prevent fraud and money laundering, and protect against malicious, deceptive, fraudulent, or illegal activity, including to prosecute those responsible for such activity. | We, or a third party, have a legitimate interest in using your Personal Data to conduct due diligence and take appropriate measures to protect against and prevent fraud. In addition, such processing may be necessary to fulfil obligations under our contract with you. |
(b) Personal Data and Voice Cloning Services
Yarn uses voice data to provide its voice cloning services. When you provide us with recordings of your voice, we utilize AI-based technologies that analyze your speech characteristics to formulate a distinct voice model of your vocal traits. This voice model can be used to generate audio resembling your voice.
Your audio recordings will be shared securely with third-party providers, such as ElevenLabs, exclusively for the purpose of creating voice models. Depending on where you reside and how we use your voice data, applicable law may define your voice data as biometric data.
Voice data used to create voice clones is processed only with your explicit consent. You have the right to withdraw consent, request the deletion of voice models, and understand the implications of voice cloning at any time by contacting us at legal@yarn.so. Upon withdrawal of your consent, voice models will be deleted within 30 days.
Audio recordings used to create voice clones will be retained only for as long as necessary to provide the voice cloning services or until consent is withdrawn, after which they will be deleted or anonymized. Yarn will not keep voice data longer than 1 year after your last interaction with us, except as required by law.
(c) Content Moderation and User Suspension
Yarn does not undertake to review all Content and expressly disclaims any duty or obligation to monitor or review content. However, to maintain the integrity and security of your data, and for fraud prevention purposes, Yarn reserves the right to moderate all content input into Yarn tools and outputs. In certain circumstances, Yarn may share your inputs or outputs, which may include Personal Data, with third parties to support the content moderation and safety initiatives. Users found to have engaged in activity that violates the Prohibited Use Policy may be subject to termination or suspension under the applicable Terms of Service.
3. Data Recipients:
Your Personal Data may be shared with:
Affiliates. We may share any Personal Data we receive with our current or future affiliates for any of the purposes described in this Privacy Policy.
Vendors and Service Providers. We may share your Personal Data with third-party vendors and service providers who provide services such as website hosting, data analysis, advertising, information technology and related infrastructure provision, customer service, email delivery, auditing, and payment processing.
Third-Party Voice Providers. Yarn uses third-party voice providers such as ElevenLabs to provide voice cloning capabilities. These third-party providers are contractually obligated to handle Personal Data according to applicable privacy laws and our instructions.
Third Parties. We may jointly develop, promote or offer products and features with other companies or partners which may require providing access to your Personal Data for the purpose of (a) providing, maintaining or supporting the services you requested, (b) analyzing and improving our services, and (c) marketing, advertising and other promotional activities. Certain services and features may allow you to display or share information with third parties. For example, you may share files or outputs or send information to third-party applications. Be sure you trust any third party with whom you share information.
As Required By Law and Similar Disclosures. We may access, preserve, and disclose your Personal Data with law enforcement agencies, regulatory bodies, and public authorities or pursuant to the exercise of legal proceedings if we believe doing so is required or appropriate to (a) comply with law enforcement requests and legal process, such as a court order or subpoena; or (b) protect your, our, or others' rights, property, or safety. For the avoidance of doubt, the disclosure of your Personal Data may occur if you use our Services to create any objectionable content.
Other Data Recipients. We may also disclose your information with other parties only where we have received your consent to do so.
4. International Data Transfers:
Our Services are hosted in the United States. This means we may transfer your Personal Data outside your country, state or province of residence, depending on your location at that time. All Personal Data will be transferred to the United States for storage.
The data will be transferred for the time required to fulfill the purpose for which it is processed. It can be shared with our service providers and Yarn's affiliates for the purposes listed in Section 2. In such cases, Yarn is the controller of the data, and the service providers are processors or joint controllers, as the case may be.
We may transfer personal data to the following categories of recipients:
| Recipient Category | Countries | Purpose of Transfer | Data Types Transferred |
|---|---|---|---|
| Cloud service providers | United States | Storage & security | Name, video, image, audio data, account details, user history |
| Payment processors | United States | Payment processing | Name, credit card details, billing address |
| Marketing analytics platforms | United States | User analytics | IP address, device info, browsing history |
| Customer support | United States | Customer service & technical support | Contact details |
| Voice cloning providers (e.g., ElevenLabs) | United States | Voice model creation | Audio recordings, voice data |
5. Data Retention:
We take measures to delete your Personal Data or keep it in a form that does not permit identifying you when this information is no longer necessary for the purposes for which we process it unless we are required or permitted by law to keep this information for a longer period. When determining the specific retention period, we consider various factors, such as the type of service provided to you, the nature and length of our relationship with you, and mandatory retention periods provided by law and any relevant statute of limitations.
When we reference "anonymization" in this Policy, it means that audio data and other personal information is irreversibly processed so it can no longer be associated with an identifiable individual.
For sensitive data such as audio recordings used for voice cloning, we will retain this data only for as long as necessary to provide the voice cloning services or until you withdraw your consent, after which the data will be deleted or anonymized. Specifically, Yarn will not keep voice data longer than 1 year after your last interaction with us, except as required by law.
6. Your Cookie Choices
Cookies, pixel tags, SDKs, or similar technologies ("Cookies") are technologies used to collect information about users and their activities on a website. We and our third-party partners, such as analytics and advertising partners, may collect information about you using Cookies to collect information about your online activities over time and across different services.
The information collected via Cookies may include information such as unique identifiers, system information, IP address, web browser, device type, and the web pages that you visit just before or just after you use the Services, as well as information about your interactions with the Services, such as the date and time of your visit, and where you have clicked.
Types of Cookies
We may use both session cookies and persistent cookies. A session cookie disappears after you close your browser. A persistent cookie remains after you close your browser and may be used by your browser on subsequent visits to our Services. Cookies we or our third-party partners place may fall under one of the following purposes:
- Strictly Necessary Cookies. Cookies that are essential to make our Services available to you, for example, to provide login functionality or to identify bots who try to access our website. These cookies cannot be disabled as we cannot provide you with the Services without this type of Cookie.
- Performing & Analytics Cookies. Cookies for website and app analytics purposes to support operation, maintenance, and improvement of our Services. We may use our own analytics Cookies or third-party analytics providers, such as Google Analytics, to collect and process certain analytics data on our behalf and understand how you engage with our Services.
- Targeting & Marketing Cookies. Cookies that may be ours or our third-party partners and support us and our advertisers in serving relevant advertising on our sites as well as sites that are not owned or operated by us to promote our services, articles, or events. The Cookies are used to make advertising messages more relevant to you and your interests or prevent the same ad from continuously re-appearing.
Depending on the country in which you are located, you may be asked to provide your consent for our use of Cookies (except for strictly necessary Cookies). You can manage cookie preferences via our cookie consent management tool available on our websites. In addition, you have the following choices concerning the use of Cookies:
- Browser Settings. Certain web browsers allow you to manage your preferences relating to Cookies. You can set your browser to refuse Cookies or delete certain Cookies. Please note that if you choose to block all Cookies, doing so may impair the use of our Services.
- Google Analytics Opt-out. To opt out from Google Analytics' use of information collected on the Services through Cookies, you can download the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/gaoptout.
- Third Party Advertising Companies' Opt-Out. We work with third party advertising partners to show you ads that we think may interest you. Some of our advertising partners are members of the Network Advertising Initiative or the Digital Advertising Alliance. If you do not wish to receive personalized ads, please visit their opt-out pages to learn about how you may opt out of receiving web-based personalized ads from member companies. You can access any settings offered by your mobile operating system to limit ad tracking, or you can install the AppChoices mobile app to learn more about how you may opt out of personalized ads in mobile apps.
7. Your Rights
(a) Data Subject Rights
Depending on where you are located or reside, you may have certain rights regarding the Personal Data we maintain about you and certain choices about what Personal Data we collect from you, how we use it, and how we communicate with you.
- Access Your Personal Data: Receive confirmation of processing and request access the Personal Data we maintain about you. Most of your Personal Data can be accessed and exported by logging into your account.
- Correct Your Personal Data: Request to update and correct inaccuracies in your Personal Data. Most of your Personal Data can be accessed and corrected by logging into your account and accessing your account settings.
- Delete Your Account: Request to close your account by submitting your request using your account settings.
- Delete Your Personal Data: Request that Yarn delete all Personal Data we maintain about you including your account and the data associated with your account. This deletion also includes the personal data processed under the legal basis of consent. Where provided by applicable law, you may request that your Personal Data be anonymized rather than deleted.
- Restrict or Object To Processing of Your Personal Data: Restrict or object to the processing of your Personal Data, where applicable.
- Request Portability of Your Personal Data: Request to transfer your Personal Data to another authorized organization.
- Withdraw Consent: You may withdraw any consent you previously provided to us regarding the processing of your Personal Data at any time. We will apply your preferences going forward and this will not affect the lawfulness of the processing before you withdraw your consent. This is particularly important for voice cloning services, where upon withdrawal of consent, we will cease further processing of your voice data for cloning purposes and delete voice models within 30 days.
- Opt-out of Voice Data for Training: You may opt out of our use of your voice data for AI model training at any time by contacting us at legal@yarn.so.
- Deactivate Push Notifications: If you use one of our mobile applications, with your permission, we may send push notifications to your mobile device. You can deactivate these notifications at any time by changing the notification settings on your mobile device.
- Unsubscribe from Marketing Communications: You may unsubscribe from receiving marketing communications at any time by following the instructions contained within the email or by contacting us directly. Please be aware that if you opt out of receiving commercial emails from us or otherwise modify the nature or frequency of promotional communications you receive from us, it may take some time for us to process your request and you may receive promotional communications from us that you have opted out from during that period, to the extent permitted by applicable law. Additionally, even after you opt-out from receiving commercial messages from us, you will continue to receive administrative messages from us regarding our Services.
You may exercise these rights by contacting us at legal@yarn.so. Before fulfilling your request, we may ask you to provide reasonable information to verify your identity. Please note that applicable law may provide for exceptions and limitations to each of these rights.
In addition to the rights listed above, you may also have the right to lodge a complaint with a supervisory authority, including in your country of residence, place of work, or where an incident took place.
(b) United States Residents
Residents of certain U.S. states, including California, Connecticut, Colorado, Utah, Virginia, Oregon, Montana, or Texas, may have additional privacy rights regarding their Personal Information under applicable state laws. In certain U.S. states, you have the following rights in addition to those listed in Section 7a:
We comply with applicable biometric privacy laws and regulations, including the Illinois Biometric Information Privacy Act (BIPA). We will obtain explicit written consent before collecting or processing biometric data (e.g., voice data for cloning), provide disclosures as required, and allow you to request deletion at any time.
If you are a resident of one of these states and would like to exercise your rights under the applicable state law, please contact us at legal@yarn.so. Before fulfilling your request, we may ask you to provide reasonable information to verify your identity.
Authorized Agents. In states where applicable, your authorized agent may submit a request to exercise any of the above rights on your behalf. Yarn may request additional information to verify their authority to act on your behalf before processing any requests.
(c) European Economic Area (EEA) Residents
If you are located in the EEA, you have certain additional rights under the General Data Protection Regulation (GDPR). These include all rights mentioned in Section 7(a), plus the right to lodge a complaint with your local data protection authority. The data controller for your information is Yarn Technologies Inc. For data transfer outside the EEA, we rely on mechanisms such as Standard Contractual Clauses approved by the European Commission.
8. Third Parties:
Our Services may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this Privacy Policy does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.
9. Security:
We implement appropriate security measures to protect your Personal Data:
- Encryption: All data is encrypted in transit using TLS 1.2 and stored in encrypted databases on our cloud infrastructure.
- Cloud Security: We utilize security features provided by our cloud infrastructure partners (AWS and Render) to maintain a secure environment for your data.
- Access Controls: We implement role-based access controls to ensure that data is only accessible to authorized personnel who require it for providing our Services.
- Third-party Security: For sensitive data such as audio recordings used in voice cloning, we ensure our third-party providers (like ElevenLabs) maintain appropriate security standards through contractual agreements.
While we take reasonable measures to protect your information, no electronic transmission or storage technology is completely secure. We cannot guarantee the absolute security of your data, but we continuously work to improve our security practices.
10. Children's Privacy:
Our Services are not intended for or directed at children under the age of 18 and Yarn does not knowingly collect, store, or process Personal Data from children under the age of 18.
If you are under the age of 18, you are not permitted to submit any Personal Data to us. If we become aware that we have inadvertently received Personal Data from a child under the age of 18, we will delete that information from our records.
Voice cloning services are strictly prohibited for individuals under the age of 18. We do not knowingly collect or process voice data from minors. If we become aware of such data, it will be promptly deleted.
Additionally, all users are strictly prohibited from uploading, transmitting, emailing, or otherwise making data from children under the age of 18 available to us or other users or using them for any of our Services. If you believe we may have inadvertently processed such Personal Data, please contact us at legal@yarn.so.
11. Updates to this Policy:
We may periodically update this Policy to reflect changes in our practices or legal requirements. If we make significant changes, we will notify you by email or through a prominent notice on our website before the changes become effective. We review our privacy practices at least annually. We encourage you to review this Policy regularly to stay informed about our privacy practices.
12. Contact Us:
For any questions regarding this Policy, our processing of your Personal Data, or to exercise your rights, please contact us at legal@yarn.so or write us at:
Yarn Technologies Inc.
2261 Market Street STE 10326
San Francisco, CA 94114