Privacy Policy

Last updated: 16 October 2026

This policy explains how DetectifAI (“we”, “us”) handles personal data when you use the DetectifAI developer platform at platform.detectif.ai: the dashboard, the REST API, and the MCP server (together, the “Platform”). It does not cover the detectif.ai marketing website or other DetectifAI products.

Summary

• Audio you send for analysis is processed to produce a result and is not stored.
• Voice profiles you create by enrolling a speaker are stored encrypted until you delete them or your account.
• Results are kept for 30 days so you can fetch them again.
• We do not sell personal data, show ads, or use third-party analytics or tracking scripts.
• You can delete speakers, API keys, and your whole account yourself from the dashboard.

What we collect

Account information

• Your name, email address and, if you provide it, your phone number.
• Your password is handled by our authentication provider and is never visible to us. If you sign in with Google or GitHub, we receive your name, email address and account identifier from that provider, not your password.
• If you joined through an event or invite link (for example a hackathon), the event code from that link.

Audio and results

• Audio you upload for deepfake detection or speaker verification is decoded and analysed, then discarded. We do not keep the recording and do not use it to train models.
• Results (for example a verdict and a score) are stored with their operation ID for 30 days, then deleted automatically.
• If you answer “was this result right?”, we store your answer with the operation. No audio is kept.
• For monitoring quality and performance we record technical details of each request, such as audio duration, format, processing times and error codes. These never include the audio itself or the file name.

Voice profiles (speaker enrollment)

When you enroll a speaker, we store a voice profile: a set of numbers derived from the recording that represents the voice, not the recording itself. Voice profiles can be biometric data. They are stored encrypted and are used only to answer your verification requests. They are kept until you delete the speaker or your account. You may only enroll a person’s voice with that person’s informed consent (see the Terms of Service).

Usage, credits and security records

• A record of each API operation (time, operation type, status, request ID and credits used) and of credit changes, so that your usage history and balance are accurate.
• When a sign-in session is first used, we record that it happened (the session identifier is stored only as a one-way hash). We use this to count active developers.
• API keys are stored only as a one-way hash; the full key is shown to you once, when it is created.
• IP addresses are stored in our database only as salted one-way hashes, to prevent abuse (for example repeated failed sign-ins or bulk account creation). Our web servers keep short-lived technical logs that may include IP addresses, for security and troubleshooting. Logs never contain audio, API keys or passwords.
• If you ask us for more credits, the reason you give and our decision.

How we use it

• To provide the Platform: authenticate you, run the operations you request, show your results, usage and balance.
• To keep the Platform secure and fair: rate limits, abuse prevention and investigating problems.
• To support you when you contact us, using request IDs and the records above.
• To understand how the Platform is used, in aggregate (for example how many developers made a successful API request in a week). Internal and test accounts are counted separately.
• To send service emails, such as address confirmation and password reset. We do not send marketing email from the Platform.

Who processes it

• Supabase, our authentication and database provider.
• Our email delivery provider, for confirmation and password-reset emails.
• Google or GitHub, only if you choose to sign in with them.
• Our own servers, which run the Platform and the models. Audio is not sent to any third-party model service.

A small number of authorised DetectifAI staff can view account details (never passwords, full API keys or audio) to provide support and prevent abuse. Every administrative action is recorded in an audit log. We disclose data to authorities only when required by law.

Your browser

To keep you signed in, the Platform stores your session in your browser’s local storage. We do not use advertising or analytics cookies, and the Platform loads no third-party scripts.

How long we keep data

• Audio: not stored; discarded once processed.
• Results: 30 days.
• Voice profiles: until you delete the speaker or your account.
• Account details: until you delete your account.
• Usage and credit records: kept for the integrity of balances and to prevent abuse. When you delete your account, they are kept without your name, email address or phone number.

Your choices and rights

• View and update your profile in the dashboard settings.
• Delete any speaker (and its voice profile) from the dashboard or the API, and revoke API keys at any time.
• Delete your account from the dashboard settings. This removes your profile, API keys, voice profiles and results.
• For any other request, including access to or correction of your data, email info@detectif.ai from your account’s email address.

Security

Data is encrypted in transit. Voice profiles are encrypted at rest. Uploaded media is decoded in an isolated service with no access to other data. Access to production systems is restricted and audited. No system is perfectly secure; if you believe you have found a security problem, please email info@detectif.ai.

Children

The Platform is intended for developers who are at least 18 years old, or younger where a parent or guardian has given any consent the law requires. It is not directed at children.

Changes

If we change this policy, we will update the date above, and for significant changes we will tell you by email or in the dashboard before they take effect.

Contact

Questions about privacy: info@detectif.ai.