Privacy Policy

Oteria is operated by Graybridge Labs (“we”, “us”, “our”). We provide an AI-powered scene partner for actors. This policy explains what data we collect, how we use it, and your rights.

Privacy notices can be sent to privacy@oteria.app.

We operate in the United States, United Kingdom, and European Union. Depending on where you are located, different data protection laws may apply (see Section 10).

Access requests

When you request private access, we collect your first name, surname, email, school or organisation, reason for requesting access, and your confirmation that you are at least 13 and, if under 18, have parental or guardian consent. We record the confirmation wording and submission time, not your date of birth. This is your declaration, not independent verification of age or parental consent. We save your request in our database and send it through FormSubmit to Graybridge Labs for review. Requesting access does not subscribe you to marketing emails. To limit spam, we temporarily store hourly request counts keyed by a hash of your IP address; raw IP addresses are not stored with your request.

Contact messages

If you use the contact form, we store the name you provide, email, topic, message and submission time in our database so we can handle your enquiry. If you email us directly, the correspondence is held in our email inbox.

Account data

We store your name, email address and an internal user ID. If you choose Google sign-in, Google provides your verified email and profile information. If you choose email and password, we store a salted, one-way password hash, never your plain-text password. Password links are stored only as hashes and can be used once. Initial setup links expire after 24 hours; recovery links expire after one hour. During private access, our team supplies these links to approved email addresses. Routine password sign-in does not send an email. We also temporarily store sign-in attempt counts keyed by protected hashes of email and IP addresses to limit abuse.

Scripts and scenes

Scripts you paste, upload, or photograph are stored on our servers (hosted on Turso), scoped to your account. Scene settings — character assignments, voice selections, mode preferences — are stored alongside each scene.

Private groups and projects

For private groups, we also store educator and student membership, invitations, the student's age and parental-consent declaration, original project files and extracted pages, reviewed scene versions, role assignments, and a private rehearsal resume position. Group educators can see their students' names, email addresses, access status and assignments, but not their private resume positions. Students can access their assigned scenes, not the full source file or other students' material. Oteria administrators can manage group access. Group invitation tokens are stored as hashes, expire after 72 hours and are consumed when accepted.

Generated audio

AI-generated audio (text-to-speech output) is cached locally in your browser using IndexedDB for replay. It is not automatically uploaded back to Oteria. The cache remains on your device until you clear it or your browser removes it. A shared take can include this audio, as described below.

Microphone input

Oteria uses the Web Speech API for microphone input. Depending on your browser and operating system, speech recognition may be handled by the browser or its speech recognition provider, which may receive your audio for processing. Oteria uses the recognition result to match your spoken line to the script. This is separate from the local take recording below.

Local recordings and shared takes

With Record performance enabled and microphone permission granted, supported browsers record your voice together with the scene partner. Completed takes are saved in this browser and can be downloaded as an MP3. They do not sync between devices or upload automatically. Download any take you want to keep, as clearing browser data or browser storage cleanup can remove it. For scenes with sharing available, choosing Share uploads the take and its script, cast details and duration. Anyone with the link can listen and read the shared script, without signing in. Project and assigned-scene recordings can be downloaded locally, but cannot be published through Share. Shared audio is stored in Vercel Blob; the take’s title, script, cast details, duration, creation time and account association are stored in Turso. Public links can be forwarded, and recipients may keep their own copies. Only share material you have permission to share.

Group-assigned and project rehearsals also support local performance recordings and MP3 downloads, including your microphone audio when recording is enabled and permission is granted. These recordings are not published through Share. The separate partner-audio download contains only the generated voices, not your microphone recording.

BYOK keys

If you connect your own ElevenLabs API key, it is encrypted at rest using AES-256-GCM with a server-side encryption secret. Your key is decrypted server-side to authenticate voice-library and generation requests to ElevenLabs. It is not returned to the browser after submission.

Usage data

We store account-linked voice-generation character counts and script-preparation usage totals for each allowance period. These records are identifiable to our team and are used to enforce limits, monitor costs and investigate abuse. We may also use aggregated totals to understand service usage.

Payment data

Where paid plans are available, payments are processed by our payment provider. We do not store your full credit card number. We may receive and store limited billing information (e.g., last four digits, expiry date, billing country) for record-keeping.

• We do not automatically upload your local take recordings. Uploading a take requires you to choose Share.
• We do not read, scan, or analyze your scripts for any purpose beyond providing the Service.
• We do not use your content to train AI models.
• We do not sell your data to third parties.
• We do not track you across other websites.

We use the data we collect to:

• Provide and maintain the Service — parsing scripts, generating speech, matching spoken lines, storing scenes and publishing takes you choose to share.
• Authenticate your identity using email and password or Google sign-in.
• Review access requests, manage invitations, and reply to you.
• Process payments and manage subscriptions where paid plans are available.
• Enforce usage caps, monitor costs and prevent abuse.
• Communicate with you about your account, service updates, or support requests.
• Improve the Service using aggregated usage totals.
• Comply with legal obligations.

We use the following third-party services to operate Oteria. Your data is shared with them only as necessary to provide the Service:

When you use BYOK, voice generation requests go directly to your own ElevenLabs account. We act as a conduit — the text is sent to ElevenLabs on your behalf using your key. Your usage is governed by your ElevenLabs plan, limits, and terms.

• Access requests: retained to review and manage private access, or until you request removal. This includes the copy in our email inbox.
• Contact messages: retained to handle your enquiry and support follow-up. Contact us to request removal.
• Account data: retained while your account is active. Deleted on account deletion.
• Scripts and scenes: retained while your account is active. Deleted on account deletion.
• Group projects: archiving a project or revoking membership does not delete its source files, reviewed versions or assignments. Contact privacy@oteria.app to request deletion of group materials, membership records or private rehearsal positions. We cannot recall files already downloaded by an authorised user.
• Audio cache: stored in your browser only. We cannot delete it — clear your browser data to remove it.
• Unshared takes: completed recordings are stored in this browser on your device, not on our server. They remain until you delete them or the browser removes stored data. If the browser cannot save a take, the player warns you to download it before leaving. Downloaded copies remain wherever you save them.
• Shared takes: stored on our hosting services without an automatic expiry. Contact privacy@oteria.app to request removal of the recording and its metadata. We cannot recall copies kept by recipients.
• BYOK keys: deleted immediately when you disconnect your key or when your account is deleted.
• Waitlist emails: retained until you request removal or we complete the early access programme.
• Usage records: account-linked totals are retained to manage allowances, costs and abuse investigations. You can request access to or deletion of these records under Section 10.

We implement appropriate technical and organisational measures to protect your data:

• All connections use HTTPS/TLS encryption in transit.
• BYOK API keys are encrypted at rest using AES-256-GCM (or equivalent).
• Database access is restricted to authenticated server-side code only.
• Email passwords are protected with salted scrypt hashes. We never store plain-text passwords or receive your Google password.
• Saved scenes are account-scoped. Takes you choose to share are public to anyone with the link, not protected by your account sign-in.

No system is perfectly secure. If we become aware of a data breach affecting your personal data, we will notify you and the relevant authorities as required by applicable law.

We use essential cookies only — specifically, a session cookie for authentication. We do not use advertising cookies, tracking pixels, or cross-site trackers.

We may collect anonymised analytics data to understand how the Service is used. This data is aggregated and cannot identify you.

Oteria is not available to children under 13. Users aged 13 to 17 must have a parent’s or legal guardian’s consent before requesting access or using Oteria. Any stricter age or consent requirements under applicable law or third-party provider terms still apply.

We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it promptly.

Depending on your location, you may have the following rights under applicable data protection law (including GDPR, UK GDPR, and CCPA):

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate data.
• Deletion: request deletion of your account and associated data.
• Portability: request your data in a standard, machine-readable format.
• Restriction: request that we limit how we process your data.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: where processing is based on consent, withdraw it at any time.

For EU and UK users

Our legal basis for processing your data is: (a) performance of a contract (providing the Service), (b) legitimate interests (improving the Service, preventing abuse), and (c) your consent (where applicable). You have the right to lodge a complaint with your local data protection authority.

For California users

Under the CCPA, you have the right to know what personal information we collect and how we use it, to request deletion, and to opt out of the sale of personal information. We do not sell your personal information.

To exercise any of these rights, contact us at privacy@oteria.app. We will respond within 30 days (or as required by applicable law).

Your data may be processed in countries other than your own, including the United States. Where we transfer data outside the UK or EU, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions to ensure your data is protected.

We may update this policy from time to time. Material changes will be communicated via the Service or email. The “Last updated” date at the top reflects the most recent revision.

For privacy-related questions or to exercise your data rights:

privacy@oteria.app

For support questions, contact support@oteria.app. We usually respond within a few working days.