Privacy Policy

1. Who is responsible for your data

PodBright is operated by EVEREST LINKS (PTE.) LTD., UEN 200901603G, with its registered address at 18 Sin Ming Ln, #07-27 Midview City, Singapore 573960 ("Everest Links", "we", "us", or "our"). Everest Links is responsible for the personal data described in this Policy.

This Policy explains how we collect, use, disclose, store, and protect personal data when you use podbright.ai, the PodBright browser extension, private RSS feeds, and related services (the "Service").

2. Data we collect

• Account and authentication data: email address and authentication details handled through Supabase, including Google OAuth or email/password authentication.
• Submitted content: the subject, sender, body, article text, URL content, and PDF content that you send for conversion. Source text is intended to be held only during processing and discarded after audio is generated.
• Episode data: AI-generated summaries, titles, sender names, timestamps, chapter information, generated MP3 files, and related metadata used in your private feed.
• Preferences: selected voice, podcast mode, episode length, difficulty, and PDF-processing choices.
• Billing data: subscription tier and Stripe customer and subscription identifiers. Stripe processes payment transactions for Everest Links, the merchant of record.
• Usage, analytics, and operations data: PodBright records first-party data in its own Supabase database, including page views, analytics events, episode jobs, RSS fetches, and user profiles. Events include signup, plan upgrades and downgrades, email and PDF ingestion and parse failures, Chrome extension submissions, text-to-speech started, completed, and failed events, RSS fetches, AI feature usage, and page views. Episode job records may include source type, email subject, character and page counts, status and error details, processing time, audio size, text-to-speech provider, and AI features used. The RSS feed endpoint records a truncated SHA-256 hash of the requester's IP address, the full user-agent string, and the inferred podcast platform.
• Communications: messages you send to support, privacy, legal, or copyright addresses.

Please do not submit sensitive or confidential content unless you are comfortable with it being processed by the providers listed below and have the right to do so.

3. How and why we use data

We use personal data to:

• create and secure your account;
• receive submitted content, generate audio, and deliver episodes through your private RSS feed;
• apply your voice, length, summary, difficulty, and chapter settings;
• manage subscriptions, usage allowances, payments, and the billing portal;
• send transactional and support messages;
• detect abuse, protect users and the Service, and enforce our Terms;
• diagnose failures and maintain or improve the Service; and
• meet legal obligations and handle rights requests or disputes.

We do not sell submitted content. We do not use submitted content to train AI models.

Depending on where you live, our legal bases may include performing our contract with you, your consent, compliance with law, and our legitimate interests in operating, securing, supporting, and improving the Service. Where Singapore's Personal Data Protection Act 2012 applies, we collect, use, and disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances and as otherwise permitted by law.

4. AI and service providers

To provide the Service, submitted content and other personal data may be disclosed to providers that process it on our behalf or provide connected services. Current providers include:

• OpenAI: text rewriting, summaries, chapter generation, and image queries;
• Unreal Speech: text-to-speech audio generation;
• Cloudflare: CDN and proxy services, inbound email routing, and R2 audio file storage;
• Supabase: database services and authentication, including Google OAuth;
• Railway: application hosting;
• Stripe: payment and subscription processing for Everest Links (Pte.) Ltd., which is the merchant of record;
• Resend: transactional email; and
• Unsplash: image search, only when configured.

We may also disclose data to professional advisers, authorities, courts, or counterparties where reasonably necessary to comply with law, protect rights and safety, or complete a corporate transaction. We do not authorize service providers to use submitted content for their own unrelated purposes.

5. International transfers

Everest Links is based in Singapore, and our providers may process data in Singapore, the United States, and other countries where they operate. Privacy laws may differ from those in your country. Where required, we use contractual or other measures intended to provide a comparable standard of protection for transferred personal data.

6. Retention and deletion

Source text from emails, articles, and PDFs is intended to be discarded after the requested audio is generated and is not intentionally stored long-term. Episode summaries, titles, chapters, sender names, timestamps, generated audio, feed data, preferences, billing records, and operational logs are kept as needed to provide, secure, support, and audit the Service and meet legal obligations. Deleting an episode is intended to remove its database record and stored audio. Closing your account is intended to remove associated Service data, subject to limited retention required for billing, fraud prevention, disputes, backups, or legal compliance. Backup deletion may take additional time.

7. Security and private feeds

We use safeguards designed to protect personal data, including HTTPS in transit and Supabase row-level security for user-data isolation. No system is completely secure.

Your RSS feed is protected by a private token in its URL rather than by a separate password in podcast apps. Anyone with the URL may be able to access the feed. Keep it private and contact us if you believe it has been exposed.

8. Your choices and rights

You can change preferences, delete episodes, manage or cancel a paid subscription, and request account deletion. Depending on applicable law, you may also have rights to request access to or correction of personal data, withdraw consent, object to or restrict certain processing, request portability, or complain to a regulator.

To make a privacy request, contact our Data Protection Officer at [email protected] or +65 8671 2971. We may need to verify your identity. We aim to process account-deletion requests within 30 days, subject to applicable law and necessary retention.

9. Cookies and local technologies

PodBright does not use third-party analytics or tracking tools. In particular, it does not use Google Analytics, PostHog, Fathom, Sentry, Mixpanel, Segment, Hotjar, Microsoft Clarity, the Meta pixel, or any other third-party analytics SDK or script.

PodBright sets no analytics cookies. Page views are recorded without a persistent identifier and may include the page path, referrer, and any utm_source, utm_medium, and utm_campaign values. These page-view records are stored without a user ID.

Supabase uses cookies needed for authentication and session management. Supabase sets their names and lifetimes; PodBright does not hardcode them.

10. Children

The Service is for users aged 18 or older. It is not directed to anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has created an account or provided personal data through the Service, contact us and we will investigate and delete the data where appropriate.

11. Changes

We may update this Policy as the Service or law changes. We will change the "Last updated" date and provide additional notice where required by law.

12. Contact

EVEREST LINKS (PTE.) LTD.
UEN: 200901603G
18 Sin Ming Ln, #07-27 Midview City, Singapore 573960

Privacy and support: [email protected]
Legal notices: [email protected]
Data Protection Officer and DMCA designated agent: Unna Muthiah, Co-founder and Director, Everest Links (Pte.) Ltd.
Email: [email protected]
Phone: +65 8671 2971