Legal
Privacy Policy
The short version
- This website sets no cookies and runs no third-party analytics or advertising trackers; we only count page views per day, anonymously. Fonts are served from our own domain.
- The quote form collects your business contact details. We use them only to answer your request, and delete them after 24 months unless you become a customer.
- Audio and video you dub with Dublayer are processed on a server dedicated to your company. They are never sent to outside AI services, never sold and never used to train models for anyone else.
- In the Dublayer service, you are the controller of your content and we act as your processor under a data processing agreement.
- You can ask us for access, correction or deletion at any time: hello@dublayer.studio.
- Who we are
- What this policy covers
- Data we collect on this website
- Data in the Dublayer service
- Voice data and consent
- Who receives data
- International transfers
- How long we keep data
- Security
- Your rights
- Cookies
- Children
- AI-generated content
- Changes
1. Who we are
dublayer.studio and the Dublayer service are operated by Dublayer, [REGISTERED ADDRESS], Türkiye, MERSİS no. [MERSİS NO] ("Dublayer", "we").
For anything about personal data, write to hello@dublayer.studio or by post to the address above.
2. What this policy covers
This policy covers two things, and our role is different in each:
- This website and the quote form. We decide why and how this data is processed, so we are the controller (data controller / veri sorumlusu).
- Content you process with the Dublayer service (video, audio, voices, transcripts, translations). Your company decides what is dubbed and why, so you are the controller and Dublayer acts as your processor (veri işleyen), only on your documented instructions and under a data processing agreement (DPA). Where your company installs and runs Dublayer on its own infrastructure without our access, we do not process that content at all.
The Turkish-language information notice required under Law No. 6698 (KVKK) is published separately: KVKK Aydınlatma Metni.
3. Data we collect on this website
| What | Why | Legal basis |
|---|---|---|
| Quote form: full name, work email, company, website or channel (optional), what you produce, monthly volume, typical length, languages, your message (optional) | To answer your request, prepare a quote and follow up on it | Steps taken at your request before entering into a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)); our legitimate interest in answering business enquiries (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Country of the request, derived from your IP address by our hosting provider (the IP address itself is not stored with your request) | To route your request to the right region and server location | Legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Technical data: IP address, browser user agent, requested URL, time | To deliver the site, prevent abuse (rate limiting, spam protection) and keep it secure | Legitimate interest in running a secure website (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)) |
| Emails you send us and our replies | To answer you and keep a record of our business correspondence | Pre-contractual steps and legitimate interest; legal obligation for commercial records (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)) |
The form fields are required to send a quote request; without them we cannot prepare one. We do not make decisions about you by automated means, we do not buy contact lists and we do not combine form data with data from other sources.
No marketing without permission. Replying to your request is not marketing. We will only send newsletters or promotional emails if you separately agree, and every such email will let you unsubscribe.
4. Data in the Dublayer service
When you dub content with Dublayer, the following is processed on the server dedicated to your company:
- the video and audio you upload, and the dubbed outputs;
- speech separated from music and effects, transcripts, translations and timing data;
- voice characteristics derived from each speaker (voice profiles and voice embeddings) used to perform their lines in other languages;
- where lip sync is switched on, face regions from close-up shots;
- consent records for each speaker (see section 5);
- user accounts for your studio (name, work email, role) and audit logs of who did what.
Our commitments as your processor:
- Your content stays on your server. Processing runs on local, self-hosted models. Nothing is sent to third-party AI services and telemetry is switched off.
- One customer per server. Your server is not shared with any other customer.
- No training on your content. We do not use your audio, video, voices or transcripts to train or improve models for us or anyone else.
- No selling. We never sell, rent or trade your content or anyone's voice data.
- Access only when needed. Our staff access your server only to set it up, maintain it or provide support you ask for, under confidentiality obligations.
- Deletion on request and at the end of the contract (see section 8).
The details, including technical and organisational measures and any sub-processors (such as the provider of the physical server), are set out in the DPA that forms part of your contract.
5. Voice data and consent
A voice is personal data. A voice profile built to reproduce someone's voice can, depending on how it is used, be treated as biometric data, which is a special category of personal data under GDPR Art. 9 and KVKK Art. 6. We treat all voice profiles with that level of care, whatever their exact legal classification.
- Before a speaker's voice is cloned, the customer must confirm that the speaker has given explicit consent for their voice to be used in this way, and that the customer holds the rights to the video. Dublayer records that confirmation for each speaker.
- Speakers without a recorded consent are not cloned; they are dubbed with a neutral voice or left out.
- A speaker can withdraw consent at any time. When the customer tells us, or when the speaker contacts us directly, the voice profile is deleted and no new dubs are made with it.
- Voice profiles are used only to dub that customer's content. They are never used to identify people, never shared with other customers and never sold.
The full rules are in our Voice Consent & Acceptable Use Policy. If you believe your voice has been used without your permission, write to hello@dublayer.studio; we will act on it promptly and involve the customer concerned.
6. Who receives data
We share personal data only with the following, and only as far as needed:
- Cloudflare, Inc. hosts this website, the quote form and its database, and protects them against attacks. It processes the technical data and form data described in section 3 on our behalf.
- Our email service provider stores the emails we exchange with you.
- Server providers that supply the physical GPU servers for customer deployments (in the EU or in Türkiye, matching the customer's region). They provide hardware and networking only and have no role in processing your content.
- Professional advisers (lawyers, accountants) under confidentiality, and public authorities where the law requires it.
We do not sell personal data and do not share it for advertising.
7. International transfers
Our hosting provider Cloudflare runs a global network, so data from this website may be processed outside Türkiye and the European Economic Area, including in the United States. For these transfers we rely on the EU Standard Contractual Clauses in Cloudflare's data processing addendum and Cloudflare's certification under the EU-US Data Privacy Framework (GDPR), and on a standard contract under Article 9 of the KVKK, notified to the Turkish Personal Data Protection Authority. You can ask us for a copy of the relevant safeguards.
Customer content in the Dublayer service stays in the region of the customer's dedicated server: Türkiye for customers in Türkiye, the EU for customers elsewhere, unless agreed otherwise in the contract.
8. How long we keep data
| Data | Kept for |
|---|---|
| Quote requests that do not lead to a contract | 24 months from receipt, then deleted automatically |
| Quote requests and correspondence with customers | For the contract, then as long as commercial and tax law requires (generally 10 years under the Turkish Commercial Code) |
| Technical logs at our hosting provider | A short period set by Cloudflare, for security and troubleshooting |
| Customer content and voice profiles | As set in the contract; deleted on the customer's request and at the end of the contract, with a deletion record sent to the customer. Where we host the server, it is wiped at the end of the contract. |
| Speaker consent records | As long as the related voice profile exists, then as long as needed to show that consent was obtained |
9. Security
This website is served only over HTTPS with strict security headers, the quote form is protected against spam and abuse, and access to stored requests is restricted to authorised staff. Customer servers are dedicated to one customer and have outbound traffic blocked after installation. More detail is in our security overview. If a breach affects your personal data, we will notify the competent authority and, where required, you, within the legal deadlines (72 hours under the GDPR; as soon as possible under KVKK).
10. Your rights
Depending on where you are, you have the right to:
- find out whether we process your data and get a copy of it;
- have inaccurate data corrected, and incomplete data completed;
- have your data deleted or anonymised;
- restrict processing, and receive your data in a portable format;
- object to processing based on our legitimate interest, and to any direct marketing at any time;
- withdraw consent at any time, where processing is based on consent;
- learn who we have shared your data with, including recipients abroad, and object to an outcome against you that arises solely from automated analysis;
- claim compensation for damage caused by unlawful processing.
To use these rights, write to hello@dublayer.studio. We will answer within 30 days, free of charge. We may ask you to confirm your identity first. If your request concerns content in the Dublayer service, we will pass it to the customer who controls that content and help them answer it.
You can also complain to a supervisory authority: in Türkiye, the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu, kvkk.gov.tr); in the EU/EEA, the data protection authority of your country.
11. Cookies
This website does not set cookies and does not use local storage, analytics, advertising pixels or social media plugins, so there is no cookie banner. To know how many people visit, we count page views per page and per day on our own hosting, without cookies, IP addresses or any other identifier. Fonts, images and videos are loaded from our own domain. Our hosting provider may set a strictly necessary security cookie if it needs to tell people from bots during an attack; such a cookie does not track you across sites. If we ever add analytics or other non-essential cookies, we will ask for your consent first and update this policy.
12. Children
Dublayer is a business service and this website is not directed at children. Customers may only dub the voice of a minor with the documented consent of the minor's parent or legal guardian, as set out in the Acceptable Use Policy.
13. AI-generated content
Dublayer produces AI-generated speech that resembles real people's voices. We mark outputs as AI-generated in a machine-readable way, as required by Article 50 of the EU AI Act, and our customers agree to disclose AI-generated or manipulated content when they publish it.
14. Changes
We will update this policy when our processing changes. The version date at the top always shows the current version, and we keep earlier versions on request. For material changes affecting customers, we will tell them in advance.
This policy is provided in English. The Turkish KVKK Aydınlatma Metni applies to people in Türkiye; where the two differ on KVKK matters, the Turkish text prevails.