Voice cloning and consent

The rule for cloning a named person’s voice, what the person records, what we store, how they withdraw, and what the platform refuses.

A simulation uses a cloned voice of a named person only after that person has given recorded consent. We never clone a voice from a public page or a recording the person did not give for this purpose. The six stock voices need no consent.

For the steps in the console, see Executive voice consent.

​

How consent is recorded

Step	What happens
1	Your team enters the executive’s name, role and email. They get a one-use link by email
2	The link is valid for 7 days
3	The executive reads five short points: what a clone is, what it is used for, what is stored, how to withdraw, and who to contact
4	They tick that they have read the points and record one sentence in their own voice
5	They record about two minutes of speech (at least 60 seconds), or upload up to three audio files instead
6	They submit. The clone is made and the consent record is stored with it

The sentence every executive reads aloud:

My name is (your name). I agree that (your company) may make a copy of my voice and use it in security awareness tests of its own staff. I know I can withdraw this at any time.

​

What is stored

Item	Why
The two minutes of speech	To build the clone
The recording of the spoken consent sentence	To show the voice was made with the person’s agreement
Their name, role and email address	To identify whose voice it is and reach them

The licence treats voice samples as biometric data. See Legal documents.

​

Withdrawal

The executive opens the same link and chooses Withdraw my consent. Then:

What	Happens
The clone	Deleted at the voice provider
The speech sample	Deleted from storage
Campaigns that use the voice	Blocked. The campaign page says who withdrew, on what date, and asks for another voice
The consent recording	Kept, with the time of withdrawal, as the record of what was agreed

Withdrawal cannot be undone. A new copy needs a new consent.

​

Request statuses

Status	Meaning
sent	The link has gone out and has not been used
recording	The executive has submitted and the clone is being made
recorded	Consent is on file and the voice is ready
revoked	The executive withdrew. The clone is gone
expired	The link was not used within 7 days. Send a new one

​

What the platform refuses

Rule	Detail
No consent, no launch	A campaign whose voice has no consent record cannot be launched
Withdrawn voice	A campaign pinned to a withdrawn voice is blocked until another voice is chosen
Executive voices per workspace	3 by default. Open invitations count towards the limit. Ask us to raise it
One use per link	A link that has been used to record cannot record again

​

Deletion

A cloned voice and its sample are deleted 30 days after the voice is created. See Retention and deletion. The licence states the same rule as: cloned only with the written consent of its owner, for the named campaign, and deleted within 30 days of the report.

An executive with a question about their data can write to [e-mail]. That address is on the consent page they see.