Privacy and data processing

How Timbrella processes your data, the providers involved, where it is stored, and how we meet the GDPR and the EU AI Act.

Who is responsible

The controller is pageBody GmbH, Bahnstr. 12, 65205 Wiesbaden, Germany. Contact for any data question: studio@timbrella.com. Company details are in the Impressum. The service is for business users and is not directed to children.

The short version

• The app, its database, and your files run on our own infrastructure in a German Hetzner data center. Core data does not leave the EU.
• Episodes are generated by AI. The script is written by a language model and the speech is synthesised. Every produced episode carries an AI disclosure and an AI Act marking in the audio.
• We clone a voice only if you ask us to, and only on your word. Speakers come from a curated library of licensed synthetic voices unless you upload a recording to build a voice of your own. If you do, you confirm the voice is yours or that the speaker gave you permission, we send the recording to ElevenLabs to build the voice, and we do not keep the recording.
• Nothing is produced until you approve the Episode Brief, and nothing is published anywhere by us. You download the finished episode and publish it yourself.
• We set no advertising or tracking cookies and run no third-party analytics.
• The AI providers that process your inputs do not use them to train their models under the API terms we use. Your inputs may be kept briefly by a provider for abuse monitoring.
• We keep your data only as long as we need it for the service and the law. You can have your account, and everything tied to it, deleted at any time.

What we process, and how it flows

• Account. Your email address and a password hash are held by our authentication service, which runs on our own infrastructure in Germany.
• Waitlist. While the beta is full, you can leave your email address and an optional name so we can offer you a seat when one opens. We keep them until you ask us to remove them (write to studio@timbrella.com), also after a seat was offered, so a second request from the same address is recognised; nothing else is sent to that address.
• Voice requests. If you ask us for a voice that is not in the library, we keep the request (language, gender, age range, style, an optional link and note) with your account and answer by email to the address on your account. It is erased with your account, or earlier if you ask us to remove it.
• Your inputs. What you set up in the app: your brand and show definitions, the cast and the names you give them, your source content or the URL you point us at, target length, and any image direction. Stored in our own database in Germany.
• Payment. Handled by our payment processor. We store the outcome and your subscription state, never your card details.
• Research. At your instruction we fetch the pages you name as sources, and retrieve search-results data for your episode topic, so that claims can be backed by evidence from a real source. Results are stored in our database.
• Brief and script. Your show definition, source content, and research are sent to a large-language-model provider to produce the Episode Brief and its script. You review and approve it before anything is produced.
• Show memory. Summaries of your past episodes are converted into numeric embeddings so a show stays consistent across episodes.
• Production. The approved script is turned into audio by a speech-synthesis provider, and the publishing kit’s images are generated by an image provider. Both outputs are stored in our own storage.
• Delivery. The links you open to play or download are short-lived signed URLs to our own storage.
• Email. Sign-up, recovery, and service emails are sent through our email provider.
• Hosting. Everything above runs on our own infrastructure in a German Hetzner data center.

Service providers

We rely on a small set of service providers (processors) to run the service. We name them here, with their role and location, and update this list when our providers change. Questions: studio@timbrella.com.

Legal bases (GDPR Art. 6)

• Contract (Art. 6(1)(b)): the processing needed to deliver the service you subscribed to, which is research, the Episode Brief, production, and the publishing kit.
• Legitimate interests (Art. 6(1)(f)): security, abuse prevention, and keeping the service running.
• Legal obligation (Art. 6(1)(c)): invoicing and tax records.

We use only the cookies needed to keep you signed in. We set no advertising or analytics cookies, so there is no consent banner to click through.

EU AI Act

• You always know when you are dealing with AI. Episodes are AI-generated: the script is written by a language model and the speech is synthesised. The publishing kit carries an AI disclosure line, and the produced audio carries an AI Act marking, so the disclosure travels with the file after you publish it (transparency under Art. 50).
• Voice cloning is opt-in and attested. Speakers are drawn from a curated library of licensed synthetic voices. You may also build a voice from a recording you upload. Before we build it you confirm that the voice is your own, or that the speaker gave you permission to use it. We cannot verify that for you, which is exactly why we ask you to state it rather than tick a box on someone else’s behalf. A voice built this way is private to your Client and is never offered to another customer, and audio made with it carries the same AI disclosure and AI Act marking as every other episode.
• Risk tier. The service is a limited-risk AI use. It produces promotional and educational content about your own subject matter. It is not used to evaluate, screen, or make decisions about people, and it is not used for any high-risk purpose under the Act (no employment, creditworthiness, biometric identification, or similar decisions).
• Human oversight is built into the flow. Nothing is produced until you approve the Episode Brief, which contains the angle, the facts, and the full script. Outputs are advisory, you edit and approve them, and nothing is published anywhere without your action. We make no solely automated decision that produces a legal or similarly significant effect about you (GDPR Art. 22).

International transfers

Core data is hosted on our own infrastructure in Germany, so no transfer mechanism is needed there. Our payment, language-model, embedding, speech, image, research, and email providers are in, or transfer data to, the United States. Those transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses in our data-processing agreements.

How long we keep it

We keep your personal data only for as long as we need it to provide the service, run your account, and meet our legal obligations. We do not keep it indefinitely for its own sake.

• You can have your account deleted at any time by emailing studio@timbrella.com. Deletion erases your account, your shows, episodes, briefs, produced audio, publishing kits, uploaded source documents, any voice clones we created for you, your voice requests, your show and reference images, and the search embeddings derived from your content, from our systems and from the services we use to produce them.
• Invoices and tax records are kept for the statutory retention period under German commercial and tax law, even after your account is deleted, because we are legally required to keep them.

Marketing email

Marketing email is consent-only and double opt-in (GDPR Art. 6(1)(a)). At sign-up, and later in your account, you can tick two separate boxes: occasional email about Timbrella, and occasional email about other pageBody products. Both start unticked, and your account works fully with neither. Ticking a box records a request and sends you one confirmation email; only your click on that email switches the preference on. We keep an append-only record of each request, confirmation, and withdrawal, including the exact wording you were shown, because we must be able to prove what was agreed to (Art. 7(1)).

Withdrawing is one step, with no confirmation loop (Art. 7(3)): untick the box in your account, and the preference is off immediately. Withdrawal never affects the email the service itself needs to send you, such as receipts and password resets.

Your rights

You have the right to access, rectify, erase, restrict, port, and object to the processing of your data, and to withdraw consent at any time (GDPR Art. 15 to 22). Write to studio@timbrella.com and we will answer within the statutory period. You also have the right to complain to a supervisory authority; ours is the Hessischer Beauftragte für Datenschutz und Informationsfreiheit.

Changes to this notice

We update this notice when the service or our providers change, and the provider list above is the part most likely to move. Material changes are announced in the app before they take effect.