Privacy Policy

DuoCast — duocast.space

Last updated: 19 September 2026 Effective from: 19 September 2026

1. Who we are

DuoCast ("we", "us") operates the service at duocast.space (the "Service"), which turns a topic into a podcast-style episode with audio, captions and video.

This policy explains what we do with your personal data. The rules for using the Service are in our Terms of Service, and you should read both.

• Data controller: Finio Solutions
• Address: AV Sanhaja, Rue Al Khawarizmi, Résidence Sabour, N° 34, Bureau N° 18, Tangier, Morocco
• Contact for privacy matters: [email protected]

We are the data controller for the personal data described here. Under Moroccan Law No. 09-08 on the protection of individuals with regard to the processing of personal data, we are the controller (responsable du traitement), supervised by the National Commission for the Control of Personal Data Protection (CNDP). Where the EU General Data Protection Regulation (GDPR) also applies — for example because you are in the EU/EEA — we act as controller under it as well. Our contact for data matters is [email protected].

2. The short version

• You give us an email address and a topic. We generate a script, voice it, render a video, and keep those files so you can download and publish them.
• To do that we send your topic and your transcript to AI services, and any reference images you upload to an image service. Section 6 describes what we share and with which kinds of provider.
• We never see your card details, because we do not take cards. Top-ups are paid in cryptocurrency.
• We do not sell your personal data, and we do not use your content to train our own models.
• You can ask us to delete your account and everything in it — see section 11.

3. What we collect

3.1 Account data

When you sign up we collect your email address and a password. We never store the password itself — only a salted hash. You may also set a display name and a theme preference.

We record the time you last used the Service.

3.2 Content you create or give us

To produce an episode you give us a topic or title and a target length. From that we generate, and store:

• the script;
• the audio track;
• word-level timings used for captions;
• the rendered video files (landscape, 9:16 portrait, and teaser versions);
• publishing metadata (title, description, tags);
• cast artwork — AI-generated character images, and the text prompts behind them.

These files stay in your account until you delete them or ask us to.

3.3 Images you upload

You can upload images for two purposes:

• Reference images, to influence how a generated character looks. These can be photographs of real people, including people other than you.
• A brand logo, to place on the wall behind the hosts.

If you upload an image of another person, you must have their permission to do so. Reference images are transmitted to our image-generation provider (section 6) and stored in your account.

3.4 Connected platform accounts

You may connect a YouTube, Instagram or TikTok account — or any other publishing platform the Service supports — so the Service can publish for you. When you do, we store an OAuth access token and refresh token, the platform account identifier, and the connection time.

These tokens allow the Service to act on your account only for publishing, and only when you press Upload. You can disconnect at any time, which deletes the stored tokens.

3.5 Payments

Top-ups are paid in cryptocurrency through a third-party payment processor. We store the transaction reference, amount, chosen asset, the deposit address and the payment status. We do not receive or store card numbers, bank details or wallet private keys.

Note that a cryptocurrency payment is recorded on a public blockchain. The blockchain record is outside our control and is not personal data we can delete.

What we do and do not refund is set out in our Refund Policy.

3.6 Technical data

We use a single session cookie to keep you signed in (section 10). We do not run advertising trackers or third-party analytics on the Service.

Our servers record standard request logs — IP address, time, and the resource requested — to operate and secure the Service.

4. How we use your data

We use it to:

• create and run your account;
• generate the script, audio, video and metadata you ask for;
• publish to a platform when, and only when, you tell us to;
• meter usage and bill top-ups;
• keep the Service secure, debug failures, and prevent abuse;
• respond to you when you contact us;
• meet our legal and accounting obligations.

We do not use your content to train AI models, ours or anyone else's, and we do not sell or rent your personal data.

5. Legal bases

Where Moroccan Law No. 09-08, or the GDPR, applies, we rely on:

• Performance of a contract — to create your account and produce your episodes.
• Legitimate interests — to secure the Service, prevent abuse, and fix faults.
• Consent — where you upload an image containing another identifiable person, you confirm you have their consent; and for any optional feature we present as consent-based.
• Legal obligation — to keep financial records.
• Consent, recorded — where Law No. 09-08 requires your prior and specific consent, we ask for it before the processing begins, not after.

6. Who we share it with

We share the minimum necessary to run the Service, and only with service providers acting for us. In general terms, the things we send, and why, are:

• AI and image services — the text you give us (your topic or title, and the episode transcript) is processed by AI services that help write the script, plan the scenes, generate the publishing metadata and choose the teaser moment. Text descriptions of a cast, and any reference image you upload, are processed by an image service in order to draw the artwork.
• Payment providers — the top-up amount, the asset you choose and the transaction reference, in order to take a cryptocurrency payment.
• The platforms you connect — the video file and its title, description, tags or caption are sent to the platform you choose to publish to, such as YouTube, Instagram, TikTok or any other platform the Service supports, and only when you press Upload.
• Hosting and infrastructure providers — the servers and storage on which the Service and your files run.

Voice generation happens on our own infrastructure. Your script is not sent to a third party to be spoken.

We do not sell or rent your personal data, and we do not use your content to train AI models. You can ask us for the current list of providers that process personal data on our behalf, and where they are located, by writing to [email protected].

We may also disclose data where the law requires it, or to protect rights and safety. If the business is sold or merged, data may transfer as part of it; we will tell you before that happens.

7. Where your data is processed

Some of the providers we use are outside your country, including in the United States. Where we transfer personal data out of the EU/EEA or Turkey, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

8. How long we keep it

• Account data — while your account exists.
• Episodes, videos, audio and casts — while your account exists, or until you delete them.
• OAuth tokens — until you disconnect the platform or delete your account.
• Payment records — as long as tax and accounting law requires, typically 10 years, as the Moroccan Code of Commerce requires for business records.
• Request logs — 30 days.

9. Security

We use salted password hashing, session tokens that are HttpOnly, HTTPS in transit, and access controls on our systems. Third-party OAuth tokens are held so the Service can publish on your behalf, and access to them is restricted.

No system is perfectly secure. Please use a unique password, and tell us at [email protected] if you believe your account has been compromised.

10. Cookies

We set one cookie, duocast_session. It holds a random session token, is HttpOnly, and SameSite=Lax. It exists only to keep you signed in, and it is required — the Service cannot work without it.

We set no advertising or analytics cookies. If that changes, this section and a consent mechanism will change first.

11. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct it if it is wrong;
• delete it — your account and everything in it;
• export it in a portable format;
• object to or restrict certain processing;
• withdraw consent at any time.

To exercise any of these, email [email protected]. We will respond within the time your law allows, normally 30 days.

12. Children

The Service is not for children. You must be at least 16 to use it, and we do not knowingly collect data from anyone younger. If you believe a child has given us data, contact us and we will delete it.

13. Changes

We may update this policy. If a change is significant we will tell you in the Service or by email before it takes effect. The date at the top always shows the current version.

14. Contact

Questions, requests or complaints: [email protected]

You also have the right to complain to a supervisory authority. In Morocco that is the CNDP (cndp.ma); in the EU/EEA, your national authority.