Privacy policy

tts-cache-router is a caching text-to-speech router for voice agents, operated by Oggnai Technologies Private Limited (CIN U62011DL2025PTC446040), 293 S/F, Western Marg, Saidulajab, New Delhi, Delhi 110030, India (“we”, “us”). This policy covers the website and dashboard at ttscacherouter.dev and the router and API at api.ttscacherouter.dev.

Two groups of people appear in it:

• Customers: the people and organisations with an account. For their account data we are the controller.
• End users: the people whose words a customer’s agent speaks through the Service. For their data we are a processor acting on the customer’s instructions, and the customer’s own privacy notice governs it.

Account data. Sign-in is with Google. We keep your email address, your name and your Google account identifier. There is no password.

Org data. Your org’s name and retention setting, who belongs to it, and the name, first characters and a one-way hash of each API key. The key itself is shown to you once and never stored.

Text and audio. The text your agent sends is split into sentences and sent to the provider you chose. The audio the provider returns is streamed to you and cached for your org (section 6). The cache stores the audio under a one-way hash of the sentence and its voice settings; the sentence text itself is not stored. Because the audio is the sentence spoken aloud, we treat it as carrying the same personal data as the text.

Provider keys. The Sarvam, Raya, ElevenLabs, OpenAI, Deepgram, xAI, Soniox, Smallest AI or Cartesia keys you save in the dashboard or through the API. We store them encrypted (AES-256-GCM), use each one only to call that provider for your org’s own requests, never show them again after you save them (only their last four characters), and never log them. You can replace or delete them at any time in the dashboard.

Technical data. Our servers log request metadata: your org, the provider and model, sizes, timings, errors, and IP addresses. They never log sentence text, provider keys or API keys. We also keep aggregate operational metrics, such as how many sentences each org served from cache.

Billing data. Your org’s credit balance and its history: the free credit, each purchase and refund with its amount and Dodo Payments’ payment and refund identifiers, and the characters served from the cache each day. You pay on Dodo Payments’ own checkout page, so your card or other payment details go to Dodo Payments, never to us. We pass Dodo Payments your org’s identifier and your name and email address, so the checkout is filled in and the payment is credited to your org.

• Running the Service: authenticating your requests, synthesizing and caching speech, and showing you your org.
• Security, debugging and abuse investigation.
• Support, when you ask for it, one welcome email when you create an account, and messages about changes that affect your account.
• Measuring our own ads: telling OpenAI that an account was created (see below).

We do not sell your data, and we do not use your text or audio to train models. There is no analytics tracker on this site or in the dashboard, and no advertising script.

Providers you choose

Each sentence that isn’t already cached goes to the TTS provider your request names, with the key you saved for it, on your account: Sarvam AI, Raya, ElevenLabs, OpenAI, Deepgram, xAI, Soniox, Smallest AI or Cartesia. They are your processors, under your agreement with them; we cannot read or change your settings there. A sentence served from the cache reaches no provider.

Our sub-processors

OpenAI, for our ads

We advertise on ChatGPT. When you create an account, our server tells OpenAI’s Conversions API that a sign-up happened, so we can measure those ads. It sends one-way (SHA-256) hashes of your email address and of our internal account id, the ad’s click id if you came from one of our ads, and your IP address and browser user agent. OpenAI uses the email’s hash only to match the sign-up to an ad you saw; it never receives your email itself, your name, or anything about how you use the Service, and no OpenAI script runs on this site.

Dodo Payments

Credit is sold through Dodo Payments, our merchant of record. Dodo Payments runs the checkout, takes the payment, handles taxes, issues invoices and processes refunds, and keeps the payment details you give it under its own privacy policy. It sends us confirmation of each payment and refund, with the amount and your org’s identifier.

We disclose data outside these lists only where the law requires it, or to protect the rights and safety of our users, and we will tell you unless we are legally barred from doing so.

The Service runs in DigitalOcean’s datacentre in San Francisco, United States: account and org data, the logs and the metrics are there, and cached audio is stored in DigitalOcean Spaces in the same region. Sarvam and Raya synthesize speech in India; ElevenLabs, OpenAI, Deepgram, xAI, Soniox, Smallest AI and Cartesia synthesize it in the regions they operate.

If you use the Service from outside the United States, including from India, your data is transferred to the United States to be processed and stored there, and the text you send is transferred to the provider you choose, in the region it synthesizes in. For transfers to our sub-processors we rely on the standard contractual clauses in their terms; for the providers you choose, your own agreement with them carries the transfer.

• Traffic between your agent, your browser and the Service is encrypted with TLS.
• API keys are stored only as one-way hashes.
• Provider keys are stored encrypted with AES-256-GCM, bound to their org and provider, and decrypted only by the service that calls the provider.
• Cached audio is scoped to its org, and is never served to another org.
• The cache is held in memory and is not written to disk.
• The database and the cache listen on no public interface.

We hold no security certification such as SOC 2 or ISO 27001. If you need something in writing for a procurement review, ask us at [email protected]. If we discover a breach affecting your data, we will tell you and the relevant regulator as the law requires.

If you hold an account. Depending on where you live, you may have the right to access, correct, delete or export your data, to object to processing, or to withdraw consent. Write to [email protected]; we will respond within 30 days.

If an agent built on the Service spoke to you. Your rights are against the business that runs the agent; contact them first. If you can’t reach them, write to [email protected] and we will pass the request on.

You may complain to your data protection authority. In India, that is the Data Protection Board.

We set these cookies, all HTTP-only and sent only over HTTPS:

• tcr_session keeps you signed in to the dashboard for up to 30 days. It is sent only to ttscacherouter.dev.
• tcr_oauth lives for 10 minutes while you sign in with Google, to check that the sign-in you finish is the one you started.
• tcr_oppref, only if you came from one of our ads on ChatGPT, lives for the same 10 minutes and carries the ad’s click id, so a sign-up can be credited to the ad (see Who else sees it).

An ad’s link carries its click id, and this site keeps it in your browser’s local storage for up to 30 days, until you sign up.

There are no analytics or third-party cookies, which is why there is no cookie banner. Fonts are served from our own domain.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy. We request only the openid, email and profile scopes, and use them only to sign you in, show you your name and email, email you about your account, and send a one-way hash of your email to OpenAI to measure our ads, as described above.

The Service is a business product and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, write to [email protected] and we will delete it.

We update this page when what we do changes, and revise the date at the top. If a change materially affects how we handle your data, we will tell account holders by email or in the dashboard before it takes effect.

For a question, an access or deletion request, or a complaint, write to [email protected]. Under India’s data protection rules, that address also reaches our grievance officer.

Oggnai Technologies Private Limited
293 S/F, Western Marg, Saidulajab, New Delhi, Delhi 110030, India
CIN U62011DL2025PTC446040
[email protected]
+91 99101 80529