Spout Privacy Policy

Effective date: August 13, 2026

Spout lets people talk to other people. With clear permission and disclosures, we record those conversations and license the resulting datasets to companies to train and evaluate voice models. This Privacy Policy explains what we collect, how we use and share it, your choices, and your rights.

If you do not agree with this Privacy Policy, please do not use Spout.

1) Scope

This Policy applies to:

• Our website (withspout.com) and related pages.
• Our apps, widgets, and conversation experiences.
• Support, marketing, and business development communications.
• B2B relationships with our customers and providers.

It does not apply to third-party services we don’t control, including our customers’ own products or models trained on data we license to them.

2) What we collect

A. Information you provide

• Account & profile: name, display name/handle, email, phone number, password or SSO details, preferred language, country/region.
• Conversations & recordings: audio files, transcripts, timestamps, participant metadata (e.g., room ID), and content you upload or share (e.g., prompts, notes).
• Payments & payouts: the payout account details you provide during payout setup (handled by our third-party payment processor), payout amounts and history, and, where required, tax information such as your name, address, and taxpayer identification number. We do not store full bank or card numbers.
• Support & surveys: messages, feedback, ratings, and content of any communications with us.

B. Information we collect automatically

• Usage and app activity: features used, clicks, app opens, session duration, account signup and confirmation, application progress and submission, and referring/exit pages.
• Device & technical: IP address, cookie identifiers, mobile IDs, browser type, OS, device settings.
• Diagnostics: crash and application-not-responding reports, JavaScript and native stack traces, error codes, app state, device/app/OS metadata, performance and network metrics, and developer-defined diagnostic context.
• Approximate location (derived from IP) for fraud, compliance, analytics, and advertising measurement.

C. Information from third parties

• Service providers (e.g., analytics, payment, hosting) give us aggregated or account-related data.
• Partners & customers may confirm whether data was used to train or evaluate models.
• Public or commercial sources may provide demographic segments or anti-fraud signals.

Sensitive and biometric information. Voice recordings, and data derived from them, can be considered biometric information under some state laws when they are used to identify a specific individual. Spout does not use your recordings, or any data derived from them, to identify you. We obtain your consent before recording and keep a record of it. We use and license recordings to build voice and speech datasets for AI development, not to infer sensitive characteristics about you. Our customers may extract acoustic features when training or evaluating models. We keep recordings for as long as needed for these purposes (see Section 6). See Sections 5 and 9 for your choices and rights.

3) How we use information

We use personal information to:

1. Provide Spout: enable calls, record audio, generate transcripts, and deliver features you request.
2. Create & license datasets: curate, annotate, transform (e.g., segment, redact, transcribe), and license recordings and transcripts—including derivatives—to companies to train, fine-tune, evaluate, and benchmark voice models.
3. Safety, trust & integrity: detect abuse, fraud, spam, security incidents, and policy violations; protect our users and our services.
4. Improve Spout: debug, test, research, and develop new features; quality control for data and labeling.
5. Marketing, measurement & communications: measure which ads lead to installs, confirmed signups, and submitted applications; optimize campaigns; and send service messages (e.g., confirmations, changes, project and payout notifications), product updates, and offers via email or SMS/text message (you can opt out).
6. Legal & compliance: comply with laws, enforce terms, and respond to lawful requests.

Legal bases for EEA/UK/Swiss users: We process data as necessary to perform our contract with you, with your consent (e.g., for recording and licensing datasets), for our legitimate interests (e.g., service improvement, security), and to comply with legal obligations.

4) How we share information

We share personal information with:

• Companies: We license recordings, transcripts, and derivative datasets (which may include associated metadata) for voice model training, fine-tuning, evaluation, red-teaming, and benchmarking. We contractually restrict use to permitted purposes and require safeguards; however, once data is integrated into models, it cannot be “untrained.”
• Service providers / processors: hosting, storage, transcription/ASR, analytics, payments, communications, security, content moderation, and labeling/annotation vendors.
• Affiliates & corporate transactions: in the event of a merger, acquisition, financing, or sale of assets.
• Legal & safety: to comply with law, protect rights, or investigate suspected violations.

We do not sell your email address or account credentials to data brokers. We may “sell” and “share” personal information — as those terms are defined by US state laws, including for cross-context behavioral advertising — for example, when we license conversation datasets to customers or use advertising and analytics technologies on our public pages and mobile app. See Section 5 and Section 8 for your choices.

Contributing to our licensed datasets is the core service Spout provides: we pay contributors for the recordings (and related transcripts and information) they create, and we license those datasets to companies for the purposes described in this Policy. We pay you for the recording service you perform, not as a price for your personal information. Being included in these datasets is the basis on which contributors are paid. If you do not want your recordings licensed, you should not participate as a paid contributor.

5) Your choices

• Recording consent: By joining or continuing in a Spout conversation after a clear notice (visual and/or audio), you consent to recording and the uses described here. If you do not consent, please leave the conversation.
• Participant notifications: Hosts should ensure all participants are notified and consent where required. We provide in-product indicators.
• Access, correction, deletion: See Section 9 for your rights and how to exercise them.
• Email preferences: Opt out of marketing messages via the unsubscribe link or by emailing hello@withspout.com.
• SMS preferences: Opt out of SMS/text notifications by replying STOP to any message, updating your notification preferences in your account settings, or by emailing hello@withspout.com. Your mobile information will not be sold or shared with third parties for promotional or marketing purposes.
• Cookies, app analytics & diagnostics: Our public pages use analytics and advertising cookies for measurement. The Spout mobile app asks before enabling Google Analytics for Firebase, Firebase Crashlytics, Firebase Performance Monitoring, and Firebase event measurement used to understand which ads lead to actions in the app. This in-app choice does not control separate Google Play and Google Ads reporting of app-store downloads or installs based on store and ad activity outside the app. Manage website choices through the cookie banner and mobile choices under Account > Analytics & diagnostics (see Section 8).
• Do Not Sell/Share: If you are a US resident in a state with applicable law (e.g., CA), you may opt out of “sale” or “sharing” of your personal information by emailing hello@withspout.com with the subject “Do Not Sell or Share My Personal Information.” Because contributing to our licensed datasets is the paid service, opting out ends your participation as a paid contributor and applies going forward; it does not affect data already licensed or used to train models.
• Withdrawing consent and pay: You can withdraw your consent to future collection and stop participating at any time by emailing hello@withspout.com or closing your account. Because being included in the datasets we license is the service you are paid for, withdrawing ends your paid participation. Withdrawal is forward-looking: it does not affect recordings already licensed to a customer or already used to train a model, which we cannot recall.
• Limit use of sensitive information (CA): You may request that we limit use/disclosure of sensitive personal information to certain permitted purposes (see Section 10).

Important: Deleting your account or requesting deletion does not remove data already licensed to customers or embedded in trained models. Where feasible, we stop future use and remove data from our active systems and future dataset releases.

6) Data retention

We keep personal information only as long as necessary for the purposes in this Policy (e.g., to provide services, comply with law, resolve disputes, and enforce agreements). Dataset customers may retain licensed data per their contracts. Where possible, we use aggregation, de-identification, or pseudonymization to reduce retention risk.

Our retention schedule:

• Account & profile data: for the life of your account, and afterward only as long as necessary for security, dispute-resolution, and legal-compliance purposes.
• Recordings, transcripts & derivatives: for as long as needed for the licensed-dataset purposes you consented to. On a verified deletion request, we remove your recordings from our active systems and exclude them from future dataset releases (data already licensed or embedded in trained models cannot be recalled — see Section 5).
• Consent records: we retain records of the consents you give and withdraw, as the legal record of those acts.
• Payment & tax records: as required by tax, accounting, and anti-fraud laws.

7) Security

We implement technical and organizational measures designed to protect personal information, including encryption in transit, access controls, and audits. Because recordings may include sensitive voice data, we practice data minimization — collecting and retaining only what we need for the purposes described in this Policy — and limit access to recordings to those who need it to provide the Services. No system is perfectly secure. If a security breach affecting your personal data occurs, we will notify affected users and the appropriate authorities as required by applicable law and without undue delay. If you believe your account or data has been compromised, contact us immediately at hello@withspout.com.

8) Cookies and analytics

We use cookies, SDKs, and similar technologies to:

• Remember settings and keep you signed in.
• Measure traffic and usage (analytics).
• Improve performance and fix bugs.
• Measure and optimize our advertising, including ads on Meta (Facebook and Instagram), TikTok, and Google Ads.

Advertising, analytics, and diagnostics (Meta, TikTok, Google Ads, Google Analytics for Firebase, Firebase Crashlytics, and Firebase Performance Monitoring). On our public marketing and application pages we use the Meta pixel, TikTok pixel, Google Ads tag, and Meta’s Conversions API to understand which ads lead to applications and improve our campaigns. In the Spout mobile app, after you allow Analytics & diagnostics, Google Analytics for Firebase measures app usage and records events that we may use in Google Ads to understand which ads lead to confirmed account signups, contributor application starts, and submitted contributor applications; Firebase Crashlytics collects crash, application-not-responding, JavaScript/native exception, stack-trace, and developer-defined error context; and Firebase Performance Monitoring measures app startup, screen, network-request, and custom connection/performance traces. Separately, Google Play and Google Ads may report app-store downloads or installs based on store and ad activity outside the app; the in-app Analytics & diagnostics setting does not control that store-level reporting. Google may receive app-instance, installation, or session identifiers, a pseudonymous Spout account ID (an internal ID rather than your name, email address, or phone number), device and operating-system information, IP-derived approximate location, app activity, crash and error context, performance metrics, and advertising identifiers where permitted. We do not intentionally include voice recordings or transcripts in Firebase telemetry. Our developer-defined Analytics events, Crashlytics keys and logs, and custom Performance traces exclude email addresses and phone numbers; SDK-generated crash reports and network traces may contain technical information generated by the app or operating system. Website identifiers sent to ad platforms, such as email or phone number, are cryptographically hashed before they leave our servers.

Your choices. On public pages, use the cookie banner to manage advertising cookies; we honor Global Privacy Control (GPC) signals where required. In the mobile app, Google Analytics for Firebase, Firebase Crashlytics, Firebase Performance Monitoring, and Firebase event measurement used for Google Ads in-app conversions remain off until you allow Analytics & diagnostics, and the same control changes that app telemetry at any time under Account > Analytics & diagnostics. When you turn it off, the app immediately stops adding its own Analytics events, diagnostic annotations, nonfatal reports, and custom performance traces; clears the pseudonymous account identifier and call context used on future reports; persists the off choice for later launches; and requests deletion of unsent crash reports stored by Crashlytics. The Crashlytics Android SDK cannot recall a report already transmitted or already being handled by the current app process, and its automatic crash-collection setting fully applies on the next app launch. We pass applicable analytics-storage, advertising-storage, advertising-user-data, and ad-personalization consent choices to Google. We do not enable personalized advertising through the mobile setting. This setting controls telemetry sent by the app; it does not control separate measurement by Google Play or Google Ads outside the app, such as app-store download or install reporting, ad impressions, or ad clicks.

You can adjust your browser settings to block or clear cookies and your in-app Account settings to disable mobile analytics, diagnostics, and Firebase event measurement used for Google Ads in-app conversions. Disabling that optional app telemetry does not prevent you from using Spout or stop separate Google Play and Google Ads reporting of app-store downloads or installs.

Learn more about how Google uses information from sites and apps that use its services.

9) Your rights (EEA/UK/Swiss & certain US states)

Depending on your location, you may have rights to:

• Access: know whether we process your data and obtain a copy.
• Correction: fix inaccurate or incomplete data.
• Deletion: request we delete your data (subject to legal/contractual limits).
• Portability: receive certain data in a portable format.
• Restriction/objection: limit or object to certain processing, including profiling or processing based on legitimate interests.
• Consent withdrawal: when processing is based on consent (e.g., recordings licensed for training), you may withdraw it prospectively.
• Opt-out of sale/sharing/targeted advertising (US state laws).
• Non-discrimination: we will not discriminate against you for exercising a right.

How to exercise: Email hello@withspout.com, or use the in-app account deletion request. We may ask for information to verify your request. Authorized agents may submit requests as allowed by law.

How long we take: We acknowledge requests within 10 days and act on verified requests within 30 days. If a request is complex and the law allows an extension, we will tell you before the 30 days are up and explain why, and we will not take more than 90 days in total. You do not need to reinstall or reopen the app to request deletion, and we never charge for these requests. What deletion covers: we deactivate your account, and we stop offering any of your recordings that we have not already licensed to a customer and exclude them from future dataset releases. As explained in Section 5, recordings already licensed to a customer, or already used to train a model, cannot be recalled, and payments you have already received are unaffected. We keep the records we are required to keep for tax, payment, fraud-prevention, and dispute purposes, and we keep the record of your consent so we can show what you agreed to and when.

Appeals (US state laws): If we deny your request, you may appeal by replying to our decision. If you are in the EEA/UK/Switzerland, you may lodge a complaint with your local supervisory authority.

10) California “Notice at Collection”

We may collect the following categories (CA Civ. Code §1798.140), and we disclose/sell/share them as indicated:

Retention: See Section 6. “Sale”/“Sharing”: Licensing conversation datasets to our customers meets the CPRA’s broad definition of a “sale” of personal information, regardless of how the underlying rights are structured. We disclose it as one rather than arguing about the label, and we honor opt-out requests and Global Privacy Control signals where required. That licensing is the service you knowingly joined and are paid for: it is the entire purpose of Spout, it happens only after the in-product disclosures described in Section 2, and you can stop it going forward at any time. Separately and importantly: we do not sell sensitive personal information, including voice data treated as biometric information, and we never share your recordings, transcripts, or data derived from them with advertising networks or data brokers, or use them for cross-context behavioral advertising. Our public web pages use advertising cookies. After a user allows Analytics & diagnostics, our mobile app can send Firebase app-usage and event data that we may use to understand which ads lead to actions in the app. Separately, Google Play and Google Ads may report app-store downloads or installs based on store and ad activity outside the app; that store-level reporting is not controlled by the in-app setting. Some state laws may treat these limited forms of ad measurement as “sharing”; they never involve recordings or transcripts. Your rights: See Section 5 and 9 to opt out or limit use.

11) Children’s privacy

Spout is for adults: you must be at least 18 to use it. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has used Spout, contact hello@withspout.com and we will take appropriate action.

12) International transfers

We are headquartered in the United States and may transfer personal information to the US and other countries that may not offer the same data-protection level as your home country. Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses) and assess local laws to protect transferred data.

13) Data controller; roles

Panels Research, Inc. is the controller for your personal information collected via Spout. When we engage service providers, they act as our processors under written agreements. Our customers are independent controllers of the licensed datasets they receive and their resulting models. Their use is governed by their policies and contracts.

14) Automated decision-making & profiling

We use automated systems to operate the service (e.g., transcription, fraud and abuse detection, dataset quality scoring). We do not make decisions that produce legal or similarly significant effects solely by automated means without human review where required by law.

15) Third-party links and services

Our site and communications may include links to third-party sites or services. Their privacy practices are governed by their own policies.

16) Changes to this Policy

We may update this Policy from time to time. We will post the updated version and change the “Effective date.” If changes materially affect your rights, we will provide additional notice (e.g., via email or in-product). Your continued use of Spout after changes means you accept the updated Policy.

17) How to contact us

Panels Research, Inc. (d/b/a “Spout”)
2261 Market Street, STE 85337
San Francisco, CA, US, 94114
Email: hello@withspout.com