Privacy Policy

We collect account email addresses, display names, IP addresses, and — for voice cloning users — a 20–30 second verbal consent recording. All personal identifying data is encrypted at rest using AES-256-GCM before writing to PostgreSQL disks. Passwords are cryptographically hashed using scrypt. User data is never sold or shared with commercial data brokers.

RegaLabs operates out of Erbil, Kurdistan Region of Iraq. High-performance GPU neural inference (Rega Voice, Rega Transcribe, and the Agent language model) and object storage are hosted on secure, access-controlled enterprise cloud infrastructure located inside and outside Iraq. Private voice clone weights, uploaded audio recordings, and enterprise business states are never used to train public open-source foundation models.

RegaLabs maintains a strict zero-warrantless-disclosure policy. No customer data, telephony call recordings, or voice assets are disclosed to any third party, government agency, or law enforcement entity without a formal, binding judicial warrant or subpoena issued by an investigative judge (قاضي التحقيق / فەرمانی دادوەری) having competent jurisdiction in the Kurdistan Region of Iraq or Federal Iraq.

You may permanently delete your account at any time via Settings → Privacy & Data, which automatically purges your credentials, private voice clone weights, and uploaded media. However, in compliance with Central Bank of Iraq financial regulations (AML Law No. 39 of 2015) and C2PA chain-of-custody requirements, anonymized transaction ledgers and cryptographic provenance hashes are retained in our immutable audit archive for a statutory period of 5 years.

Your privacy rights are protected under the Constitution of Iraq (Articles 17 and 40) and the Iraqi E-Commerce Regulation No. 4 of 2025. You may export a complete JSON archive of your account preferences, API keys, and workspace metadata at any time from Settings. RegaLabs maintains proactive alignment with Iraq's draft Personal Data Protection Law.