What we store
Your email, name, and — only if you create a voice clone — your 20–30 second consent recording.
How it is protected
Passwords are scrypt-hashed, personal data is encrypted at rest with AES-256-GCM, and sessions are HttpOnly cookies. Nothing is sold, ever.
Where we are
RegaLabs is operated from the Kurdistan Region of Iraq. Personal data is stored on secure, access-controlled cloud services which may be located outside Iraq; the protection described in this policy applies regardless of where the data is physically stored.
C2PA chain of custody
Provenance hashes stay in the immutable ledger for legal chain of custody. If you delete your account, all personal data and audio are erased; the anonymized hashes remain.
Your rights
Delete your account from inside the studio — the delete option lives in your account menu and erases all personal data and audio. A readable JSON copy of your account preferences and local workspace settings can be downloaded from Settings → Privacy & Data. Your privacy rights are recognised under the Constitution of Iraq (Articles 17 and 40) and the Iraqi E-Commerce Regulation No. 4 of 2025. Iraq’s draft Personal Data Protection Law is not yet in force; when it takes effect we will comply with it fully.