Privacy policy

tts-cache-router is a caching text-to-speech router for voice agents, operated by Oggnai Technologies Private Limited (CIN U62011DL2025PTC446040), 293 S/F, Western Marg, Saidulajab, New Delhi, Delhi 110030, India (“we”, “us”). This policy covers the website and dashboard at ttscacherouter.dev and the router and API at api.ttscacherouter.dev.

Two groups of people appear in it:

• Customers: the people and organisations with an account. For their account data we are the controller.
• End users: the people whose words a customer’s agent speaks through the Service. For their data we are a processor acting on the customer’s instructions, and the customer’s own privacy notice governs it.

Account data. Sign-in is with Google. We keep your email address, your name and your Google account identifier. There is no password.

Org data. Your org’s name and retention setting, who belongs to it, and the name, first characters and a one-way hash of each API key. The key itself is shown to you once and never stored.

Text and audio. The text your agent sends is split into sentences and sent to the provider you chose. The audio the provider returns is streamed to you and cached for your org (section 6). The cache stores the audio under a one-way hash of the sentence and its voice settings; the sentence text itself is not stored. Because the audio is the sentence spoken aloud, we treat it as carrying the same personal data as the text.

Provider keys. The Sarvam, Raya or ElevenLabs keys you save in the dashboard or through the API. We store them encrypted (AES-256-GCM), use each one only to call that provider for your org’s own requests, never show them again after you save them (only their last four characters), and never log them. You can replace or delete them at any time in the dashboard.

Technical data. Our servers log request metadata: your org, the provider and model, sizes, timings, errors, and IP addresses. They never log sentence text, provider keys or API keys. We also keep aggregate operational metrics, such as how many sentences each org served from cache.

Billing data. Your org’s credit balance and its history: the free credit, each purchase and refund with its amount and Dodo Payments’ payment and refund identifiers, and the characters served from the cache each day. You pay on Dodo Payments’ own checkout page, so your card or other payment details go to Dodo Payments, never to us. We pass Dodo Payments your org’s identifier and your name and email address, so the checkout is filled in and the payment is credited to your org.

• Running the Service: authenticating your requests, synthesizing and caching speech, and showing you your org.
• Security, debugging and abuse investigation.
• Support, when you ask for it, and messages about changes that affect your account.

We do not sell your data, and we do not use your text or audio to train models. There is no advertising or analytics tracker on this site or in the dashboard.

Providers you choose

Each sentence that isn’t already cached goes to the TTS provider your request names, with the key you saved for it, on your account: Sarvam AI, Raya or ElevenLabs. They are your processors, under your agreement with them; we cannot read or change your settings there. A sentence served from the cache reaches no provider.

Our sub-processors

Dodo Payments

Credit is sold through Dodo Payments, our merchant of record. Dodo Payments runs the checkout, takes the payment, handles taxes, issues invoices and processes refunds, and keeps the payment details you give it under its own privacy policy. It sends us confirmation of each payment and refund, with the amount and your org’s identifier.

We disclose data outside these lists only where the law requires it, or to protect the rights and safety of our users, and we will tell you unless we are legally barred from doing so.

The Service runs in DigitalOcean’s datacentre in Bengaluru, India: account and org data and the logs are there. Cached audio is stored in DigitalOcean Spaces in Singapore. Sarvam and Raya synthesize speech in India. ElevenLabs may synthesize it outside India, in the regions it operates.

For transfers to our sub-processors we rely on the standard contractual clauses in their terms; for the providers you choose, your own agreement with them carries the transfer.

• Traffic between your agent, your browser and the Service is encrypted with TLS.
• API keys are stored only as one-way hashes.
• Provider keys are stored encrypted with AES-256-GCM, bound to their org and provider, and decrypted only by the service that calls the provider.
• Cached audio is scoped to its org, and is never served to another org.
• The cache is held in memory and is not written to disk.
• The database and the cache listen on no public interface.

We hold no security certification such as SOC 2 or ISO 27001. If you need something in writing for a procurement review, ask us at [email protected]. If we discover a breach affecting your data, we will tell you and the relevant regulator as the law requires.

If you hold an account. Depending on where you live, you may have the right to access, correct, delete or export your data, to object to processing, or to withdraw consent. Write to [email protected]; we will respond within 30 days.

If an agent built on the Service spoke to you. Your rights are against the business that runs the agent; contact them first. If you can’t reach them, write to [email protected] and we will pass the request on.

You may complain to your data protection authority. In India, that is the Data Protection Board.

We set two cookies, both strictly necessary, both HTTP-only and sent only over HTTPS:

• tcr_session keeps you signed in to the dashboard for up to 30 days. It is sent only to ttscacherouter.dev.
• tcr_oauth lives for 10 minutes while you sign in with Google, to check that the sign-in you finish is the one you started.

There are no analytics, advertising or third-party cookies, which is why there is no cookie banner. Fonts are served from our own domain.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request only the openid, email and profile scopes, and use them only to sign you in and show you your name and email.

The Service is a business product and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, write to [email protected] and we will delete it.

We update this page when what we do changes, and revise the date at the top. If a change materially affects how we handle your data, we will tell account holders by email or in the dashboard before it takes effect.

For a question, an access or deletion request, or a complaint, write to [email protected]. Under India’s data protection rules, that address also reaches our grievance officer.

Oggnai Technologies Private Limited
293 S/F, Western Marg, Saidulajab, New Delhi, Delhi 110030, India
CIN U62011DL2025PTC446040
[email protected]
+91 99101 80529