Privacy Policy

Voice Bridge, Rwanda Media Voice Bridge Platform

How Voice Bridge collects, uses, stores, and protects your personal data when you use the platform.

1. Who We Are

Voice Bridge is an AI-powered subtitling and transcription platform for the Kinyarwanda language, operated by Duka Labs Limited ("Duka Labs", "we", "us", "our"), the Implementing Consultant for the Rwanda Media Voice Bridge (RMVB) project. The project is developed with Rwanda's Centre for the Fourth Industrial Revolution (C4IR) and supported by the Deutsche Gesellschaft für Internationale Zusammenarbeit (GIZ) GmbH.

2. What Data We Collect

2.1 Data you provide when creating an account

• Your name and email address.
• Organisation name and job role (optional but recommended for institutional accounts).
• Billing and payment information, processed through a third-party payment processor. We do not store card numbers or payment credentials.

2.2 Content you upload for processing

When you upload video and audio files for transcription or subtitling, those files may contain:

• Spoken dialogue and narration, classified as Voice Data under our processing framework.
• Moving images, on-screen text, and associated visual content, classified as Audiovisual Source Data.
• Personal data about third parties, including actors, interview subjects, performers, and documentary participants who are identifiable from the content.

Important, Voice as Biometric Data

Under Rwanda Law No. 058/2021 and the IP Law No. 055/2024, a human voice constitutes biometric data and a personal identity marker. When you upload content containing identifiable voices, you are responsible for ensuring you have the legal basis, including appropriate consent from those individuals, to process their voice data through this platform. See Section 7 (Your Responsibilities as the Data Controller for your Content) for full details.

2.3 Usage and technical data generated automatically

• Features accessed, upload timestamps, session durations, and export actions.
• IP address, browser type, device type, and operating system.
• Server-side logs generated when you interact with the platform or API.

3. How We Use Your Data

4. Legal Basis for Processing

We process your personal data on the following legal bases, consistent with Rwanda Law No. 058/2021 and, where applicable, the EU GDPR:

• Contract performance, processing necessary to deliver the transcription and subtitling services you have subscribed to.
• Legitimate interests, platform security monitoring, fraud prevention, and service reliability, where these do not override your fundamental rights.
• Legal obligation, compliance with applicable Rwandan law and lawful authority requests.
• Consent, AI model improvement using your content, marketing communications, and any processing for which we specifically request your agreement. You may withdraw consent at any time.

5. Your Content and AI Model Improvement

We will never use your uploaded content to retrain or improve our AI models without your explicit written consent.

The NLP models used on the platform are tested, not trained, on your content during normal platform use. If Duka Labs or C4IR wishes to use your uploaded audio, video, or transcription outputs to improve the model, we will:

1. Contact you directly in writing with a full explanation of what will be used and why.
2. Provide a separate written consent instrument for you to sign.
3. Offer fair compensation or a mutually agreed benefit.
4. Allow you to withdraw consent at any time before any training run is executed.

Any model improvement use during the pilot phase is strictly non-commercial, consistent with our agreements with C4IR and GIZ.

6. Data Retention

Upon project end or termination of service, all user-uploaded content, transcriptions, translations, subtitle files, and any data derived from uploaded content will be permanently deleted from all systems within 30 days, consistent with our obligations to C4IR and GIZ under the RMVB project agreements.

7. Your Responsibilities as the Data Controller for Your Content

When you upload content to Voice Bridge that contains personal data about third parties, including actors, interview subjects, performers, or journalists, you become the Data Controller for that personal data. Duka Labs processes it as your Data Processor, on your instructions. This means you are responsible for:

• Ensuring you own or have the legal right to process the content you upload.
• Ensuring that identifiable individuals in your uploads have consented to their voice and likeness being processed by an AI subtitling platform.
• Ensuring that any confidential, classified, or legally restricted content has verified authority before uploading.
• Complying with the moral rights of performers under Rwanda Law No. 055/2024, including the right not to have their work distorted or misrepresented.

Special Note, Institutional and Government Content

If your content was produced under client contracts with confidentiality clauses, such as EU-funded NGO documentary footage, government communications, or donor reporting materials, you must verify that your contract permits processing by a third-party AI tool before uploading. If uncertain, obtain written confirmation from your client first.

Voice Bridge processes content in a secure environment and deletes files after 72 hours. However, responsibility for the authority to upload rests entirely with you.

8. Your Rights

Under Rwanda Law No. 058/2021, you have the following rights regarding your personal data held by Duka Labs:

To exercise any of these rights, contact privacy@voicebridge.rw. We will respond within 30 days. Individuals whose voice or image appears in content uploaded by a third party (e.g. an actor or interviewee) may also contact us at the same address.

9. Data Security

We implement the following technical and organisational measures, consistent with the security obligations in our agreements with C4IR and GIZ:

• Encryption in transit (TLS 1.3) for all data transmitted to and from the platform.
• Encryption at rest for all stored files and processing outputs.
• Automated deletion of uploaded files 72 hours after processing completion.
• Access controls, staff access to user-uploaded content is restricted to authorised personnel on a strict need-to-know basis.
• Deletion Confirmation Logs, records of all downloads and deletions of content, available to institutional clients on written request.
• Data Incident notification, you will be notified within 72 hours of Duka Labs becoming aware of any incident affecting your data.

10. Third-Party AI Services

Where Duka Labs uses third-party AI services or APIs for benchmarking or testing platform performance, we verify that the provider's terms do not permit retention or use of submitted data for training their own models. Where this cannot be conclusively confirmed, content is anonymised before submission. A register of all third-party AI services used is maintained and available to institutional clients on written request.

11. Children

Voice Bridge is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16 as account holders. Content featuring minors as subjects may be uploaded only for legitimate documentary, journalistic, or educational purposes. Do not upload content of minors in vulnerable or private situations. Contact privacy@voicebridge.rw if you believe data from a child under 16 has been submitted.

12. Changes to This Policy

We will notify you by email and platform notice at least 30 days before any material changes take effect. Continued use after that date constitutes acceptance. The current version and effective date are always shown at voicebridge.dukalabs.com/policy.

13. Contact

© 2026 Duka Labs Limited / Voice Bridge. All rights reserved. For legal review before publication. Version 1.0 · May 2026