Policy states retention 'only for as long as necessary.' YouTube API data max 30 days. No specific timeline for user-uploaded video content or account data post-deletion. General statement about complying with legal obligations for retention. No guaranteed deletion period after account closure specified. Voice cloning data retention not specifically addressed.

Privacy policy references 'appropriate administrative, technical and security procedures' with firewalls, encryption, and intrusion detection—but these are generic claims. No SOC 2 Type II or ISO 27001 certification mentioned. No bug bounty program. No known major public breaches. Nudge Security profile available but no specific certifications confirmed. Small company (Nine Thirty Five LLC) likely has basic security controls.

ToS (Jan 2026) grants Nine Thirty Five a broad license to 'access, use, host, store, cache, modify, reproduce, transmit, display, publish, and distribute your Content to operate, improve, promote and provide the Services and to develop new services and products.' The phrase 'develop new services and products' implies potential use of uploaded content (video, audio, images) for model improvement. Privacy policy does not explicitly say content is used for training nor explicitly opt-out. YouTube API data retained max 30 days per Google policy. Voice cloning feature present—audio likeness data collected.