What happens to your voice, and who can reach it

The short answer

A MemoriesBox archive is made of three things: audio recorded by the person themselves, transcripts of that audio, and a voice model built from it. All three sit in the European Union. The person who is recorded decides who gets a key. Anything in the archive can be exported and kept on your own drive, without us.

This section exists because the honest questions about this category are uncomfortable ones, and they deserve pages rather than a paragraph in a privacy policy.

The seven questions, and where each is answered

Why this cluster exists

47% of Americans regret not recording or documenting a conversation with someone who has since died, and 59% have never done it at all (YouGov, June 2022, n=6,090). That figure covers recording or documenting, so it is not a statement about voice specifically. It is still the shape of the problem: most people intend to and do not.

The reason is often not price. It is a reasonable suspicion that handing a parent's voice to a small company is a bad idea, and that suspicion is well earned. StoryFile filed for Chapter 11 on 5 May 2024 owing $150,000 in customer refunds (US Bankruptcy Court, White Plains, New York, case 7:24-bk-22398). HereAfter AI's website returns 404 on every path as of 17 August 2026. MyHeritage confirmed DeepStory’s discontinuation in an August 2025 notice; users reported it had stopped accepting new creations by July 2025 while perfectly healthy as a business.

So the argument is not "trust us". It is: here is where the data sits, here is what the law makes us do, here is what you can take away, and here is what we cannot guarantee.

What we do, in one place

• Everything is stored in the European Union, backups included: Stockholm and Supabase's EU region, with the application running in Frankfurt. Four American processors touch content for the length of a request, and one of them, the voice vendor, holds the voice model. They are named, with their countries, on /trust/where-your-data-lives.
• The voice is built only from recordings the person made themselves, knowingly, while alive and taking part — and only when they press "Create my digital self" in their own settings. Never from photographs, messages, or somebody's description of them.
• The digital self answers from what was actually said. It is told not to invent hard facts, and when a subject was never recorded it says so in character rather than making something up.
• Every conversation says what it is. A line under the conversation heading, every session, in all five languages, states that this is a digital imitation built only from the person's own recordings. Generated speech is stored with machine-readable metadata marking it as AI-generated, as Article 50 requires.
• No streaks, no push notifications, no daily counts. One email exists: a single question, sent to someone who recorded and then stopped, never more than once in seven days, with an opt-out that needs no login. That is the whole of it, and it is described rather than hidden.
• Export at any time, whether or not a subscription is running. A lapsed card never deletes a recording; that is written into the Terms.
• A way to stop. Settings → Voice → "Retire my digital self" deletes the voice model at the vendor and erases the character brief. The recordings stay. Deleting the account deletes everything, including the voice.

What we can't promise

• We cannot promise permanence. MemoriesBox is at version 0.4.1, which is pre-1.0, and we publish that number deliberately.
• We hold no SOC 2 and no ISO 27001 certification. Memory Murals and Avataari publish security certifications; we do not. We compete on where the data sits and on what you can take with you.
• We cannot promise the avatar outlives the company. Files outlive companies. Services do not.
• We cannot promise this helps with grief. There is a real argument that products like this can make the past too attractive to let go, and the research in both directions is thin. We set that out on /trust/consent rather than hiding it.
• We have no published reviews and no independent review footprint anywhere. That absence is the reason this cluster is written the way it is.

What the law says

Three instruments govern most of what happens here, and all three are public.

• GDPR (Regulation (EU) 2016/679): lawful basis and consent under Articles 6 and 7, special-category data under Article 9, access and portability under Articles 15 and 20, processors under Article 28, security under Article 32. Primary text: eur-lex.europa.eu.
• EU AI Act (Regulation (EU) 2024/1689), Article 50: transparency obligations, applicable since 2 August 2026. Primary text: artificialintelligenceact.eu/article/50.
• National law on personality and post-mortem rights, which varies by member state and matters more than most people expect. See /trust/who-owns-a-voice-clone.

Questions people ask

Is MemoriesBox GDPR compliant?

MemoriesBox is established in the European Union, hosts recordings there, and processes them on the basis of the storyteller's explicit consent. Compliance is a continuing obligation rather than a badge, so the useful version of this answer is the detail on /trust/where-your-data-lives.

Can my family read or hear my recordings without permission?

No. The person recorded decides who gets access, while they are alive. Nobody is given a key by default, including us.

Does anyone at MemoriesBox listen to the recordings?

Only the founding team, only when a member asks us to look at their own account, and every such access is logged by the storage provider. Nobody opens a recording to check it, to improve anything, or out of curiosity. The processors that handle audio for a moment are listed with their countries on /trust/where-your-data-lives.

What happens to the archive when the person dies?

It continues, under whoever they named while living. The GDPR does not apply to the personal data of deceased people (Recital 27), so what protects the archive after death is national law plus the arrangement the person made themselves. Both are explained on /trust/who-owns-a-voice-clone.

How is this different from the services that have shut down?

Mostly by being honest about the difference between files and services, and by holding the data in a jurisdiction with enforceable rights. The full account, including what we still cannot guarantee, is on /trust/what-happens-if-we-shut-down.

---

Related: How the voice clone works · Every other way to keep a voice · The full comparison table

When you are ready, start a subscription. $139 a year, first 14 days free, cancel anytime.