Is HeyGen safe? What it does with your face, voice, and videos

The Morse teamPublished November 8, 20269 min read

As of November 2026, HeyGen is safe in the sense that it's a real company that says it's SOC 2 Type II certified, checks consent before it builds a custom avatar, and publishes its security practices. It isn't private by default. Unless you're an enterprise customer, HeyGen's privacy policy lets it train its models on what you upload until you email to opt out, its terms give it an irrevocable license to your videos, and your face and voice data stays on its servers for as long as your avatar exists.

We read HeyGen's privacy policy (last updated October 15, 2026), its terms (October 16, 2026), its biometric information privacy notice (May 5, 2026), its voice supplemental terms, its moderation policy, its trust and safety, security, and FAQ pages, and four of its help center articles on November 8, 2026. We didn't make a HeyGen account or an avatar. HeyGen earns credit for its biometric notice, which names the face and voice data it extracts, the laws that govern it, and a retention limit for each kind.

Does HeyGen use your face to train AI?

It can, unless you're an enterprise customer or you opt out, and HeyGen's own pages don't agree on the details. The privacy policy says "we may use the input that you provide us to improve our services, for example, to train and enhance the models that power our Services," on the ground of HeyGen's "legitimate interest," and that you may opt out "by contacting us at privacy@heygen.com" (HeyGen). There's no switch in the app named on any page we read.

Here is what each HeyGen page said on November 8, 2026:

Some reviews repeat the FAQ's version. One AI tool review says "Customer videos, scripts, and custom avatars are not used to train general models" (Aona AI). HeyGen's privacy policy and terms keep training on the table for anyone who isn't on an enterprise contract. The biometric notice is the strictest of the six. It says HeyGen uses "your videos and associated face geometry" for training only with your consent, asked for separately, and that you "can use our service to create an avatar without consenting to this purpose." Everything else you type or upload, such as scripts, voice clips, and images, falls under the privacy policy's opt-out rule.

Withdrawing consent later has limits. For users in Europe, the notice promises to delete identifiable face data within 60 days "to the extent technically feasible without compromising the integrity of already-trained models," and adds that "where biometric data has been irreversibly incorporated into model weights in a non-extractable form, it is no longer considered personal data" (HeyGen). We compare other companies' training rules in which AI companies train on your data.

Who owns your HeyGen avatar and videos?

You do, on paper, with a license to HeyGen that you can't take back. On paid plans, the terms say you own your input and output, and that "HeyGen does not claim to own any of Your Content." The same section grants HeyGen a license to "access, use, host, cache, store, reproduce, transmit, display, publish, distribute, and modify Your Content to operate, improve, promote and provide the Services," and calls it "royalty-free, transferable, sublicensable, worldwide and irrevocable." It survives the end of the terms (HeyGen).

The Free plan gives you less. You own your input, but your output comes with only a "limited, non-exclusive, non-transferable, revocable license" for "personal, non-commercial, and internal evaluation purposes," and HeyGen may delete a Free account, with notice, after six months with no activity (HeyGen). Our page on who owns your AI chats sets licenses like this one beside other AI apps' terms.

Can someone make a HeyGen avatar of you without permission?

HeyGen's rules forbid it and its process checks for it. Its moderation policy says creating a custom avatar of another person "is strictly prohibited" without "the explicit consent of the individual being represented" (HeyGen). For every video avatar, the person on camera records a consent video of under 30 seconds, reading HeyGen's script word for word, at the same time as the footage. If you're making an avatar of someone else, "that person must record their own consent video," and HeyGen rejects a consent clip from a different person or a screen recording (HeyGen).

The biometric notice explains the check: HeyGen compares face data from the footage with face data from the consent recording, then deletes the verification data "typically within minutes" (HeyGen). The trust and safety page says avatar owners must honor "removal requests from those depicted" (HeyGen). For voices, HeyGen's voice terms say anyone whose voice was cloned without permission can report it to moderation@heygen.com, and "an active HeyGen account is not required" (HeyGen).

What does HeyGen do with your voice?

It clones it only with the speaker's permission, under separate voice terms. Those terms say "ownership of a recording alone does not establish permission to clone or use a person's voice," require you to be 18 or older, forbid cloning anyone under 18, and need HeyGen's prior written approval for a celebrity, political candidate, or deceased person's voice. They also draw a line between making your clone and training HeyGen's general models: the voice terms "grant no additional permission for general model training" (HeyGen).

The same page warns that "disabling a voice is not the same as deleting its associated personal data." To remove the data, send a deletion request to privacy@heygen.com.

Does HeyGen track you for ads?

Yes, on its websites. The privacy policy names "Google Analytics, Datadog, DoubleClick and Meta" among its tracking tools and says HeyGen uses them "for remarketing and to deliver targeted ads to you." It adds that the site "is not designed to respond to" do not track or opt-out preference signals, and that visitors in the EU and UK are asked for consent first (HeyGen). The same policy says HeyGen doesn't "sell" or "share" personal information as California law defines those words, and the biometric notice says it doesn't sell or profit from your face data. We cover how ad trackers reach AI apps in AI chatbots that share data with trackers.

How long does HeyGen keep your face and videos?

As long as your avatar is active, then up to 60 days. The privacy policy says deleted data stays in disaster recovery backups "for 60 days and then automatically and permanently erased," and that HeyGen tries to act on a deletion request "within 72 hours" (HeyGen). The biometric notice sets outer limits by place: in the EEA, UK, and Switzerland, avatar face data is destroyed within 60 days of deleting the avatar; for Illinois residents, within three years of your last interaction at most; for Texas residents, within a year after the purpose ends (HeyGen).

HeyGen's help center describes it more simply. Deleting your account means "your account and all your data will be instantly deleted" (HeyGen). The policy's 60-day backup window is the more exact answer. The help center's avatar FAQ also offers to help if you delete an avatar by mistake during your first month of a subscription (HeyGen).

If HeyGen is sold, the policy says personal information "will" move to the new owner with the part of the business it belongs to, after you're "contacted in advance" (HeyGen).

How do you opt out and delete your HeyGen data?

1. Opt out of training: email privacy@heygen.com and ask HeyGen to stop using your inputs and face data to train its models. Keep the reply.
2. Delete an avatar: remove it from its slot on the Avatars page. HeyGen lets you redo an avatar once per billing cycle (HeyGen).
3. Remove a cloned voice: disabling it isn't enough; ask privacy@heygen.com to delete the voice data.
4. Delete the account: click your initials in the lower-left corner, choose Settings, then under Account click Delete Account and type your email to confirm (HeyGen). Canceling a plan only moves you to Free (HeyGen).

Is HeyGen secure?

Its security page describes the usual controls. HeyGen says it's SOC 2 Type II certified, runs annual third-party penetration tests, stores all customer data on Amazon Web Services in the United States, and encrypts data at rest with AES-256 and in transit with TLS 1.2 or higher. It says its contracts bar its AI subprocessors from training on customer data (HeyGen). We found no breach notice on HeyGen's own pages as of November 8, 2026. Its terms cap HeyGen's liability at what you paid in the past 12 months or $100, whichever is more (HeyGen).

How Morse keeps your scripts private before they become a video

HeyGen's training license, its 60-day backups, and its irrevocable terms all attach to what you upload. An avatar needs your face, but the script it reads doesn't need to start inside HeyGen. Morse doesn't make videos or avatars. It's where the words get written: the script, the talking points, the translation you'll check, the lines you'd rather not hand a training set while they're still drafts.

A Morse chat is stored in your browser, encrypted, not on our servers, and our servers don't keep your messages or log what you write. Morse doesn't train AI on your content, sell your data, or show ads, and runs no advertising trackers or third-party analytics, so there's no opt-out email to send. Pick a privacy mode for each chat:

• E2EE, for a launch script or an internal announcement no one should see early. Your browser checks the enclave's hardware attestation before anything leaves your device, then encrypts the message so only that enclave can read it; our servers relay ciphertext they can't read. The enclaves are run by third-party providers, not by Morse, and the protection rests on the hardware and attestation working as designed. E2EE comes with Pro, at $19 a month.
• Private, the default, for everyday drafts and rewrites. Grok and open-weight models like DeepSeek, Kimi, and GLM answer here, and Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing.
• Anonymous, to polish a line with GPT, Claude, or Gemini. Our proxy removes your account, email, and IP address, so the provider reads the text without knowing it's you. It may keep it for a limited time to check for abuse, under its own policy, so leave names out.

Your history locks when you sign out and takes two keys to open, one of which never leaves your device. Because we don't store chats, we usually have very little to give authorities. Clearing your browser deletes your drafts for good and we can't recover them, so paste the final script wherever you keep your files. Our CapCut training guide covers the same question for a video editor, and is Sora private covers OpenAI's video app.

Before you upload your face to HeyGen

• Training: email privacy@heygen.com to opt out before you upload, and decline the separate training consent when you create an avatar. On Morse, there's nothing to opt out of.
• Other people: never film a colleague or relative for an avatar without their own consent video. Get written permission for a voice, as HeyGen's voice terms require.
• Business use: a Free plan video isn't licensed for commercial use.
• Leaving: delete avatars and voices first, then the account, and expect backups to last up to 60 days.

Write your next script in Morse: start free, or try a chat from the home page without an account.