Privacy Policy
The short version: your conversations are yours. We process them to build your maps and your Brain, we store them encrypted, and you can export or delete everything at any time. The detail, including exactly what we do and do not do with your data, is below.
1. Who is responsible
The data controller is Talkgraph LTD, registered in England and Wales (company number 17377289), registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Our registration with the Information Commissioner's Office has been submitted and the registration number will appear here as soon as it is issued. Contact for anything in this policy: privacy@talkgraph.ai.
2. What we collect
Account data: your email address, and your name and avatar if you sign in with Google. Content: your transcripts, imported files, maps, edits, participant names you add, and the concept index that forms your Brain. Usage data: plan and node usage, and minimal technical logs needed to run and secure the service. Payments: handled by Stripe - we receive your subscription status and a customer reference, never your card details. Correspondence: emails you send us.
3. Audio
Your audio is streamed to our transcription provider to be turned into text and is not stored by us as audio. What we keep is the transcript and the maps built from it. Imported audio files are processed the same way: transcribed, then the text is kept, not the sound.
4. Why we process it
To provide the service you signed up for (contract): turning speech into maps, storing your graphs, building your Brain, answering your questions from it, sending sign-in links and receipts. To keep the service secure and prevent abuse (legitimate interests): rate limits, logs, blocking attacks. To improve the product (legitimate interests): aggregate, non-content usage such as how many nodes were created - never the content of your conversations. To tell you about significant TalkGraph updates (legitimate interests, with an unsubscribe in every email). To meet legal obligations (tax and accounting records for payments).
5. What we do not do with your data
We do not sell your data or share it with advertisers or data brokers. We do not use your content to train AI models, and our AI providers are contractually barred from doing so with API traffic. We do not build advertising or behavioural profiles from your conversations. This reflects how TalkGraph operates today; if any of it ever changes, we will update this policy and tell you before the change takes effect, as set out in section 12.
6. Who processes it for us
Supabase (database and authentication, encrypted at rest, EU/US), Vercel (hosting and delivery, US), Deepgram (speech-to-text, US), OpenAI (AI structuring of transcripts into maps, US), Resend (transactional email, US), Stripe (payments, US). Each processes only what its job requires under a data processing agreement. Where data leaves the UK, transfers are protected by the UK International Data Transfer Addendum or equivalent safeguards.
7. How long we keep it
Your content stays for as long as your account exists - that is the product. Delete a graph and it is removed from the live database immediately; residual copies in encrypted backups cycle out within 30 days. Delete your account (or ask us to) and your account data and content are erased, except the minimal records we must keep by law, such as payment records. Sign-in and security logs are kept no longer than 12 months.
8. Your rights
Under UK GDPR you can ask for access to your data, correction, erasure, restriction, portability, and you can object to processing based on legitimate interests. Most of these are built into the product: export any graph to PNG, PDF or Markdown, correct any card directly, delete anything instantly. For the rest, email privacy@talkgraph.ai - we respond within 30 days. If you are unhappy with how we handle your data you can complain to the ICO at ico.org.uk.
9. Cookies
TalkGraph uses only the cookies and local storage needed to keep you signed in and remember your preferences. There are no advertising cookies and no third-party analytics trackers. If that ever changes, this policy will change first and we will ask for your consent where the law requires it.
10. Emails
We send service emails (sign-in links, receipts, security notices) because the service cannot work without them. We may occasionally email you about significant TalkGraph updates; every such email has a one-click unsubscribe, and unsubscribing never affects service emails. The weekly Brain digest is a product feature you can turn off at any time from the email itself.
11. Children
TalkGraph is not directed at children under 13 and we do not knowingly collect their data. If you believe a child under 13 has an account, contact privacy@talkgraph.ai and we will delete it.
12. Changes
When this policy changes in a way that matters, we will tell you by email or in the app before the change takes effect, and this page always shows the current version and its date.