Privacy Policy
The short version at present: your conversations remain yours. We process them to build your maps and Brain, do not retain the audio recording, do not train models on your content, and let you export or delete your work. Every registered user will be told before this policy changes.
1. Who is responsible
Talkgraph LTD is the data controller for TalkGraph as it operates at present. We decide why and how personal data is processed, including for individual, team and enterprise accounts. Talkgraph LTD is registered in England and Wales (company number 17377289) at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Talkgraph LTD is registered with the Information Commissioner's Office under data-protection registration reference ZC218298. Contact: privacy@talkgraph.ai.
2. What we collect at present
Account data includes your email address and, if you choose Google sign-in, the name, avatar and account identifier Google provides. Content includes transcripts, imported files, maps, edits, participant names, generated artifacts and the concept index that forms your Brain. Audio is processed transiently as described below. Usage and technical data includes plan and node usage, API route, model-token counts, timestamps, errors and security events. Web measurement can include page path, referring host, a daily-rotating visitor hash, coarse location, browser, operating system and device type. Platform and abuse-prevention logs may temporarily include IP address and user agent. Stripe handles card details; we receive subscription status, transaction references and a Stripe customer identifier. We also keep correspondence you send us and, if you consent, conversion or referral identifiers. Section 13 explains how encryption and access controls protect this information at present.
3. Audio
At present, audio is streamed to Deepgram to be turned into text and is not retained by TalkGraph as an audio recording. We retain the transcript and the maps built from it. Imported audio files follow the same process: the sound is transcribed and discarded after processing, while the resulting text is kept until you delete it or your account. Other people in your conversations. If you capture a meeting or a call, the voices, names and words of the other participants are processed in the same way as yours: transcribed by Deepgram, structured by our AI provider and stored as part of your content. TalkGraph shows an on-screen notice while capture is running, and our terms require you to give participants any notice or consent the law requires; the notice does not transfer that responsibility to us. We do not build profiles of participants, contact them, or use their words to train models. A participant who wants their words removed can email privacy@talkgraph.ai and we will work with the account holder to remove them.
4. Why and how we process it
We process account data, content, audio, payments and service messages because this is necessary to perform our contract with you. We process proportionate usage, performance and security information for our legitimate interests in operating, improving and protecting TalkGraph, preventing fraud and enforcing limits. Optional Google Ads conversion measurement, the Meta Pixel and PromoteKit referral attribution rely on your consent. For visitors in the United States they are on by default and you can opt out at any time (see section 10). Tax, accounting and lawful disclosure requirements are processed to meet legal obligations. We do not use conversation content for general product analytics.
| Data | Purpose and basis | Retention | Recipients |
|---|---|---|---|
| Account and authentication | Provide and secure your account — contract and legitimate interests | Account lifetime; security records up to 12 months | Supabase, Resend; Google if chosen |
| Content and Brain | Create, store and retrieve your knowledge — contract | Until you delete it or your account; backups within 30 days | Supabase and the current AI provider |
| Live or imported audio | Create a transcript — contract | Transient processing; TalkGraph does not retain the recording | Deepgram |
| Usage, errors and security events | Meter plans, maintain reliability and prevent abuse — contract and legitimate interests | Up to 12 months | Supabase and Vercel |
| Page and performance measurement | Understand use and performance — legitimate interests | Up to 12 months; no raw IP in our analytics table | Vercel |
| Optional conversion and referrals | Attribute advertising conversions and referrals: consent (opt-out for visitors in the United States) | Until consent is withdrawn, you opt out, or the provider's applicable period ends | Google Ads, Meta and PromoteKit |
| Billing and accounting | Take payment and keep statutory records — contract and legal obligation | Normally six years for accounting records | Stripe |
5. What we do not do at present
At present, we do not sell personal data, disclose it to data brokers, use conversation content for advertising profiles, or train AI models on your content. Our AI providers are required not to train on API content supplied to provide TalkGraph. Any future change would require an updated policy and advance notice to every registered user under section 17.
6. Who receives data
Supabase (database and authentication, encrypted at rest, EU/US), Vercel (hosting and delivery, US), Deepgram (speech-to-text, US), OpenAI (AI structuring of transcripts into maps, US), Resend (transactional email, US), Stripe (payments, US), Google Ads (optional conversion measurement after consent, US), PromoteKit (optional referral attribution after consent, US). Each provider receives only the information required for its function. If you choose Google sign-in, Google authenticates you and provides limited account details under Google's own privacy terms. Law-enforcement or regulatory bodies receive information only where disclosure is legally required. We do not give private content to advertisers.
7. International transfers
TalkGraph and its providers may process data in the United Kingdom, European Economic Area and United States. Where UK personal data is transferred to a country without UK adequacy regulations, we use the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, an International Data Transfer Agreement, or another lawful safeguard appropriate to the transfer.
8. Retention and deletion
Content is retained while your account exists because persistent knowledge is the service. Deleting a graph removes it from the live database immediately, and residual encrypted backup copies cycle out within 30 days. You can delete your account yourself from the profile menu in TalkGraph or at talkgraph.ai/delete-account. Account deletion removes account data and content, subject to that backup cycle and records we must retain by law. Security, sign-in, product-usage and web-measurement records are retained for no longer than 12 months. Accounting records are retained for the period required by law, normally six years. Correspondence is normally retained for 12 months after the matter closes, unless it is needed for a legal claim.
9. Administrative and support access
Private content is not routinely read by TalkGraph. Access to production systems is restricted to authorised personnel and protected service credentials. Authorised access may occur where it is necessary to provide support you request, investigate a security incident, restore data, enforce these terms or comply with law. We limit access to the information needed for that task and seek your permission before support access to content where practicable. Operational dashboards use account, billing, usage and security information rather than conversation content.
10. Cookies, analytics and referral measurement
Essential cookies and local storage keep you signed in, remember preferences and store your privacy choice. Vercel Web Analytics and Speed Insights measure page use and performance; our own analytics store no raw IP address and use a daily-rotating visitor hash. Google Ads conversion measurement, the Meta Pixel (which tells Meta when an ad on Facebook or Instagram led to a sign-up) and PromoteKit referral attribution are optional. Outside the United States they load only after you choose "Accept"; the banner's "Learn more" popup explains these services, and closing the banner with × leaves them disabled. In the United States they are on by default and the notice offers "Opt out"; we also treat a Global Privacy Control signal from your browser as an opt-out. We work out which applies from the country of your connection. Wherever you are, you can change your choice from the privacy-choice control on this page. We do not sell personal information for money; some US state laws call this kind of advertising measurement "sharing", and opting out stops it. TalkGraph does not use conversation content for analytics or advertising.
11. Emails
At present, service emails include sign-in links, receipts, security notices and product messages needed to provide TalkGraph. Product-update email includes an unsubscribe option; opting out does not stop necessary service messages. The weekly Brain digest is optional and can be turned off from the message.
12. Your rights
Under UK data-protection law you may request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. Export, correction and deletion tools are built into TalkGraph. For any other request, email privacy@talkgraph.ai. We respond without undue delay and within one calendar month, subject to any lawful extension. You may complain to the Information Commissioner's Office at ico.org.uk.
13. Security and encryption
At present, data sent between your browser, TalkGraph and the providers named in this policy is protected in transit using HTTPS/TLS. Supabase provides encryption at rest for the managed database and its backups. Account authentication, row-level database policies and server-side ownership checks restrict access to private content, while powerful service credentials remain on the server. These access controls complement encryption but are not themselves encryption. TalkGraph is not end-to-end encrypted at present: TalkGraph and the named transcription, AI and storage providers must be able to access content for the limited time needed to transcribe it, structure it, answer from it and store it. We will not describe TalkGraph as end-to-end encrypted unless the architecture changes to make that technically true.
14. Security incidents
We assess suspected personal-data breaches, contain them, preserve appropriate evidence and document the response. Where a breach is likely to risk people's rights and freedoms, we notify the Information Commissioner's Office as soon as practicable and, where feasible, within 72 hours. Where the risk to an affected person is high, we also notify that person without undue delay and explain practical steps they can take.
15. Third-party services
At present, TalkGraph links to or works with the providers named in this policy. If you deliberately connect, import from or send information to another service, that service may process the information under its own privacy terms. We will identify a new built-in provider before it begins processing user content and update the current provider list.
16. Business changes and children
If TalkGraph is reorganised, financed, sold or transferred, relevant data may be disclosed under confidentiality and transferred as part of the business, subject to this policy and applicable law. TalkGraph is not directed at children under 13 and we do not knowingly collect their data. Contact privacy@talkgraph.ai if you believe a child under 13 has an account.
17. Changes and notice to every user
This policy describes TalkGraph as it operates at present. Before any change takes effect, we will publish the new version and notify every registered user by email and in the application, stating the effective date. The current dated version remains available on this page. People using a demo without an account should review this page because we do not hold contact details with which to notify them directly.