Privacy Policy
Last updated: 29 April 2026 · Effective: upon publication
1. Who we are
TalkBot ("we," "us," "our") is operated by TalkBot Technologies (incorporation in progress). Our registered office is HSR Layout, Bengaluru, Karnataka, India. You can reach our Data Protection Officer at privacy@talkbot.brandsap.com.
2. What we collect
From customers (workspace owners)
- Account details: name, email, phone, password hash, billing address
- Payment data: handled by Stripe / Razorpay; we do not store full card numbers
- Workspace configuration: agents, IVR flows, contacts, queue setup
- Usage telemetry: API requests, call counts, minutes, errors
From end-users (callers)
- Phone number (caller ID)
- Call audio (only if recording enabled by workspace)
- Transcripts (text of conversation)
- Metadata: call duration, language detected, intent classification
3. How we use it
- To provide the service (voice agents, transcription, billing)
- To improve product quality (anonymized aggregate metrics only)
- To send transactional emails (account, billing, security)
- To comply with legal obligations (DPDP, IT Act, TRAI, tax)
We do not sell personal data. We do not use customer call recordings to train external LLMs or share with advertisers.
4. Legal basis (GDPR / DPDP)
- Contract: service delivery to customers
- Consent: recording and transcript retention require explicit workspace + caller consent flows
- Legitimate interests: security, fraud prevention, aggregate analytics
- Legal obligation: tax, regulatory reporting
5. Sub-processors
We use the following sub-processors to deliver the service:
| Sub-processor | Purpose | Data location |
|---|---|---|
| Groq Inc. | Speech-to-text, LLM inference | US |
| LiveKit Inc. | WebRTC SFU + SIP gateway (cloud option) | US, EU, AP |
| Hetzner Online GmbH | Hosting (default region) | EU (DE/FI) |
| AWS S3 (Mumbai region) | Call recording storage (India) | IN |
| Stripe Inc. | International billing | US |
| Razorpay Software Pvt Ltd | India billing | IN |
| Postmark / SendGrid | Transactional email | US |
| Cloudflare Inc. | DNS, CDN, DDoS | Global edge |
We notify customers in writing 30 days before adding new sub-processors.
6. Data retention
- Account data: retained while account is active + 90 days post-cancellation
- Call recordings: per workspace setting, max 12 months default
- Transcripts: per workspace setting, max 12 months default
- Billing records: 7 years (statutory)
- Aggregate analytics: indefinite (no PII)
7. Your rights
Under DPDP Act 2023 (India) and GDPR (EU/EEA), you have the right to access, correct, erase, restrict, port, and object to processing of your data; and to lodge a complaint with the Data Protection Board (India) or supervisory authority (EU).
To exercise these rights, email privacy@talkbot.brandsap.com. We respond within 30 days.
8. Security
- TLS 1.3 in transit on all endpoints
- SRTP for call media within LiveKit
- Encryption at rest (Postgres + S3 SSE)
- JWT auth with role-based access control
- HMAC-signed webhooks; replay-protected
- Annual penetration test (planned, Year 1)
- SOC 2 Type 1 (planned, Year 2)
9. Cookies
We use only essential cookies (session token, CSRF) and a single anonymous analytics cookie (Plausible.io, no IP tracking). No third-party advertising cookies.
10. International transfers
If you are in the EU/EEA, your data may be processed in the US (Groq, LiveKit cloud option). We rely on Standard Contractual Clauses (SCC) for these transfers.
11. Children's privacy
TalkBot is not directed to children under 18. We do not knowingly collect data from minors.
12. Changes to this policy
We will email all customers at least 30 days before any material change.
13. Contact
Privacy questions: privacy@talkbot.brandsap.com
Postal: HSR Layout, Bengaluru, Karnataka, India