Privacy Policy

TalkToLeads installs and maintains lead-response, qualification, routing, human-handoff and follow-up workflows for service businesses. We are not a CRM, a marketing agency, or a lead vendor.

This policy applies to personal data relating to:

• Website visitors — anyone browsing talktoleads pages.
• Checkout visitors — businesses that give a work email and agency name at checkout but have not yet paid.
• Clients and business contacts — the people at a client business we work with.
• Leads and customers of a client — individuals whose enquiries pass through a workflow we operate for that client.
• Employees and contractors — our own personnel, where relevant to service delivery.

We collect different categories of data for different reasons. Retention approaches below are summaries — section 10 has the detail.

Website chat

The chat widget on this site is answered by Claude, a model operated by Anthropic. What you type is sent to Anthropic to produce the reply. We do not keep the conversation: app/api/chat/route.ts records that a question was answered and which source answered it, never the message text. [LAWYER: confirm the wording describing Anthropic’s commercial terms — specifically that inputs and outputs are not used to train models, and whether that statement needs qualifying.]

Cookie and consent categories

These are the four categories the banner offers, exactly as lib/consent.ts defines them. Everything except the first is off until you switch it on, and rejecting never restricts access to the site.

A choice you make is honoured for 6 months, after which the banner asks again. It also asks again if we change the categories materially. [LAWYER: confirm the re-prompt period is acceptable in each market served.]

We use personal data to:

• Operate, maintain and improve our website.
• Review onboarding submissions and decide whether a request fits our standard implementation scope.
• Request and confirm payment through Wise, and issue invoices for the monthly fee.
• Deliver implementation, maintenance, support and operational reporting.
• Set up and operate the workflows a client has asked us to run.
• Send transactional and service communications, such as onboarding steps and project updates.
• Respond to enquiries, support requests and privacy requests.
• Protect our systems and prevent fraud, abuse and security incidents.
• Meet legal, accounting and tax obligations.
• Measure website performance, where you have given consent or where otherwise permitted by applicable law.

The grounds we rely on depend on where you are and which law applies. Depending on your jurisdiction, these may include:

• Consent, where applicable law requires it — for example, for non-essential cookies and certain marketing messages. You may withdraw consent at any time.
• Performance of a contract, or steps taken at your request before entering one — for example, reviewing your checkout details or delivering the service.
• Legitimate business interests, where permitted — for example, securing our systems, preventing abuse, and understanding aggregate website performance, balanced against your rights.
• Compliance with legal obligations, such as tax, accounting and lawful requests from authorities.
• Client instructions, where we act as a service provider or processor handling data on a client’s behalf.

• For lead and customer data processed through client workflows, the client typically determines the purpose and means of processing and is generally the data controller or Data Fiduciary under applicable law.
• TalkToLeads generally acts as a service provider / data processor, handling that data under the client’s documented instructions.
• The client remains responsible for their own customer notices, for obtaining and maintaining valid permissions and consents, for having a legal basis to contact people, for approving message content, for any regulated-industry obligations, and for compliance with the laws that apply to them and to their recipients.
• TalkToLeads will process client lead data only to provide the contracted services, and in accordance with the Data Processing Addendum, applicable law, and documented client instructions.

Where we act for our own purposes

Separately from operating client workflows, we process some data for our own purposes as an independent controller: securing and monitoring our platform, keeping audit and abuse-prevention records, maintaining billing and tax records, and producing aggregate operational statistics that do not identify individual leads. Those purposes are described in this policy rather than in the DPA.

Our full Cookie Policy lists the technologies we use, their purpose and their duration. In summary, we group them into essential, functional/preferences, analytics, and marketing categories.

• Essential technologies are needed for the site to work and for us to record your privacy choices. They cannot be switched off.
• Functional / preference technologies remember settings you have chosen.
• Analytics technologies help us understand aggregate site performance.
• Marketing technologies are only described here so the category is complete; they are used only if and when we actually enable them.

You can accept, reject or change your choices at any time using the Cookie settings link in the footer. Optional technologies are activated according to your stated preference and applicable law. Your browser settings can also block or delete cookies independently of our banner.

We share personal data only with the categories of recipient below, and only as needed. Our current providers are listed on the Subprocessors page.

• Hosting and database providers — to run our systems and store data.
• Email delivery providers — to send transactional and service email.
• Analytics providers — where you have consented or it is otherwise permitted.
• Session-replay / heatmap providers — where you have consented, with sensitive fields masked.
• Payment provider (Wise) — to request and confirm payment.
• Messaging providers, such as the WhatsApp Business Platform, where a client selects that channel for their workflow.
• Automation and integration providers — where used to connect the systems a client has asked us to connect.
• Professional advisors — lawyers, accountants and auditors, under duties of confidentiality.
• Authorities — where we are lawfully required to disclose, or to establish, exercise or defend legal claims.
• A recipient in a corporate transaction — if the business is sold, merged or reorganised, subject to applicable law and appropriate confidentiality.

Primary storage is in Japan and hosting is in the United States. Our database and authentication run on Supabase in AWS ap-northeast-1 (Tokyo), and the website and its server routes run on Vercel in the United States. So if you are in Australia, New Zealand, Singapore, the UAE or anywhere else, your data is processed outside your own country.

The table below is the full list, generated from the same record the subprocessors page uses, so the two cannot disagree.

Where applicable law requires safeguards for such transfers, we will put appropriate safeguards in place.

Different categories are kept for different periods. Our default retention approach is 30 days, adjusted per category as follows:

• Lead data is retained for 30 days after cancellation, then deleted.
• Account data is retained for 12 months after cancellation, or longer where tax law requires.
• Client data is retained during active service, then deleted or returned in accordance with the contract and the Data Processing Addendum, subject to legal requirements, backup cycles, unresolved disputes, or security needs.
• Setup requests that do not become clients are retained for [INSERT PERIOD].
• Billing and tax records are retained for as long as applicable law requires.
• Security and audit records are retained for [INSERT PERIOD].
• Consent and opt-out records are retained for as long as needed to keep honouring the choice.

We use reasonable technical and organisational safeguards designed to protect personal data against unauthorised access, loss, misuse and alteration.

No system or transmission method is completely secure. We cannot and do not guarantee absolute security. If you believe you have found a security issue, please contact us at the address in section 16.

Depending on your jurisdiction, you may have rights under applicable data-protection law, which may include:

• Access to the personal data we hold about you.
• Correction of inaccurate or incomplete data.
• Deletion or erasure of data, in defined circumstances.
• Withdrawal of consent, where processing relies on consent.
• Objection to, or restriction of, certain processing, where applicable.
• Data portability, where applicable.
• Opting out of marketing communications at any time.
• Making a complaint to us, and to a supervisory authority or grievance mechanism where one is available to you.

To exercise a right, use the privacy request page. We may need to verify your identity, or your authority to act for someone else, before we can act on a request — this protects you from someone else obtaining your data.

We aim to respond within [INSERT RESPONSE TIMEFRAME — VARIES BY JURISDICTION]. Where applicable law sets a shorter or longer period, that period applies.

Our website and services are directed at businesses, not children. We do not knowingly collect personal data from children.

If you believe a child’s data has been provided to us, contact pritpalkaur112@gmail.com and we will take appropriate steps to delete it.

Clients remain responsible for ensuring their own workflows are not directed at children, and that any processing of children’s data meets the requirements of applicable law.

Our website and communications may link to sites and services we do not operate. Those are governed by their own privacy policies and terms, and we are not responsible for their content or practices.

We may update this policy as our service, providers, or legal obligations change. When we do, we update the version number and the “last updated” date shown at the top of this page.

Where a change is material and applicable law or our contract requires it, we will provide additional notice — for clients, through the account contact on file.

The fastest route for a formal request is the privacy request page, which records your request and routes it to a named owner.