Privacy policy.

What we process, why, and the rights you hold — handled under the GDPR, with data kept in the EU.

Overview

This policy explains how Telltone Sole proprietorship ("Telltone", "we") processes personal data when you visit our website or use the Telltone platform and its product layers (Studio, Relay, Guide, Pilot). We collect only what we need to operate the service, and we never sell your data.

Every workspace's data is isolated and scoped to that workspace. Access is enforced on our backend, not merely hidden in the interface.

Controller & contact

Controller

Telltone GmbH, [FILL STREET ADDRESS], [FILL POSTCODE] Frankfurt am Main, Germany

Data protection

privacy@telltone.com

Data we process

• Account data — name, email, role, and workspace membership.
• Workspace content — the requests, conversations, documents, and configuration you create within your workspace.
• Billing data — subscription, plan, and payment-status information. Card details are handled by our payment processor and are not stored by us.
• Usage data — product usage, feature metering, and activity needed to operate, secure, and bill the service.
• Support data — the messages and context you share when you contact us for help.
• Technical data — IP address, device and browser type, and timestamps, used to keep the service secure and available.
• Optional analytics — only if you consent via the cookie banner.

Why we process it

We process personal data to provide the service and perform our contract with you (Art. 6 (1)(b) GDPR), to meet legal obligations such as tax and accounting requirements (Art. 6 (1)(c)), and on the basis of our legitimate interest in a secure, reliable platform and in preventing abuse (Art. 6 (1)(f)).

Optional analytics and any non-essential cookies are processed only with your consent (Art. 6 (1)(a)), which you can withdraw at any time by contacting us at privacy@telltone.com.

Hosting & data location

The Telltone platform and its primary database are hosted in the EU (Frankfurt, Germany). In the course of normal operation, operational data is processed within the EU/EEA.

Some sub-processors (see below) may process limited data outside the EU/EEA. Where that is the case, we rely on an adequacy decision or EU Standard Contractual Clauses, together with appropriate additional safeguards.

Sub-processors

We use carefully selected service providers to operate the platform. Each acts as a processor under a data-processing agreement (Art. 28 GDPR):

• Supabase — database, authentication, and file storage. EU region (Frankfurt).
• Vercel — website and application hosting, content delivery. EU processing region; transfers covered by EU Standard Contractual Clauses where applicable.
• Stripe — payment processing and billing. Transfers covered by EU Standard Contractual Clauses.
• Railway — hosting for AI processing services. Transfers covered by EU Standard Contractual Clauses where applicable.
• Resend — transactional and notification email delivery. Transfers covered by EU Standard Contractual Clauses where applicable.
• Anthropic — AI language processing for product features. Transfers covered by EU Standard Contractual Clauses; data is not used to train third-party models.
• Google — AI language processing for product features. Transfers covered by EU Standard Contractual Clauses or an adequacy decision where applicable.

A current list of sub-processors is available on request at privacy@telltone.com.

Cookies

We use strictly necessary cookies and local storage to operate the platform — for example to keep you signed in and to remember your workspace and language. These do not require consent.

Optional analytics or measurement cookies are set only after you consent via the cookie banner, and you can withdraw consent at any time. When you reach a checkout or billing page, our payment processor (Stripe) may set cookies that are necessary to process payments and prevent fraud. You can review or withdraw your choices by contacting us at privacy@telltone.com.

Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and objection. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Hessischer Beauftragte für Datenschutz und Informationsfreiheit (or the authority for our registered seat — see datenschutzkonferenz-online.de).

Data retention

We retain personal data only as long as necessary for the purposes described here or as required by law. When you close a workspace, its data is deleted after a short grace period, except where statutory retention periods apply.

Billing and accounting records are retained for the periods required under German commercial and tax law (generally up to ten years under § 257 HGB and § 147 AO).