Privacy policy.

What we process, why, and the rights you hold — handled under the GDPR, with data kept in the EU.

Overview

This policy explains how Telltone Sole proprietorship ("Telltone", "we") processes personal data when you visit our website or use the Telltone platform and its product layers (Studio, Relay, Guide, Pilot). We collect only what we need to operate the service, and we never sell your data.

Every workspace's data is isolated and scoped to that workspace. Access is enforced on our backend, not merely hidden in the interface.

Controller & contact

Controller

Telltone (owner: Mubarak Yousuf Musa), Jaspertstraße 7, 60435 Frankfurt am Main, Germany

Data protection

privacy@telltone.com

Data we process

• Account data — name, email, role, and workspace membership.
• Workspace content — the requests, conversations, documents, and configuration you create within your workspace.
• Billing data — subscription, plan, and payment-status information. Card details are handled by our payment processor and are not stored by us.
• Usage data — product usage, feature metering, and activity needed to operate, secure, and bill the service.
• Support data — the messages and context you share when you contact us for help.
• Technical data — IP address, device and browser type, and timestamps, used to keep the service secure and available.
• Optional analytics — only with your consent via the cookie banner. We use Google Analytics 4, which processes pseudonymous usage data (e.g. pages viewed, approximate city-/country-level location, device and browser type, referrer, and a pseudonymous identifier). Google Analytics is not anonymous; names, email addresses, and form contents are not sent to Google. We also use Microsoft Clarity for behavioral analytics (session recordings and heatmaps); this data is likewise pseudonymous (not anonymous) and form contents are masked.

Why we process it

We process personal data to provide the service and perform our contract with you (Art. 6 (1)(b) GDPR), to meet legal obligations such as tax and accounting requirements (Art. 6 (1)(c)), and on the basis of our legitimate interest in a secure, reliable platform and in preventing abuse (Art. 6 (1)(f)).

Optional analytics and any non-essential cookies are processed only with your consent (Art. 6 (1)(a)), which you can withdraw at any time by contacting us at privacy@telltone.com.

Hosting & data location

The Telltone platform and its primary database are hosted in the EU (Frankfurt, Germany). In the course of normal operation, operational data is processed within the EU/EEA.

Some sub-processors (see below) may process limited data outside the EU/EEA. Where that is the case, we rely on an adequacy decision or EU Standard Contractual Clauses, together with appropriate additional safeguards.

Sub-processors

We use carefully selected service providers to operate the platform. Each acts as a processor under a data-processing agreement (Art. 28 GDPR):

• Supabase — database, authentication, and file storage. EU region (Frankfurt).
• Vercel — website and application hosting, content delivery. EU processing region; transfers covered by EU Standard Contractual Clauses where applicable.
• Stripe — payment processing and billing. Transfers covered by EU Standard Contractual Clauses.
• Microsoft Azure (Azure OpenAI) — AI voice and speech processing for Relay. EU/EEA (Azure OpenAI Data Zone).
• Railway — hosting for our AI processing services. EU region (Amsterdam).
• Twilio — inbound telephony for the Relay phone channel. Transfers covered by EU Standard Contractual Clauses.
• Resend — transactional and notification email delivery. Transfers covered by EU Standard Contractual Clauses where applicable.
• Google (Google Analytics 4) — optional, consent-based audience and usage measurement on our public marketing pages. Google acts as a processor for this under Google's data processing terms (Google Ads Data Processing Terms). EEA contracting entity: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), part of Google LLC (USA). Google may transfer personal data to the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework and additionally relies on the EU Standard Contractual Clauses.

A current list of sub-processors is available on request at privacy@telltone.com.

Cookies

We use strictly necessary cookies and local storage to operate the platform — for example to keep you signed in and to remember your workspace and language. These do not require consent.

Optional analytics or measurement cookies are set only after you consent via the cookie banner, and you can withdraw consent at any time. When you reach a checkout or billing page, our payment processor (Stripe) may set cookies that are necessary to process payments and prevent fraud. You can review or withdraw your choices by contacting us at privacy@telltone.com.

These optional services include Google Analytics 4. Storing or accessing information on your device (including any cookies) only occurs with your consent (§ 25(1) TDDDG); the subsequent processing relies on your consent (Art. 6(1)(a) GDPR). When consent is granted, Google Analytics 4 typically sets first-party cookies (e.g. _ga, _ga_*) to store a pseudonymous identifier; depending on your consent and settings, measurement may also be cookieless. Google Analytics is not loaded before consent is given. Google may transfer personal data to the USA; the safeguards are described in the "Sub-processors" section. You can withdraw or change your consent at any time via "Manage cookies" in the footer.

These optional services also include Microsoft Clarity, a behavioral-analytics service that provides session recordings and heatmaps. Microsoft Clarity is not loaded until you grant the separate "Microsoft Clarity" consent; nothing is captured before that. The interaction data can include page navigation, clicks, scrolling, pointer/mouse movement, device and browser information, and similar usage information. This data is pseudonymous (not anonymous); form contents are masked, and we do not intentionally send names, email addresses, telephone numbers, message contents, patient data, Relay conversations, or Workspace data to Microsoft. Storing or accessing information on your device only occurs with your consent (§ 25(1) TDDDG); the subsequent processing relies on your consent (Art. 6(1)(a) GDPR). When consent is granted, Clarity sets first-party cookies (including _clck and _clsk) to store a pseudonymous identifier and to connect page views into a session; further cookies may be set. The provider is Microsoft (Microsoft Corporation); Microsoft also processes this data for its own purposes and acts as an independent controller to that extent. Details of this and of the safeguards for international transfers — Microsoft may process data outside the EU/EEA, including in the USA — are set out in the Microsoft Privacy Statement. Microsoft Clarity retention: session recordings (playback) 30 days; heatmap and click data and favorited or labeled sessions up to 9 months. You can withdraw or change your consent at any time via "Manage cookies" in the footer.

Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability, and objection. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Hessischer Beauftragte für Datenschutz und Informationsfreiheit (or the authority for our registered seat — see datenschutzkonferenz-online.de).

Data retention

We retain personal data only as long as necessary for the purposes described here or as required by law. When you close a workspace, its data is deleted after a short grace period, except where statutory retention periods apply.

Billing and accounting records are retained for the periods required under German commercial and tax law (generally up to ten years under § 257 HGB and § 147 AO).

For Google Analytics 4, user- and event-level data retention is set to 14 months.