Privacy Policy

Effective Date: February 8, 2026
Last Updated: October 8, 2026

Welcome to TalkBuildr ("we", "us", or "our"), provided by IdeaVista, trading as TalkBuildr. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our chatbot platform in compliance with the General Data Protection Regulation (GDPR) and Dutch data protection law.

1. Information We Collect
   • Personal Information: Name, email address, payment details (processed by Stripe), company name (optional)
   • Usage Data: Chat logs, support messages, analytics data, IP addresses, device/browser information
   • Cookies and Tracking: See our Cookie Policy for detailed information
2. Legal Basis for Processing (GDPR Article 6)

   We process your personal data under the following legal bases:

   • Contract Performance (Article 6(1)(b)): Processing necessary to provide our Services and fulfill our contract with you (account management, service delivery, support)
   • Consent (Article 6(1)(a)): For analytics cookies and marketing communications (where you have opted in)
   • Legitimate Interests (Article 6(1)(f)): For fraud prevention, security, improving our Services, and business analytics
   • Legal Obligation (Article 6(1)(c)): For compliance with tax, accounting, and legal requirements
3. How We Use Your Information
   • To provide, maintain, and improve our Services
   • To process payments and manage subscriptions (via Stripe)
   • To communicate with you about your account, updates, and support
   • For analytics, troubleshooting, and security purposes
   • To comply with legal obligations (tax, accounting, law enforcement requests)
   • To prevent fraud and ensure platform security
4. Information Sharing & Third-Party Processors

   We do not sell your personal data. We share data with the following trusted third-party processors under Data Processing Agreements (DPAs):

   • Stripe (USA): Payment processing — covered by EU-US Data Privacy Framework (DPF)
   • Supabase (data stored in Ireland, EU): Database and authentication. Supabase is a US company, so access from the US is covered by EU Standard Contractual Clauses (SCCs)
   • Vercel (processed in Paris, France, EU): Application hosting and delivery. Vercel is a US company, so access from the US is covered by EU-US Data Privacy Framework (DPF)
   • OpenAI (USA): AI processing for chatbot responses — covered by Data Processing Agreement. OpenAI does not train models on data submitted via its API
   • Resend (USA): Transactional email delivery — covered by EU-US Data Privacy Framework (DPF)
   • Upstash (EU/USA): Rate limiting and caching — covered by EU Standard Contractual Clauses (SCCs)
   • Sentry (EU — Germany): Error tracking and monitoring — hosted in the EU, no international transfer required
   • Jina AI (Germany, part of Elastic): Reads the public web pages at the URLs you add to your knowledge base, so we can turn them into text. Only the page address is sent
   • Apple, iCloud Drive (USA and EU): Storage of our encrypted backups only. The backups are encrypted with a key Apple can't read, until they move to our own server. Apple Inc. is certified under the EU-US Data Privacy Framework (DPF)
   • Google Analytics (USA): Analytics (only with your consent) — covered by EU-US Data Privacy Framework (DPF)

   For full details on sub-processors, data types, and transfer mechanisms, see our Data Processing Agreement.

   We may disclose information if required by law or to protect our legal rights.

5. International Data Transfers

   Some of our service providers are located outside the European Economic Area (EEA). We ensure appropriate safeguards are in place:

   • EU-US Data Privacy Framework (DPF) adequacy decision where applicable
   • EU Standard Contractual Clauses (SCCs) approved by the European Commission
   • Data Processing Agreements (DPAs) with all processors

   Sentry is hosted in the EU (Germany) and does not involve international data transfers.

   Note on BYOK Users: If you connect your own OpenAI API key (Bring Your Own Key, BYOK), chats for that chatbot go through your own OpenAI account, under your own terms with OpenAI. See our Terms of Service for details.

6. Data Retention

   We retain your personal data for the following periods:

   • Account Data: Until you delete your account. We then remove your account, chatbots, conversations, visitor chat files and chatbot avatars right away
   • Backups: We keep weekly encrypted backups, plus occasional restore points before database changes. They are stored on our own machine and as an encrypted copy in Apple iCloud. Backups older than 35 days are removed, and deleted copies can stay in Apple iCloud for up to 30 more days. So data from a deleted account can stay in encrypted backups for up to 65 days
   • Chat Logs: Until you delete the chatbot or your account. To delete a single conversation or one visitor's data, email us and we delete it by hand within 30 days
   • Billing Records: 7 years. When you delete your account, we cancel any live subscription right away, detach your saved payment methods and clear our own metadata from your Stripe customer record. The record itself stays, with your billing details and invoices, because Dutch tax law (fiscale bewaarplicht, article 52 AWR) requires us to keep them for 7 years. The legal basis is legal obligation (Article 6(1)(c))
   • Analytics Data and Email Logs: Not yet removed automatically when you delete your account. Email us and we delete them on request
   • Support Correspondence: Until you ask us to delete it

   Apart from the backup removal described above, we do not run automatic deletion after a set period. You can request earlier deletion at any time by exercising your GDPR rights (see section 7).

7. Your GDPR Rights

   Under GDPR, you have the following rights:

   • Right of Access (Article 15): Request a copy of your personal data
   • Right to Rectification (Article 16): Correct inaccurate or incomplete data
   • Right to Erasure (Article 17): Request deletion of your personal data ("right to be forgotten")
   • Right to Data Portability (Article 20): Receive your data in a machine-readable format
   • Right to Restriction of Processing (Article 18): Limit how we use your data
   • Right to Object (Article 21): Object to processing based on legitimate interests or direct marketing
   • Right to Withdraw Consent (Article 7(3)): Withdraw consent for analytics cookies or marketing at any time
   • Right to Lodge a Complaint (Article 77): File a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens — AP)

   How to Exercise Your Rights:
   Email us at privacy@talkbuildr.com with your request. We will respond within one month as required by GDPR Article 12(3). This period may be extended by two further months for complex requests, in which case we will inform you within the first month.

   Dutch Data Protection Authority:
   Autoriteit Persoonsgegevens
   autoriteitpersoonsgegevens.nl

8. Data Security

   We implement appropriate technical and organizational measures to protect your data:

   • Encryption in transit (TLS 1.2+) and at rest (AES-256)
   • Row-Level Security (RLS) on database tables
   • Role-based access controls (RBAC)
   • Rate limiting on the chat widget and most public API endpoints
   • Error monitoring via Sentry (EU-hosted)
   • Incident response procedures
9. Data Breach Notification

   In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

   • Notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours of becoming aware of the breach (GDPR Article 33)
   • Notify affected users without undue delay if the breach poses a high risk to their rights (GDPR Article 34)
   • Provide clear information about the nature of the breach and remedial actions taken

   BYOK Users: If your own OpenAI API key leaks, revoke it in your OpenAI account and add a new one in the chatbot settings. See our Terms of Service for details.

10. Cookies and Tracking Technologies

    We use cookies and similar tracking technologies. For detailed information about:

    • What cookies we use
    • Why we use them
    • How to manage your cookie preferences
    • Cookie consent banner requirements (Dutch AP compliance)

    Please see our Cookie Policy.

11. Children's Privacy

    Our Services are not directed to individuals under 16 years of age (in accordance with the Dutch Implementation Act GDPR — Uitvoeringswet AVG, or UAVG). We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us and we will delete such information.

12. Automated Decision-Making and Profiling

    We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you (GDPR Article 22).

    AI processing (via OpenAI) is used to generate chatbot responses, but this does not constitute automated decision-making that affects your rights. You maintain full control over how you use chatbot responses. OpenAI does not train its models on data submitted via the API.

13. Updates to This Policy

    We may update this Privacy Policy from time to time. When we make material changes:

    • We will update the "Last Updated" date at the top
    • We will notify you via email at least 30 days before material changes take effect
    • We will display a prominent notice on our website

    Where changes require your consent under GDPR, we will seek your renewed consent before applying those changes. If you do not agree with the updated policy, you may close your account.

14. Contact Information

    For privacy concerns, GDPR requests, or data protection questions, contact us:

    Privacy Contact Email: privacy@talkbuildr.com
    General Support: support@talkbuildr.com

    Company Details:
    IdeaVista, trading as TalkBuildr
    Geuzenkade 55-2, 1056 KN Amsterdam, the Netherlands
    KvK Number: 97755893
    VAT ID: NL005286133B78
    https://talkbuildr.com

    Note on Data Protection Officer: As a small enterprise, IdeaVista is not required to appoint a Data Protection Officer under GDPR Article 37. For all data protection inquiries, please contact us using the email addresses above.

    Note on EU Representative: As a Netherlands-based company with an establishment in the EU, we are not required to appoint an EU representative under GDPR Article 27.