This policy explains how TalkingSuites (“we”, “us”) handles personal data when you visit this website, create an account, and use the TalkingSuites platform — the web app, its API and the services it runs for your organization.
Who is responsible
TalkingSuites is responsible for the personal data described in this policy. For the content your organization runs and stores on the platform — the data inside your servers, containers, databases and buckets — your organization decides what is processed and why, and we process it on your behalf. That relationship is described in our data processing terms.
Questions about this policy, or about your data, go to [email protected] — put “Privacy” in the subject.
What we collect
When you visit this website. This website sets no cookies and runs no analytics or advertising scripts. If you change its appearance — dark or light, an accent, a palette — that choice is kept in your own browser’s storage and never sent to us. Our web servers, like any, receive the technical details of each request (such as your IP address and browser) to deliver the page and keep the site secure.
Your account. Your name, email address and password. We never store the password itself — only a strong one-way hash (argon2id). When you choose a password, we check whether it has appeared in a known breach by sending the first five characters of a hash of it to the Have I Been Pwned service; the password itself never leaves our systems. If you add them: a profile photo, your time zone, passkeys (their public keys only), an authenticator app for two-factor sign-in (its secret is stored encrypted), and GitHub or Google sign-in (the identity those services confirm to us).
Signing in and security. The sessions you have open, the device and address you signed in from, and sign-in attempts — used to keep your account safe, to show you where you are signed in, and to slow down anyone guessing passwords. Security emails (a new sign-in, a changed password) are always sent.
Your organization. Its name and logo, its members and their roles, teams, invitations, settings and sign-in rules, verified email domains and single sign-on configuration. Every change made in an organization is recorded in its audit log — who did what, to what, when and from which address — which the organization’s owners and admins can read.
Billing. Billing details you give us (such as a company name, address and tax number), invoices, payments and usage records, and your AI credit balance. When you add a card, it is entered into a form provided by Stripe and goes directly to Stripe; we store only what Stripe tells us to identify it — the brand, the last four digits and the expiry date.
What you run. The servers, containers, databases, buckets, secrets and workspaces you create, and their configuration. Secrets are encrypted; their values are never shown in responses or logs. Container logs are collected so you can search them, with secrets masked, and kept for 72 hours. Measurements of your servers (processor, memory, disk and network use) are kept so you can see them and so traffic can be billed. When you connect GitHub, we read your repositories when a page asks for them; we keep the link to the repository, not your code. When a system’s tool is called, a record of the call is kept, with anything that looks like a secret removed from its arguments.
Requesting early access. When you ask for early access on this website: your name and work email, and — if you give them — your company, your role, the size of your team and what you would like to run. We use them only to reply to you about access and to set up your organization, and we delete them if you ask us to.
Talking to us. What you send us when you write to us, and the emails we send you, so we can answer and show what was sent.
How we use it
- To provide the service you asked for: running your account, your organization and what it runs.
- To keep it secure: authenticating you, preventing abuse, detecting and investigating problems.
- To bill you correctly: measuring what runs, invoicing it and taking payment.
- To communicate with you: service and security messages, and — if you chose them — notifications and receipts.
- To support you when you ask for help, and to improve the service.
- To meet our legal obligations, such as keeping invoices.
We do not sell personal data, and we do not use it for advertising.
Where the law requires a legal basis, we rely on the contract with you (to provide the service), our legitimate interests (security, preventing abuse, improving the service — balanced against your rights), our legal obligations (such as tax records), and your consent where we ask for it.
Who we share it with
We share personal data only with the companies that help us provide the service, under contracts that require them to protect it and to use it only for us:
- Infrastructure providers that host the platform, and the servers and buckets you create in the locations you choose.
- Stripe, which processes card payments.
- An email delivery provider, which sends the emails we send you.
- A form service, which delivers early-access requests and messages from this website’s forms to us.
- Google reCAPTCHA, which checks that a form on this website is sent by a person, not a bot.
- GitHub, when you connect a GitHub account or sign in with it, and Google, when you sign in with it.
- Have I Been Pwned, which receives a five-character fragment of a hash of a new password — never the password.
- AI model providers, when you use the AI features: what you send the assistant or an agent, and the context it needs, is processed by them to generate a response.
We may also disclose information when the law requires it, to protect people or the service from harm, or to a successor if TalkingSuites is merged or sold — who would then be bound by this policy.
International transfers
The services we use may process data in countries other than yours. Where the law requires it, we protect those transfers with appropriate safeguards, such as standard contractual clauses.
How long we keep it
- Your account: for as long as it exists. When you delete it, we delete your personal data, except what we must keep by law.
- An organization: when it is deleted, it can be restored for 7 days; after that its servers, buckets, secrets and what they held are destroyed.
- Container logs: 72 hours. Server measurements: detailed samples for 3 days, hourly figures for about 13 months, because traffic is billed on them.
- The audit log: 30 days on the Free plan; without limit on Enterprise; seven years with the extended-retention add-on.
- Notifications: 90 days. Webhook delivery records: 30 days.
- Invoices and payment records: as long as tax and accounting law requires.
How we protect it
Passwords and one-time codes are hashed; secrets, authenticator seeds and provider credentials are encrypted; every organization is isolated from every other; and every change is recorded. Our security page describes the mechanisms in detail.
Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to delete it, to receive it in a portable form, to object to or restrict how we use it, and to withdraw consent you gave. Many of these you can do yourself — edit your profile, export the audit log, delete your account. For anything else, write to [email protected] with “Privacy request” in the subject, and we will answer within the time the law allows. You also have the right to complain to your data protection authority.
If your personal data is part of an organization’s content — for example, you are a customer of one of our customers — please contact that organization first; we will help them respond.
Children
TalkingSuites is a service for businesses and is not meant for anyone under 16. We do not knowingly collect personal data from children.
Changes to this policy
When we change this policy we update the date below, and if a change is significant we tell account holders by email before it takes effect.
Also: Terms · Acceptable use · Cookies · Data processing