Talia← Back to Login

Privacy Policy

Last updated: 27 February 2026

1. Introduction

This Privacy Policy explains how Talia (“Company”, “we”, “us”, or “our”) collects, uses, stores, and protects personal data and customer data when you use the Talia AI CRM platform, related websites, applications, and APIs (collectively, the “Services”).

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. This policy is incorporated into and governed by our Master Services Agreement.

2. Data Controller

For the purposes of the EU and UK General Data Protection Regulation (GDPR), the Customer is the “data controller” and Talia is the “data processor” of personal data processed through the Services. Talia processes personal data only on documented instructions from the Customer and for the purposes of providing the Services.

3. Data We Collect

We collect and process the following categories of data:

  • Account Information: Name, email address, and login credentials for each Authorised User.
  • Customer Data: All data, information, content, and materials that you input, upload, or provide to the Services, including client records, inventory data, invoices, watch information, and communications.
  • Usage Data: How you interact with the Services, including feature usage, session data, and performance metrics.
  • Third-Party Integration Data: When you connect third-party services (such as Gmail or Shopify), we access only the data necessary to provide the integration. For Gmail, we access your email address and the ability to send emails on your behalf. We do not read your inbox.
  • Technical Data: Browser type, IP address, device information, and cookies necessary for the functioning of the Services.

4. How We Use Your Data

We use the personal data and Customer Data you provide to operate, secure, and improve the Talia service for you specifically. In particular:

  • To deliver the features you are paying for — pricing intelligence, CRM, invoicing, automations and the day-to-day running of your account.
  • To process transactions and send invoices, buying forms, and communications on your behalf.
  • To provide customer support and respond to your requests.
  • To create anonymised, aggregated calibration signals that help only your AI pricing models stay accurate and customised to your trading style. These signals never identify you, your clients, your specific deals, or your inventory, and cannot be re-identified. The result is an AI tuned to your trading patterns, your inventory, and your client base — sharper, faster pricing intelligence that other Talia members do not see.
  • To debug, secure, and improve the platform.
  • To comply with legal obligations.

What we will never do — ironclad commitments

  • We will never sell your personal data or Customer Data to any third party. Not now, not after an acquisition, not under any commercial pressure. This commitment travels with us — any acquirer of Talia inherits it as a binding condition of sale. We retain dedicated security specialists whose role is to defend the platform against intrusion, exfiltration, and supply-chain attack — protecting your data is treated as a precondition of operating, not an optional feature.
  • We will never share your trading activity, client lists, inventory, invoices or messages with other Talia members, your competitors, or any external party. Your books are your books. Other dealers using Talia have no window into your account, no benchmark derived from your specific deals, no way to discover what you bought, sold, or who you are talking to.
  • We will never use your Customer Data to train general-purpose AI models — including OpenAI, Anthropic, Google, or any other external provider. We configure each AI provider, where they offer such controls, to disable training on Customer Data. The internal AI models that power Talia are trained only on the anonymised calibration signals described above; they live entirely inside Talia and are never exposed, sold, licensed, or made available outside the platform.
  • We will never let our own staff browse your tenant. No Talia employee has standing read access to your inventory, your invoices, your client records, your sales, or your messages. Concretely:
    • Database-level isolation (PostgreSQL row-level security): every query against your tenant is forced to pass a tenant-ID gate at the database layer. Even an internal application bug cannot return another tenant’s row.
    • Encrypted at rest with AWS-managed keys (KMS) and in transit using TLS 1.2 minimum (TLS 1.3 supported). Backups are encrypted with separately managed keys.
    • Credentials never reach client-side JavaScript. Authentication uses bcrypt-hashed passwords, short-lived JWT access tokens (15 minutes), refresh tokens stored in HttpOnly cookies, and per-IP login rate-limiting to defend against credential-stuffing.
    • Tenant identifiers are UUID-validated at every query boundary to defeat injection attempts.
    • Two-factor authentication (TOTP and email-OTP) and trusted-device controls are available to every account at no extra cost.
    • All authentication, access and administrative events are written to a structured audit trail. Internal access to production data requires a named, time-bound, audited session — never standing access — and is recorded in a way that allows you to demand a complete log of any time it occurred.
  • You can leave at any time. Your data is yours. On request, we will export everything in your tenant in machine-readable form and permanently delete it from our systems within 30 days, subject only to mandatory legal retention. No clawback, no hostage rates, no “but you signed up for a year”.

Your data feeds back into your own intelligence. It never enriches anyone else’s.

5. Third-Party Integrations

Gmail Integration

When you connect your Gmail account, we request access to the following Google API scopes:

  • gmail.send — to send emails (invoices, buying forms, client communications) on your behalf.
  • userinfo.email — to identify which email account is connected.

We store your OAuth tokens securely using AES-256 encryption. We never read, scan, or access the content of your inbox. We only send emails that you explicitly initiate through the CRM (e.g., sending an invoice or buying form). You can disconnect Gmail at any time from Settings → Integrations, which immediately revokes our access; you can also revoke access from your Google Account permissions page.

Limited Use Disclosure

Talia’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We only use Google user data (your account email address and the ability to send email via the gmail.send scope) to provide the user-facing email-sending features you explicitly initiate within Talia.
  • We do not transfer, sell, or share Google user data to third parties, advertising platforms, data brokers, or information resellers.
  • We do not use Google user data for advertising, credit assessment, or any purpose unrelated to the features described above.
  • We do not use Google user data to develop, improve, or train generalised artificial intelligence or machine-learning models.
  • Human access to Google user data is not permitted except with your explicit consent, where necessary for security or compliance with applicable law, or where the data has been aggregated and anonymised.
  • Google OAuth tokens are encrypted at rest (AES-256) and are deleted when you disconnect the integration or delete your account; emails you send are retained as part of your CRM records per Section 9 (Data Retention and Deletion).

Shopify Integration

When you connect Shopify, we access product, inventory, and order data as authorised by the scopes you approve. This data is used solely to synchronise your Shopify catalogue with the CRM.

AI Providers

We use third-party AI providers to power certain features. When you use the Talia assistant, the text you type and the voice input you record are transmitted through our servers to these providers to generate a response: voice recordings are transcribed by a speech-to-text provider (Deepgram), and messages are processed by large-language-model providers (currently OpenAI and Groq). This can include personal data you mention, such as client names or contact details. These providers act on our instructions, solely to provide the service. They are configured, where they offer such controls, so that Customer Data submitted through the Services is not used to train general-purpose models. Our ability to enforce this commitment depends on the provider’s available configuration options and contractual terms; however, we use commercially reasonable efforts to maintain such configuration. In the mobile app, we ask for your explicit consent before your input is first shared with these providers, and you can withdraw it at any time in Settings.

6. Data Storage and Security

  • Customer Data is stored on encrypted databases hosted on AWS (Amazon Web Services) in the EU (London, eu-west-2).
  • Documents and files are stored on Cloudflare R2 with access-controlled presigned URLs.
  • OAuth tokens are encrypted at rest using AES-256 encryption.
  • All data in transit is encrypted using TLS 1.2+.
  • We implement appropriate technical and organisational security measures as required by Article 32 of the GDPR.

7. Sub-processors

We use the following categories of sub-processors to deliver the Services:

  • Cloud Infrastructure: Amazon Web Services (AWS) — hosting, database, caching.
  • File Storage: Cloudflare R2 — document and image storage.
  • AI Services: OpenAI and Groq — CRM assistant and natural language processing; Google (Gemini) — text embeddings for search.
  • Speech-to-Text: Deepgram — transcription of voice input to the assistant.
  • Email Delivery: Mailtrap — transactional emails (password resets, invitations).
  • Error Monitoring: Sentry — application error tracking.

All sub-processors are bound by written agreements requiring substantially the same level of data protection obligations. Upon request, we will provide a full list of current sub-processors.

8. International Data Transfers

Customer Data may be transferred to jurisdictions outside the UK or European Economic Area for processing. Any such transfers are made in compliance with applicable data protection laws, using appropriate safeguards such as the UK International Data Transfer Agreement or EU Standard Contractual Clauses.

9. Data Retention and Deletion

We retain Customer Data for the duration of your subscription. Upon termination, we will securely delete or anonymise Customer Data within 60 days. At your request, we will provide a one-time export of your data in a standard format before deletion. Backup copies are overwritten in the ordinary course of business. We may retain copies of Customer Data as required to comply with legal obligations or for legitimate internal business purposes (such as audit or compliance), but will continue to protect any such retained data under our confidentiality and security obligations.

10. Your Rights

Under GDPR, you have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your data.
  • Object to or restrict processing of your data.
  • Request data portability.
  • Withdraw consent at any time (where processing is based on consent).

To exercise any of these rights, contact us at info@taliaai.com.

11. Cookies

We use essential cookies for authentication and session management. These are strictly necessary for the functioning of the Services. We do not use tracking or advertising cookies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to you via email or through the Services. Your continued use of the Services after any changes constitutes acceptance of the updated policy.

13. Contact

For any questions about this Privacy Policy or our data practices, contact us at:

Talia
Email: info@taliaai.com
Website: app.taliaai.com

Terms of Service•Sign In