Privacy Policy

Version 1, effective 25th August 2026

1. WHO ARE WE

TALK IT OUT MAKING THE WORLD SPIN BETTER LTD (company number 12577239), of Rhode Hill House, Rhode Lane, Uplyme, Lyme Regis, Dorset, United Kingdom, DT7 3TY ("we", "us", or the "Controller") is the controller of the personal data described in this Privacy Policy (the "Policy").

You can contact us about this Policy or your personal data at support@talkitout.app or by post at the address above.

2. SCOPE and defined terms

This Policy applies to the TiO mobile application (the "App"), the voice-coaching service delivered through it (the "Service"), the TiO website at talktotio.com (the "Website"), and your other interactions with us, including social media channels, contact, beta, team, organisational, support, research, and marketing communications. It explains the personal data we collect through those channels and the choices and rights you have over that data.

We store the text of what you say, together with the emotion signals, insights, and actions generated from it, as your "journal". We refer to the text produced from your speech as the "transcript". We do not retain voice audio in your journal or our primary application database; voice audio is processed in real time by service providers as described in sections 3 and 7.

3. the data we collect

‍Account data.

Your Sign in with Apple identity. Apple may provide your name and email address, and you may choose to withhold them or use an Apple private-relay email address.
A unique account identifier that we use as the key to your account.

Your journal. When you record a session, your speech is streamed to our voice provider and processed and transcribed to text in real time. We do not retain the audio in your journal or our primary application database. We store:

the transcript of the session;
emotion signals derived from the sound of your voice for each utterance, comprising a set of named emotion scores (up to 48 emotions) and four aggregate intensity bands ("spheres");
the insights and suggested actions generated from the session; and
any takeaways and next steps you dictate or choose.

Session and usage data. Session start and end times, session duration, minutes used, the coaching style you select, the analytical models applied, your subscription status, and similar operational data.

Diagnostic and device data. Records of session lifecycle events and network and device conditions, used to run and secure the App and to diagnose faults. These records are keyed by your account identifier where you are signed in, or by a device identifier where you are not.

Subscription data. Your subscription tier, status, and any cancellation record. Payment card details are processed by Apple and are never received by us; we receive only your subscription status (see section 7).

Website and enquiry data. When you use a Website contact, beta, team, organisational, or support form, or contact us by email or another channel, we may collect your name, email address, organisation, role, the contents of your message, the reason for your enquiry, and our correspondence with you. We collect only the fields you submit or that are generated as part of handling the enquiry.

Website technical data. When you visit the Website, our hosting, security, and analytics tools may process your IP address, browser and device type, operating system, pages viewed, referring page, timestamps, approximate location derived from IP, cookie or similar identifiers, and security or error logs.

Marketing Data: We may collect and use your email address in order to send you marketing e-mails from time to time in order to keep you informed of the full range of our services. We rely on the “soft opt-in” rule which is permitted by law. You can opt out of receiving these updates at any time by clicking the “unsubscribe” button or by emailing us at support@talkitout.app. Some customers positively opt in to receiving e-marketing from us by using the button on our homepage. If you have used this then again you may opt out at any time.”

4. sensitive data

Your voice and the emotion signals we derive from it are special-category data under Article 9 GDPR because they concern your emotional or mental state.

We process this data only with your explicit consent. You give that consent when creating your account in our App. You can withdraw that consent at any time as described in section 12; withdrawal stops future processing for that purpose but does not affect processing already carried out lawfully.

5. why we use your data, and our legal basis

Purpose	Legal basis
To provide the App and Service, run your account, deliver purchased minutes, and keep your history across sessions	Performance of our contract with you (Article 6(1)(b))
To generate coaching from your voice and the emotion signals derived from it	Your explicit consent (Article 6(1)(a)
To secure, maintain, and diagnose the App and Website; prevent abuse; and keep necessary technical logs	Our legitimate interests in operating reliable and secure services (Article 6(1)(f))
To respond to contact, support, beta, team, and organisational enquiries, and to take steps you request before entering a contract	Our legitimate interests in responding to enquiries (Article 6(1)(f)) and, where applicable, steps at your request before a contract (Article 6(1)(b))
To use non-essential Website cookies or analytics	Your consent where required (Article 6(1)(a))
To send marketing communications	Your consent (Article 6(1)(a)) or another permitted basis such as the soft opt-in, where all legal conditions are met.
To keep a pseudonymised copy of transcripts and emotion signals in the research dataset to improve the Service (see section 9)	Your separate explicit research consent (Article 6(1)(a).

‍

We do not sell your personal data. We do not share it for cross-context behavioural advertising or targeted advertising based on activity across unrelated services.

6. automated analysis

We use automated analysis of your words and voice to generate coaching insights and suggested actions. These are suggestions only. They do not produce legal or similarly significant effects on you, and there is no solely automated decision-making within the meaning of Article 22 GDPR; you decide what to do with the insights.

7. Who recieves or processes your data, and international transfers

We use service providers to operate the App, Service, and Website. Some act as our processors; others, such as Apple for parts of its own services, may act as independent controllers under their own privacy notices.

Recipient	Purpose	Data categories	Location
Hume AI	Real-time voice processing, transcription, and emotion analysis	Voice audio; derived emotion scores	United States
Anthropic (Claude)	Generating insights and session summaries from your transcript	Transcript text; emotion summaries	United States
Google Firebase	Authentication, application storage, and serverless compute	Account identifiers; session transcripts; insights; diagnostic logs	EU — Firestore in the eur3 multi-region (Europe); Cloud Functions in europe-west1 (Belgium)
Neon (provisioned through Render)	Hosting the pseudonymised research dataset (transcripts and emotion signals)	Pseudonymised emotion records	EU — eu-central-1 (Frankfurt)
Apple	Sign in with Apple identity and subscription billing	Account identifier; purchase records	United States and other regions
Webflow	Hosting the Website, serving pages, security logs, and receiving form submissions	Website technical data; enquiry form submissions (see section 3)	United States
Mailchimp	Handling enquiries, support, mailing lists, and related communications	Enquiry and correspondence data; email address and marketing preferences (see section 3)	United States

‍

You can find out more about how our service providers manage your data on the link below:

We use the following sub-processors to deliver the Service. Each processes only the data needed for its purpose, under a data processing agreement.

Hume: https://www.hume.ai/privacy-policy
Anthropic:https://www.anthropic.com/legal/privacy

International transfers. Some recipients are outside the EEA and UK. Voice data is sent to Hume AI and transcript text is sent to Anthropic in the United States; Apple and any Website or communications providers may process data in the United States or elsewhere. Depending on the recipient and the country from which the data is transferred, we rely on an adequacy decision or regulation, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or International Data Transfer Agreement, and/or an applicable Data Privacy Framework certification. You can request information about the relevant safeguards at support@talkitout.app.

Where a recipient acts as our processor, we require it by contract to process personal data only on documented instructions, protect confidentiality and security, assist with rights requests, and delete or return data at the end of the service as required by the contract. Provider-held copies may remain for the retention and backup periods set out in the relevant provider agreement and in that provider’s own published policies; they are not outside our responsibility merely because a provider holds them.

8. encryption and confidentiality

Data sent through the App and Website is encrypted in transit using TLS where supported. Your journal and research dataset are encrypted at rest using the encryption provided by our infrastructure providers, including Google Firebase and Neon.

We do not use end-to-end encryption for the journal. We and our processors can read the content needed to provide the Service, for example to transcribe your speech and generate insights. Authorised personnel may access personal data only where needed for support, security, legal compliance, or another documented purpose.

9. where your data is stores

Your account journal is stored in the EU: Firestore in the eur3 multi-region (Europe). The research dataset is stored in the EU: Neon eu-central-1 (Frankfurt). To provide the Service, we transfer voice and transcript data to recipients in the United States as described in section 7. Website, enquiry, support, and marketing data is stored in the locations used by the providers listed in section 7.

10. how long we keep your data

We retain your journal data for as long as your account is active. When you delete your account, it is removed from our primary systems immediately. We do not operate long-term backups, and any short-lived system copies expire within 24 hours.

We only keep all other data for as long as is necessary for the purpose(s) for which it was provided. If you contact us to delete your membership or if you withdraw your consent to our processing of your data, we will delete your personal data immediately.

11. deleting your account and other data

You can delete your account at any time in the App at Settings, then Delete Account. This permanently removes your account, your journal entries, and the insights derived from them from our primary systems. We do not retain long-term backup copies.

The following limits and separate processes apply:

Data held by the providers listed in the table in section 7 may remain for the retention and backup periods setout in the relevant provider agreement and in that provider’s own published policies.
Website enquiry, support, business-correspondence, and legal records are not necessarily linked to your App account and therefore may not be deleted by the in-App Delete Accountaction. You can ask us to erase them, subject to applicable law, at support@talkitout.app.
You can stop marketing emails by using the unsubscribe link or contacting us. We may keep a minimal suppression record, so we do not contact you again.

12. your Rights and choices

Subject to applicable law, you may have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased;
restrict or object to processing that we base on our legitimate interests;
receive your data in a portable format;
withdraw any consent you have given, at any time and as easily as you gave it;
object to direct marketing and unsubscribe from marketing communications; and
change or withdraw consent for non-essential Website cookies.

To exercise a right, withdraw research consent, request research-data erasure, or raise a privacy question, mail support@talkitout.app or use any in-App privacy control we provide. We respond within one month where UK or EU GDPR applies, subject to permitted extensions and identity checks. You can also delete your account and journal in Settings, then Delete Account.

13. complaints

If you consider that we have handled your personal data unlawfully, you may lodge a complaint with the data-protection authority where you live or work, or where you believe an infringement occurred.

Please tell us first, so we have a chance to address your concerns. If we fail in this, you can address any complaint to the UK Information Commissioner’s Office, either by calling their helpline or as directed on their website at www.ico.org.uk.

14. children

The App and voice-coaching Service are for adults aged 18 and over. They are not directed to anyone under 18, and we do not knowingly create App accounts for or collect journal data from anyone under 18. The Website and its enquiry forms are also not intended to collect personal data from children. If we learn that we have collected a child'spersonal data, we will take appropriate steps to delete it.

15. united states state privacy rights

The App and Website are available to people in the United States. Depending on the state in which you live and whether the relevant law and business thresholds apply, you may have rights to know or access personal information, correct it, delete it, obtain a portable copy, opt out of certain sales, sharing, targeted advertising, or profiling, limit certain uses or disclosures of sensitive personal information, and appeal a refusal of a request. We do not sell personal information or use it for cross-context behavioural advertising.

You may submit a request at support@talkitout.app. We may need to verify your identity and may accept requests from an authorised agent where required by law.

16. website cookies, app device data, and tracking

Website cookies and similar technologies. The Website uses only cookies and similar technologies that are strictly necessary to provide and secure it. We do not use analytics, advertising, or other non-essential technologies on the Website. If that changes, we will ask for your consent first.

App device data and tracking. We use Firebase, including App Check, and diagnostic logs containing a device or account identifier to run and secure the App. We do not track you across other companies' apps or websites, and we do not use an advertising identifier.

17. changes to this policy

We may update this Policy. We will post the current version on the Website and, where applicable, in the App with a new effective date. Where a change materially affects your rights or the sensitive data we process, we will notify you through the App, by email, or through another appropriate channel and, where required, ask for consent again.

18. how to contact us

Questions about this Policy oryour personal data, email: support@talkitout.app

‍