Privacy policy

1. The short version

• We do not sell personal data. We never have and there is no arrangement under which we would.
• We do not use your contacts or your customers’ messages to train machine-learning models, our own or anybody else’s.
• We do not use your customers’ data to market anything to them.
• We do not run advertising trackers on this website. There is no analytics cookie, no advertising pixel and no consent banner, because there is nothing to consent to.
• You can see and download everything we hold, correct it, and ask us to delete it.

The rest of this page is the detail behind those five sentences.

2. Who is responsible for what

Indian data protection law, like most, distinguishes the party who decides why personal data is processed from the party who processes it for them. The distinction matters here because talkv sits on both sides of it, depending on whose data is in question.

Your data — we are the Data Fiduciary

For the personal data of the people who use talkv — your name, your work email, your sign-in activity, your billing history — we decide why it is processed and we are responsible for it. This policy is our notice to you about that.

Your customers’ data — you are, and we process it for you

For the personal data of the people you message — the contacts you import, the messages they send you, the files they send you — you are the Data Fiduciary. You decided to collect it, you obtained the consent, and you decide what it is for. We process it only to provide the service to you, only on your instructions, and for no purpose of our own.

3. What we collect

Data you give us about your business

• Your name, work email address and password (stored only as a one-way hash).
• Your workspace name, the people you invite, and what each of them is allowed to do.
• Your business details where you provide them for invoicing, and your tax registration.

Data you upload about your customers

• Phone numbers, normalised to E.164 format — more than one for the same person where you hold more than one — with their names, your tags, and the consent record you supplied for each of them.
• Whatever else you choose to record against a person: where they are, their company, their gender, a birthday or anniversary, what kind of customer they are, when they last bought from you and what they have spent, free-text notes, and any fields you define for your own workspace.
• The other people who share a contact’s number — a family on one phone, say — each with their name and a birthday, where you record them.
• The lists and audiences you build from them.

Files you upload for your templates and broadcasts

• Photos, videos and PDFs you put at the top of a template or a broadcast — an offer’s banner, a product video, a menu. They are your business’s own material rather than information about your customers, and they are shown only to your workspace.
• A file you send through our API as a link — one customer’s invoice, say — is handed to WhatsApp, which fetches it from you. We keep neither the file nor the link; the message records only the kind of file and the name it was given.

Data that arrives from WhatsApp

• Messages your customers send to your business, including text, media, and the button or list replies they tap.
• Messages you send, and the delivery, read and failure receipts that come back for each of them.
• Where you use coexistence and have enabled it in your Meta app settings, messages sent from your own WhatsApp Business app, and up to six months of prior conversation history provided as a one-time backfill by Meta.
• An access token for your WhatsApp Business Account, and a two-step verification PIN we generate for your number. Both are encrypted at rest and neither is ever written to a log.

Data we generate

• Application logs and error reports, which record what happened and when. They deliberately exclude access tokens, PINs and sign-up codes.
• An audit log of significant actions in your workspace, recording whose account was affected and, where one of our operators was working in a support session, which operator that was.
• Daily counts of billable messages by category, which is what your reports are built from.

We do not collect location data, contact lists from your device, biometric data, or any special category of personal data, and none of it is asked for anywhere in the product.

4. Why we process it, and on what basis

• To provide the service — sending your messages, showing you replies, producing your reports. Basis: performance of our contract with you, and for your customers’ data, your instructions as Data Fiduciary.
• To charge you correctly — recording what was delivered so that the right amount is taken from your balance. Basis: performance of our contract, and our legal obligation to keep accounting records.
• To keep the platform safe — investigating abuse, enforcing the acceptable use policy, and protecting the standing of the shared platform app every customer depends on. Basis: our legitimate interest, and Meta’s requirements of us.
• To support you — answering your questions, and where necessary opening a read-only support session. Basis: performance of our contract.
• To comply with the law — responding to a lawful demand from an authority with jurisdiction over us. Basis: legal obligation.

5. WhatsApp and Meta

talkv is a Tech Provider on the WhatsApp Business Platform. To send and receive messages we exchange data with Meta’s Graph API on your behalf: your message content, the recipient’s phone number, and your message templates — with any photo, video or PDF at the top of them, including the sample Meta reviews — go to Meta; inbound messages, delivery receipts and template decisions come back.

Meta processes that data under its own terms and privacy policy, as an independent party. It is not our sub-processor and we cannot vary what it does. Your relationship with Meta for the WhatsApp Business Account is direct: Meta bills your payment method for conversations, and we are never told what those amounts were.

We use data received through the WhatsApp Business Platform only to provide talkv to you. We do not use it for our own advertising, we do not combine it across customers, and we do not transfer it to any party for their own purposes.

6. Who else processes it

We keep this list short on purpose and it is complete as at the date on this page. Each of these is under a written agreement to process data only on our instructions.

• Meta Platforms — the WhatsApp Business Platform itself. Necessary to send or receive any message. Independent party, not a sub-processor.
• Our hosting provider — the servers and database that run talkv and store your data.
• Razorpay — payment processing for wallet top-ups. They receive your payment details, which we never see or store; we receive only the fact of a successful payment and its reference.
• Our email provider — transactional email such as sign-in links, invitations and receipts.

We will also disclose data where we are legally required to, and we will tell you first unless we are prohibited from doing so. If we are ever acquired, your data would move with the business and you would be told before it did.

We do not sell personal data, and we do not share it for anyone else’s advertising.

7. Where it is kept

Your data is stored on servers in India. Some of our providers, including Meta, operate globally and may process data outside India in the course of delivering a message — this is inherent in sending a WhatsApp message and cannot be avoided. Where a transfer happens under our control, we do it under appropriate safeguards.

Media that your customers send is fetched from Meta and stored by us so it can still be opened after Meta’s own links expire. It is never written to a publicly readable location and is served only through an access-controlled endpoint that checks who is asking.

8. How long we keep it

• Contacts — for as long as your account is open. After you close it, 30 days, then deleted.
• Chat messages — 24 months from when each was sent or received, then deleted automatically. The conversation shows that older messages were removed, and when.
• Photos, videos, voice notes and documents in chats — 12 months. The message stays in the chat and says the file was removed.
• Who received each broadcast, and what happened to each message — 18 months after the broadcast finishes. The broadcast’s totals are kept while your account is open.
• Photos, videos and PDFs you upload for templates and broadcasts — for as long as your account is open; nothing removes them on a schedule. After you close it, they are deleted with the rest of your workspace. A file sent through our API by link is never stored at all.
• Spreadsheets you upload to import contacts — 30 days. The contacts they created stay.
• Raw notifications from WhatsApp, which we keep only to find faults — 30 days, or 90 if one could not be processed.
• An opted-out contact’s record — their number and the opt-out, nothing else, kept for as long as your account is open, including after you delete the contact. Deleting it outright would let the next import of the same spreadsheet bring that person back with their consent reset, which is how a suppression list quietly stops working.
• Application logs — 90 days.
• Audit logs — three years. They are append-only; nothing edits a row.
• Billing records and invoices — eight years, because Indian tax law requires it.

9. How it is protected

• Encrypted in transit, on every connection, always.
• Access tokens and two-step PINs are encrypted at rest and excluded from logs by construction rather than by filtering.
• Passwords are stored only as a one-way hash and are never recoverable, including by us.
• Access is by ability rather than by job title, so an account can only do what it has been granted.
• Our own support access is read-only, enforced by rejecting every write at the HTTP layer rather than by maintaining a list of safe routes, and it expires on its own.
• The console authenticates with a session cookie rather than a token held in browser storage, because anything that can reach the page can read browser storage, and what a token would grant is the ability to message your entire contact list.

No system is perfectly secure. If a breach affects your data we will tell you and the relevant authority without undue delay, with what we know and what we are doing about it.

10. Your rights

Where we are the Data Fiduciary for your own data, you may ask us to:

• confirm what we hold and give you a copy;
• correct it if it is wrong or incomplete;
• erase it, where we have no continuing obligation to keep it;
• nominate somebody to exercise these rights if you cannot; and
• complain, to us and to the relevant authority.

Write to hello@talkv.io. We reply within 30 days. We may need to confirm who you are first — which is a protection for you, not an obstacle.

11. Your customers’ rights

If one of your customers exercises a right over data you hold in talkv, the request is properly yours to answer, because you are the Data Fiduciary for it. The console gives you what you need: you can find a contact, read everything held about them — every field, every number, and the whole record of what has passed between you — correct it, and delete it. If they have asked for a copy to keep, the Contacts and Chats downloads in Settings hold all of it.

If such a person writes to us directly, we will pass the request to you and tell them we have done so. We will not act on it ourselves unless the law requires us to.

One exception, and it runs whatever your settings say: where somebody replies to one of your WhatsApp messages with a recognised stop word, we record their opt-out immediately and exclude them from later marketing broadcasts. That is a requirement of Meta’s policy and of ours.

12. Cookies

This website sets no cookies at all. There is no analytics, no advertising pixel, and therefore no consent banner. Your theme preference is stored in your own browser, on your own device, and is never sent to us.

The console at app.talkv.io sets one strictly necessary cookie, which keeps you signed in. Without it you could not use the product. It is not used for tracking and it is not shared.

13. Children

talkv is a business tool and is not directed at children. We do not knowingly collect personal data from anybody under 18 as a user. If you believe a child has provided us with data, write to hello@talkv.io and we will delete it.

14. Grievance officer, and how to reach us

Under the Information Technology Act 2000 and the rules made under it, and under the Digital Personal Data Protection Act 2023, we publish the name and address of the person who will handle a complaint about how we have used your data.

Grievance Officer
Akshat Mewada
Talkv
A202 Green Avenue, Maple County 1, Near Shilaj Railway Crossing, Thaltej Shilaj Road, Thaltej
Ahmedabad, Gujarat 380059, India

hello@talkv.io

Mark a complaint Grievance in the subject line so it is routed as one. Complaints are acknowledged within 24 hours and resolved within 15 days.

If we change this policy in a way that materially affects you, we will tell you by email and in the product at least 30 days before it takes effect, and the date at the top of this page will change.