Draft, pending legal review. Operator: TalkQ (company not yet registered).
DRAFT - not legal advice - pending review by a qualified lawyer (owner decision 2026-10-06)
Privacy Notice
Version: v0.2-draft. Date: 2026-10-07. Language: EN (Bulgarian translation pending).
For visitors of the talkq.ai website and people who sign up for a workspace (GDPR Art. 13). This notice covers data talkq controls. It does not cover call data of the Customer's buyers, which talkq processes for the Customer under the Data Processing Agreement; those people should read the Customer's own notice.
1. Controller
[OWNER TO FILL: legal name], EIK [OWNER TO FILL], address [OWNER TO FILL]. Contact: [OWNER TO FILL]. Data protection officer or contact: [OWNER TO FILL] [TO CONFIRM by lawyer: whether a DPO is required].
2. What we collect, why, on what basis
| Data | Purpose | Legal basis (Art. 6) |
|---|---|---|
| E-mail address, password (stored only as a salted hash), preferred language (en or bg) | create and verify the account, send the verification e-mail | contract (6(1)(b)) |
| Verification token (stored hashed) | prove control of the address | contract |
| IP address and browser user agent, stored only as keyed HMAC hashes, never raw | evidence of acceptance of Terms, DPA and AUP; abuse and rate limiting | legitimate interest (6(1)(f)): proof of contract and security [TO CONFIRM by lawyer] |
| Company legal name, country, VAT id, billing address, billing e-mail, VIES result and registered name | invoicing, tax, B2B checks | contract; legal obligation (6(1)(c)) |
| Declared sector and use case, sensitive-data kinds | acceptable-use screening, high-risk review | legitimate interest; legal obligation under the EU AI Act [TO CONFIRM by lawyer] |
| Acceptance records (document, version, document hash, time) | demonstrate contract and DPA acceptance | contract; legitimate interest |
| Account activity and security audit events | security, support, accountability | legitimate interest |
| Console and API logs (no secrets, no message content) | operation and security | legitimate interest |
| Website inquiry form: name, e-mail, phone, company, website, workflow description, best time to call, language, consent | answer your inquiry and discuss an evaluation of TalkQ; the form is sent by e-mail through Resend to vladimir.bazdarski@talkq.ai and is not stored in the TalkQ database | consent (6(1)(a)) given with the form checkbox; steps at your request before a contract (6(1)(b)) [TO CONFIRM by lawyer: inquiry form] |
| IP address of the inquiry sender, used only as a one-way hash | rate limiting and abuse protection of the inquiry form | legitimate interest (6(1)(f)): security [TO CONFIRM by lawyer: inquiry form] |
Sources: ADR-017, ONB-2-BACKEND spec, gdpr-roles.md. Cookies and analytics on the website: [TO CONFIRM: not verified in the repo].
3. Retention
- Unverified signups (account, tokens): deleted after 7 days by a scheduled sweep that runs hourly [source: ADR-017, TALKQ-492].
- Verification tokens: valid 24 hours, single use.
- Password reset tokens: valid 60 minutes, single use.
- Account data: for the life of the account, then deleted within [OWNER TO FILL] days.
- Acceptance evidence: [TO CONFIRM by lawyer: contractual limitation period, e.g. 5 years under Bulgarian law].
- Invoices and tax data: as required by Bulgarian accounting and tax law [TO CONFIRM by accountant].
- Audit log: [TO CONFIRM].
- Website inquiries: not stored in the TalkQ database. The e-mail stays in the inbox of vladimir.bazdarski@talkq.ai while we answer and evaluate the inquiry, and is deleted 12 months after it is received unless a customer relationship has started by then [TO CONFIRM by lawyer: inquiry form]. Resend keeps its sending logs under its own retention [TO CONFIRM]. The hashed IP address is held only in server memory for rate limiting and is gone at the latest when the server restarts.
4. Recipients
Hosting provider [TO CONFIRM: Hetzner]; Resend (verification e-mail and website inquiry e-mail; EU sending region, US-held account data); the TalkQ inbox vladimir.bazdarski@talkq.ai on Google Workspace (Google), which receives website inquiries [TO CONFIRM by lawyer: Google Workspace data region and transfer terms]; VIES (EU Commission VAT check, sends VAT id) [TO CONFIRM]; payment and accounting providers [OWNER TO FILL]; authorities where law requires. We do not sell data.
5. Transfers outside the EEA
Resend keeps account data, metadata, logs and analytics in the US. Transfers rely on the EU-US Data Privacy Framework certification or SCCs [source: ADR-017; TO CONFIRM by lawyer].
6. Automated decisions
The sector screening classifies declared use cases mechanically (allowed, high risk, prohibited). A person decides on high-risk cases, and you may ask for human review of any refusal. [TO CONFIRM by lawyer: Art. 22 relevance, B2B context].
7. Your rights
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where used. Contact [OWNER TO FILL]. You may complain to the Bulgarian Commission for Personal Data Protection (КЗЛД), [TO CONFIRM: address and procedure].
8. Security
Passwords are hashed; tokens are stored hashed; IP and user agent are stored as keyed hashes; data is encrypted at rest per tenant where it concerns workspaces; access is logged [source: ADR-017, ADR-003].
9. Provision of data
E-mail, password and company details are needed to create an account; without them we cannot provide the Service. Sector declaration is mandatory before voice features are enabled.
10. Changes
We publish new versions here with the version and date above.