Privacy Policy

1. Introduction and Scope

Dmytro Boguslavskyy, sole proprietor (Einzelunternehmer) ("TalkBreezy," "we," "us," or "our") operates the TalkBreezy AI voice chat platform accessible at talkbreezy.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect your personal data in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG), the German Telemedia Act (Telemediengesetz - TMG), and other applicable data protection laws.

This Privacy Policy applies to all users of our Service, including visitors, registered users, and paying customers. By using our Service, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller (Verantwortlicher)

The data controller responsible for the processing of your personal data pursuant to Article 4(7) GDPR is:

For data protection inquiries, you may contact us at the address above or via email at [email protected].

3. Categories of Personal Data We Collect

3.1 Account and Registration Data

When you create an account, we collect:

• Email address (required for account creation and communication)
• Password (stored in encrypted/hashed form using bcrypt)
• Account creation timestamp
• Display name or username (if provided)

3.2 Financial and Transaction Data

When you purchase credits or make payments:

• Transaction identifiers and amounts
• Credit balance and usage history
• Billing history and invoices
• Last four digits of payment card (for display purposes only)
• Payment status of each purchase

Important: We do not store complete credit card numbers, CVV codes, or other full payment credentials. All payment processing is handled by Stripe, Inc., a PCI-DSS Level 1 certified payment processor. Please refer to Stripe's Privacy Policy for information about their data practices.

3.3 Voice and Audio Data

Our Service enables real-time AI voice conversations. Regarding audio data:

• Real-time Processing: Audio is streamed and processed in real-time to generate AI responses
• No Permanent Storage: We do NOT record, store, or retain audio recordings of your voice conversations
• Immediate Deletion: Audio data is discarded immediately after real-time processing
• AI Processing: Audio is converted to text for AI processing; this text is not permanently stored

We may retain anonymized, aggregated metrics about conversation patterns (e.g., average session length) for service improvement, but these do not contain any personal identifiers or conversation content.

By using the voice chat feature, you consent to the real-time processing of your audio for the purpose of providing the Service.

3.4 Usage and Interaction Data

We collect information about how you use our Service:

• Session timestamps and duration
• Characters you interact with and interaction frequency
• Feature usage patterns
• Error logs and crash reports
• User preferences and settings

3.5 Technical and Device Data

We automatically collect certain technical information:

• IP address (may be anonymized for analytics)
• Browser type, version, and language settings
• Operating system and device type
• Screen resolution and viewport size
• Referring website or source
• Date and time of access

3.6 Communication Data

If you contact us for support or inquiries:

• Email correspondence content
• Support ticket information
• Feedback you provide

4. Purposes and Legal Bases for Processing

We process your personal data for the following purposes based on the corresponding legal bases under Article 6 GDPR:

4.1 Contract Performance (Art. 6(1)(b) GDPR)

• Providing and maintaining the Service
• Processing account registration and authentication
• Processing payments and managing credit balances
• Billing and invoicing for one-time credit purchases
• Delivering AI voice chat functionality
• Providing customer support

4.2 Legitimate Interests (Art. 6(1)(f) GDPR)

• Improving and optimizing our Service and user experience
• Analyzing usage patterns to develop new features
• Ensuring security and preventing fraud, abuse, or misuse
• Protecting our legal rights and enforcing our Terms of Service
• Maintaining server logs for security and debugging purposes

4.3 Legal Obligations (Art. 6(1)(c) GDPR)

• Retaining financial records as required by German tax law (AO, HGB)
• Responding to lawful requests from authorities
• Complying with applicable data protection regulations

4.4 Consent (Art. 6(1)(a) GDPR)

• Sending marketing communications (only if you have opted in)
• Using non-essential cookies or analytics (where consent is required)

Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal.

5. Data Sharing and Recipients

We may share your personal data with the following categories of recipients:

5.1 Service Providers (Processors)

We engage third-party service providers who process data on our behalf:

• Stripe, Inc.: Payment processing for one-time credit purchases (USA, EU Standard Contractual Clauses apply). We share the purchase amount and the payment status with Stripe; there is no recurring billing and no subscription data to share.
• Hetzner Online GmbH: Server hosting and infrastructure (Germany)
• Cloudflare, Inc.: CDN, DNS, and security services (USA, EU SCCs apply)
• Google LLC: Analytics via Google Analytics 4 (USA, EU SCCs apply)
• Cloud Infrastructure Providers: AI processing infrastructure

All service providers are contractually obligated to process data only as instructed and to maintain appropriate security measures.

5.2 Legal and Regulatory Disclosures

We may disclose data when required by law or to:

• Comply with legal process or governmental requests
• Enforce our Terms of Service
• Protect the rights, property, or safety of TalkBreezy, our users, or others
• Investigate suspected fraud or violations

5.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the acquiring entity. We will notify you of any such transfer and any choices you may have regarding your data.

5.4 No Sale of Personal Data

We do NOT sell, rent, or trade your personal data to third parties for their marketing purposes.

6. International Data Transfers

Your personal data may be processed in countries outside the European Economic Area (EEA), including the United States. When transferring data internationally, we ensure appropriate safeguards are in place:

• Adequacy Decisions: Transfers to countries with EU adequacy decisions
• Standard Contractual Clauses (SCCs): EU-approved contractual clauses for data protection
• Data Processing Agreements: Binding contracts requiring GDPR-equivalent protections

You may request information about specific transfer mechanisms by contacting us at [email protected].

7. Data Retention

We retain personal data only as long as necessary for the purposes described in this Privacy Policy:

• Account Data: Retained until you delete your account, plus up to 30 days for backup removal
• Voice/Audio Data: Not retained; processed in real-time and immediately discarded
• Transaction Records: 10 years (as required by German commercial and tax law, §§ 147 AO, 257 HGB)
• Usage Logs: 90 days (for security and debugging)
• Support Communications: 3 years after resolution
• Marketing Consent Records: Until withdrawal plus documentation period

After the retention period expires, data is securely deleted or anonymized.

8. Your Rights Under GDPR

As a data subject, you have the following rights under the GDPR:

8.1 Right of Access (Art. 15 GDPR)

You may request confirmation of whether we process your personal data and obtain a copy of such data.

8.2 Right to Rectification (Art. 16 GDPR)

You may request correction of inaccurate personal data or completion of incomplete data.

8.3 Right to Erasure (Art. 17 GDPR)

You may request deletion of your personal data ("right to be forgotten") where applicable legal grounds exist.

8.4 Right to Restriction of Processing (Art. 18 GDPR)

You may request limitation of processing in certain circumstances.

8.5 Right to Data Portability (Art. 20 GDPR)

You may request to receive your data in a structured, commonly used, machine-readable format.

8.6 Right to Object (Art. 21 GDPR)

You may object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

8.7 Right to Withdraw Consent (Art. 7(3) GDPR)

Where processing is based on consent, you may withdraw consent at any time.

8.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority. The relevant authority for Berlin is:

8.9 Exercising Your Rights

To exercise any of these rights, contact us at [email protected]. We will respond within one month as required by GDPR. We may request verification of your identity before processing requests.

9. Cookies and Tracking Technologies

9.1 Cookie Consent

In accordance with the GDPR and the German Telecommunications-Telemedia Data Protection Act (TTDSG), we request your consent before placing non-essential cookies on your device. When you first visit our website, you will see a cookie consent banner allowing you to:

• Accept: Allow all cookies including analytics
• Decline: Only essential cookies will be used
• Settings: Choose which cookie categories to allow

You can change your cookie preferences at any time by clicking the "Cookie Settings" link in our website footer or by clearing your browser's localStorage (key: breezy_consent).

9.2 Essential Cookies (Strictly Necessary)

These cookies are necessary for the Service to function and cannot be disabled:

Legal basis: Art. 6(1)(f) GDPR - legitimate interest in providing a functional website.

9.3 Analytics Cookies (Require Consent)

We use Google Analytics 4 to understand how visitors use our Service. These cookies are only placed if you consent:

Google Analytics collects:

• Pages visited and time spent
• Traffic sources and referrers
• Device and browser information
• Approximate geographic location (country/city level)

We have implemented the following privacy measures:

• IP Anonymization: Your IP address is anonymized before storage
• Data Sharing Disabled: We do not share analytics data with Google for advertising
• Minimum Retention: Data retention is set to the shortest available period

Legal basis: Art. 6(1)(a) GDPR - your consent.

You may also opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

9.4 No Advertising or Tracking Cookies

We do NOT use:

• Advertising or marketing cookies
• Retargeting or remarketing pixels
• Social media tracking cookies
• Third-party cookies for cross-site tracking

9.5 Third-Party Services

The following third-party services may set their own cookies when you interact with their features:

• Stripe: Payment processing - sets cookies necessary for secure payment transactions. See Stripe's Cookie Policy.
• Cloudflare: Security and performance - may set cookies for bot protection. See Cloudflare's Cookie Policy.

9.6 Managing Cookies

In addition to our consent banner, you can control cookies through your browser settings. Most browsers allow you to:

• View and delete existing cookies
• Block all or certain cookies
• Set preferences for specific websites

Please note that blocking essential cookies may prevent the Service from functioning correctly.

For more information on managing cookies, visit www.allaboutcookies.org.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

10.1 Technical Measures

• Encryption in transit using HTTPS/TLS 1.3
• Password hashing using bcrypt with appropriate work factors
• Secure WebSocket connections (WSS) for voice communication
• Regular security updates and patch management
• Firewall and intrusion detection systems

10.2 Organizational Measures

• Access controls limiting data access to authorized personnel
• Security awareness and training
• Incident response procedures
• Regular security assessments

10.3 Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required by Article 33 GDPR. If the breach poses a high risk, we will also notify affected individuals directly.

11. AI and Automated Decision-Making

Our Service uses artificial intelligence to generate voice responses during conversations. Regarding AI processing:

• No Profiling: We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you
• Entertainment Purpose: AI responses are generated for entertainment only and do not constitute advice, recommendations, or decisions affecting your legal rights
• No Content Retention: AI conversations are not permanently stored or used to build profiles about you

Disclaimer: AI-generated content may be inaccurate, incomplete, or inappropriate. You acknowledge that you use the AI features at your own risk and should not rely on AI responses for any important decisions. See our Terms of Service for full disclaimers.

12. Children's Privacy

TalkBreezy is intended solely for users who are at least 18 years old. We do not knowingly collect personal data from children under 18. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at [email protected]. We will take steps to delete such data promptly.

13. Third-Party Links and Services

Our Service may contain links to third-party websites or services that are not operated by us. We have no control over and assume no responsibility for the content, privacy policies, or practices of third-party sites. We encourage you to review the privacy policies of any third-party sites you visit.

14. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of material changes by:

• Posting the updated Privacy Policy on this page with a new "Last updated" date
• Sending an email notification for significant changes
• Displaying a notice within the Service

We encourage you to review this Privacy Policy periodically. Continued use of the Service after changes constitutes acceptance of the updated Privacy Policy.

15. Contact Information

For any questions about this Privacy Policy, to exercise your data protection rights, or for any privacy-related concerns, please contact us:

We aim to respond to all privacy inquiries within 30 days.