Privacy Policy
What we hold, why we hold it, where it lives, and what you can ask us to do with it.
1. Who this is from
Talking Bird is operated by [to confirm: registered entity name], registered at [to confirm: registered address]. Where this policy says “we”, it means that company.
2. Our role, and yours
Talking Bird answers questions about documents and spreadsheets that a customer connects to it. Almost everything it holds is content the customer put there, and that content frequently contains information about other people — staff, applicants, vendors, grantees.
Under India’s Digital Personal Data Protection Act, the customer is the Data Fiduciary for that content and Talking Bird is a Data Processor acting on their instructions. We do not decide what goes into a workspace and we do not use it for our own purposes. If you are an employee of one of our customers and want to know what is held about you, your employer is the right first stop; we will help them answer.
We are the Data Fiduciary for one narrow category: the account details of the people who sign in, and the enquiries sent to us through this website.
3. What we hold
| What | Where it is stored | Why |
|---|---|---|
| Files you connect or upload | Object storage, one folder per workspace | The source of every answer |
| Extracted text, in fragments | Postgres, one row per fragment | What makes a document searchable |
| Numeric representations of those fragments | Postgres | How the relevant passage is found |
| Spreadsheet contents | Held in memory while a question is being answered; the file itself stays in object storage | So totals are calculated rather than estimated |
| Questions asked, and the answers given | Postgres | Conversation history you can read and delete |
| Account details: name, work email, role | Postgres | Sign-in and permissions |
| Credentials for systems you connect | Postgres, encrypted | Re-reading a source without asking you again |
| Mailbox tokens, if you connect email | Postgres, encrypted | Drafting replies you send yourself |
4. What we do not hold
- No payment card details. There is no checkout on this site. Plans are agreed with a person and invoiced by hand, so card and bank details never reach the product.
- No government identifiers collected by us, and no special-category personal data — unless a customer chooses to upload documents containing it, which is their decision to make.
- No advertising or profiling data. We do not build profiles, and we do not sell or share anything with data brokers.
5. Cookies and tracking
This site sets no cookies and runs no third-party analytics. There is no Google Analytics, no advertising pixel and no session recorder anywhere in it — which is why you have not been asked to accept a cookie banner.
The application stores a few values in your browser’s local storage, which stays on your device and is never transmitted to a third party: your sign-in token, your light or dark theme preference, whether you have completed the product tour, and your own dashboard layout. Clearing your browser data removes all of them and signs you out.
6. Where it lives
- Subscription. Amazon Web Services, in the [to confirm: AWS region] region. Data does not leave that region in normal operation.
- Self-hosted licence. Entirely inside your own infrastructure. Nothing reaches us: no telemetry, no phone-home, no shared database. This policy then describes only what your own systems do.
7. Answering a question sends text to a model
To answer, the product sends the passages it judged relevant — not your whole corpus — to a language model. On the subscription service that model is Amazon Bedrock, called inside AWS. Under Bedrock’s terms those prompts and responses are not used to train models and are not retained by the model provider.
On a paid plan you may supply your own key for another provider instead. If you do, those passages go to that provider under your agreement with them rather than ours, and their privacy terms govern what happens next.
8. Who else is involved
We use a small number of sub-processors to run the service: [to confirm: the sub-processor list - at minimum AWS for hosting and the managed model, plus the transactional email provider]. We will give notice before adding a new one.
We do not otherwise disclose customer content. If we were ever compelled to by law, we would tell the affected customer unless we were legally prohibited from doing so.
9. How long it is kept
- Content stays until you delete it. Deleting a file removes its searchable fragments with it, and deleting a workspace removes everything belonging to it — the database cascades the deletion from the workspace record through every dependent row.
- Deleted data can survive in encrypted backups for [to confirm: backup retention period] before those backups age out.
- Enquiries sent through this website are kept for [to confirm: enquiry retention period].
10. Your rights
Under the DPDP Act you may ask for access to your personal data, its correction, or its erasure, and you may withdraw consent. Where the data sits inside a customer’s workspace, that customer answers the request and the product gives them the tools to act on it directly. For the account details we hold ourselves, write to us and we will act.
Our grievance contact is [to confirm: grievance officer name and address]. If you are not satisfied with our response you may complain to the Data Protection Board of India.
11. Security
Credentials and mailbox tokens are encrypted at the application layer with a key held outside the database, and the product refuses to store one at all if that key is missing rather than falling back to plain text. Workspaces are separated by checks that run on every read, and those checks are covered by tests that deliberately try to cross them. The full detail, including what is not yet in place, is on the security page.
12. Changes
When this policy changes we will update the date at the top, and for any change that materially affects customers we will tell workspace administrators directly rather than relying on you to re-read the page.