1. Data controller
The data controller for personal data processed through TalKing is Quentin Rosset, sole trader, registered in France under SIREN 107 314 445, contact rossetquentin26@gmail.com.
2. Data we collect
- Account data: email address, authentication identifiers (e.g. Google ID if you sign in with Google).
- Usage data: number of translations, timestamps, source/target language, credit balance.
- Voice input: the short audio you record is transmitted to our server and to AI providers for transcription and translation. It is processed in-memory and not stored on our servers.
- Technical data: IP address, browser/OS, error logs, needed for security and reliability.
- Payment data: collected directly by Paddle (our Merchant of Record). We only receive limited billing metadata (order ID, plan, country, last 4 digits).
3. Purposes and legal bases
- Provide the service (account, translation, credit management) - performance of contract.
- Security, fraud and abuse prevention (including the 150/day cap) - legitimate interests.
- Billing, tax compliance and accounting - legal obligation.
- Customer support - performance of contract / legitimate interests.
- Product improvement (aggregated statistics only) - legitimate interests.
4. AI processing of your voice
Audio is sent to third-party AI providers (OpenAI for transcription, Google Gemini for translation) to produce the translated text. We do not use your audio or translations to train models. Providers may process data outside the EU under standard contractual clauses.
5. Recipients / subprocessors
- Hosting & database: Supabase / Cloudflare (EU regions where available).
- AI providers: OpenAI, Google (Gemini) for speech-to-text and translation.
- Payments & invoicing: Paddle.com (Merchant of Record).
- Authentication: Google (if you use Google sign-in).
- Authorities where required by law.
6. International transfers
Some subprocessors are based outside the EU/EEA (notably the US). Transfers are covered by Standard Contractual Clauses or adequacy decisions as applicable.
7. Retention
- Account data: kept while your account is active, deleted within 30 days after account deletion.
- Voice recordings: not stored (processed in-memory only).
- Translation logs: metadata only (no content), kept up to 12 months for abuse prevention.
- Billing records: kept 10 years to comply with French accounting law.
8. Your rights (GDPR)
You have the right to access, rectify, erase, restrict or object to the processing of your data, to data portability, and to withdraw consent at any time. To exercise these rights, contact rossetquentin26@gmail.com. We respond within 1 month. You may also lodge a complaint with the French supervisory authority (CNIL).
9. Security
We apply appropriate technical and organisational measures: HTTPS transport, encrypted storage, access controls, row-level security in the database, and least-privilege service credentials.
10. Cookies
We use strictly necessary cookies/local storage for authentication and to remember your settings (language, hotkey). No advertising or third-party tracking cookies are used.