Legal

Privacy Policy

Last updated: June 28, 2026 · Effective: June 28, 2026

Talkfolio, Inc. ("Talkfolio", "we", "our", "us") runs Talkfolio, a chat-first portfolio service for professionals and consultants.

This policy covers data we collect from you as a profile owner (someone with a Talkfolio account) or as a visitor (someone who chats with a public Talkfolio page), how we use it, and the rights you have over it.

By using Talkfolio you agree to this policy. If you do not agree, stop using the service.

Information we collect

1.1 Account and profile information (profile owners)

When you create an account and build your portfolio we collect:

Identity data. Your full name, email address, and optionally a profile photo.
Portfolio content. Experience, projects, skills, services, pricing labels, testimonials, and anything else you add in the dashboard. You provide this content. We use it to power your personal agent.
Authentication credentials. Hashed passwords or OAuth tokens from providers such as Google. We never store plaintext passwords.
Social and integration links. URLs you add (GitHub, LinkedIn, Cal.com, and similar) so your agent can show them to visitors.
Uploaded documents. Résumés or pitch files you upload for your agent knowledge base, stored in Cloudflare R2.

1.2 AI-generated embeddings

Content you enter into your profile is converted into vector embeddings with OpenAI's text-embedding-3-small model (1 536 dimensions) and stored in Neon Postgres with the pgvector extension. Embeddings are required for your agent to answer questions from your profile. They belong to your profile only and are deleted when you delete your account or the source content that produced them.

1.3 Billing and subscription data

Talkfolio uses Polar for payment and subscriptions. When you subscribe to a paid plan:

Payment card details are collected and stored by Polar and its payment networks. We never see or store your raw card number, CVV, or expiry date.
We receive from Polar: your Polar customer ID, subscription ID, product ID, subscription tier (free, pro, max), billing period dates, and subscription status (active, canceled, past_due, trialing).
We store this billing metadata in our subscriptions table to gate features, enforce usage limits, and show your plan in the dashboard.
Polar's privacy policy covers how your payment data is handled. Review it at polar.sh.

1.4 Usage records

To enforce per-plan message limits we keep a usage_records table of AI messages consumed in each billing period. Records are tied to your user ID. We use them for limit enforcement and, in aggregate, to understand platform demand.

1.5 Visitor data (portfolio visitors)

When someone visits a Talkfolio portfolio page, we collect limited data on behalf of the profile owner:

Fingerprint hash. A hashed, non-reversible browser fingerprint used to recognise unique visitors across sessions. No PII is derivable from this hash alone.
IP hash. A one-way hash of the visitor's IP address used for fraud prevention. The raw IP is never stored.
Geolocation metadata. Approximate country, city, and timezone derived from the IP at request time (for example, "United States / New York / America/New_York"). We do not store street-level or GPS coordinates.
User agent and referrer. Browser type and the referring URL.
Conversation content. Messages between the visitor and the agent, stored in our messages and conversations tables, tied to the hashed visitor ID and the profile they chatted with.
Email address (if voluntarily provided). If a visitor shares an email through a capture prompt, that address is stored in our visitors and leads tables and shared with the profile owner.
Lead score and intent signals. Our pipeline assigns a lead score and detects message intent (pricing, availability, project, general). Profile owners see this in the dashboard.

Profile owners are the data controllers for visitor data collected on their portfolio pages. Talkfolio acts as a data processor on their behalf. Profile owners must inform their own visitors appropriately.

1.6 Analytics and telemetry

We use PostHog to track product events such as sign-ups, first lead received, and subscription changes. PostHog has its own privacy policy. We do not sell this telemetry. We instrument named funnel events and use session replays on our marketing and dashboard pages to improve the product.

How we use your information

To run the service. Power your agent, embed profile content, and serve your public page at /[username].
To manage billing and subscriptions. Enforce plan limits, process upgrades and downgrades, and reconcile Polar webhook events.
To detect and score leads. Classify visitor messages and show lead scores in your dashboard CRM.
To improve the service. Review anonymised usage in PostHog, find unanswered visitor questions through gap reports, and tune our intent classifier on aggregated signals.
To communicate with you. Send transactional email via Resend (verification, password reset, lead notifications, billing receipts). We do not send marketing email without your opt-in.
To enforce acceptable use. Block abusive visitor sessions (isBlocked) and enforce usage quotas.
For security and fraud prevention. IP hashing, session tokens, and anomaly detection.

We do not use your portfolio content or visitor conversations to train general-purpose AI models. Your content stays in your own profile's embedding store.

Legal basis for processing (GDPR)

If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, these legal bases apply:

Purpose	Legal basis
Providing the contracted service	Performance of a contract (Art. 6(1)(b))
Billing and subscription management	Performance of a contract (Art. 6(1)(b))
Security and fraud prevention	Legitimate interests (Art. 6(1)(f))
Product analytics and improvement	Legitimate interests (Art. 6(1)(f))
Transactional email notifications	Performance of a contract (Art. 6(1)(b))
Marketing communications	Consent (Art. 6(1)(a))
Visitor lead data (on behalf of profile owners)	Legitimate interests of the profile owner (Art. 6(1)(f))

Data retention

Account and profile data. Kept for the life of your account. Deleted within 30 days of account deletion.
Vector embeddings. Deleted when source content is removed or the profile is deleted.
Billing records. Kept for 7 years to meet financial record-keeping rules, even after account deletion. We never store card details.
Conversation and visitor data. Kept for 24 months from the last visitor interaction, then purged. Profile owners can delete individual conversations from the dashboard at any time.
Usage records. Kept for 13 months for billing disputes and historical usage review.
Analytics events. Kept for 12 months in PostHog, then expired per PostHog retention settings.
Session tokens. Expire at their expires_at timestamp and are purged on the next cleanup cycle.

Cookies and tracking

Talkfolio uses these cookies and local storage mechanisms:

Session cookie (strictly necessary). A secure, HTTP-only cookie set by BetterAuth for your authenticated session. Expires when the session ends or at the configured expiry.
PostHog analytics cookie (functional/analytics). A first-party cookie used to recognise returning product users for funnel analysis. You can opt out through PostHog's opt-out mechanism.
Visitor fingerprint (functional). Stored in localStorage on visitor browsers to keep conversation context across reloads. Contains only the hashed visitor ID, not PII.

We do not use third-party advertising cookies or cross-site tracking pixels. Analytics stay in PostHog and are not shared with advertising networks.

Security

We use these controls to protect your data:

Data in transit is encrypted with TLS 1.2+.
Data at rest is encrypted by Neon and Cloudflare R2 using AES-256.
Cal.com API keys and OAuth tokens are encrypted at the application layer.
Passwords are never stored in plaintext. BetterAuth uses bcrypt-based hashing.
IP addresses are hashed with a rotating secret before storage. Raw IPs are never persisted.
Access to production infrastructure is limited to authenticated personnel with MFA.
Database access follows row-level security principles at the application layer via Drizzle ORM.

No system is perfectly secure. If you find a vulnerability, disclose it to hello@talkfolio.me.

Your rights

Depending on your jurisdiction, you may have these rights over your personal data:

Access. Request a copy of the personal data we hold about you.
Rectification. Correct inaccurate or incomplete data. Most data is editable in your dashboard.
Erasure ("right to be forgotten"). Request deletion of your account and associated data. Start from Settings → Danger Zone, or email us.
Portability. Request an export of your profile content in JSON.
Restriction. Ask us to restrict processing in certain circumstances.
Objection. Object to processing based on legitimate interests.
Withdraw consent. Where processing relies on consent (for example, marketing email), withdraw at any time.
Lodge a complaint. If you are in the EEA/UK, you may complain to your local data protection authority.

To exercise any right, contact hello@talkfolio.me. We respond within 30 days, or sooner if the law requires it.

Children's privacy

Talkfolio is not for people under 16. We do not knowingly collect personal data from children under 16. If you believe a child gave us personal data, contact hello@talkfolio.me and we will delete it promptly.

International data transfers

Talkfolio is operated from the United States. If you use the service from the EEA, UK, or other regions with transfer rules, your data is transferred to and processed in the United States and other countries where our sub-processors operate. Where required, we rely on Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms.

Changes to this policy

We may update this Privacy Policy. For material changes we email the address on your account and post a notice in the dashboard at least 14 days before the changes take effect. Continued use after that date means you accept the updated policy.

Contact us

For privacy questions, requests, or complaints:

Talkfolio, Inc.

Dileep Nagar, Mithi, Sindh, Pakistan

Email: hello@talkfolio.me