Privacy Policy for Talkbar

Effective Date: Aug 1, 2025

At Talkbar, we are committed to protecting the privacy and security of all End Users who interact with our services. This Privacy Policy explains how Talkbar (“we”, “us”, or “our”) collects, uses, discloses, and safeguards personal data when our application is accessed through a customer’s website (“Customer’s Website”).

By using Talkbar via a Customer’s Website, you (“User”, “End User”) agree to the collection and use of information in accordance with this Privacy Policy.

• Scope

This Privacy Policy applies to all Users of the Talkbar application embedded in or accessed through a Customer’s Website. It governs data collected through Talkbar only, and not any other functionality or services provided directly by the Customer’s Website.

• Data Controller and Data Processor Roles
• The Customer is the Data Controller for End User data and determines the purposes and means of processing.
• Talkbar operates as a Data Processor, acting on behalf of and under the instructions of the Customer.
• In jurisdictions where applicable, Talkbar and the Customer may be joint controllers for certain processing operations, and appropriate Data Processing Agreements (DPAs) will be executed.
• Information We Collect

Depending on how the Talkbar application is configured by the Customer, we may collect the following categories of data:

• Personal Information
• Name (if provided by the User)
• Email address (if required by the Customer’s Website)
• IP address
• Location data (city and country, inferred from IP address)
• Any other personal data voluntarily shared by the User during a chat session.
• Non-Personal / Technical Information:
• Browser type and version
• Operating system
• Time of access and duration of interaction
• Referring URLs
• Tracking & Attribution Data:
• UTM parameters and campaign attribution data captured from URLs when Users arrive via marketing campaigns. This data is used solely for analytics purposes on behalf of the Customer and is never used to build advertising profiles.
• Cookie and Similar Technologies:

Talkbar may use session cookies or similar technologies to maintain chat session continuity and collect the technical information listed above. These are functional in nature and not used for advertising tracking. Users may control cookie settings via their browser, though disabling cookies may affect chat functionality.

• Legal Basis for Processing (GDPR Applicable Users)

For Users in the European Economic Area (EEA) or United Kingdom, we rely on the following legal bases under Article 6 of the GDPR:

• Contractual necessity – Processing required to deliver the Talkbar chat service.
• Legitimate interests – To detect fraud, ensure security, and improve service performance, where such interests are not overridden by your rights.
• Legal obligation –Where processing is required to comply with applicable law.
• Consent – Where the Customer has obtained consent from the User prior to initiating data collection through Talkbar.
• How We Use Your Information

We process collected data strictly for the following purposes:

• To provide and operate the Talkbar service.
• To transmit chat messages between Users and Customer Website’s representatives.
• To improve functionality, performance, and User experience.
• To detect and prevent fraud, abuse, or security threats.
• To provide campaign attribution analytics to the Customer (UTM data).
• To comply with legal obligations.

Talkbar does not sell or share User data for marketing or advertising purposes.

• Data Retention

User data is retained only as long as necessary for the purposes for which it was collected, or as required by applicable law or agreement with the Customer. By default

• Chat logs are retained for up to 90 days from the date of the interaction.
• Customers may request earlier deletion of chat logs at any time.
• Personal data shared within a chat session is treated as confidential and is not stored beyond the agreed retention period.
• Upon termination of a Customer’s contract with Talkbar, all associated User data will be deleted or returned within 30 days unless otherwise required by law.
• Data Security

We implement and maintain robust administrative, technical, and physical safeguards to protect data against unauthorized access, loss, misuse, or alteration. Measures include but are not limited to:

• End-to-end encryption of chat data in transit (TLS 1.2 or higher).
• Encryption of data at rest
• Role-based access controls limiting data access to authorized personnel only.
• Regular security audits and penetration testing.
• Secure hosting and server infrastructure.

In the event of a personal data breach that poses a risk to Users’ rights and freedoms, we will notify the affected Customer within 72 hours of becoming aware of the breach, and support the Customer in fulfilling any obligations to notify relevant supervisory authorities and affected individuals as required under applicable law (including GDPR Article 33/34 and applicable US state laws).

• Sharing of Data

We do not share User data with third parties except in the following circumstances:

• With the Customer’s Website, as the Data Controller.
• With sub-processors and service providers who support our infrastructure, under strict confidentiality and data processing agreements.
• To comply with legal obligations or valid governmental requests.
• To enforce legal rights or investigate violations of our terms of service.

We do not sell or rent any personal data under any circumstances.
A current list of sub-processors is available upon request from the Customer.

• International Data Transfers

Talkbar is headquartered in the United States. If User data is transferred outside of the country of origin or outside the EEA/UK, we ensure such transfers comply with applicable data protection laws. For transfers from the EEA or UK to countries not deemed adequate by the European Commission, we rely on the European Commission’s Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms as the lawful transfer basis.

Customers may request a copy of the applicable SCCs or transfer documentation by contacting us at the address below.

• Your Rights

Subject to applicable laws, Users may have the following rights:

• Right of Access – Request a copy of personal data held about you.
• Right of Access – Request a copy of personal data held about you.
• Right to Erasure – Request deletion of your personal data.
• Right to Erasure – Request deletion of your personal data.
• Right to Object – Object to processing based on legitimate interests.
• Right to Data Portability – Receive your data in a structured, machine-readable format (where applicable).
• Right to Withdraw Consent – Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

As Talkbar acts as a Data Processor, requests should be directed to the Customer’s Website (the Data Controller), which controls your data. Talkbar will cooperate fully with the Customer to support the fulfillment of these rights within legally required timeframes.

• Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know – The right to know what personal information is collected, used, shared, or sold.
• Right to Delete – The right to request deletion of personal information collected from you, subject to certain exceptions.
• Right to Correct – The right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing – Talkbar does not sell or share personal information for cross-context behavioral advertising.
• Right to Non-Discrimination – You will not be discriminated against for exercising any of your CCPA rights.
• Right to Limit Use of Sensitive Personal Information – To the extent Talkbar processes sensitive personal information, you have the right to limit its use to necessary purposes.

To exercise these rights, please contact the Customer’s Website directly. California residents may also contact Talkbar at the address in Section 13 of this policy.

Categories of personal information collected in the last 12 months: Identifiers (name, email, IP address), Internet or network activity (browser type, OS, session data), Geolocation data (city/country from IP). No sensitive personal information as defined under CPRA is collected by Talkbar by default.

• Changes to Privacy Policy

We reserve the right to update this Privacy Policy at any time. The version number and effective date at the top of this document will be updated accordingly. For material changes that significantly affect User rights, we will provide advance notice through the Customer’s Website or within the Talkbar interface at least 14 days prior to the change taking effect. For non-material updates (e.g., clarity improvements, formatting), the updated policy will be posted without advance notice.

Continued use of the application after a material change takes effect constitutes acknowledgment of the updated terms. We encourage Users to review this policy periodically.

• Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please contact us:

Talkbar AI LLC

30 N Gould St Ste N,
Sheridan, WY 82801,
Los Gatos, CA 95032

Email: privacy@talkbar.ai

For GDPR-related inquiries, EU/UK Users may also contact our appointed representative or lodge a complaint with their local supervisory authority (e.g., the ICO in the UK, or the relevant EU Data Protection Authority).

• Governing Law

This Privacy Policy shall be governed and interpreted in accordance with the laws of the State of California, USA, without regard to conflict of law principles. Nothing in this clause limits the rights of Users under applicable mandatory data protection laws in their country of residence (including GDPR for EEA/UK residents).