Privacy Policy

1. Introduction

TalkGenAI ("we", "our", or "us") provides an AI-powered web application generator service. This Privacy Policy explains how we collect, use, disclose, and protect your information when you use our service through the WordPress plugin or directly via our API.

2. Information We Collect

2.1 Account Registration Information

When you register for TalkGenAI at https://app.talkgen.ai (required before using the WordPress plugin), we collect:

• Google Account Information: Email address, name, Google ID, and profile picture (via Google OAuth login)
• API Keys: Automatically generated unique keys for authenticating your WordPress plugin
• Account Creation Date: Timestamp of registration

2.2 Information You Provide

When you use TalkGenAI, we collect:

• App Descriptions: The text descriptions you enter to generate applications or articles
• Modification Requests: Instructions for modifying existing apps

2.3 Automatically Collected Information

We automatically collect:

Usage Information:

• Timestamp of API requests
• Number of apps and articles generated
• Number of active apps (for tier limits)
• Credits used per month
• Service response times
• Error logs (when generation fails)
• AI model used for each generation

Technical Information:

• IP address (for security and abuse prevention; and with your consent we may also derive an approximate location such as country/region/city)
• User agent string (device/browser information)

2.4 Information We Do NOT Collect

We explicitly do NOT collect:

• WordPress admin usernames or passwords
• WordPress post or page content
• WordPress database content
• Information about other installed plugins or themes
• Payment information (handled securely by Paddle when you subscribe)
• Any data not explicitly mentioned in sections 2.1-2.3

3. How We Use Your Information

3.1 Primary Uses

We use your information to:

• Generate Applications & Articles: Process your descriptions using AI models from the providers listed in section 4.1 to create blog articles, images and web applications
• Provide the Service: Deliver generated content to your WordPress site via API
• Track Usage: Monitor your monthly credit usage and active app limits
• Enforce Tier Limits: Free tier (limited monthly usage, 1 website) vs. paid tiers with increased limits, websites, and premium AI models. Current plans and limits are listed on our pricing page
• Authentication: Verify your API key with each request
• Billing: Track usage for paid subscriptions

3.2 Security & Abuse Prevention

• Rate Limiting: Prevent abuse by limiting API requests
• Fraud Detection: Identify suspicious patterns and prevent account abuse (e.g., repeatedly deleting and re-creating accounts to claim free credits)
• Service Protection: Maintain service availability for all users
• Email Hash Retention: Keep cryptographic hash of email after account deletion to prevent free credit abuse (GDPR-compliant under Article 17.3.e)

3.3 Service Improvement

• Quality Assurance: Analyze failed generations to improve AI prompts
• Performance Optimization: Monitor response times and optimize infrastructure
• Feature Development: Understand common use cases to build new features

3.4 Customer Support

• Troubleshoot issues you report
• Answer questions about service usage
• Provide technical assistance

3.5 Communications

We may send emails related to your account and use of the service, such as:

• Service emails: security alerts, account updates, important service notices, and responses to your support requests.
• Product updates / marketing emails (where applicable): we will only send promotional messages when permitted by law, and such emails will include an unsubscribe option.

3.6 Account Access for Support & Configuration

To provide customer support, troubleshoot problems, and help you set up and configure the Service, authorized TalkGenAI staff may access your account, including viewing your dashboard, settings, account data, and the content you have generated (such as articles and apps). When necessary to assist you, authorized staff may also make configuration changes on your behalf.

• Purpose limitation: Such access is used solely to operate the Service and to provide the support, troubleshooting, or configuration assistance you request or that is necessary to keep the Service working. It is never used for marketing or shared with third parties.
• Restricted access: Account access is limited to a small number of authorized staff and is protected by internal access controls.
• Audit logging: Each instance of staff access to a customer account is logged, including who accessed the account, when, and the reason. These records are retained to protect you and to maintain accountability.
• Legal basis (GDPR): We rely on our legitimate interests in operating, securing, and supporting the Service, and on the performance of our contract with you. You may object to or request restriction of this processing as described in Section 7, though doing so may limit our ability to provide support.

4. How We Share Your Information

4.1 Third-Party AI Services

We share the content you ask us to work on (article titles, topics, instructions, your brand/business description, and any page content we scan from a website you connect) with:

• OpenAI: text generation on the free tier, and generation of article hero images and brand images on all tiers (Privacy Policy, Terms)
• Anthropic: text generation on paid tiers, including articles, refinements and content plans (Privacy Policy, Terms)
• Perplexity and Google (Gemini): only if you use the AI Visibility feature, which asks these assistants questions about your brand to measure whether they cite you (Perplexity Privacy Policy, Google Privacy Policy)

We select the specific model for each task and tier, and the models we use change over time as providers release new versions. The list above names the providers that receive data, which is what determines where your content goes.

Note: only the content described above is sent to these services. We do not send your email address, password, payment details, or other account information to AI providers.

4.2 Infrastructure Providers

• MongoDB: Database for storing user accounts, API keys, usage statistics, and generation history
• Railway: Cloud hosting infrastructure for our API service

4.3 Payment Processing

• Paddle: Payment processing for paid subscriptions (Privacy Policy)

Note: We never see or store your credit card information. Paddle handles all payment data securely.

4.4 Internal Monitoring

To operate and improve our service, we use an internal monitoring system that sends operational event notifications (such as new account registrations and content generation activity) to a private, access-restricted channel used solely by TalkGenAI staff. This data is used exclusively for service operations, fraud prevention, and product improvement. It is never shared with third parties or used for marketing.

4.5 Analytics Providers

With your Analytics consent only, usage data from our website and app pages is shared with:

• Microsoft (Microsoft Clarity): interaction data, session replays and heatmaps (Privacy Statement)
• Google (Google Analytics 4): page views, traffic source and device data, with IP anonymisation enabled (Privacy Policy)

Neither runs on our admin pages, and neither receives anything if you decline Analytics consent or withdraw it later via Cookie settings. See section 8 for the detail of what each collects.

4.6 We Do NOT Sell Your Data

We do NOT:

• Sell your data to third parties
• Share data with advertisers
• Use your data for marketing to others
• Share data except as explicitly listed above

5. Data Retention

5.1 Generated Applications & Articles

• WordPress Plugin Storage: If you use the WordPress plugin, generated apps and articles are stored in YOUR WordPress database (you control deletion from WordPress admin).
• Service Processing Copies: To operate the service, provide job history, and troubleshoot issues, we may temporarily store your inputs (such as app titles/descriptions and modification requests) and generated outputs in our systems.
• Retention (typical): Job records (including associated inputs and outputs) are typically retained for a limited time (e.g., up to 7 days) and then automatically cleaned up, while aggregated/usage analytics may be retained longer as described below.

5.2 Usage Logs & Analytics

• Usage Statistics: Up to 90 days (for billing verification, fraud prevention, and service improvement)
• Error Logs: Up to 30 days (for debugging and reliability improvements)
• Aggregated Analytics: Indefinitely (anonymized, no personal identifiers)

5.3 Account Deletion (GDPR-Compliant)

When you delete your account from your TalkGenAI dashboard:

• Personal Data Deleted Immediately: Email, name, Google ID, profile picture, IP address
• API Keys Revoked: All API keys deactivated immediately
• Usage Data Deleted: All generation history and usage logs removed
• WordPress Apps: Remain in YOUR WordPress database (you control deletion)
• Fraud Prevention Data: Cryptographic hash (SHA-256) of your email is retained permanently to prevent abuse of free credits (GDPR Article 17.3.e - legal exception for fraud prevention). This hash cannot be reversed to obtain your email.

Important: If you previously claimed free credits and delete your account, you will NOT receive free credits again if you re-register with the same email (fraud prevention).

6. Data Security

6.1 Security Measures

We implement industry-standard security practices:

• HTTPS/TLS Encryption: All data in transit is encrypted
• API Key Authentication: Secure authentication for all requests
• Rate Limiting: Automatic abuse prevention system
• Database Encryption: Sensitive data encrypted at rest
• Access Controls: Strict internal access permissions
• Google OAuth: Secure Google login (we never see your Google password)
• Automated Monitoring: Continuous security monitoring

6.2 Your Responsibilities

• Keep your Google account secure (this is your TalkGenAI login)
• Keep your WordPress admin credentials secure
• Don't share your API key publicly or commit it to public repositories
• Keep WordPress and plugins updated

7. Your Rights (GDPR & Israeli Privacy Law)

7.1 European Union & Israel Users

Under GDPR and Israeli privacy law, you have the following rights:

• Right to Access: Request a copy of all data we hold about you
• Right to Rectification: Correct any inaccurate data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data
• Right to Restriction: Limit how we process your data
• Right to Data Portability: Receive your data in machine-readable format
• Right to Object: Object to processing of your data
• Right to Withdraw Consent: Withdraw consent at any time
• Right to Lodge a Complaint: File complaint with data protection authority

7.2 How to Exercise Your Rights

Self-Service Options:

• Delete Account: Use the "Delete My Account" button in your TalkGenAI dashboard (immediate, GDPR-compliant deletion)

For Other Rights (Access, Export, Rectification):

• Email: [email protected]
• Subject Line: "Privacy Rights Request - [Your Email]"
• Response Time: We will respond within 30 days

7.3 Israeli Data Protection Authority

You can lodge a complaint with:

• Name: Israeli Privacy Protection Authority
• Website: gov.il/privacy

8. Cookies & Tracking

8.1 Our Website/Service

We use cookies and similar technologies for operational purposes (for example, to maintain login sessions). We use a consent banner with separate categories for Analytics and Marketing. Non-essential cookies and tracking are disabled by default and are only enabled after you opt in.

Manage consent: You can accept/reject from the banner and you can change your choice later using the "Cookie settings" link in the site footer.

8.2 Attribution (Traffic Source Tracking)

With your consent, we collect limited attribution information to understand where visitors come from and to improve our marketing:

• Analytics (opt-in): landing page URL/path, referrer domain, and UTM parameters (e.g., utm_source, utm_medium, utm_campaign).
• Marketing (opt-in): advertising click identifiers where present (for example gclid, fbclid, msclkid, ttclid).
• Device/Geo (opt-in): we may store device type (desktop/mobile/tablet) and an approximate location such as country/region/city (derived from IP or hosting headers), when available.

We store this information in our database linked to your TalkGenAI account only when you have consented to the relevant category.

8.3 WordPress Plugin

The WordPress plugin does NOT set cookies or track users. All communication is server-to-server.

8.4 Microsoft Clarity (Analytics & Session Recordings)

With your Analytics consent, we use Microsoft Clarity on our public website and user-facing app pages (for example: Home, Pricing, Login, Dashboard) to understand how people use the site and to improve usability. We do not run Clarity on our admin pages.

Clarity may collect information such as:

• Pages visited and general interaction patterns (clicks, scrolls, navigation)
• Device/browser information and approximate location derived from IP address
• Session replays and heatmaps to help us identify UX issues

We use this data for analytics and product improvement. You can opt out at any time via Cookie settings in the footer. For more information, see Microsoft's Clarity privacy information: Microsoft Privacy Statement.

8.5 Google Analytics 4 (Traffic Measurement)

With your Analytics consent, we use Google Analytics 4 on the same public website and user-facing app pages to measure traffic and understand which channels bring visitors to TalkGenAI. We do not run Google Analytics on our admin pages.

Google Analytics may collect information such as:

• Pages viewed, session duration, and navigation paths within our site
• Traffic source: referring website, search terms where provided, and UTM campaign parameters
• Device and browser information, and an approximate location (country/region/city) derived from IP address
• A randomly generated identifier stored in cookies (_ga, _ga_<stream>) used to recognise returning visits

We enable IP anonymisation, so your full IP address is not stored by Google Analytics. Google acts as our processor for this data and may process it on servers outside your country, including the United States. Google Analytics does not record your screen, and unlike Clarity it does not capture session replays.

You can opt out at any time via Cookie settings in the footer. You may also install Google's Analytics Opt-out Browser Add-on. For more information, see Google's Privacy Policy and how Google uses data from sites that use its services.

9. International Data Transfers

Data Location: Your data is processed in:

• Primary Location: Railway servers
• AI Processing: OpenAI and Anthropic servers (US-based), and — only if you use the AI Visibility feature — Perplexity and Google
• Analytics (only with your Analytics consent): Microsoft Clarity and Google Analytics, which may process data on servers outside your country, including the United States

Transfer Safeguards:

• We use standard contractual clauses for GDPR compliance
• All data transfers use encrypted connections (TLS/HTTPS)
• Third-party providers are contractually obligated to protect your data

10. Children's Privacy

TalkGenAI is not intended for children under 13 (or 16 in the EU). We do not knowingly collect information from children. If you believe we have collected information from a child, contact us immediately at [email protected].

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes:

• We will update the "Last Updated" date at the top
• We will notify you via email (paid subscribers)
• We will display a notice in the WordPress plugin admin
• Major changes will require your re-consent

Your continued use after changes indicates acceptance of the new policy.

12. Legal Basis for Processing (GDPR)

Under GDPR, we process your data based on:

• Contract Performance: To provide the service you requested
• Legitimate Interests: For security, fraud prevention, and service improvement
• Consent: Where you have explicitly agreed (e.g., plugin activation)
• Legal Obligation: To comply with applicable laws

13. California Privacy Rights (CCPA)

California residents have additional rights under CCPA:

• Right to know what data we collect
• Right to delete personal information
• Right to opt-out of data sales (Note: We don't sell data)
• Right to non-discrimination for exercising rights

Contact [email protected] to exercise these rights.

14. Contact Us