HeyTalkLegal
Privacy Policy
Last updated October 8, 2026
HeyTalk turns conversations into notes, tasks and follow-ups. Conversations can contain personal and business-sensitive information, so we collect only what the product needs, say why we need each piece, keep it in India, and let you delete it whenever you want.
1. In short
- Only what we need. Every item we collect is listed below with the reason. If we don’t need it, we don’t keep it.
- Stored in India. Your account and conversations live in our database in India (Mumbai region).
- Financial details are masked. Card numbers, PAN, Aadhaar, UPI IDs and spoken OTPs or CVVs are replaced with “••••” before a transcript is saved or used.
- Audio isn’t kept. It is deleted once transcribed, unless you turn on playback.
- Nothing is sold, shared for ads, or posted for you without your approval.
- You’re in control. Export or delete everything yourself, any time.
2. Who we are and how to reach us
HeyTalk (“HeyTalk”, “we”, “us”) provides the website at heytalk.site and the HeyTalk app. Under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), we are the Data Fiduciary for your account data. When a company uses HeyTalk for its team, that company decides how its conversations are used, and we process them on its behalf.
Grievance Officer: Arav, HeyTalk · support@heytalk.site. We acknowledge every request within 72 hours and resolve it within 30 days.
3. What we collect, and why
We ask for as little as possible. Here is every piece, why it’s needed, and what happens if you’d rather not share it.
| Data | Why we need it | Your choice |
|---|---|---|
| Email address (from Google sign-in) | To identify your account and let you sign in. Optional reminder emails go here. | Required to have an account. Reminder emails can be turned off. |
| Name (from Google, or what you type) | Only to show whose words are whose in a transcript, and which tasks are yours. Without a name, HeyTalk can’t tell “I’ll send it” from someone else’s promise. | Use any name you like, such as a first name or initials. Change it in Settings. |
| Role and language | To write the right brief (for example a design brief) and understand Hinglish or other Indian languages. | Optional. Change or skip in Settings. |
| Audio you record | To produce the transcript. Deleted as soon as it’s transcribed. | You can paste or upload a transcript instead. Playback (keeping audio for 7 or 30 days) is off by default. |
| Transcripts, notes, tasks, decisions | This is the product: your notes and what you owe. | Delete any conversation at any time. |
| Search data (numeric “embeddings” of your notes) | So you can ask questions across your conversations. | Deleted with the conversation. |
| Names of other participants and their consent choice | To label speakers and to remove anything said by someone who declined. | You decide who is named. |
| Connected app access (Slack, Jira, Notion, Google Calendar) | Only to do what you approve in those apps. Stored encrypted. | Optional. Disconnect any time in Settings. |
| Payment record (amount, date, Razorpay payment ID) | To give you Pro and keep the records the law requires. | Only if you buy Pro. We never see or store card numbers, UPI PINs or bank details. |
| Usage counts and error logs, IP address and browser type | To enforce plan limits, keep the service secure and fix problems. | Kept briefly (see retention). |
What we deliberately don’t collect: your Google password, your profile picture, your contacts list, your location, or anything from your device beyond what you record.
4. How we use it
- To transcribe, summarise and organise your conversations, and answer your questions about them.
- To remind you of what you committed to. Reminder emails can be turned off.
- To act in Slack, Jira, Notion or email only when you approve it, or when you switch on automation for that kind of action yourself.
- To run, secure and fix the service, and enforce plan limits.
We process your data based on your consent, which you give when you create an account and record a conversation, and for the legitimate uses the DPDP Act allows (such as keeping payment records). You can withdraw consent at any time by deleting your data or your account. That stops further processing, and it doesn’t affect what was done before.
5. What we never do
- We never sell your data or share it for advertising.
- We never use your conversations to train our own AI models.
- We never post, send or message anyone on your behalf without your approval.
- We never store card numbers, UPI PINs, or bank login details. Payments are handled entirely by Razorpay.
- We never read your inbox or calendar beyond what a feature you switched on needs. Calendar access is read-only.
6. Where your data is stored
In India. Our database (your account, transcripts, notes and tasks) is hosted in India, in the Mumbai region, and our application servers run in Mumbai.
Processed outside India only where a provider requires it. AI transcription and note-writing use Google’s Gemini API, which may process data on servers outside India. Our hosting provider may keep short-lived operational logs outside India. These transfers are made only to countries the Government of India has not restricted, and only to provide the service.
7. Who processes your data
We use a small number of providers. Each processes data only to provide its service to us, under its own security and confidentiality commitments.
| Provider | What for | What they receive |
|---|---|---|
| Google (Gemini API) | Transcription, notes, answers, search | Audio, transcripts (financial details already masked), questions |
| Turso | Database, India | Your account and conversation data |
| Vercel | Hosting (Mumbai) and temporary audio storage | App traffic; audio until transcribed, or for the playback period you choose |
| Razorpay | Payments (RBI-authorised payment aggregator) | Your payment details, entered directly with Razorpay, never with us |
| Google (Sign-in) | Authentication | Sign-in requests |
| Resend | Reminder emails | Your email address and the reminder |
| Deepgram, Anthropic | Only if enabled for your workspace | Audio or transcripts, for the same purposes as Gemini |
| Slack, Jira, Notion, Google Calendar | Only if you connect them | Only what you approve to send, or read-only event details |
8. How we protect it
- Encrypted in transit (HTTPS/TLS) everywhere.
- Connected-app access is encrypted (AES-256-GCM) before it is stored. Invite links and API tokens are stored only as one-way hashes.
- Financial identifiers are masked automatically in every transcript before it is saved or used: card numbers, PAN, Aadhaar, UPI IDs, and OTPs, CVVs or PINs said aloud.
- Strict separation: each conversation is visible only to the person who recorded it and the people they invite.
- Team controls: an admin can switch off audio playback and public share links, show teammates only summaries instead of full transcripts, and limit invite links to the company’s email domain, for everyone in the team.
- Least access: only the founder can access production systems, for support and security only.
If something goes wrong: we will tell affected users and customers without undue delay, and report to CERT-In and the Data Protection Board of India within the times the law sets.
9. For banks, NBFCs and fintech teams
HeyTalk is a productivity tool, not a payment system, and is not itself regulated by the Reserve Bank of India. Many of our customers are, so we are built to support their obligations:
- Data stays in India at rest, and we never handle your customers’ payment data.
- Financial identifiers are masked automatically, as above. Masking is a safety net, not permission to discuss customer account details in recorded meetings. Follow your own data-handling policy.
- Admin controls for audio playback, share links, transcript visibility and invites, plus export and deletion.
- Contracts that match your vendor-risk process: a data processing agreement, completed security questionnaires, cooperation with your audits, and incident reporting commitments, on request.
- Self-hosted Enterprise option: run HeyTalk inside your own cloud or data centre with your own AI model, so conversations never leave your environment.
Write to support@heytalk.site for our security documentation.
10. How long we keep it
- Audio is deleted as soon as it has been transcribed. If you turn on playback (Pro, off by default), audio of new recordings is kept for the 7 or 30 days you choose, then deleted. A team admin can switch playback off for everyone.
- Conversations (transcript, notes, tasks and search data) are deleted automatically after 90 days, or straight away when you delete them.
- Recordings started but never finished are removed after 24 hours.
- Operational logs are kept for up to 30 days, and usage counts for up to 3 months.
- Payment records are kept for as long as tax and accounting law requires.
- Your account is kept until you delete it. Deleting it removes everything above, except payment records the law requires us to keep.
11. Recording other people
Always tell people before you record them, and get the consent your company and the law require. HeyTalk helps: you can note each participant’s consent, and anything said by someone who declines is removed from the transcript and from everything written from it.
12. Your rights
Under the DPDP Act and similar laws, you can:
- Access a copy of your data: Settings → Your data → Export. The providers who process it are listed above.
- Correct your name, role or any note, directly in the app.
- Erase a conversation, or your whole account, yourself from Settings → Your data.
- Withdraw consent by deleting your data or account.
- Nominate someone to act for you if you are unable to, by writing to support@heytalk.site.
- Raise a grievance with our Grievance Officer at support@heytalk.site. If you’re not satisfied, you can complain to the Data Protection Board of India.
If you live outside India, you may have similar rights under laws such as the GDPR. Write to us and we’ll help.
14. Children
HeyTalk is for people aged 18 and over. We do not knowingly collect data from children.
15. Changes
If we make meaningful changes, we update the date above and, for significant changes, tell you in the app or by email before they take effect. Questions? Email support@heytalk.site. See also our Terms of Service and Security page.