Privacy Policy

This policy explains what personal data Talk to Me Data collects, why, who we share it with, how long we keep it, and the rights you have. It applies to our website at talktomedata.com, our app at app.talktomedata.com, and the AI agents we run for you (together, the “Service”).

We’ve written it in plain English. If anything is unclear, email us at nas@talktomedata.com.

1. Who we are

Talk to Me Data is a trading name of MATUTTO LTD, a company registered in England and Wales (company number 12558540), registered office 106 Cranston Court, 56 Bloemfontein Road, London W12 2FG.

In this policy, “we”, “us” and “our” mean MATUTTO LTD. “You” means anyone who visits our website or uses the Service.

Contact for anything privacy-related: nas@talktomedata.com

2. Our role: controller and processor

• We are the controller for your account details, billing information, how you use the Service, and the public data we collect to run our agents (see section 7).
• We act as a processor for our business customers for the content our agents handle on their behalf, such as the emails, documents and contact lists a customer connects or uploads. The customer decides what our agents do with that data. If your personal data reached us through one of our customers, for example because you emailed them, please contact that customer first. We will help them respond to you.

3. What we collect

3.1 Information you give us

• Account details: your name, email address and password (stored securely by our authentication provider; we never see it in plain text). If you sign in with Google, we receive your name, email address and profile picture from Google.
• Onboarding answers: company name, company size, location, industry, your role, how you heard about us, and whether the account is for a business or personal brand.
• Agent requests and chats: the instructions you give your agents, the questions you ask them and the answers they produce.
• Brand kit and designs: logos, colours, fonts, captions and images you upload or create in the Create studio.
• Contact lists (Property Leads agent): contact lists you upload from your CRM so we can match them against property records.
• Messages to us: anything you send us by email, through the contact page or the forms on our website (such as the demo request and get-started forms, which ask for your email, name, role, team size and what you’d like to automate), or during a call you book with us.

3.2 Information from the tools you connect

When you connect a tool such as Gmail, Google Calendar, Google Drive, Google Sheets, Outlook, Slack, Notion, HubSpot or others, you grant our agents permission to read and act on data in that tool. We use a connection provider, Composio, to hold the access tokens securely. Our agents only access the data needed to do the job you asked for, when you ask for it or when an agent you scheduled runs.

The content our agents read (for example an email thread or a spreadsheet) is processed to complete the task and is stored only as part of that agent’s conversation history, so you can see what it did.

If you connect Google Search Console to the SEO & GEO Manager, we read, read-only, the search performance data for the websites you choose: the searches people used to find your site, the pages they landed on, clicks, impressions, average position, and splits by device and country. We connect to Google directly for this (not through Composio) and store the access tokens ourselves, encrypted.

3.3 Information from social media platforms

Public profile data. When you add a social media account to the Social Media Manager (your own or a competitor’s), we collect publicly available information about that account and its recent posts: handle, display name, bio, profile picture, follower and following counts, and each post’s caption, thumbnail, publish date and public engagement figures (views, likes, comments, shares). We collect this through the YouTube Data API and through Apify, a data collection provider, for Instagram, TikTok and Facebook Pages.

Accounts you connect for posting (Instagram, Facebook, TikTok). If you choose to connect an account so our agent can post for you, you sign in on that platform’s own page and approve the permissions listed below. We never see your password.

We use these permissions only to:

1. confirm that the account you signed in to is the one in your dashboard;
2. publish the posts you designed and scheduled, at the time you chose; and
3. show you the result of each post (whether it was published and a link to it).

Access tokens are encrypted before they are stored, and only our servers can read them.

We do not use data from Meta or TikTok for advertising, we do not sell it, we do not share it with anyone other than the service providers who help us run the Service (section 9), and we do not use it to build profiles of people. See section 5 for Google and YouTube.

3.4 Information collected automatically

• Usage data: pages viewed, features used, clicks, device and browser type, approximate location from your IP address, and referring website. If you click “Accept all” in our cookie banner (see section 14), we collect this with PostHog and Google Analytics using cookies. If you choose “Necessary only”, PostHog still counts page views and clicks anonymously, without cookies or storing anything on your device: it works out a privacy-preserving code from your IP address and browser on its servers, so you can’t be recognised across days. Vercel Web Analytics also counts page views on our website without using cookies or identifying you.
• Advertising measurement: if you click “Accept all”, the Meta Pixel tells Meta when you visit our website or book a call with us, so we can measure and improve our ads on Facebook and Instagram. Meta handles this data under its own privacy policy.
• Security data: when you sign up, Cloudflare Turnstile checks that you are a person and not a bot. This involves Cloudflare processing your IP address and browser signals.
• Service data: how many “actions” each request used, which agents ran and when, and error logs. We need this to meter your plan and keep the Service working.

3.5 Payment information

Payments are handled by Stripe. We receive your name, email, billing address, the last four digits of your card, the card brand and expiry, and your payment history. We never see or store your full card number.

3.6 Information from the website you add

When you add a website to the SEO & GEO Manager, we visit its publicly available pages the way a search engine does (page titles, descriptions, headings, structured data, robots.txt, llms.txt and sitemap), and run Google’s PageSpeed Insights test on it. We only read pages anyone can see without logging in.

4. How we use your data and our lawful bases

UK data protection law requires a lawful basis for each use of personal data. Ours are:

Where we rely on legitimate interests, we have weighed our interests against your rights and concluded they are not overridden. You can ask us for details, and you can object at any time (section 12).

We do not intentionally collect special category data (such as health, religion or ethnicity). If it appears in content you ask an agent to process, we process it only to carry out your instructions.

5. Google and YouTube data

Google user data. Talk to Me Data’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we only use Google user data (for example Gmail, Calendar, Drive, Docs, Sheets or Google Search Console data) to provide the features you asked for;
• we do not use it for advertising;
• we do not sell it or transfer it to others, except to provide the Service, to comply with the law, or as part of a merger or acquisition with notice to you;
• no person at Talk to Me Data reads it unless you ask us to (for example for support), it is needed for security or to comply with the law, or it has been aggregated and anonymised; and
• we do not use it to train general-purpose AI or machine-learning models.

We do not allow humans to read Google user data unless you ask us to (for example for support), it is needed for security or to comply with the law, or it is aggregated and anonymised for our internal operations. We do not use Google user data to develop, improve or train generalised AI or machine-learning models. To produce your analysis and suggested fixes, we send the relevant Search Console figures to our AI provider Anthropic, under terms that prevent it from training on them.

When you disconnect Search Console (or remove the website), we revoke our access at Google and immediately delete the tokens and all Search Console data we pulled. You can also remove our access at any time at myaccount.google.com/permissions.

YouTube. The Social Media Manager uses YouTube API Services to show public data about YouTube channels. By using those features you agree to be bound by the YouTube Terms of Service, and Google’s use of data is covered by the Google Privacy Policy. We only access public channel and video data using an API key. We do not ask for access to your YouTube account. We delete YouTube data we have stored when you remove that channel from your dashboard, and we keep and refresh it in line with the YouTube API Services Developer Policies. You can also revoke any access through Google’s security settings page at myaccount.google.com/permissions.

6. How we use AI

Our agents are powered by large language models from Anthropic (Claude), Google (Gemini, including for generating images) and OpenAI (ChatGPT). When an agent works on a task, we send the relevant content (your instructions, and data from your connected tools or social accounts) to these providers so they can produce a response.

• We use their paid, commercial API services. Under those terms, they do not use our data to train their models, and they keep it only for a limited period for safety and abuse monitoring.
• We do not use your data to train AI models of our own.
• AI can make mistakes. Please check important outputs before relying on them.

AI visibility checks. To show whether AI assistants recommend your business, we ask ChatGPT (OpenAI), Gemini (Google) and Claude (Anthropic) questions a customer might ask about what you offer, with their web search switched on, and record their answers, the sources they cite and the businesses they name. The questions may be based on the searches that bring people to your site, and we send your website address and brand name with them so we can find mentions of you. We don’t send your Search Console figures to OpenAI or Gemini for these checks.

Automated decision-making. The Service analyses public post performance and generates suggestions, but we do not make any decisions based solely on automated processing that have a legal or similarly significant effect on you.

7. Data about people who are not our users

Some of our agents use information about people who have not signed up to Talk to Me Data. We handle it carefully:

• Public social media accounts. If a customer adds your public Instagram, TikTok, YouTube or Facebook Page account to their dashboard (for example as a competitor), we collect the public profile and post data described in section 3.3. We only collect what you have made public, we keep a limited number of recent posts, and we use it to show performance insights to that customer. We do not collect private messages, private accounts or follower lists.
• Public property records. The Property Leads agent uses public records published by US local government bodies (such as county assessor data, building permits, property sales, vacancy and code-violation records, and foreclosure auctions). These records can include property owners’ names.
• Contacts uploaded by customers. Property Leads customers may upload their own contact lists. The customer is the controller of that data and we process it on their behalf.

If you’d like to know whether we hold data about you, object to it being processed, or ask us to delete it, email nas@talktomedata.com. We will act on your request unless we have a compelling legal reason not to, in which case we’ll explain why.

8. Emails we send

• Service emails such as account confirmations, receipts, failed-post alerts, posting reminders and weekly digests. Reminders and digests can be switched off in your Social Media Manager settings. We cannot switch off essential account emails while you have an account.
• Marketing emails only if you agreed to receive them, or if you’re a customer and did not opt out. Every one has an unsubscribe link.

9. Who we share your data with

We do not sell your personal data. We share it only with the service providers who help us run the Service, under contracts that require them to protect it and use it only on our instructions:

We also send data to Meta (Instagram, Facebook) and TikTok when you tell us to publish a post. Those platforms handle it under their own privacy policies as independent controllers.

We may also disclose data:

• if required by law, a court order, or a regulator;
• to protect the rights, safety or property of our users, the public or us; or
• to a buyer or successor if our business is sold or merged, in which case this policy will continue to apply to your data.

10. International transfers

Some of our providers are based in, or access data from, countries outside the UK, mainly the United States. When we transfer personal data outside the UK, we make sure it is protected by at least one of:

• a UK government “adequacy” decision for the destination country, including the UK–US Data Bridge for US companies certified under it;
• the ICO’s International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses; or
• another safeguard permitted by UK data protection law.

You can ask us for a copy of the relevant safeguards by emailing nas@talktomedata.com.

11. How long we keep your data

Deleted data may remain in encrypted backups for up to 7 days until those backups are overwritten.

12. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify data that is wrong or incomplete;
• erase your data (“right to be forgotten”);
• restrict how we use your data;
• data portability: receive data you gave us in a machine-readable format, or have it sent to another provider;
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent at any time, where we rely on consent. This does not affect processing that already happened; and
• not be subject to decisions based solely on automated processing that significantly affect you.

To use any of these rights, email nas@talktomedata.com. We will respond within one month. If your request is complex we may extend this by up to two further months and will tell you why. We may need to confirm your identity first. There is normally no charge.

To delete your data, see our Data Deletion Instructions.

13. Security

We protect your data with encryption in transit (HTTPS) and at rest. Tokens for social platforms are separately encrypted with a key held only by our servers. Access to the database is restricted by row-level security, so each customer can only reach their own data, and sensitive tables can only be read by our servers. We limit staff access to what is necessary. No system is perfectly secure, but if a breach affects your personal data we will tell you and the ICO where the law requires.

15. Children

The Service is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

16. Changes to this policy

We may update this policy from time to time. We’ll change the “Last updated” date at the top and, if the changes are significant, tell you by email or in the app before they take effect.

17. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at nas@talktomedata.com. We will acknowledge your complaint within 30 days and tell you what we are doing about it.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: