Privacy Policy

TengTalk ("TengTalk," "we," "us," or "our") operates the TengTalk web application at tengtalk.com (the "Service"). This Privacy Policy explains how we collect, use, disclose, retain, and protect your personal information, and describes your rights under applicable law.

TengTalk is designed to be ephemeral by default. Your audio recording is permanently deleted immediately after transcription. Your transcript and analysis exist only in your active browser session. We collect the minimum information necessary to operate the Service.

By using the Service, you consent to the collection, use, and disclosure of your personal information as described in this policy. You may withdraw consent at any time — see Section 7.

Under Alberta PIPA s. 5, TengTalk is responsible for all personal information in its custody or control and has designated a Privacy Officer to oversee compliance with this policy and applicable privacy law.

Privacy Officer contact:
TengTalk — Privacy Officer
Email: privacy@tengtalk.com
Website: tengtalk.com

You may contact the Privacy Officer to exercise any rights described in this policy, request access to your personal information, submit a correction, withdraw consent, or make a privacy complaint. We will respond within 45 calendar days of receiving your request (PIPA ss. 24–25).

If you are not satisfied with our response, you may contact the Office of the Information and Privacy Commissioner of Alberta (OIPC):

• Website: oipc.ab.ca
• Edmonton: 410 – 9925 109 Street NW, Edmonton, AB T5K 2J8 · 780-422-6860
• Calgary: Suite 2460, 801 6 Avenue SW, Calgary, AB T2P 3W2 · 403-297-2728
• Toll-free: 1-888-878-4044

Before contacting the OIPC, you must first raise your complaint directly with us and allow us at least 30 working days to respond.

We collect personal information only for specific, identified purposes (PIPA ss. 11–13). Below is a complete description of what we collect and why.

Information you provide directly

• Email address — collected at account registration. Used for magic-link authentication and to deliver your analysis summary by email after each session.
• Audio recordings — captured in your browser when you initiate a recording session. Audio is uploaded over an encrypted connection, used for transcription and vocal analysis, and permanently deleted from our storage immediately after transcription and any vocal analysis are complete. (See Section 3 regarding our vocal-analysis provider's own handling of audio it receives.)

Information collected automatically

• Session and usage data — browser type, IP address, and interaction events (e.g., recording start/stop). Used to operate and improve the Service. Retained for up to 90 days then deleted or anonymized.
• Authentication tokens — stored in your browser to maintain your logged-in session. Managed by Supabase Auth; tokens are single-use (magic links) or expire on logout.

What we do not collect

• Payment information (the Service is currently free).
• Transcripts or AI-generated analyses are never stored on our servers after your browser session ends.
• We analyze vocal characteristics (such as tone, pitch, cadence, and emotional expression) to enrich your debrief — see Section 3 — but we do not create voiceprints or use your audio to identify you biometrically.
• We do not knowingly collect personal information from individuals under 18.

Under PIPA ss. 12–13, we must identify the purposes for which personal information is collected before or at the time of collection. Our purposes are:

• Authentication — to verify your identity and provide access to the Service using your email address and a one-time magic link.
• Transcription — to convert your audio recording into text using OpenAI's Whisper speech-to-text service.
• AI analysis — to generate a structured debrief (action items, summary, follow-up draft) using Anthropic's Claude AI service.
• Vocal tone analysis — to assess vocal characteristics (tone, pitch, cadence, emotional expression, and which speaker expressed them) using our own audio-processing systems and a specialized third-party voice-analysis provider, Behavioral Signals, in order to enrich your debrief with delivery and sentiment insights.
• Email delivery — to send you a plain-text copy of your analysis to your registered email address immediately after each session, via Resend.
• Service improvement — to monitor reliability, fix errors, and improve performance, using anonymized usage data.
• Legal compliance — to comply with applicable laws and respond to lawful requests.

We will not use your personal information for any new purpose without first identifying the new purpose and obtaining your consent (PIPA s. 13(2)).

We do not use your personal information to train our own machine learning models. Our transcription provider (OpenAI) and analysis provider (Anthropic) are contractually prohibited from using your content to train their models.

Exception — vocal tone analysis: our voice-analysis provider, Behavioral Signals, may use audio submitted for vocal tone analysis to train and improve its own models, under its standard terms. We disclose this so that your consent is informed. By using the vocal tone analysis feature you consent to this use; if you do not consent, you may ask us to disable the feature for your account by emailing legal@tengtalk.com. We are working to secure contractual terms that remove this training use; this section will be updated if and when those terms are in place.

We collect, use, and disclose personal information only with your meaningful consent, obtained before or at the time of collection (PIPA ss. 7–8).

Express consent is obtained at account registration (you accept these terms and this policy) and at the start of each recording session (you initiate the recording by pressing Record).

Implied consent applies where you voluntarily provide personal information for a purpose that a reasonable person would understand from the context — for example, voluntarily entering your email address to receive your analysis by email.

Because audio recordings may contain sensitive personal information (conversations on personal, financial, health, or professional matters), we apply the higher standard of express consent for recording and processing.

Withdrawing consent (PIPA s. 9): You may withdraw consent at any time by contacting our Privacy Officer at privacy@tengtalk.com. We will immediately stop collecting, using, or disclosing your personal information for the relevant purpose. Note that withdrawing consent to the core processing (transcription and analysis) will make it impossible to deliver the Service. You may request account deletion at any time.

When you record a conversation, the recording captures the voices and statements of all participants — including other people who have not directly consented to TengTalk's collection of their personal information.

Your obligations as the recorder: Before recording any conversation using TengTalk, you must inform all other participants that the conversation is being recorded and processed by AI, and obtain their consent as required under applicable law. See Section 4 of our Terms of Service for the full consent representation you make to us when you use the recording feature.

Canadian recording law: Under s. 184 of the Criminal Code (RSC 1985, c C-46) and s. 183.1, a participant in a conversation may lawfully record it with the consent of any one party to the conversation (one-party consent). However, civil privacy law (PIPA) imposes additional obligations. We rely on your representation that all required consents and notifications have been obtained.

Processing steps for your audio:

1. Your browser captures audio via the MediaRecorder API and transmits it over TLS (HTTPS) to Supabase Storage.
2. The audio file is sent to OpenAI Whisper (US) for speech-to-text transcription.
3. The transcript is sent to Anthropic Claude (US) for AI analysis and generation of action items, summary, and draft follow-up.
4. If vocal tone analysis is enabled, the audio file is also sent to Behavioral Signals (United States) to assess vocal tone, emotion, and per-speaker delivery. See Section 3 regarding that provider's own model-training use of audio it receives.
5. Results are displayed in your browser session and emailed to your registered address via Resend.
6. The audio file is permanently and irrevocably deleted from our storage (Supabase) immediately after transcription and any vocal analysis are complete.
7. The transcript is discarded after the analysis is returned. It is never written to a persistent database.

Notice required by Alberta PIPA s. 13.1: TengTalk uses service providers located outside Canada to process personal information. These international transfers are also subject to PIPEDA as federal law governing cross-border data flows. The following providers process your personal information on our behalf:

• Supabase Inc. (San Francisco, CA, USA) — authentication and temporary encrypted audio storage. Privacy Policy
• OpenAI OpCo, LLC (San Francisco, CA, USA) — speech-to-text transcription via the Whisper API. Privacy Policy
• Anthropic PBC (San Francisco, CA, USA) — AI conversation analysis via the Claude API. Privacy Policy
• Resend Inc. (San Francisco, CA, USA) — transactional email delivery of your analysis summary. Privacy Policy
• Behavioral Signals Technologies, Inc. (Los Angeles, CA, USA) — vocal tone, emotion, and per-speaker analysis of your audio. Note: unlike our other providers, Behavioral Signals may use submitted audio to improve its own models under its terms (see Section 3). Privacy Policy
• Vercel Inc. (San Francisco, CA, USA) — web application hosting and deployment. Privacy Policy

We have entered into data processing agreements with these providers requiring them to protect your personal information to a standard comparable to what is required under Canadian law. With the exception of Behavioral Signals (see Section 3), our providers are contractually prohibited from using your content for their own model training or other purposes (consistent with PIPEDA Schedule 1, Principle 4.1.3).

Important notice about foreign law: Personal information transferred to the United States may be subject to access by US courts, law enforcement, or national security authorities under US law, including the CLOUD Act and Foreign Intelligence Surveillance Act (FISA). We cannot prevent such access by contract. If you have questions about our policies regarding foreign service providers, contact our Privacy Officer at privacy@tengtalk.com.

Under PIPA s. 35, we retain personal information only as long as reasonably required for the purposes for which it was collected. After that, it is securely destroyed or anonymized. Our retention periods are:

• Audio recordings: Permanently deleted from cloud storage immediately after transcription is complete. Typical retention period: under two minutes.
• Transcripts: Never written to persistent storage. Exist only in transit between OpenAI and Anthropic during active processing. Discarded after analysis is complete.
• AI analyses / results: Never stored on our servers after your session ends. Exist only in your active browser session and in the email we send you.
• Email address and account data: Retained while your account is active and for up to 30 days after account deletion, then permanently destroyed.
• Session and usage logs: Retained for up to 90 days for security and operational monitoring, then deleted or anonymized.

We do not sell your personal information to anyone. We do not disclose it to third parties except:

• Service providers — as described in Section 6, solely to deliver the Service, under data processing agreements.
• Legal requirements — if required by law, court order, or a lawful request from a Canadian or foreign public authority, or to protect the rights, safety, or property of TengTalk, our users, or the public. Where legally permitted, we will notify you of such a request.
• Business transfer — in connection with a merger, acquisition, or sale of substantially all of our assets, provided the successor is bound by privacy obligations no less protective than this policy.

Under PIPA s. 34, we implement safeguards appropriate to the sensitivity of the personal information. Given that audio recordings may contain sensitive conversational content, we treat all user data as sensitive. Our safeguards include:

• Encrypted data transmission (TLS/HTTPS) for all data in transit;
• AES-256 encryption at rest for any temporarily held audio files (Supabase);
• Passwordless authentication — no passwords are stored, reducing credential exposure risk;
• Minimal retention — audio is deleted immediately after transcription, eliminating the largest attack surface;
• Access controls limiting who within TengTalk can access personal information.

No transmission over the internet or electronic storage is 100% secure. If you believe your account or information has been compromised, contact us immediately at privacy@tengtalk.com.

Under PIPA s. 34.1, if a privacy breach occurs that poses a real risk of significant harm (RROSH) to individuals — including harm to reputation, financial loss, identity theft, or other significant impacts — we must notify the OIPC without unreasonable delay.

Significant harm under PIPA includes: bodily harm; humiliation; damage to reputation or relationships; loss of employment or business opportunities; financial loss; identity theft; damage to property.

If the OIPC determines individual notification is warranted (PIPA s. 37.1), we will notify affected individuals as required. We maintain an internal breach response procedure consistent with the OIPC's April 2024 guidance.

Under Alberta PIPA ss. 23–32, you have the following rights with respect to your personal information:

• Right of access (s. 24): Request a copy of the personal information we hold about you. We must respond within 45 calendar days of receiving your written request. We may charge a reasonable fee for access requests.
• Right of correction (s. 30): Request that we correct errors or omissions in your personal information. We will correct it as soon as reasonably possible at no charge.
• Right to withdraw consent (s. 9): Withdraw consent to collection, use, or disclosure at any time. We will immediately stop the relevant activity. Withdrawal from core processing will make the Service unavailable to you.
• Right to challenge compliance (s. 5): Challenge our privacy practices by contacting our Privacy Officer. Unresolved complaints may be escalated to the OIPC.

To exercise any of these rights, contact our Privacy Officer at privacy@tengtalk.com. We will verify your identity before processing your request.

TengTalk is subject to Canada's Anti-Spam Legislation (CASL), SC 2010, c 23.

Magic-link login emails are system messages that are not commercial electronic messages under CASL s. 1(2). They contain no promotional content and require no separate consent.

Post-session analysis emails (delivered after each recording) are transactional service messages delivered pursuant to your use of the Service. These are exempt from CASL's consent requirements under s. 6(6)(d)(i) and s. 6(6)(f) — they deliver a service you are entitled to receive as part of your account. These emails contain no promotional content.

Every email we send includes our name, contact address, and an unsubscribe mechanism valid for at least 60 days. Unsubscribe requests are processed within 10 business days (CASL s. 11). If you unsubscribe from analysis emails, you will still receive authentication emails necessary to access the Service.

TengTalk is an Alberta-based business subject to Alberta's Personal Information Protection Act (PIPA), SA 2003, c P-6.5. PIPA has been designated "substantially similar" to PIPEDA (SOR/2004-219), meaning PIPA applies instead of PIPEDA for purely provincial transactions.

Because TengTalk sends personal information to US-based service providers (OpenAI, Anthropic, Supabase, Vercel) as part of its core operations, those cross-border transfers are also governed by the federal Personal Information Protection and Electronic Documents Act (PIPEDA). We comply with both laws. Where they overlap, we apply the more protective standard.

Quebec's Act respecting the protection of personal information in the private sector (as amended by the law commonly known as Law 25) imposes heightened obligations on the processing of personal information of Quebec residents, including specific requirements where technology is used to analyze voice or other behavioural or biometric characteristics.

The Service — including its vocal tone analysis feature — is not offered to, and is not intended for use by, residents of the Province of Quebec. If you are a resident of Quebec, please do not use the Service. We do not knowingly collect or process the personal information of Quebec residents, and you should not record conversations with individuals located in Quebec using the Service without first obtaining independent legal advice on Law 25 compliance.

If you believe we have inadvertently processed personal information subject to Law 25, contact us at legal@tengtalk.com and we will address it promptly.

Although TengTalk is a Canadian company governed by Alberta PIPA, we provide the following information for California residents under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• We do not sell or share your personal information for cross-context behavioural advertising.
• We do not use sensitive personal information for purposes beyond those disclosed in this policy.
• California residents may submit requests to access, delete, or correct their personal information by contacting us at privacy@tengtalk.com.

Categories of personal information collected: Identifiers (email address, IP address, device identifiers); internet activity (usage events, session data); audio data (processed and deleted in under two minutes, never retained).

Canada has been recognized by the European Commission as providing an adequate level of data protection for commercial organizations subject to PIPEDA (Commission Decision 2002/2/EC). This adequacy decision covers TengTalk's operations as a Canadian company.

Legal basis for processing: We process personal data to perform our contract with you, to comply with legal obligations, and on the basis of our legitimate interests in operating and improving the Service.

International transfers to US processors: Where your personal data is transferred from Canada or the EEA to our US-based processors, we rely on Standard Contractual Clauses and equivalent contractual safeguards. See Section 6 for details.

EEA and UK residents may lodge a complaint with their local supervisory authority. For a list of EEA authorities, visit edpb.europa.eu.

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected information from a minor, contact our Privacy Officer at privacy@tengtalk.com and we will delete it promptly.

The Service uses cookies and similar technologies only as necessary to maintain your authenticated session. We do not use third-party advertising cookies, tracking pixels, or behavioral analytics. You may configure your browser to refuse cookies, but this will prevent you from logging in to the Service.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. For material changes, we will notify you by email at least 30 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy. If you do not agree, you may close your account before the changes take effect.

The effective date at the top of this page shows when it was last revised.

For all privacy-related inquiries, access requests, corrections, consent withdrawals, and complaints:

TengTalk — Privacy Officer
Email: privacy@tengtalk.com
Website: tengtalk.com

We will acknowledge your inquiry promptly and respond in full within 45 calendar days of receipt of your written request (PIPA s. 25).

If our response does not satisfy you, you may escalate to the OIPC — see Section 1 for contact details. You must first attempt resolution with us and allow 30 working days before contacting the OIPC.