Privacy policy

Last updated: 28 September 2026

Draft for legal review. This text has not been checked yet and is not legally binding. In case of doubt, the German version prevails.

This policy applies to the website talkward.app. In short: this site sets no cookies, embeds no third-party content and uses no analytics or advertising services. The chat in the bottom right corner runs via our own service chat.talkward.app and only stores something in your browser once you open it (section 5).

1. Controller

Pangolin UG (haftungsbeschränkt) i. G., Hansestr. 3, 59590 Geseke, Germany, represented by the managing director Tobias Stöber.
Email: hey@talkward.app

We have not appointed a data protection officer because we are not required to under Art. 37 GDPR and § 38 BDSG. Review once staff are hired

2. Visiting the website

When you visit talkward.app, our server necessarily processes your IP address, the requested address, date and time and information from your browser (user agent, language). This is required to deliver the page to your device. Based on your preferred browser language, we redirect the start address to the German or English version.

We do not keep access logs with this data. Server error messages may occasionally contain an IP address; they are deleted after 14 days at the latest.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest is providing the website securely and without errors.

3. Hosting

The website runs on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Nuremberg. Hetzner processes the data on our behalf under a data processing agreement according to Art. 28 GDPR. The data does not leave the European Union.

4. No cookies, no tracking, no external content

The site uses no cookies. We serve fonts and images ourselves; no content is loaded from Google, social networks or other third parties. We use no web analytics and no advertising networks. The only item in browser storage is the chat’s conversation identifier, which is created only when you open the chat (section 5). Consent under § 25 TDDDG is therefore not required.

The newsletter form (section 7) only sends data to our email service provider when you submit it. Before that, the page loads nothing from there.

5. Chat on this website

In the bottom right corner we offer a chat. It runs on Talkward itself, at chat.talkward.app, on the same Hetzner servers in Nuremberg as this website (section 3). It is not a third-party service.

When you open a page, your browser loads the script for the chat button and its styling from chat.talkward.app. Our server processes the technical data listed in section 2. Nothing else happens as long as you do not open the chat.

When you open the chat, it places a random conversation identifier in your browser’s local storage. It links your messages to one conversation, even when you change pages or come back later, and is strictly necessary for the chat (§ 25 (2) no. 2 TDDDG). You can delete it at any time by clearing the site data in your browser. We process your messages, the time, your browser language and any details you provide voluntarily, such as your name or an email address for a reply. While the chat is open it also reports every 20 seconds which page of talkward.app you are viewing, so that our team can put your question in context. We keep this only for the duration of your visit. Check: keep the screen view app switched off for this brand, or describe it here

AI replies. An AI assistant answers first in the chat; its replies are labelled as such. For this we transmit the conversation to a language model. Talkward can use three providers: Anthropic, PBC (USA), add address and legal basis of the transfer after legal review (data processing agreement, EU standard contractual clauses or Data Privacy Framework); Anthropic via Amazon Web Services EMEA SARL, Frankfurt region; or Mistral AI SAS, 15 rue des Halles, 75001 Paris, with processing in the European Union. For the chat on this website, enter the AI location of the “Talkward” brand: Anthropic (US), Claude EU (Frankfurt) or Mistral (Paris) is configured. According to its own commitment, Anthropic does not use the content for training; Mistral does not use it for training (setting in our account) and, according to its own statement, retains inputs and outputs for up to 30 days for abuse monitoring. For questions the assistant should not answer, a person from our team takes over.

Legal basis and retention. The legal basis is Art. 6 (1) (b) GDPR where a possible contract is concerned, otherwise Art. 6 (1) (f) GDPR with the legitimate interest of answering your questions quickly. We delete conversations once they are resolved and no retention obligation applies, at the latest after set a period, e.g. 12 months.

6. Contact by email

When you write to us, for example to request a demo or join the waitlist, we process your email address, your name and the information in your message to answer your request. The legal basis is Art. 6 (1) (b) GDPR where a possible contract is concerned, otherwise Art. 6 (1) (f) GDPR.

Emails to @talkward.app are forwarded by the email forwarding service of our domain registrar Namecheap, Inc., 4600 East Washington Street, Phoenix, AZ 85034, USA, to our customer service inbox in Talkward. We run Talkward ourselves on Hetzner servers in Germany (section 3). Namecheap processes the messages on our behalf under a data processing agreement according to Art. 28 GDPR. As Namecheap's servers are located in the USA, the data is transferred there. The basis for this is the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR), which form part of that agreement.

We delete requests once they have been dealt with and no retention obligation applies. Waitlist requests are kept until we have contacted you at launch or you object.

You can subscribe to our newsletter using the form on this website. In it we write about new features, launch dates, the trial phase and offers relating to Talkward. The only required information is your email address. The legal basis is your consent under Art. 6 (1) (a) GDPR and § 7 (2) no. 2 UWG.

Double opt-in and logging. After you submit the form, we send you an email with a confirmation link. Only when you click it do we add you to the mailing list. This ensures that nobody can enter someone else's address. We log the time of sign-up and confirmation, the IP address used, the language and the wording of the consent. This allows us to prove that you consented (Art. 7 (1) GDPR). The legal basis for this is Art. 6 (1) (f) GDPR. If you do not confirm the sign-up, we delete the data after 30 days.

Email service provider Brevo. For sign-up and sending we use Brevo, operated by Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. Brevo processes your data on our behalf under a data processing agreement according to Art. 28 GDPR on servers in the European Union.

Open and click analytics. Our newsletters contain an invisible tracking pixel that is loaded from Brevo's servers when you open the email, and links that are redirected via Brevo. This tells us whether and when you opened an issue and which links you clicked. For this, Brevo stores the time, IP address and details of your device and email program, linked to your email address. We use this analysis to see which topics are of interest and to improve the newsletter. The legal basis is your consent to the newsletter, which expressly covers this analysis (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). If you do not want the analysis, please unsubscribe; opting out of the analysis alone is not technically possible. The tracking pixel does not load if your email program does not display images automatically. We delete the analytics data when you unsubscribe.

Withdrawal. You can withdraw your consent at any time with effect for the future, using the unsubscribe link at the end of every email or by writing to hey@talkward.app. After you unsubscribe, we remove your address from the mailing list. So that we do not write to you again by mistake, it is kept on a suppression list (Art. 6 (1) (f) GDPR). We keep the records of consent until the three-year limitation period has expired.

8. Data in the Talkward product

This policy covers the website and the chat on it. When retailers use Talkward for their customer service, we process their customers’ messages as a processor under Art. 28 GDPR. The respective retailer is the controller; their privacy policy provides information about this data. The subprocessors are listed in the data processing agreement. So that retailers can write their own policy, here are the key points:

Storage. Conversations, customer records and attachments are stored with Hetzner Online GmbH in an ISO/IEC 27001:2022-certified data centre in Nuremberg, separated per retailer (section 3).

AI replies. The retailer chooses per workspace where the AI runs: at Anthropic, PBC in the US (default), at Anthropic via Amazon Web Services in Frankfurt (“Claude EU”), or at Mistral AI SAS, Paris, with processing in the European Union (“Europe”). For individual brands the retailer can switch on the “Europe only” option: conversation content, order information and customer records of that brand then go exclusively to Mistral, and there is no substitute provider outside Europe, not even during an outage. Mistral does not use the content for training (setting in our account) and, according to its own statement, retains it for up to 30 days for abuse monitoring. If Mistral is unavailable, the AI does not reply and the conversation goes to the retailer’s team.

Translation. Messages in other languages are translated by DeepL SE, Maarweg 165, 50825 Cologne, Germany (DeepL API Pro). According to its own statement, DeepL does not store the texts permanently and deletes them after translation. If DeepL is unavailable or does not support a language, the language model of the chosen AI location translates; for brands with “Europe only” always Mistral, never a provider outside Europe.

Push notifications. Retailer staff can be notified about new messages in the Talkward app. Delivery runs through the Expo Push Service (650 Industries, Inc., USA). By default the notification contains the message text and the customer’s name or email address; for brands with “Europe only” only the note “New message” with the brand and a conversation identifier.

Customer pictures. Talkward takes customers’ profile pictures from Instagram and Facebook through the retailer’s channel. Only if the retailer explicitly switches it on does Talkward also query Gravatar (Automattic Inc., USA) with a hash of the customer’s email address; this is off by default and never happens for brands with “Europe only”.

Calls and video calls. If the retailer books the “Calls” or “Video calls” extension, their customers can call from the chat window. Audio and video run encrypted between the browsers (WebRTC) and are relayed through our own relay server (TURN) at Hetzner in Nuremberg, so neither side sees the other’s IP address. The conversation keeps the type, outcome, duration and the name of the team member who answered. Unless recording is switched on, nothing of the call itself is stored, and video never.

Recording and transcript of calls. The retailer can switch recording on per brand; it is off by default. Recording only happens with the consent of everyone involved (Art. 6(1)(a) GDPR; without consent, recording the privately spoken word would be a criminal offence under Section 201 of the German Criminal Code): the customer is asked in the chat window, the team member agrees in their profile or in the individual call. Without the consent of the team member who answers, nothing is recorded. Only audio is recorded, including for video calls, in the team member’s browser. Both sides see the note “Recording” while it runs. The audio file is stored as an attachment to the conversation at Hetzner in Nuremberg (section 3) and deleted automatically after 30 days; the retailer can choose a period between 1 and 365 days. The transcript stays with the conversation as an internal note until the conversation is deleted. Transcription is done by Mistral AI SAS, Paris (Voxtral model, processing in the European Union via api.mistral.ai), for all brands, including those with “Europe only”. Mistral does not use the recordings for training and, according to its own statement, retains them for up to 30 days for abuse monitoring.

Proof and withdrawal of consent. For every consent we store the time, the version of the notice text, the language and the shortened IP address (IPv4 without the last byte, IPv6 shortened to /48). Consent can be withdrawn at any time with effect for the future via “Stop recording” in the chat window; the recording then ends immediately.

The retailer’s channels. WhatsApp, Instagram and Facebook run through the retailer’s Meta account, Amazon buyer messages through their seller account. These services are not affected by the “Europe only” option.

The retailer’s AI apps (Claude, ChatGPT, MCP). If the retailer connects an AI app such as Claude (Anthropic, PBC, USA) or ChatGPT (OpenAI, USA) through the Talkward MCP server, or uses the automation blocks “Assign Claude Code” or “Ask ChatGPT”, Talkward passes the requested conversation content and contact data to that app. This only happens when the retailer has set up and authorised the connection, through the retailer’s own account with the provider and only within the chosen rights (“Read only”, “Notes only” or “Read and write”). For this the provider is a service provider of the retailer, not a subprocessor of Talkward. The connection can be disconnected at any time; whatever an app writes is shown with its name in the conversation. For a connection Talkward stores the app’s name, the rights, times of use and the access keys only as hashes, but no additional copies of conversation content. The automation blocks do not run for brands with “Europe only”; access through the MCP server is controlled by the retailer.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6 (1) (f) GDPR (Art. 21). You can withdraw any consent you have given at any time (Art. 7 (3) GDPR). Please write to hey@talkward.app.

You may also lodge a complaint with a data protection supervisory authority, for example the authority responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2-4, 40213 Düsseldorf, Germany.

10. Changes

We update this policy when the website or the law changes. The version published here applies.