Privacy policy

NOVODEV, a SASU whose registered office is at 35 rue de Marseille, 69007 Lyon, France, is the data controller. For any question, or to exercise your rights: contact@talkxp.com.

To create and keep your account: surname, first name, email address, language, country, encrypted password, and a photograph if you upload one. If you sign in with Google, Microsoft or Apple, we receive your name and email address from those services, nothing more.

To book and hold a session: the description of what you need, the date, the duration, the expert chosen, the messages exchanged and the files shared.

To take payment: the amount, the currency and the transaction reference. Your card number never passes through our servers and is never stored there: it is entered directly with our payment provider.

For experts: in addition, the tax information required by regulation - tax identification number, country, date of birth or registration number - and the bank details held by the payment provider.

Technically: date and time of connection, IP address, device type, operating system and app version. These logs are used to alert you to an unusual access and to investigate an incident.

• To provide the service - account, booking, call, messaging, payment: performance of the contract between us.
• To invoice and to report - invoices, VAT, annual reporting of experts’ income: legal obligations.
• To keep things secure - connection logs, alert when signing in from a new country, anti-circumvention filter: legitimate interest in protecting the service and its users.
• To let you know - session reminders, messages received, notifications: performance of the contract. Browser and phone notifications are only switched on with your agreement.

• Your account and your exchanges: for as long as you are registered.
• Connection logs: twelve months, then automatic deletion.
• Visits through an expert’s link: thirteen months. They serve to establish the commission owed by the expert and to account to them for their outreach. Beyond that, only aggregate figures remain, which designate nobody.
• Invoices and accounting entries: ten years, as the law requires.
• Experts’ tax information: for as long as needed for reports already filed to remain supportable.

When you delete your account, the effect is immediate: the account becomes unusable and your personal data is anonymised. Your messages lose their content, your reviews their comment, and the files you shared are removed from hosting - your profile photo included.

Accounting and tax entries remain, but with no identity attached to them: amounts remain, a person no longer does. Message rows also remain, emptied of their content, because the other party may need them to have a dispute decided.

Your data is neither sold, nor rented, nor passed to advertisers. It is entrusted to the providers below, each for a precise function and for no other use.

• Stripe (Ireland, United States): payments, identity verification of experts, transfers.
• FedaPay (Benin): payments in West Africa, where that method is offered.
• Nuxit (France): hosting of the database.
• Netlify and Railway (United States): hosting of the site and of the application services.
• Cloudinary (United States): profile photographs and files shared during a session.
• Mailchimp Transactional (United States): sending emails.
• Google Firebase (United States): phone notifications.
• Metered (United States): technical relay for the call when the direct connection fails. The relay carries the stream, it does not keep it.
• DeepL (Germany): translation, when you ask for a message or a review to be translated. Only the text concerned is sent.
• Groq and Google (United States): understanding your searches. What you type into the search bar is sent to these services to be matched to a field of expertise.
• Sentry (United States): reporting technical errors, so they can be fixed.
• Twilio (United States): sending SMS, where that method is used.

Transfers to the United States rest on the European Commission’s standard contractual clauses and, where the provider has signed up to it, on the EU - US Data Privacy Framework.

Your data may also be passed to an administrative or judicial authority where the law requires it, in particular to the tax authorities for the annual reporting of experts’ income.

Nothing is recorded. The sound and the picture travel directly between the two participants, and are not kept.

By default, a watermark bearing the names of both participants is displayed during the call. It is not there to monitor: it discourages sharing a screenshot and makes it possible, if an image circulates, to know where it came from. The expert may turn it off for a given call; the picture then carries no name.

An attempt to capture the screen or to record is reported to the other party when the system detects it. That protection is not absolute, and we would rather say so: on Android capture is blocked, on iPhone it is only detected, and nothing prevents someone from filming their screen with another device.

Messages are kept in their original version, before contact details are masked, so that a dispute can be settled on what was actually written.

You may at any time ask for access to your data, its correction, its erasure, the restriction of its processing, or object to processing based on our legitimate interest. You may also ask to receive your data in a reusable format.

Most of these rights are exercised directly from your account area: correcting your profile, withdrawing a notification permission, deleting your account. For the rest, write to contact@talkxp.com. We answer within one month.

If our answer does not satisfy you, you may refer the matter to the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, 75007 Paris, France, or to the data protection authority of your country of residence.

TalkXp sets no advertising tracker and to this day uses no analytics tool. We would rather say so plainly than display an impressive list.

The cookies that make the service work keep you signed in and remember your language. They cannot be declined, because without them you cannot stay signed in.

One more is set only if you arrive through an expert’s personal link. It holds a random identifier - not your name, not your address, not your IP address - used to know that your visit came from that expert, and to determine the share TalkXp takes out of their pay if you book with them. It lives for ninety days, and you may erase it at any time by clearing the site’s data: that deprives you of nothing, since the price you pay is the same either way.

What we then record is limited to the date of the visit, the expert concerned, the network the link came from where stated, the device type and the country. Neither the IP address nor any advertising identifier is kept.

If analytics were introduced, they would be offered to you through the consent banner, and declining would remain as easy as accepting.

The detail cookie by cookie - name, lifetime, purpose - is in the cookie policy.

Exchanges are encrypted in transit. Passwords are stored as a fingerprint, never in the clear, and cannot be recovered - by us included. Address confirmation tokens are likewise kept as a fingerprint.

Access to data is restricted to the people who need it, and connections from an unusual country trigger an alert.

Should a data breach likely to create a risk to your rights occur, the supervisory authority would be notified within 72 hours, and you would be informed.

This policy may change, in particular if a new provider is added. Every new version is published here with its date. The rules of use are set out in the terms of use.