Privacy

Who is responsible

The controller under Art. 4 (7) GDPR is Speakwise GmbH, Kollage 3, 49170 Hagen a.T.W., Germany. You can reach us at hallo@speakwise.agency or +49 5401 1523001. Full company details are on the imprint page. We are not required to appoint a data protection officer; questions go to the managing director at the addresses above.

The short version

This site runs no analytics, no advertising pixels and no tracking cookies. There is nothing to consent to, which is why there is no cookie banner. If you join the waitlist we store your email address so we can send you an invite. If you leave a comment we store your name and what you wrote. Everything is hosted in the EU, and you can have any of it deleted by asking.

When you join the waitlist

Submitting the form stores the following in our database: the email address you typed, which page you submitted it from, the referring URL and any utm parameters on it, the time, your browser's user agent string, and a shortened form of your IP address.

The IP address is deliberately truncated before it is written down. For IPv4 we keep only the network part (203.0.113.42 becomes 203.0.113.0/24) and for IPv6 only the first 48 bits. That is enough to stop one person submitting the form a thousand times and not enough to identify you.

Legal basis: your consent under Art. 6 (1)(a) GDPR, given by submitting the form, together with our legitimate interest under Art. 6 (1)(f) GDPR in keeping the form from being abused. You can withdraw consent at any time with effect for the future, and withdrawing it does not make the earlier processing unlawful.

What we do with it: send you an invite when one is available, and occasionally write to you about what we have built. Nothing else. We do not sell the list, we do not share it with advertisers, and we do not use it to build a profile of you. Every email we send has an unsubscribe link.

How long we keep it: until you ask us to delete it, or until the waitlist has served its purpose and is closed. One email, one row, deleted on request.

When you just read the site

Our hosting provider writes a server log for every request, containing the IP address, the time, the page requested, the HTTP status, the referring URL and the browser and operating system reported by your device. This is how a web server works and how we notice when something is broken or under attack. Legal basis is our legitimate interest in a site that stays up and is not being abused, Art. 6 (1)(f) GDPR. These logs are short-lived and we do not combine them with anything else.

Cookies and local storage

We set one cookie, and only for people who sign in to the private product. It holds a session token, nothing about you, and it exists so the app knows you already typed the password. It is strictly necessary under § 25 (2) TDDDG and therefore needs no consent.

If you switch the site between light and dark mode we store that choice in your browser's local storage under the key tallo-theme. It never leaves your device and is only written when you press the button. Clearing your browser data removes it.

When you leave a comment

Under a blog post you can leave a comment. We store the name you type, the comment itself, the time, your browser's user agent and the same truncated IP prefix described above. An email address is optional; if you give one it is never published and never shown to other readers, and we use it only to reply to you.

Your name and your comment are published on a public page once we have read it. Nothing appears automatically. Legal basis is your consent under Art. 6 (1)(a) GDPR, given by submitting the form, plus our legitimate interest under Art. 6 (1)(f) GDPR in keeping the comment box from being used for spam. Ask us and we will delete your comment.

Who else touches the data

We keep this list as short as we can, and everyone on it processes data only on our instructions under a contract meeting Art. 28 GDPR.

• Vercel Inc. hosts the site and runs the code that receives your form submission. The functions that handle your data are pinned to Vercel's Frankfurt region.
• Supabase Inc. provides the database your waitlist row or comment is written to. The project is hosted in the EU.

Both are US companies, so a support case or an administrative access can still involve access from outside the European Economic Area even though the data itself sits in the EU. Any such transfer is covered by the European Commission's Standard Contractual Clauses under Art. 46 GDPR. We do not pass your data to anyone else, and we do not use it to train any model.

The product itself

Tallo is in private testing and reachable only behind a password. It generates images and video through third-party model providers, and the people testing it are told separately and in detail what that involves before they use it. Reading this website or joining the waitlist does not put any of your data through those systems.

How the data is protected

Everything is served over HTTPS. The database is reachable only with a server-side key that is never sent to your browser. The waitlist endpoint is rate limited per network. No part of the site sends your email address to a third party. We cannot promise that a connected system is impossible to break into, and if something does go wrong we will tell the people affected and the supervisory authority where the law requires it.

Your rights

Under Art. 15 to 22 GDPR you can ask us what we hold about you, have it corrected, have it deleted, have its processing restricted, object to processing based on legitimate interest, withdraw a consent you have given, and receive your data in a portable format. An email to hallo@speakwise.agency is enough. We do not require a particular form of words and we do not charge for it.

You can also complain to a supervisory authority. The one responsible for us is Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany. You may instead complain to the authority where you live or work.

We make no automated decisions about you that produce legal effects, and we do not profile you.

Changes

If we start doing something new with data, this page changes first and the date at the top changes with it. If the change is significant and we have your email address, we will tell you.