Privacy Policy
Last updated November 2, 2026 · Operator ATP-LOGIC LTD · Contact hello@talktomyagent.io
This Privacy Policy explains, in plain language, what personal information ATP-LOGIC LTD collects through Talk To My Agent (TTMA), including the TTMA website and dashboard, voice agents, ChatGPT phone errands, and the TTMA apps on the Shopify App Store and Wix App Market; how we use and share it; how long we keep it; and the choices you have.
If anything here is unclear, email hello@talktomyagent.io and we will explain.
01 Privacy at a glance
- TTMA answers and places phone calls, and holds voice conversations on websites, for businesses. The business you are speaking with decides how its agent is used; we run the technology for it.
- Calls are recorded and transcribed by default, so the business can review them. By default the agent does not announce this. The business is responsible for telling callers where the law requires it.
- We never sell personal information, never use it for advertising, and never use it to train AI models.
- We work with a set of named service providers to run calls, AI, hosting, and email. They are listed in Section 9.
- Transcripts, caller phone numbers, and recordings are deleted automatically from our cloud systems 90 days after a call, unless the business has arranged a different period.
- You can ask us to access, correct, or delete your information at any time: hello@talktomyagent.io.
02 Who we are and our role
Talk To My Agent (TTMA) is operated by ATP-LOGIC LTD ("ATP-LOGIC", "we", "us"). In this Policy, a "Merchant" is a business that uses TTMA; a "caller" is anyone who speaks with a Merchant's voice agent, whether on a call the agent answers, a call it places, or on the Merchant's website; and a "visitor" is anyone who browses talktomyagent.io.
- For Merchants' account, billing, and dashboard data, and for visitors to our own website, ATP-LOGIC is the controller: we decide how that data is used, as this Policy explains.
- For callers, and for the store and booking data we access to answer them, the Merchant is the controller and ATP-LOGIC is a processor acting on the Merchant's instructions. If you are a caller, the Merchant's own privacy policy also applies, and the Merchant is the best first contact for your requests. We help Merchants respond.
We make a Data Processing Addendum (DPA) available to Merchants on request.
03 What we collect
From Merchants
Your name, email address, and sign-in details (including basic profile information if you sign in with Google). Your business details: for app installs, your shop or site identity; for Wix, the business name, email, phone, address, and time zone from your site settings. Billing details, handled by Stripe, or by Shopify or Wix for app subscriptions. The documents you provide to register a phone number with the carrier. And the content you give your agent, such as its greeting, instructions, knowledge, and uploaded documents.
From callers
The caller's phone number, the call audio, and a transcript of the call. After the call, our AI writes a short summary and, if the caller left a message, records their name, callback number, and request. Anything else a caller chooses to say becomes part of the transcript.
From a Merchant's store or other connected systems
Only what is needed to answer a caller, as described in Section 6.
From visitors to our website and dashboard
Usage information collected by Google Analytics (Section 14), and technical information such as browser type and IP address in our server logs.
Technical data
Agent configuration, usage records (call dates, durations, and billing), and technical logs that we use to run and fix the Service.
04 How we use it
We use personal information only to:
- answer and place calls for the Merchant, verify callers, and look up the information they ask for;
- write post-call summaries and email the Merchant any message a caller left;
- send a caller a text or WhatsApp message, where the Merchant has turned that on (Section 5);
- provide support, investigate problems, and improve the quality of the Service, including by having authorized staff review calls;
- bill for the Service, keep it secure, prevent fraud and abuse, and meet our legal obligations.
What we never do
We do not sell or rent personal information, use it for advertising, build profiles across services, or use it for any purpose unrelated to the Service. We do not use Merchant or caller data, including any data obtained through the Shopify or Wix APIs, to train, fine-tune, or improve any artificial-intelligence model, whether ours or anyone else's.
How AI is involved
Calls are handled by an AI voice model that listens and responds in real time. AI is also used after a call to summarize it and record any message, and to help Merchants set up their agent from their store content and documents. We use the paid services of our AI providers, whose terms prohibit them from training their models on this data; they may keep it for a limited time to detect abuse, as their terms allow. If a Merchant connects its own account with an AI provider, the Merchant's agreement with that provider governs how that provider handles the data.
The agent answers questions, takes messages, and, where enabled, makes bookings or submits orders that the caller has confirmed. It does not make decisions that have legal or similarly significant effects on people.
Legal bases
Where the GDPR or similar laws apply, we rely on: performance of a contract; consent; our legitimate interests in operating, securing, and improving the Service; and compliance with legal obligations. Where we act as a processor, we process data only on the Merchant's documented instructions.
05 Calls, recordings, and messages
Calls are recorded and transcribed by default, and the Merchant can listen to recordings and read transcripts in its dashboard. By default, the Service does not play the caller any spoken notice: it does not announce that the call is recorded and transcribed, or that the assistant is an AI. Section 5 of our Terms of Service explains exactly what the Service does and does not announce. The Merchant is responsible for any recording consent and AI-disclosure notice the law requires of it.
Merchants with a direct TTMA account can turn on a spoken pre-call notice, and turn recording off, in the voice portal. For the Shopify and Wix apps, we set either up on request.
Who can listen to a recording
A Merchant can play back its own calls from its signed-in dashboard. Each playback link is created on request for a single call and stops working five minutes after it is issued. Authorized ATP-LOGIC staff can access recordings and transcripts to provide support, fix problems, and improve the Service. We do not give recordings to anyone else, except to the providers in Section 9 or where the law requires it.
Messages to callers
Where a Merchant turns it on, the agent can send the caller a text or WhatsApp message, only to the number the caller is calling from, for example with a link or details the caller asked for. A text message is sent only after the caller agrees to it on the call, and we keep a record of each text message and of that agreement.
06 Connected stores and systems
To answer a caller, the Service accesses only what it needs, when it needs it.
- Shopify. We request three permissions: read orders, read products, and draft orders. Reading orders lets the agent look up the caller's own order (status, items, totals, fulfillment, and tracking), after verifying the caller with the email or phone number on the order; where enabled, it can also use the phone number and postcode on the order's shipping or billing address for that check. Reading products lets it search your catalog. The draft-order permission is used only to calculate a shipping quote from the postcode, country, and state the caller gives; no draft order is saved. The app never creates, changes, cancels, or refunds an order. We request only the protected customer-data fields we need and justify each one to Shopify.
- Wix. The app reads your site's business details (name, email, phone, address, and time zone), mainly to fill in phone-number registration. Where booking is enabled, the agent reads your services, staff, and availability and, once the caller confirms, creates the booking in Wix for a service that needs no online payment, sending Wix the caller's name, phone number, and email if they gave one. Wix may then send the caller its own confirmation and reminder messages, based on your Wix settings. The agent cannot cancel or reschedule bookings.
- Your own systems and other integrations. On direct and custom deployments, the agent can send information to systems the Merchant connects, such as a CRM (for example monday.com) or the Merchant's own order system. This can include the caller's name, phone number, and order details.
We do not keep a separate copy of order or booking data after a lookup. What the agent says on the call, such as an order's status, becomes part of the transcript and is deleted with it (Section 11). The Wix booking feature keeps a masked log of each booking (first name and the last four digits of the phone number), and on direct deployments that submit orders, the agent's server keeps a log of each order it submits.
07 Voice conversations on websites
A Merchant can add a Talk button to its own website. When a visitor uses it, the browser asks for permission to use the microphone, and the conversation is then handled like a phone call: the audio is processed by the voice AI, a transcript is kept, and the conversation is recorded if the Merchant's recording is on (the default). As with calls, no notice is played by default, and the Merchant is the controller of these conversations.
The Talk button sets no cookies and uses no browser storage. To prevent abuse, we keep the address of the website the conversation started from and a one-way hash of the visitor's IP address, not the address itself. The same applies to the Talk sessions Merchants hold with their own agent from the dashboard.
08 Where the voice agent runs
The TTMA voice gateway is the software that connects each call to the voice AI. Our hosted agents run it on servers we operate (Section 9), and some Merchants run it on a computer or server they control.
On every call, the gateway keeps a local text transcript of the call (with the phone numbers, date, and duration) and technical logs, and on direct deployments it may keep the other local records described in Section 6. These local copies are not yet covered by the automatic 90-day deletion described in Section 11. On a Merchant's own machine they are under the Merchant's control, and the Merchant is responsible for securing and deleting them; uninstalling the gateway removes them. On our servers, we delete them on request.
09 Who we share it with
We share personal information only with the service providers below, each bound by contract to protect it and to use it only to provide its service to us:
| Provider | What it does for us | Data involved | Location |
|---|---|---|---|
| Google Cloud and Firebase | Hosting, database, file storage, sign-in, and storage of credentials | Account data, call records, transcripts, recordings, agent configuration | USA |
| Google Gemini API | The real-time voice AI, speech transcription, post-call summaries, and web search for the agent | Call and website-conversation audio, transcripts, search queries | USA and other Google locations |
| Google Cloud Translation | Translating some booking requests made in languages other than English | The text of the request | USA and other Google locations |
| Google Analytics | Measuring how our website and dashboard are used (Section 14) | Usage and device data, cookie identifiers | USA and other Google locations |
| Amazon Web Services | Servers that run our hosted voice agents, email delivery, and backups | Call audio as it passes through, local transcripts and logs, emails (including callers' messages to Merchants), database backups | USA |
| Cloudflare | Secure network connections between the phone network, browsers, and the voice agents | Call and conversation audio and data while in transit | Global network |
| Telnyx | Phone numbers, calls, call recording, text messages, and WhatsApp messaging | Phone numbers, call audio and recordings, message content, phone-number registration documents | USA |
| Meta (WhatsApp) | Delivering WhatsApp messages, where the Merchant has turned them on | Phone numbers and message content | USA and other Meta locations |
| Stripe | Payments for customers billed directly by us | Name, email, and payment details (Stripe holds the card; we never see the full number) | USA |
| Anthropic | AI that helps set up a Merchant's agent from its store content and documents | Merchant business content (not call data) | USA |
| Brave, Tavily | Backup web search for the agent | Search queries | USA |
| OpenAI | Only if you connect TTMA to ChatGPT (Section 16) | As described in Section 16 | USA |
Platforms and services that a Merchant connects, such as Shopify, Wix, monday.com, or the Merchant's own systems, receive data as described in Section 6, under their own terms.
We update this list when we add or change a provider, and notify Merchants that have a DPA as the DPA provides. We also disclose personal information where the law requires it, to enforce our Terms, to protect the rights and safety of people or of the Service, and in connection with a merger or acquisition, in which case we will give notice.
10 Where data is processed
Our main systems are in the United States. Some providers in Section 9 also process data in other countries, a gateway run by a Merchant processes data wherever that machine is located, and ATP-LOGIC keeps an offline backup for disaster recovery. Where the law requires, we protect international transfers with appropriate safeguards, such as Standard Contractual Clauses.
11 How long we keep it
We keep personal information only as long as we need it for the purposes in Section 4:
| Data | How long |
|---|---|
| Merchant account data | While the account is active. |
| Closed accounts | Deleted after a short grace period (at least 7 days, or until the end of the last paid period), except records the law requires us to keep. |
| Shopify access tokens | Deleted when the app is uninstalled. We do not store Wix access tokens. |
| Call transcripts, caller phone numbers, call summaries, and callers' messages | Automatically redacted from our cloud systems 90 days after the call (a period between 30 and 365 days can be arranged instead), and earlier on a verified deletion request. The call's date, duration, and billing record are kept; nothing that identifies the caller is. |
| Call recordings | Deleted on the same schedule as the transcript, together with the phone carrier's copy. A deleted recording stays recoverable in our cloud storage for up to 7 days, as a safeguard against accidental deletion, and is then permanently erased. The carrier keeps its own record of the call (numbers, time, and duration) under its own terms. |
| Local transcripts and logs on the servers that run voice agents | Not yet covered by the 90-day schedule (see Section 8). We delete them on request. |
| Data of an uninstalled app or removed deployment | Its call records are deleted. Some recording files may remain in storage until deleted on request. |
| Order and booking data | Not stored separately after the lookup (see Section 6). |
| Text-message records | Kept as the record of each message and of the caller's agreement to receive it. |
| Backups | Kept only for disaster recovery (cloud database backups for up to 90 days). Data deleted from our live systems can remain in a backup until that backup expires or is replaced. |
| Technical logs | Kept for a limited period for troubleshooting and security. |
| Billing records | As long as tax and accounting law requires (typically up to 7 years). |
| Website analytics | Under our Google Analytics retention settings. |
12 Security
We protect personal information with safeguards suited to its sensitivity, including:
- encryption in transit (HTTPS/TLS), and encryption at rest in our cloud database and storage;
- encryption of Shopify access tokens with AES-256-GCM, and storage of other credentials in a dedicated secrets manager;
- access to production systems limited to authorized staff who need it, with administrative actions logged;
- separation of each Merchant's data by deployment, so that a Merchant's dashboard and API can reach only that Merchant's own calls;
- ongoing monitoring, security updates, and a process for responding to incidents.
No system is perfectly secure. If a security breach creates a real risk of significant harm, we will notify the people affected (and, where we act as a processor, the Merchant) and the competent authority without undue delay and, where feasible, within 72 hours, and we keep records of breaches as the law requires. Nothing in this Policy or our Terms waives a breach-notification duty that the law does not allow to be waived.
13 Your rights and choices
Depending on where you live, for example under the GDPR or UK GDPR, Canada's PIPEDA, Israel's Privacy Protection Law, or US state laws such as the CCPA, you may have the right to access, correct, or delete your personal information, to get a copy of it, to restrict or object to its use, and to withdraw consent. We do not sell personal information or share it for cross-context advertising, and we will not treat you differently for using your rights.
Merchants can use these rights in the dashboard or by emailing us. Callers should contact the Merchant first, because the Merchant controls that data; we help Merchants respond, and you can also contact us directly. You also have the right to complain to your local data-protection authority.
Shopify privacy requests. For the Shopify app, within 30 days:
- customers/data_request: we provide the store owner with that customer's call data;
- customers/redact: we delete the transcripts and recordings of calls to or from that customer's phone number, and overwrite the number in our call records. The call's date, duration, and billing record remain;
- shop/redact: after a Merchant uninstalls, we redact all of that shop's call data.
To make a request or ask a question, email hello@talktomyagent.io. We respond within the time the law requires (for example, 30 days under PIPEDA and one month under the GDPR).
14 Cookies and analytics
On talktomyagent.io and in the dashboard we use:
- essential browser storage that keeps you signed in to the dashboard;
- a preference cookie that remembers your language or country choice for one year;
- Google Analytics, which uses cookies to show us how people use the website and dashboard (for example pages visited, approximate location, and device type). We use it to understand and improve our site, not for advertising;
- on billing pages, Stripe's own cookies, which Stripe uses to prevent fraud.
You can block or delete cookies in your browser settings, and you can opt out of Google Analytics with Google's browser add-on (tools.google.com/dlpage/gaoptout). The Talk button that Merchants add to their websites sets no cookies.
The phone-errands landing and trial pages also send optional first-party usage counts, such as opening the page or choosing to try a call. These counts contain only a fixed event name, page category and campaign category. They do not include your email, phone number, account identifier, full URL, recording or transcript, and do not set a visitor cookie. Browser Do Not Track and Global Privacy Control signals disable these optional counts. Server-side signup, trial and hosted-setup milestones are counted separately for operating the service. Aggregate counts and hashed business-event deduplication records are scheduled for deletion after 400 days. Automatic deletion may take additional time. Infrastructure security logs follow their separate retention settings.
15 Children
The Service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 18 (or under the age of digital consent where they live), and we delete it promptly if we learn that we have.
16 TTMA Phone Errands in ChatGPT
When you connect TTMA to ChatGPT, we process your TTMA account identifier, selected calling agent, connection permissions and the phone errands you authorize. An errand includes the receiving number, recipient name, message or goal, and facts you supply. If you grant the email permission, we also share your verified account email with ChatGPT to identify the connection.
The selected TTMA agent places the call through our telephony and voice-AI providers. ChatGPT can request the linked caller number, locale, call status, duration and available transcript through that connection. Your agent's existing recording and report-destination settings continue to apply. The connection does not give ChatGPT your TTMA password, telephony credentials, or unrestricted access to your other agents or business records.
The shared TTMA demo, when available, uses a TTMA-operated number and calls only the receiving number you confirm while connecting. Use sample information in the demo. TTMA operates that agent and may access its recordings and transcripts as described in Section 5. Other demo users cannot read your errand results through their connections. We retain hashed user and receiving-number allowance counters until ninety days after the demo campaign expires to prevent repeated sign-ups or connections from resetting the allowance.
Phone-errand request copies are accessible for thirty days, after which they are scheduled for deletion. Short-lived authorization records and connection security records have separate expiry periods, up to ninety days after their last renewal. Underlying TTMA call reports and recordings follow Section 11 and the selected agent's retention settings. Disconnecting revokes further access through that connection; it does not delete your TTMA history or copies already received by ChatGPT or your configured report recipients. Information shared with ChatGPT is also subject to OpenAI's policies and your ChatGPT account settings.
17 Changes to this Policy
We may update this Policy as the Service changes. We will post the new version here with a new "Last updated" date and, for material changes, tell Merchants by email or in the Service before the change takes effect.
18 Contact us
ATP-LOGIC LTD, 135 Almore Avenue, North York, Ontario M3H 2H9, Canada. For privacy and data-protection questions or requests: hello@talktomyagent.io.
ATP-LOGIC LTD, 135 Almore Avenue, North York, Ontario M3H 2H9, Canada. Questions: hello@talktomyagent.io.