Privacy Policy

1. Controller

The controller is the operator named in the legal notice. For all data protection questions: kontakt@tellsom.com.

2. The key points

• Anonymous to others: Other users do not see who you are unless you reveal your identity yourself. In every chat you appear under a separate pseudonym. So that a chat reaches the right people, our system links it internally to the accounts involved — we show none of this to others.
• Encrypted, but not end-to-end: We store messages encrypted (AES-256-GCM, a separate key per chat). Our server can decrypt them and reads every message when it is sent, because otherwise the filter against hate and insults could not work. No human reads your chats in normal operation — not even when someone reports a message: our moderation decides based on the reason for the report and the filter’s results and sees no message text. The exception is an order from an authority or a court.
• No advertising, no tracking: We do not sell data, show no advertising and use no analytics or tracking tools.
• Anonymous does not mean untraceable: We store data pseudonymously. In the case of serious crimes we can link a pseudonym to an account on the order of an authority or court.

3. Which data we process

• Account: email address — for sign-in only as a cryptographic hash, additionally encrypted for notifications and replies to support requests —, password only as a hash, display name, @name, profile picture (one of the motifs or an uploaded photo), language and settings, as well as the time of your age confirmation and the accepted version of the terms of use.
• Sign in with Apple or Google: the identifier the provider issues for tellsom and, where applicable, your email address. For Apple we also keep an encrypted token so that we can revoke the link with Apple when you delete your account.
• Sessions and security: signed-in devices (app or browser family), times and IP addresses — the latter only as a hash — to protect your account, limit requests and prevent abuse.
• Chats: messages (encrypted), pseudonyms, times, read status, reveal requests, blocks and reports.
• Events, Ask-me links and products: what you create — questions, titles, descriptions, images, durations and, if you provide it, the location of an event.
• Answers without an account: Guests receive a random guest token that stays on their device; we only store its hash so that the guest can find their way back into the conversation and blocks take effect. Before sending, Cloudflare Turnstile checks that a human is answering.
• Ratings (tellsom Business): stars and texts that customers submit via a product code. They are deliberately readable by the business and by us because they feed its analyses; the encryption of 1:1 chats does not apply to them.
• Businesses: name, products, verification (the verified domain or social media profile), team members and invitations.
• Push notifications: the device identifier for Apple’s push service. A notification only says that something new has arrived — without content and without a pseudonym.
• Payments: For purchases in the App Store, Apple gives us the identifier, product, price, currency and country of the purchase, but no payment data. For purchases in the browser, Stripe gives us the subscription identifier, amount and status; we never see card or account details.
• Earn: through which link a business arrived, commissions and your payout details (IBAN or PayPal address), the latter encrypted. Only the operator can read them, in order to pay out.
• AI analyst: your conversation with the AI analyst — questions and answers, encrypted, per person and business —, plus how many questions a business has asked and what they cost (section 5).
• Support: what you write to us via the help form; it reaches us as an email with your address as the reply-to address.
• Waiting list (tellsom.com): your email address and language, so that we can write to you at launch.
• Moderation: reports, hits of the automatic filter, warnings, suspensions and our decisions — as evidence and for the obligations under the Digital Services Act (DSA).
• Notices via the “Report abuse” form and from the app: the reported address, category and explanation — in the app, instead of an explanation, what is being reported (text, image or name) —, a snapshot of the reported public text, internally the account or business the content belongs to, and — only in the form, optionally — your name and email address. We store the address only in encrypted form and use it solely for the acknowledgement of receipt and our decision; afterwards we delete it.
• Server logs: technical entries without message content and without IP addresses in plain text, for troubleshooting and security.

4. On your device

The app stores your sign-in and guest tokens in the iPhone keychain, plus settings such as language, recent searches and your consent to the AI analyst. In the browser we only set a technically necessary session cookie and, once you choose a language on the sign-in page, a cookie that remembers that language (one year); small settings are stored locally. There are no cookies for advertising or analytics.

5. AI analyst (tellsom Business)

When a business asks the AI analyst a question, we send the question, the conversation so far and the business’s data — products, ratings with stars and texts, and the chats with customers about these products — to Anthropic, the provider of the AI model Claude, in the USA. Customers appear without names and without pseudonyms, only as “customer”. Personal 1:1 chats and Direct Messages are excluded. Before the first question, the app asks for permission. We store your conversation encrypted on our side so that it is still there after you sign out and on every device; team members cannot see it. Anthropic receives it only together with each question.

6. Legal bases

• Contract (Art. 6(1)(b) GDPR): account, chats, events, links, Business, subscriptions, Earn and support.
• Legitimate interest (Art. 6(1)(f) GDPR): security, limiting requests, preventing abuse, the automatic filter and moderation — to protect against bullying and hate.
• Consent (Art. 6(1)(a) GDPR): push notifications, notification emails, the waiting list and the transfer to Anthropic for the AI analyst. You can withdraw your consent at any time with effect for the future — in the app (push in the settings, the AI analyst in its chat menu) or by email.
• Legal obligation (Art. 6(1)(c) GDPR): retention of accounting-relevant data, information to authorities and obligations under the DSA.

7. Recipients

• Cloudflare — hosting, database, file storage, bot protection (Turnstile), the AI model of the automatic filter (Workers AI) and sending emails (sign-in codes, notifications, support). The database currently runs in the EU but is not contractually bound to the EU. Turnstile is additionally covered by Cloudflare’s Turnstile Privacy Addendum.
• Resend — only as a fallback for sending emails when Cloudflare cannot deliver one.
• Anthropic — only for the AI analyst (section 5).
• Apple — push notifications, “Sign in with Apple” and App Store purchases.
• Google — only for “Sign in with Google”, to verify the sign-in.
• Stripe — payments in the browser. Stripe acts as the merchant of record and processes payment data under its own responsibility.
• Authorities — only where a law or an order obliges us to.

We have agreements under Art. 28 GDPR with our processors.

8. Transfers to third countries

Cloudflare, Resend, Anthropic, Apple, Google and Stripe also process data in the USA. Where a recipient is certified under the EU-US Data Privacy Framework, we base the transfer on the European Commission’s adequacy decision; otherwise on standard contractual clauses (Art. 46(2)(c) GDPR).

9. How long we keep data

• Account: until you delete it. After the deletion request it is deactivated immediately and permanently removed, including images, after 30 days.
• Chats from events and Ask-me links: deleted together with their messages 90 days after the event or link ends. Chats you delete disappear from your inbox immediately.
• Ratings and customer chats about products (tellsom Business): as long as the product exists. When a business deletes a product, its ratings, customer chats and product photo are permanently removed 90 days later; the product code stays reserved so that a printed QR code never points to someone else’s product.
• Conversation with the AI analyst: until you delete your account, the business is deleted or you leave the team; each conversation keeps at most its last 200 messages.
• Sessions: expired ones 30 days, revoked ones 90 days after they end.
• IP hashes: we create a new random salt for every day and delete it 30 days after that day ends. Until then we can match an IP hash of that day against a known IP address (for example to fight abuse); after that nobody, including us, can link it to an IP address. Hashes of different days cannot be linked to each other.
• Reports and moderation decisions: as long as they are needed as evidence; for this purpose the pseudonyms of reported chats are kept even after a chat is deleted.
• Accounting-relevant data such as commissions and payouts: as long as tax law requires (seven years in Austria).
• Waiting list: until launch or until you ask us to delete it.
• Server logs: automatically deleted after a few days.
• Backups: deleted data can remain for up to 35 days in encrypted backups that serve only to restore the service after an outage; after that it is gone there too.

10. Automated decisions

The filter decides automatically whether a message is delivered, and suspensions after repeated violations are imposed automatically (terms of use, section 6). You can at any time ask for a human to review the decision, state your point of view and contest the decision — by email to kontakt@tellsom.com.

11. Your rights

You have the right of access, rectification, erasure (“Delete account” in the settings), restriction of processing, data portability (“Export data” in the settings) and to object to processing based on legitimate interest. You can withdraw consent at any time with effect for the future. Write to us at kontakt@tellsom.com.

You can lodge a complaint with a data protection authority — in Austria with the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at.

12. Minimum age

tellsom is for people aged 18 and over. We do not knowingly process data of minors; if we learn of it, we delete the account.

At sign-up in the iOS app — where Apple reports that age rules apply — we ask Apple’s Declared Age Range interface for an age range, never a date of birth. The range is evaluated only on your device; it is neither stored nor sent to tellsom. If it is under 18, sign-up ends; an account created a moment earlier in that sign-up is deleted again. Otherwise, as everywhere, your confirmation that you are at least 18 applies.

13. Changes

If the way we process data changes, we update this policy and inform you about material changes.