Privacy Policy

Last updated: September 25, 2026

This policy explains what personal data Talkra collects when you use the website, the web app, call links and permanent rooms, or contact us; why we need it; how long we keep it; and what you can do about it. Talkra is built to collect as little as possible: calls run directly between browsers and are never recorded.

Who we are

Talkra is operated by Denis Alimov, Bulgaria, 9000, Varna, Han Krum 8, office №2 ("Talkra", "we").

For any privacy question, write to contact@talkra.eu.

Our role

We are the data controller for your account, sign-in and security data, service emails and support conversations. We decide why and how that data is processed.

If you use Talkra's paid features to manage your own clients, you decide which client records and call schedules to store. For that data you are the controller, and we process it only on your instructions to provide the service to you. If you are a client of a Talkra user, see the Data Rights page.

Data we process

For each category below we list what we collect, why, the legal basis under Article 6 of the GDPR, and how long we keep it.

Account

What
Email address, password hash (none if you only sign in with Google), language, time zone, plan, verification status, and the dates your account was created and last used.
Why
To create and run your account and to sign you in.
Legal basis
Performance of our contract with you (Art. 6(1)(b)).
Retention
Until you delete your account. Deletion takes effect 14 days after you request it, and you can cancel it during that time.

Sign in with Google

What
If you choose it: your Google account identifier and the email address Google shares with us. We do not receive your Google password, contacts or photos.
Why
To link your Google account and sign you in.
Legal basis
Performance of our contract with you (Art. 6(1)(b)).
Retention
Until you delete your account.

Scheduling (paid features)

What
Calls you create (start and end time, call link), call types (name and color), client records (the name or alias you choose and the client's time zone), and your private calendar feed link.
Why
To schedule calls, generate call links, fill your calendar feed and build monthly reports.
Legal basis
Performance of our contract with you (Art. 6(1)(b)). For client records, see Our role above.
Retention
Until you delete the item or your account.

Sessions and security

What
For each signed-in session: IP address, browser user agent and dates. You can end them all at once in Settings. Failed sign-in counters per email and IP address. Security event logs with a hashed email address and the IP address. The IP address recorded with an account deletion request.
Why
To keep accounts safe, detect stolen sessions, slow down password guessing and investigate abuse.
Legal basis
Our legitimate interest in securing the service (Art. 6(1)(f)) and our duty to keep personal data secure (Art. 6(1)(c) with Art. 32 GDPR).
Retention
Session records are deleted 30 days after they expire. Security event logs are kept for up to 90 days. The deletion request record is erased together with the account.

Verification codes and reset links

What
One-time codes for registration and email changes, and password reset links.
Why
To confirm that you control the email address.
Legal basis
Performance of our contract with you (Art. 6(1)(b)).
Retention
Codes expire after 10 minutes and reset links after 1 hour. Expired records are deleted after 30 days.

Service emails

What
Emails we send you: verification codes, password reset links, email change confirmations and account deletion notices. We do not send newsletters or marketing emails.
Why
To operate your account. These emails cannot be switched off while your account exists.
Legal basis
Performance of our contract with you (Art. 6(1)(b)).
Retention
We do not keep copies of sent emails. Our email provider keeps delivery logs for a limited time under its own retention policy.

Call guests

What
Guests join from a link without an account. While the call is being set up and running, our signaling server holds a temporary connection identifier in memory.
Why
To connect the call the guest chose to join.
Legal basis
Our legitimate interest in delivering the call (Art. 6(1)(f)).
Retention
The connection identifier disappears when the call ends. We do not build profiles of guests.

Technical logs

What
Standard request data recorded by our web servers, such as IP address, requested address, time and browser type. When the camera or microphone cannot start on a call page, the page also reports the error type and the permission state, never a picture or sound.
Why
To operate, troubleshoot and protect the service.
Legal basis
Our legitimate interest in running a reliable and secure service (Art. 6(1)(f)).
Retention
90 days.

Support and privacy requests

What
Messages you send to our support or privacy address and our replies.
Why
To answer you and keep a record of what was agreed.
Legal basis
Performance of our contract where it concerns your account (Art. 6(1)(b)), our legal obligation for data rights requests (Art. 6(1)(c)), otherwise our legitimate interest in responding (Art. 6(1)(f)).
Retention
2 years.

Calls and media

  • Each call connects two participants. Audio and video travel directly between the two browsers (peer to peer) and are encrypted with DTLS-SRTP using keys created by the browsers.
  • If a network blocks a direct connection, the encrypted media is relayed through our own TURN server. The relay forwards the data but cannot decrypt it.
  • Talkra does not record calls. Optional text chat is not saved. We do not store audio, video, chat messages, or anything shown on screen.
  • To set up a direct connection, the two browsers exchange network addresses, so the other participant's browser can see your IP address.

We process media only to deliver the call, on the basis of our contract with the account holder (Art. 6(1)(b)).

How calls and accounts are protected

What we do not do

  • We do not use analytics or advertising trackers.
  • We do not sell or rent personal data.
  • We do not profile you or make automated decisions that have legal effects on you.
  • We do not use call content for any purpose.

Who receives data

We share personal data only with providers that help us run Talkra, under data processing agreements, or where the law requires it.

  • DigitalOcean hosts our servers and database in Europe, France.
  • Brevo (Sendinblue SAS, France) delivers our service emails.
  • Google handles Sign in with Google if you choose it, and runs the public STUN server that browsers contact when a call starts to discover their public network address. The STUN server sees your IP address but no call content.
  • Authorities and courts, when we are legally required to disclose data or need to protect our rights or the safety of users.
  • A company that takes over Talkra in a merger or sale. We will tell you in advance so you can delete your account before the transfer.

International transfers

Our servers are in Europe, France. Google may process sign-in and STUN data outside the European Economic Area. Such transfers rely on the EU-US Data Privacy Framework or on Standard Contractual Clauses approved by the European Commission.

Your rights

  • Access the personal data we hold about you and get a copy.
  • Have inaccurate data corrected.
  • Have your data deleted.
  • Restrict processing or object to processing based on our legitimate interests.
  • Receive your data in a portable, machine-readable format.

Much of this you can do yourself in Settings: export your data, change your email, sign out on all devices and delete your account.

How to exercise your rights

Age limit

Talkra accounts are for people aged 18 and over. If we learn that an account belongs to someone younger, we will delete it. Parents or guardians with concerns can write to contact@talkra.eu.

Changes to this policy

We update this policy when our processing changes; the date at the top shows the current version. If a change is material, we will email account holders before it takes effect.

Complaints

You can complain to the data protection authority in the country where you live or work. Our lead supervisory authority is Commission for Personal Data Protection (kzld@cpdp.bg). We would appreciate the chance to resolve your concern first at contact@talkra.eu.