Privacy Policy

talktobuild.tech is a globally available SaaS that helps people describe an app idea, discuss it with Lumi by text or live voice, generate blueprints and planning documents, schedule calls, use a collaborative whiteboard, and prepare a handoff kit for builders.

We are the controller of personal data we collect through the service. You are responsible for making sure you have the right to submit any personal data, confidential information, or third-party content you include in your projects, chats, calls, documents, or whiteboards.

• Account information, including name, email address, login provider details, authentication identifiers, and profile data stored through Supabase Auth and Postgres.
• Project and idea content, including project names, one-line summaries, structured idea fields, brief answers, generated blueprints, generated documents, prompt packs, handoff files, and selected tool preferences.
• Chat messages and voice-call transcripts, including messages you send to Lumi and Lumi's responses, stored in Supabase Postgres so your project can continue across sessions.
• Voice audio while you are in a live call. Audio is routed through LiveKit and processed by Deepgram for speech-to-text and text-to-speech. We store transcripts, not ordinary raw call audio, in our application database.
• Collaborative whiteboard content, including Excalidraw document JSON stored per project as a whiteboard artifact.
• Scheduling information, including Cal.com booking identifiers, scheduled times, duration, timezone, booking status, and related project or session identifiers.
• Payment metadata for one-time INR treat purchases, including item, amount, currency, provider, order identifiers, payment status, and related entitlement records. Razorpay is planned for payment processing; today the gateway may run in test mode.
• Basic usage and technical data, such as device/browser data, IP-derived security signals, request logs, error logs, rate-limit records, and approximate timestamps needed to operate and secure the service.

• To create and secure your account, authenticate you, prevent abuse, and provide customer support. Legal bases: contract, legitimate interests, and legal obligations.
• To provide the core service: saving projects, running chat and voice sessions, generating blueprints and documents, saving whiteboards, scheduling calls, and creating handoff kits. Legal basis: contract.
• To process one-time treat purchases, maintain payment records, activate entitlements, detect fraud, and satisfy tax/accounting duties. Legal bases: contract, legitimate interests, and legal obligations.
• To monitor reliability, debug errors, enforce rate limits, protect the service, and improve product quality. Legal basis: legitimate interests.
• To send service notices, security alerts, booking confirmations, and policy updates. Legal bases: contract, legitimate interests, and legal obligations.
• Where we rely on consent, such as for optional cookies or future marketing messages, you may withdraw consent at any time.

Lumi works by sending relevant user content to third-party AI and speech providers so the service can respond, transcribe calls, synthesize speech, research context, and generate artifacts. This may include your project details, chat history, voice transcripts, whiteboard context, selected files, and brief answers.

We use OpenRouter and/or OpenAI for LLM processing, and Deepgram for speech-to-text and text-to-speech in live calls. LiveKit carries the real-time audio room. We do not use your account data, project content, chat logs, voice transcripts, or whiteboards to train our own AI models.

Third-party AI providers may process submitted content under their own enterprise/API terms and retention settings. Do not submit highly sensitive, regulated, or confidential third-party data unless you are allowed to do so and accept this processing.

We currently use or plan to use the following subprocessors:

• Supabase: authentication, Postgres database, and related backend infrastructure.
• OpenRouter: routing LLM requests for chat, research, and generation.
• OpenAI: LLM processing directly or through OpenRouter where applicable.
• Deepgram: speech-to-text and text-to-speech for live calls.
• LiveKit: real-time voice rooms and agent dispatch infrastructure.
• Cal.com: scheduling, booking confirmations, and calendar workflow.
• Razorpay: planned INR payment processing for one-time treat purchases.

We may update this list as the service changes. Material changes will be reflected in this policy.

• Account, project, chat, transcript, document, handoff, and whiteboard data are kept while your account is active or as needed to provide the service.
• If you request deletion, we will delete or anonymize account and project data within 30 days unless we must retain it for legal, security, dispute, or fraud-prevention reasons.
• Payment, tax, accounting, and legal records may be retained for up to 8 years or longer if required by applicable law.
• Security logs, rate-limit records, and operational logs are usually retained for up to 12 months unless needed longer for investigation, abuse prevention, or legal claims.
• Backups may retain deleted information for up to 90 days before they expire from backup systems.

Depending on where you live, including under GDPR/UK GDPR, CCPA/CPRA, and India's Digital Personal Data Protection Act, you may have rights to access, correct, delete, export, restrict, object to certain processing, withdraw consent, and appeal or complain about our response.

To exercise rights, email lumi@talktobuild.com. We may need to verify your identity before acting on your request. We do not sell personal information. We also do not knowingly share personal information for cross-context behavioral advertising as those terms are used under CCPA/CPRA.

We operate from India and use global infrastructure and service providers. Your data may be processed in India, the United States, the European Economic Area, the United Kingdom, and other countries where our providers operate.

Where required, we rely on appropriate transfer mechanisms such as contractual safeguards, data processing terms, and provider compliance programs. These countries may not provide the same data protection level as your home jurisdiction.

We use necessary cookies and similar technologies for authentication, session management, security, and core product functionality. Supabase Auth and embedded third-party flows such as Cal.com or Razorpay may set cookies or similar storage when you use those features.

If we introduce optional analytics, marketing, or advertising cookies, we will provide controls where required by law.

talktobuild.tech is not intended for users under 18. You must not create an account or use the service if you are under 18. If we learn that we collected personal data from a child, we will delete it as required by law.

We use technical and organizational safeguards such as authentication, row-level access controls, service-role separation, rate limiting, and provider security controls. No internet service can be guaranteed to be perfectly secure, so you should avoid submitting information you do not want processed through AI, speech, database, or scheduling providers.

We may update this Privacy Policy as the service, providers, or legal requirements change. We will update the "Last updated" date and, for material changes, provide reasonable notice through the service or by email. Continued use after changes take effect means you accept the updated policy.

Operator and grievance contact: Yash Goyal, individual based in India.

Email: lumi@talktobuild.com. Please include enough detail for us to understand and respond to your request.