1. Data controller
The data controller is Edoardo Rinaldi, sole trader (=TellPip), VAT number 04139890364, Via Lodovico Vedriani 41, 41124 Modena, Italy, certified email (PEC) edo.rinaldi@pec.it, email hello@tellpip.eu.
2. Personal data processed
- Browsing data from the Website (for example IP address, date and time, page requested, browser) and the information stored in the browser described in the Cookie Policy.
- Account data: email address, linked computers, plan, trial and subscription status, data on use of the service; the names the User is called by in calls and the name shown to the people they invite; the invitation or sign-up code used and the page and campaign that brought them to the Website (stored with the email); for the Enterprise plan, the administrator's details and the email addresses of the seats.
- Purchase and billing data received from Paddle: name, email address, country, billing address and VAT number if given, plan, amounts paid, invoices.
- Content processed with the App (questions, portions of the transcript, document passages, screen images), sent to artificial intelligence providers to generate answers, notes and client memory and to put search results in order.
- Support data: messages sent to hello@tellpip.eu or from the App, with the technical report if the User sends one.
Email before the download. Before the download we ask for your email. We keep it together with where you came from (the page and the campaign of the link that brought you to the Website, and an invitation code if you had one), to know which video or invitation brought you, and to send you the download link. When you sign in to TellPip with the same email, this information is linked to your account. We send you news about TellPip only if you tick the separate box. The Website also remembers your email in your browser for 60 days, so it doesn't ask again. The counts of visits and downloads carry no identifier.
3. Purposes and legal bases
- Providing the App and the subscription (account, sign-in, trial, AI answers and notes, updates) and sending service communications: performance of the contract (Art. 6(1)(b) GDPR).
- Responding to contact and support requests: pre-contractual steps or performance of the contract (Art. 6(1)(b) GDPR).
- Accounting and tax obligations: legal obligation (Art. 6(1)(c) GDPR).
- Operation and security of the Website and the App, prevention of abuse and fraud, defence of TellPip's rights: legitimate interest of TellPip in keeping the service secure and protecting its rights (Art. 6(1)(f) GDPR).
- Knowing which channels bring users to TellPip, through the source (page, campaign, invitation or sign-up code) stored with the email and the account: legitimate interest of TellPip in knowing which channels bring users (Art. 6(1)(f) GDPR).
- Statistics and advertising cookies, promotional communications: only with consent, if enabled (Art. 6(1)(a) GDPR).
For the data of other call participants contained in the content, the controller is the User and TellPip acts as processor on the User's behalf.
4. Recipients
- Convex, Inc. (United States; data hosted in Ireland), processor: hosts TellPip's server (account data, support reports, AI requests in transit only).
- Artificial intelligence providers (United States), processors: generate answers and notes and put search results in order.
- Cloudflare, Inc. (United States), processor: hosting of the Website and of the update files, anonymous visit statistics without cookies (Cloudflare Web Analytics), email forwarding.
- Scaleway SAS (France, EU), processor: sending of the server's emails.
- Google (Google LLC, United States, and Google Ireland Ltd): Google Fonts on the Website (IP address) and the Gmail mailbox where email sent to TellPip is kept.
- Hugging Face, Inc. (United States): IP address when the local models are downloaded.
- Notion Labs, Inc., Google LLC and Microsoft Corporation: only if the User connects Notion, Google Drive or OneDrive/SharePoint (see section 10).
- Paddle.com Market Ltd (United Kingdom), reseller and Merchant of Record, independent controller of payment and billing data under its own privacy policy.
Data may also be disclosed where required by law, for example to a judicial authority.
5. Transfers outside the EU
Transfers to the United Kingdom are based on the European Commission's adequacy decision (Art. 45 GDPR). Transfers to the United States are based on the adequacy decision for companies certified under the EU-US Data Privacy Framework (Art. 45 GDPR) and on the standard contractual clauses approved by the European Commission (Art. 46 GDPR). Further details can be requested at hello@tellpip.eu.
6. Retention
- Account data: for the duration of the account and for no longer than 12 months after it is closed or the subscription ends.
- Billing data and invoices: 10 years, as required by Italian tax law.
- Support correspondence and reports: as long as needed to handle the request, and no longer than 12 months.
- Emails left on the Website by people who never create an account: at most 12 months, then deleted; if the person subscribed to news, until they unsubscribe.
- AI requests: not stored on TellPip's server; the AI providers keep them for the limited period set by their terms.
- Website logs: the short period set by Cloudflare's policy; browser data: as stated in the Cookie Policy.
Data may be kept longer only to comply with a legal obligation or to establish, exercise or defend a right in court.
7. Provision of personal data
Providing the email address and payment data is a contractual requirement: without them the account cannot be created and the subscription cannot be taken out. Billing data are also required by tax law. Data sent by email are optional, but without them TellPip cannot reply.
8. Rights of the data subject
The data subject may exercise the rights set out in Articles 15 to 22 GDPR (access, rectification, erasure, restriction, portability, objection) by writing to the certified email address edo.rinaldi@pec.it with the subject line "Esercizio diritti privacy" (or to hello@tellpip.eu). Consent may be withdrawn at any time, without affecting the lawfulness of processing before its withdrawal. The data subject may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).
9. Automated decision-making
TellPip makes no decisions based solely on automated processing and carries out no profiling. Changes to this notice are published on this page with a new date.
10. Connected services (Google Drive, Notion, Microsoft OneDrive and SharePoint)
Connecting a service is optional and is done by the User from the App. TellPip only accesses what the User chooses to share, with the permissions listed below, and only for the purposes described in this section.
Google Drive
- Permission:
drive.fileonly. TellPip can see only the files the User picks in Google's own file picker, plus the files TellPip itself creates in the User's Drive (the call-notes documents, when the User saves notes there or uses "Propose to the wiki"). TellPip has no access to the rest of the Drive. - Use: the picked files are copied to the User's computer and indexed there, so that answers during calls can draw on them.
- Revoke: in the App (Settings › Connectors › Revoke) or in the Google account (Security › Third-party access).
Notion
- Permission: the User signs in to Notion and picks, in Notion's own screen, the pages TellPip may access. TellPip can read those pages and insert or update content in them only to save call notes or when the User uses "Propose to the wiki". TellPip does not receive Notion user information or email addresses.
- Use: the shared pages are copied to the User's computer and indexed there.
- Revoke: in the App or in Notion (Settings › Connections).
Microsoft OneDrive and SharePoint
- Permissions (delegated):
User.Read(sign-in and basic profile),Files.Read.AllandSites.Read.All(to read the files and sites the User selects as sources),Files.ReadWrite.Allonly if the User enables writing notes, andoffline_access(to stay connected). - Use: the selected files are copied to the User's computer and indexed there; TellPip writes only call notes, when the User has enabled it.
- Revoke: in the App or at myapps.microsoft.com.
For all connected services
- The content of the shared files and pages is copied and indexed on the User's computer. The TellPip server does not store it: for Notion it only exchanges the sign-in code, and it never keeps Notion content or access tokens. The access tokens are stored encrypted on the User's computer.
- Searches in this content run on the User's computer; to put the results in order, the most relevant passages and the User's question may be sent to TellPip's server and to an artificial intelligence provider.
- As for any document used in the App, the content of the shared files and pages can be sent to an artificial intelligence provider to answer the User's questions (see sections 2 and 4). It is never used to train AI models.
- This data is not sold and not used for advertising.
- The User can delete their data from the App's Account page or by writing to hello@tellpip.eu.
TellPip's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.