Privacy notice

Who we are

Talkfront is a live chat service and a trading name of Lonex Group Ltd, registered in England and Wales, company number 17149187, at Portland House, Belmont Business Park, Durham, DH1 1TW. For questions about this notice or about your data, email privacy@talkfront.app.

There are three different relationships covered here, and they matter:

• You visit this website. We are the controller of the little we collect.
• You have a Talkfront account. We are the controller of your account data.
• You chatted with a company that uses Talkfront. They are the controller of that conversation. We are their processor, acting on their instructions. Ask them about your data first, but if you come to us, we will help you reach them.

If you are visiting this website

This site is a set of static pages. It sets no advertising or tracking cookies, and it loads no fonts or images from third-party servers. The typefaces you are reading are served from our own domain specifically so that visiting this page tells nobody else that you did.

Two small things do happen in your browser:

• Our web server keeps standard logs: IP address, the page requested, the time, and your browser's user-agent string. These exist to keep the service running and to investigate abuse, and are deleted after 30 days.
• We count page views. Pirsch records that a page was read, roughly where from, and what linked to it. It sets no cookie and no identifier that follows you between sites, so we see totals rather than people.
• A referral tag may be stored for your session. If you arrive from a widget footer link carrying a ?ref= value, we keep that value in your browser's session storage so the referral can be credited if you sign up. It is cleared when you close the tab and it contains no personal data.

See the cookie notice for the full picture.

If you have a Talkfront account

We hold what we need to give you an account and charge you for it:

• Identity and contact: name, email address, and a hashed password.
• Workspace data: your workspace name, the websites you have added, your settings, and the colleagues you have invited.
• Billing: your plan, billing address and VAT number where given, and an identifier from our payment processor. We never see or store card numbers.
• Security and audit: sign-in times, IP addresses, and the transparency log of actions taken in your workspace.
• Support correspondence: anything you send us, so we can answer it and refer back to it later.

Why we are allowed to

If you chatted with a company that uses Talkfront

The company whose website you were on decides what to collect and why. We store it on their behalf and only do what they instruct. That typically includes:

• The messages exchanged, and any files sent.
• Anything you typed into the pre-chat form, such as a name and email address.
• Details their own system passed to us about you, if you were signed in to their site.
• Technical context: the page you were on, the page you arrived from, your browser, and an approximate location derived from your IP address, usually a city and country.
• A token stored in your browser so your conversation is still there when you change page.

To see, correct or delete that data, contact the company you were chatting with. If you cannot reach them, email us and we will pass your request on.

Who else sees it

We do not sell personal data, and we do not share it for advertising. We use a small number of suppliers to run the service, each under a contract that limits them to acting on our instructions:

• Hosting and infrastructure: servers and backups, located in Europe.
• Payment processing: Stripe, who handle card details so that we never hold them.
• Email delivery: for account emails, invoices and missed-chat notifications.
• Edge network and bot protection: Cloudflare, which terminates connections and filters abusive traffic.

Each one is named, with what it does and where it is, on the sub-processor list, which we update before a new supplier starts rather than after. We will also disclose data where the law requires it, and we will tell you when we are permitted to.

Where your data lives

Talkfront data is hosted in Europe. Where a supplier processes data outside the UK or EEA, that transfer is covered by UK International Data Transfer Agreements, EU Standard Contractual Clauses, or an adequacy decision.

How long we keep it

How we protect it

• Everything travels over TLS, including the WebSocket connection carrying messages.
• Passwords are hashed, never stored in a readable form.
• Two-factor authentication and passkeys are available to every account, and workspace owners can require them.
• Each workspace's data is isolated at the query level, so one customer cannot see another's.
• Message content is rendered as text and never as HTML, which removes a whole class of attack from chat.
• Actions taken inside a workspace are recorded in a transparency log with timestamps and IP addresses.

Your rights

Under UK GDPR you can ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct anything that is wrong.
• Delete it, where we have no continuing reason to keep it.
• Restrict or object to how we use it.
• Give it to you, or to someone else, in a portable format.
• Withdraw consent, where consent is what we relied on.

Email privacy@talkfront.app and we will respond within one month. There is no charge.

If you are unhappy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first so we can put it right.

Children

Talkfront is a business tool and is not intended for children. We do not knowingly collect data from anyone under 16. If you believe we have, tell us and we will delete it.

Changes to this notice

When we change something that matters, we will update the date at the top and email account holders before it takes effect. Minor wording fixes will not get an email.