United Kingdom and European Union Notice

1. Where FairTalk is offered

FairTalk is offered only to adults (18 or over) living in Australia or New Zealand, as our Terms of Service say, and everyone recorded must be an adult. We do not offer or market it in the United Kingdom, the European Union or the European Economic Area (EEA), we have no office there, and our price is set and shown in Australian dollars only. This notice is not an invitation to use FairTalk from there. It adds to our Privacy Policy.

2. When this notice matters

This notice matters only where the United Kingdom General Data Protection Regulation (UK GDPR) with the Data Protection Act 2018 (UK), or the European Union’s General Data Protection Regulation (Regulation (EU) 2016/679) (EU GDPR), applies to how we handle your personal information. That might be so if you are in the UK, the EU or the EEA and a FairTalk user recorded or mentioned you or asked us to email you an invitation, or you used FairTalk from there. It depends on your circumstances, which this notice does not decide. We do not check anyone’s location.

3. Who is responsible

FairTalk Pty Ltd, based in Western Australia, decides why and how personal information is handled in FairTalk, so where these laws apply we are the controller. Contact us at contact@fairtalk.com.au. We have no data protection officer, and because we do not offer FairTalk in the UK or EU we have not appointed the local representative these laws can require there.

Stripe takes payments for us and is also a controller in its own right, for purposes such as preventing fraud and meeting its legal obligations. Google is a controller in its own right for sign-in and font requests.

4. What we handle, why, and our lawful basis

We handle account details, the recording (never stored by us), the transcript, the AI analysis, topic titles, resolutions, consent records, invitation email addresses and technical data such as IP addresses. If you were recorded or mentioned, the information came from the people in the conversation. If you were invited, your email address came from the person who invited you.

What we do	Lawful basis (Articles of UK GDPR and EU GDPR)
Run accounts, subscriptions, payments, session requests and notifications	Contract with the account holder (Article 6(1)(b))
Record, transcribe and analyse a session, and show the results	Contract, for an account holder. Consent on screen, for a recorded person with no account (Article 6(1)(a)). Explicit consent for special category data (section 5)
Handle what speakers say about a person who is not present	Legitimate interests (Article 6(1)(f)): letting people record and reflect on their own conversation
Send resolution reminders, where switched on	Legitimate interests: helping you follow through. Each email has an unsubscribe link
Send an invitation a user asked for	Legitimate interests: letting a user invite a person they name
Keep a conversation shared between linked accounts after one account is erased (section 7)	Legitimate interests: it is also the other person’s record, because both helped create it
Keep logs, and records of consent and of acceptance of our documents	Legitimate interests: protecting the service and showing what was agreed
Keep billing records, answer requests and complaints, and respond to courts and regulators	Legal obligation (Article 6(1)(c)) where UK or EU law requires it, otherwise legitimate interests: meeting the laws that apply to us in Australia
Tell the waitlist about our launch, and send marketing email	Consent (Article 6(1)(a))

Our pages load Google Fonts without asking for consent first (section 6). We do not sell personal information, share it for advertising or use conversations to train AI models.

5. Sensitive information and consent

Difficult conversations often include information about health (including mental health), sex life or sexual orientation, and sometimes beliefs, ethnic origin or political opinions. UK and EU law call this special category data. We do not filter it out, and the analysis can repeat it.

The only condition we rely on is the agreement given in the app before a session, which we treat as the explicit consent (Article 9(2)(a)) of the person who gives it:

• In a “Just me” session, the account holder agrees for themselves.
• With a linked person (someone with their own FairTalk account who has accepted a link with the person recording), the account holder asks for the session and the linked person approves it on their own device.
• With a person who has no account, the screen shows a short notice that the conversation will be recorded, transcribed and analysed by AI using overseas providers, that the audio is not kept and that the transcript is deleted after analysis. The account holder and the other person each confirm their own agreement on that screen, so we cannot verify who gave the second. The account holder must make sure the other person really agreed and knows where to find our Privacy Policy.

We store that each agreement was given and when. For a person with no account, that record does not identify them. We do not claim that it meets every requirement these laws set for explicit consent. It has limits:

• The app asks only the account holder and one other person to agree. Our Acceptable Use Policy forbids recording more than two people, or anyone who has not agreed, but we have no agreement from anyone else who can be heard.
• A person who is only mentioned cannot give consent, and we do not claim to have it. What is said about them is used to produce that session’s analysis, resolutions and private coaching, which can repeat it and are stored and shown as this notice describes. We do not use it for advertising or to profile them, and we do not contact them: this notice and the Privacy Policy are how we tell them.
• Conversations can include allegations of criminal conduct. We do not screen for them, check whether they are true, act on them or make any decision from them.

Stopping a recording and withdrawing consent

Either person can stop a recording at any time, but stopping does not delete it: what was recorded up to then is still sent for transcription. To withdraw consent afterwards, use the delete option on the conversation where it is offered, or email contact@fairtalk.com.au. If you were recorded and have no account, email us with the details in section 8. For a conversation shared with a linked person, either of you can ask: we delete it within 30 days and tell the other person. Withdrawing does not undo what was done before, and a provider may still hold its own copy for the period its terms set.

6. Where your information goes, and the safeguards

An adequacy decision is a formal finding, by the United Kingdom or the European Commission, that a country protects personal information well enough. Australia has none from either. So if these laws apply to you, your information is handled in countries whose privacy law differs from UK and EU law, and your rights may be harder to enforce there.

Our database, which includes the sign-in records, is in Sydney, Australia. The Trust Centre lists what each provider receives.

In the table, “clauses” means the provider’s terms include the European Commission’s standard contractual clauses with the UK Addendum, which are contract terms for sending personal information to a country with no adequacy decision. “Framework” means the provider’s own EU-US Data Privacy Framework certification, with its UK Extension.

Provider and place	What it handles	Transfer safeguard
Deepgram, United States	Session audio, sent with an instruction that it is not to be used to train the provider’s models	None yet: no signed data processing agreement, no clauses and no adequacy decision
Anthropic, United States and possibly other countries	Transcript text	Clauses
Amazon Web Services, Australia	Everything we store	Clauses
Amazon Web Services, Australia	Our application servers, which receive everything sent to FairTalk	Clauses
Resend, United States	Emails we send	Clauses and Framework
Stripe, United States and other countries	Payments	Clauses and Framework
Google, United States and worldwide	Google sign-in, if you choose it	Framework. No data processing agreement with us: Google is a controller in its own right
Google Fonts, United States and worldwide	Your IP address and browser details, sent by your browser when our pages load, before any choice	None between us and Google. We cannot control what Google does with it
Netlify (hosts our website)	Requests to load our website	Place and safeguard not confirmed

7. How long we keep it, and what deleting covers

• We never store the audio. We delete the transcript when the analysis is saved or, if none is made, after about a week. The analysis is written from the transcript and can quote or closely repeat what was said.
• We keep the analysis, resolutions and private coaching until the conversation is deleted or the account is erased, 30 days after its holder deletes it. Until then they can sign in and reverse it. Erasing an account removes its profile details, disables its sign-in and removes the email address and password from it, and removes sessions that were not shared with a linked person, private coaching, notifications, feedback and pending invitations.
• A conversation shared with a linked person is the exception. It stays available to that person after the other account is erased, with the erased person’s name shown as ‘Deleted user’ and their private coaching erased, because both helped create it. Either of them can ask us to delete it (section 5).
• Activity log entries are kept for 12 months. Records of consent to record and of acceptance of our documents are kept for 7 years as evidence, and billing records for 7 years because tax law requires it.
• Waitlist email addresses are kept until launch communications are finished or you ask us to remove yours. Server logs are kept for a limited period for security and fault-finding.
• Erased data may remain in backups for a short period, up to 14 days, before it expires. Providers keep their own copies for the periods their terms set.

8. Your rights

Where these laws apply to you, you can ask us to give you a copy of your personal information, correct it (the app has no way to edit an AI analysis, so tell us what is wrong), delete it (section 7 says what deleting covers), limit what we do with it while a question is sorted out, or give it to you in a form you can take elsewhere. Section 5 covers withdrawing consent.

Account holders can download their data and delete their account in Profile, but the download is not a complete copy, so you can also email contact@fairtalk.com.au. If you were recorded or mentioned, tell us enough to find the session, such as who recorded it and when. We keep no audio and cannot reliably identify people from an analysis, so we may not be able to find it, and if so we will say so. Requests are free. We may need to check who you are. We will answer within 30 days, and will tell you why in writing if we cannot do what you ask.

Your right to object

You can object at any time to anything we do on the basis of our legitimate interests (section 4). You can always tell us to stop sending you marketing email, or to remove you from the waitlist. For any of these, email contact@fairtalk.com.au.

Conversations that involve two people

A conversation holds both people’s information, so we consider both people’s privacy when we respond. Between linked people, each person receives the shared analysis and their own private coaching, and never the other person’s coaching. That is the rule our app and server apply. If an account holder recorded you and you have no account, the session sits only in their account. They can open the whole analysis, including the coaching written about you, and you cannot open it in the app. The Acceptable Use Policy explains what the person who recorded a conversation is told if you ask us to remove it.

9. Automated decisions and AI

The analysis, suggested resolutions and private coaching are generated by an AI system built on a model from Anthropic. The app labels the analysis as AI-generated and tells you it can be wrong. We say this whether or not the European Union’s Artificial Intelligence Act (Regulation (EU) 2024/1689) applies to FairTalk.

• The AI is given the transcript text, our instructions, the names used for the speakers, the account holder’s display name and each person’s coaching style.
• It works from words only, after the conversation. We do not analyse tone of voice, create voiceprints or identify anyone by voice. Our transcription provider separates the speakers (“Speaker 0”, “Speaker 1”) only to label who said what in that one recording.
• In normal operation, nobody at FairTalk reads an analysis before you see it. Our owner and developer can technically reach stored content through database administration, only to fix a fault, answer a request from the person concerned or meet a legal obligation.

The AI evaluates what each person said automatically, but makes no decision about anyone with a legal or similarly significant effect. Its output is suggestions you are free to ignore, and it does not change your access to FairTalk, what you pay or your account status.

10. Other things to know

• Data breaches: wherever you live, if a data breach is likely to cause serious harm we will tell the people affected, where we can contact them, and the privacy regulator (the Office of the Australian Information Commissioner or, in New Zealand, the Office of the Privacy Commissioner) as soon as practicable. If one of these laws applies to you and a data breach is likely to put you at risk, we will also tell you without undue delay and notify the regulators that law requires us to notify.
• Courts: conversations and analyses in FairTalk have no legal privilege and no counsellor confidentiality. A court or a law could require an analysis to be handed over.
• Cookies: the app has no advertising and no analytics or tracking tools. It sets a display-theme cookie and a security cookie, and keeps your sign-in token in your browser’s local storage. Stripe’s and Google’s own pages may set their own cookies.

11. Complaints

If you are unhappy with how we have handled your personal information, email contact@fairtalk.com.au. We will reply in writing within 30 days. If we need longer, that reply will say so, and we will tell you the outcome without undue delay.

If one of these laws applies to you, you can also complain to a data protection regulator:

• In the United Kingdom: the Information Commissioner’s Office, at ico.org.uk/make-a-complaint or on 0303 123 1113. It expects people to complain to the organisation first.
• In the European Union or the European Economic Area: the data protection authority where you live or work.

Each regulator decides for itself whether it can deal with a complaint about a company in Australia.