Privacy Policy

Controller and contact

The operator of the Talavio service, trading under the Talavio brand, controls data directly connected with Talavio accounts, service security, billing and contact with us. The operator's identity and correspondence details appear in the contact section below.

For privacy matters, email hello@talavio.com.

Our data protection roles

Talavio is the controller for account-holder and direct contact data. When a homeowner sends information through a contractor's widget, that contractor is the controller and Talavio processes the information on its documented instructions as the platform provider.

Data we process

• account and contact data, including name, email and sign-in information;
• company, team, widget configuration and service preferences;
• lead and project data, including scope, location, budget, messages, photos, estimates and appointments;
• technical and security data, such as IP address, timestamps, browser type and event logs;
• support correspondence and billing information if paid services are enabled.

Purposes and legal bases

• providing the service, managing accounts and handling orders — performance of a contract or pre-contract steps;
• protecting accounts, preventing misuse and improving the service — legitimate interests of Talavio and its customers;
• tax, accounting and other statutory duties — legal obligation;
• marketing communications or optional technologies — consent where required;
• processing lead data — the customer's instructions and the legal basis selected by that customer.

Recipients

Data may be shared with hosting, file-storage, database, email, security and support providers, professional advisers, and authorities legally entitled to receive it. A contractor receives enquiries submitted through its widget.

Google, Apple or Microsoft receive data only when their sign-in option is selected. An AI provider receives relevant project data only when that feature is enabled and used.

Transfers outside the EEA

Some providers may process data outside the European Economic Area. Where that happens, we rely on a GDPR transfer mechanism, such as an adequacy decision or Standard Contractual Clauses, depending on the provider and destination.

Retention

Account data is kept while the service is used and afterwards where needed for accounts, legal obligations and claims. Lead data is retained according to the controller customer's instructions. Security logs are kept only as long as needed to protect the service. Deleted data may remain for a limited period in rotating backups.

Your rights

• access your data and obtain a copy;
• correct, erase or restrict processing;
• object to processing based on legitimate interests;
• receive portable data where applicable;
• withdraw consent at any time without affecting earlier processing;
• complain to the President of the Polish Personal Data Protection Office or your local supervisory authority.

AI, estimates and automation

AI visuals, scoring and estimates are decision-support tools. We do not make decisions about individuals that produce legal or similarly significant effects solely by automated means. Results should be checked by the relevant contractor or specialist.

Security, children and changes

We use proportionate technical and organisational measures, including access controls, encrypted connections and private file storage. No system can guarantee complete security.

The service is not directed to people under 18. We may update this policy as features or laws change; the updated version will be dated and published here.