Updated 15 October 2026

Privacy notice

TalkToMe is an AI reflection tool with a free profile. This notice explains what happens to information you share, where it is held and how to contact us.

Controller and contact

Davide Florio, a sole trader trading as 1Prestige1, based at 4 Gorse Rise, London SW17 9BS, United Kingdom, is the data controller responsible for TalkToMe. For privacy requests, email dyang5548@gmail.com. Please do not put sensitive conversation details in your first email. We may need to verify that a request concerns your information before acting on it.

Information and purposes

You can type or speak reflections about feelings, circumstances and goals. The text you send, together with recent conversation context, goes to our AI provider OpenAI to generate a reply. Voice input is converted to text by your browser or device where supported. Depending on the browser, audio may be processed by its speech-service provider, not only on your device. Microphone permission is optional; typing is an alternative. This is optional self-guided support, not confidential therapy. Avoid including identifiers or details you do not want processed.

If you create a profile, we receive a user identifier and email from ChatGPT sign-in and store your chosen display name, focus and any optional age, gender and conversation preferences in our account database, linked to your sign-in identifier. These profile details are included as context for OpenAI to personalise replies. You can edit or clear the optional fields from your profile. Your check-in progress, journal entries, device preferences and conversation continuity may be stored in this browser on your device. They help you return to a useful thread. We also collect limited first-party events about public pages and selected clicks to understand site use. These can include a visit identifier, page path, referral and time. Do not enter another person's private details.

Legal basis and recipients

We process messages to provide the conversation you request (contract). Before starting, we ask for explicit consent to process sensitive information you choose to share for AI reflection. You can withdraw through Privacy & device settings and stop using AI conversations while continuing to browse resources. Optional site measurement is off until you choose to allow it. Hosting infrastructure handles requests and OpenAI processes the conversation to generate replies. Your local journal is not automatically shared with a professional featured on the site. Reflections can reveal health or other especially sensitive information. Do not treat this as confidential clinical care. We record the consent version and acceptance time against a hashed account or temporary guest identifier; no message content is stored in that record. Consent receipts expire after 90 days when requests next trigger maintenance; a later consented request creates a fresh receipt. Withdrawing removes the current receipt. Our wider data-protection assessment, supplier contracts and international-transfer safeguards still require operational verification.

Your choices and requests

Providing a message is necessary only if you want an AI reply. Optional profile fields, voice input and site measurement can be declined. Withdrawing consent stops future consent-based processing and does not undo processing that was lawful before withdrawal. You can use My profile to export or delete your stored profile, and Privacy & device settings to export or clear local notes. These are separate controls. An active renewing subscription must be cancelled before self-service profile deletion; you can still contact us to exercise your rights.

Privacy requests are normally answered without undue delay and within one calendar month, subject to applicable identity-check and extension rules. We will explain any lawful extension or refusal. You do not have to use a special form or include your journal in a request. You may object to processing based on legitimate interests, including necessary security processing; we must consider that objection.

Security, enquiries and automated replies

We use limited technical information to protect the service against abuse and excessive requests, based on our legitimate interest in keeping it secure and available. Optional measurement relies on your consent. Professional enquiry forms pass the details you enter through our server to prepare an email draft; this endpoint does not save the enquiry in our database or send it automatically. Your email provider and the recipient process the message if you send it. Partner applications involve the business contact and application details supplied through the separate partner form. AI replies and profile personalisation are automated, but are not decisions about employment, credit, diagnosis or entitlement to treatment.

See Cookies & device storage for storage categories, choices and limitations. We do not claim that browser notes are encrypted or inaccessible to someone using your unlocked device.

Storage and retention

Journal and progress data kept in your browser remain there until you clear site data, use its available reset controls or lose access to that device. New device notes are separated by account; old unassigned notes are not automatically imported. You can export or clear this account’s local notes from Privacy & device settings. We do not store chat transcripts in a TalkToMe account database. If you purchase Plus, Square processes your payment information. We store its customer and subscription identifiers and billing status to control access; we do not store card details. Profile and subscription records remain in our database until you request deletion, subject to any legal retention requirements; an automated retention schedule has not yet been established. The server sends recent messages to OpenAI for a reply. We request store:false for Responses to avoid retaining response application state. This does not eliminate provider abuse-monitoring logs or other retention that may apply under the account configuration; those arrangements still need verification. First-party measurement records in our database are removed after 90 days when the event endpoint next receives traffic. Server logs and backups may follow hosting-provider schedules that are not yet verified. Request limits use short-lived hashed identifiers, not raw IP addresses, and are cleared after expiry when traffic resumes. We will update this notice when other operational periods are confirmed.

International processing and your rights

Hosting and AI processing may occur outside the UK. Provider locations and applicable transfer safeguards still need verification. You can ask for access, correction, erasure, restriction or portability where applicable, object to processing based on legitimate interests, and complain to the UK Information Commissioner's Office. Contact us at the address above. Clearing browser data removes the local copy on that device, but does not itself erase information already processed by providers.

Safety

TalkToMe cannot assess, locate or monitor you in an emergency. Contact local emergency services if there is immediate danger. We will revise this notice as the service and its verified data flows change.