Privacy Policy

This Privacy Policy explains what personal data totalkto.ai (the "Service") collects, how we use and share it, and your choices. By using the Service you agree to this Policy. Please also read our Terms of Use.

1. Data we collect

• Account data — your email address and authentication credentials (passwords are stored hashed by our authentication provider; we never see them in plain text).
• Photographs & images you upload to create an avatar.
• Voice recordings / audio samples you record or upload for voice cloning, and microphone audio you record while speaking to an avatar (sent for transcription).
• Documents & files you attach as knowledge sources, and the text extracted from them.
• Generated content — avatar idle videos, voice clone identifiers, and conversation text.
• Technical data — basic logs and request metadata needed to operate and secure the Service.

2. Sensitive & biometric data

3. How we use data

• To create and operate your avatars (generate the talking video, voice, and idle animation);
• To transcribe your speech, generate conversational replies, and ground them in any attached document;
• To authenticate you and keep your account and content secure;
• To maintain, debug, and improve the Service.

We do not sell your personal data.

4. Who we share it with (sub-processors)

To provide features you request, your data is transmitted to the following third-party processors, each subject to its own terms and privacy policy:

• Supabase — authentication, database, and file storage (your account, avatar records, and uploaded photos/videos/documents are stored here).
• D-ID — generates the animated talking-avatar video from your photo.
• ElevenLabs — speech-to-text (transcribing your microphone audio) and voice synthesis / voice cloning.
• OpenAI — generates the avatar's conversational replies from your messages and any attached document text.

We may also disclose data where required by law or to protect our rights and the safety of others.

5. Consent of others

If your uploaded content contains the face, likeness, voice, or personal data of another person, you confirm you have obtained their explicit, informed consent (or, for a deceased person, the authority/consent of their estate or rights holders) before uploading it. You are solely responsible for obtaining and being able to evidence such consent.

6. Storage, retention & deletion

• Your photos, videos, and documents are stored in your private, access-controlled storage area; database rows are protected by row-level security so only you can access your own records.
• You can delete an avatar (and its associated stored files) at any time from your gallery.
• To delete your entire account and all associated data, contact us at [email protected]; we will action deletion within a reasonable period, subject to any legal retention obligations.
• Note that content already transmitted to third-party processors (e.g., a voice clone created at ElevenLabs) may also need to be deleted directly with that provider or via us on request.

7. Your rights

Depending on your jurisdiction, you may have rights to access, correct, export, restrict, or delete your personal data, and to withdraw consent. To exercise these rights, contact [email protected].

8. Children

The Service is not directed to children under 18 and we do not knowingly collect their data.

9. Changes

We may update this Policy; material changes are reflected by the "Last updated" date above.

10. Contact

Privacy questions or requests: [email protected] — totalkto.ai, Germany.