Privacy Policy

Last updated: July 23, 2026

This Privacy Policy (the “Policy”) describes how THE CHATBOT FACTORY, a simplified joint-stock company (SAS) with a capital of 9,600 euros, whose registered office is located at 16, Villa des Nymphéas – 75020 Paris, registered with the Paris Trade and Companies Register (RCS) under number 789 487 121 (“tolk.ai”, “we”), processes personal data.

This data is processed in connection with its website, its contact forms and its software solutions, in accordance with Regulation (EU) 2016/679 (“GDPR”) and French Law No. 78-17 of January 6, 1978, as amended.

1. Scope

This Policy applies to the processing of personal data for which tolk.ai acts as data controller: browsing the tolk.ai website and using its forms (contact, demo), creating and managing the accounts of our clients’ Collaborators on the Genii platform, as well as managing the business relationship and billing.

It does not apply to data processed on behalf of our clients through the conversational agents they deploy (including the content of conversations with their own users): for this processing, tolk.ai acts as a data processor, under the conditions described in section 8.

2. Personal Data Collected

  • Via the website and its forms: identity (first name, last name), professional contact details (email address, phone number), company and position, content of the message sent, as well as browsing data (see section 6);
  • Via the Genii platform (accounts of our clients’ Collaborators): first name, last name, professional email address, organization, login credentials (password stored in encrypted form), connection logs;
  • As part of the business relationship: contact details of the relevant contacts, history of exchanges, order and billing data.

We do not knowingly collect special categories of data within the meaning of Article 9 of the GDPR in this context, and we ask you not to send us any such data via the forms.

3. Purposes of Data Use

Personal data is collected solely to:

  • respond to your contact and demo requests;
  • create and manage accounts, provide and administer our services;
  • invoice, maintain our accounting, and manage unpaid invoices;
  • send marketing communications to professional contacts related to our activities;
  • ensure the security of our systems, and prevent fraud and abuse;
  • compile usage statistics in aggregated and anonymized form;
  • manage requests to exercise rights and our compliance obligations.

4. Legal Basis for Processing

Processing is based on:

  • User consent (forms, non-essential cookies),

  • The pre-contractual or contractual performance;

  • Legitimate interest (security, service improvement),

  • Compliance with legal obligations, where applicable,

  • The legal obligations to which we are subject.

5. Retention Period

Data is retained for the following periods:

  • Platform account data: duration of the contract (plus the applicable reversibility period);
  • Prospect and business contact data: 3 years from the last contact;
  • Billing data and accounting records: legal accounting and tax retention periods;
  • Connection logs: 12 months;
  • Cookies and tracking data: retention periods indicated in section 6.

6. Cookies

Showcase website (www.tolk.ai): The site may use cookies to ensure it functions properly, measure audience metrics, and improve the user experience. You can configure your browser to refuse all or some cookies. Your consent is managed via Complianz; you can withdraw your consent at any time via the cookie manager accessible in the footer.

Genii chat widget: As long as no interaction has taken place, the widget does not store any data. Upon the first interaction, technical data is stored in the browser’s localStorage (widget state, browser language, conversation history, and conversation and user identifiers). This information does not track users across other sites or tabs.

The platform: It uses cookies strictly necessary for its operation (authentication, security, session preferences), which are exempt from consent. Other trackers (audience measurement, where applicable) are only placed with user consent, collected and modifiable at any time via the cookie management module. Details of the trackers used, their purposes and their retention periods are provided in that module.

7. Recipients

The data is accessible only to authorized tolk.ai teams, on a need-to-know basis, as well as to our technical subcontractors involved in providing our services (hosting, operations, internal tools), whose up-to-date list is published on the Trust Center available at https://helpcenter.tolk.ai/trust-center. We do not sell or rent your data to third parties. It may be disclosed to authorities where required by law.

8. Hosting and Transfers

Data is hosted in France or, on a transitional basis where applicable, within the European Union, on the infrastructure described in the Trust Center. No personal data transfer outside the European Union takes place without the appropriate safeguards required under Chapter V of the GDPR.

9. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure. These measures comply with Article 32 of the GDPR.

In the event of a data breach likely to result in a risk to individuals’ rights and freedoms, we notify the authorities and/or our Clients within the timeframes set out by the GDPR.

10. User Rights

In accordance with applicable regulations, you have the following rights: right of access, right to rectification, right to erasure, right to restriction of processing, right to object, right to data portability, and the right to withdraw your consent at any time.

You may exercise your rights by contacting our DPO at dpo@tolk.ai. Proof of identity may be requested in case of reasonable doubt about the identity of the requester.

You also have the right to lodge a complaint with the French Data Protection Authority (CNIL, at www.cnil.fr)

11. Protection of Minors

Our showcase website (www.tolk.ai) is not intended for individuals under the age of 18, and as data controller, we do not knowingly collect personal data concerning minors.

12. Links to Third-Party Sites

The website may contain links to third-party sites. We are not responsible for the privacy policies or practices of these external sites.

13. Our Role as Processor on Behalf of Our Clients

When you interact with a conversational agent deployed by one of our clients on their own interfaces, that client is responsible for processing your data; tolk.ai processes it on their behalf, under their instructions, as a data processor, under the terms of the data processing agreement available at: https://www.tolk.ai/legal/dpa.

To exercise your rights regarding this data, please contact that client directly; any request sent to us directly will be forwarded to them without delay.

In this context, the data is neither used to train artificial intelligence models nor shared with other clients or third parties other than subcontractors necessary for the service.

More information: https://www.tolk.ai/legal/politique-confidentialite-genii

14. Changes to this Policy

We reserve the right to modify this policy at any time. The current version is the one published on this page.