Privacy Policy

Tealfeed Private Limited (“Tealfeed”, “we”, “us”) runs Tealfeed AI: the website tealfeed.ai, the web app at app.tealfeed.ai, and the Tealfeed AI apps for Android and iPhone (together, the “Services”). Tealfeed AI is where appointment-based professionals run their business: a public store, bookings and calendar, client records, chat, payments and invoices, recommendations and Discover, and TIA, an AI assistant.

This Policy is our notice to you under India’s Digital Personal Data Protection Act, 2023 and its Rules (“DPDP”), the EU and UK General Data Protection Regulation (“GDPR”), and other privacy laws that apply to you. It tells you what personal data we process and why, so that you can decide whether to give it. Where the law needs your consent, we ask for it separately and clearly, and you can withdraw it at any time (see Consent). You can read this Policy in English, and you can ask us for it in any language listed in the Eighth Schedule to the Constitution of India.

1. Who we are and how to reach us

Tealfeed Private Limited, 3rd Floor, Innov8, Orchid Centre, Golf Course Road, Sector 53, Gurugram, Haryana 122011, India.

• Privacy questions and requests: contact@tealfeed.com.
• Grievance Officer and Data Protection Officer: Rohit Garg, rohit@tealfeed.com, at the address above. You can raise any complaint about how we handle your data with him, and we will respond within 30 days.

2. Members, Clients and who is responsible

Members are the professionals and businesses who create a Tealfeed AI account. Clients are the people who book a Member, buy from a Member’s store, or whom a Member keeps in their client records. Visitors who only browse a store are covered too.

• For a Member’s account, profile, chats, recommendations, Discover and TIA, Tealfeed decides why and how the data is used. We are the data fiduciary (DPDP) and the controller (GDPR).
• For the client records, bookings, notes, invoices and files a Member keeps about their own Clients, the Member is the data fiduciary or controller, and Tealfeed is their data processor. We use that data only to provide the Services to that Member, on their instructions. The Member is responsible for having a lawful reason to keep it, and for answering their Clients’ requests. If you are a Client, you can contact the business directly, or write to us and we will pass your request on and help.

3. What we collect

Data you give us

• Account and sign-in: name, email address, password (stored only as a bcrypt hash we cannot read), and, if you use them, your mobile number and the name and email that Google or Apple share when you sign in with them. Apple may give us a private relay email instead of your real one.
• Profile and store: username, photo and cover image, headline, about, city, website and social links, experience and education, and the services, prices, availability, articles, deals, listings and products you publish.
• Clients and contacts: the people in your contact book (names, emails, phone numbers, companies, labels, notes, how you met and who referred them), whether you add them by hand, import a file, or sync them from your phone (see Contacts from your phone).
• Bookings, orders and payments: what was booked or bought, when, for how much, the answers to booking questions, and the payment status and reference. Card and bank details go to the payment provider, not to us (see Payments).
• Messages: chats with other Members, group chats and introductions, the photos and files you send in them, and whether a message was delivered and read (see Chats).
• Recommendations: what you write when you recommend someone, and the recommendations you accept.
• Tasks, notes, documents and deal rooms: what you write and upload to run your work.
• TIA: what you type or say to TIA, the files you attach, and its replies (see AI features).
• Support and reports: what you send us when you ask for help or report someone.

Data collected as you use the Services

• Device and notifications: a device identifier and, if you allow notifications, the push token Google or Apple gives your phone. Nothing else on your phone is read unless you choose a feature that needs it (your contacts, microphone or photos), and the phone asks your permission first.
• Usage: the features you use and the actions you take (for example, which Discover posts you open or save), linked to your account, to run and improve the Services.
• Diagnostics and security: error reports (the page, your account id, IP address and browser), page speed measurements (without your account id), and sign-in and security events (IP address, device and email).
• Approximate location: the country your connection comes from, worked out from your IP address, to choose currencies and payment options and to apply a business’s country rules at booking. We never collect your precise location.

Data from others

• A Member may add you to their contacts, or record that someone referred you.
• Another Member may recommend you, or introduce you to someone.
• Payment providers tell us whether a payment succeeded.
• Google, if you connect Google Calendar or Google Meet (see Google user data).

4. What is public, and who can see what

• Your store and profile are public by default: your name, username, photo, headline, about, city, links, experience and education, and the services, articles, deals, listings and products you publish. You can make the page private (anyone with the link) or turn it off, and set each item to public, link only, contacts, selected people, or nobody.
• Recommendations stay hidden until the person recommended accepts them. Even then, your store shows recommendations given or received only if you switch that on. Either side can delete a recommendation.
• Discover shows a Member’s posts to people who can already see their page, and to people who have them in their contacts. Next to a post, it may show up to three people you know who recommend it. It never shows anyone’s contact list.
• Your email and phone number are never shown to another Member because of a chat alone. They appear only where you put them on your store, or when a booking exists between you.

5. How we use data, and our legal reasons

Under DPDP, we process your data for the purposes you consent to and for the legitimate uses the Act allows. Under the GDPR, each use rests on one of the legal reasons below.

Discover ranking is the only personalisation we do, and it never produces legal or similarly significant effects. We make no decisions about you by automated means alone that do. We never use personal data for advertising, never sell it, and never use it to train general-purpose AI models.

6. Contacts from your phone

In the Android and iPhone apps you can sync your phone’s contacts. Nothing is read until you tap to sync and your phone grants permission.

• What is read: each contact’s name, email addresses and phone numbers. Nothing else from your address book.
• Where it goes: into your own contact book in the workspace you are using. It is private to you (and to teammates with access to that workspace).
• How it is used:
  • The emails and phone numbers are matched against Tealfeed AI accounts, to show which of your contacts are on Tealfeed AI.
  • They also decide whose posts and recommendations reach you in Discover. Other Members see posts from people in their own contacts, never your list.
• What we never do: message, email or invite your contacts, show your list to anyone, sell it, or use it for advertising.
• Your control: turn off “Keep syncing” (which otherwise syncs once a day), remove all synced contacts in one step, or revoke the permission in your phone’s settings.

Importing a contacts file works the same way. When you add someone’s details, you are responsible for being allowed to share them with us for these uses.

7. Chats and messages

• Who you can message: other Members in your contacts. Blocked accounts, and accounts that blocked you, cannot message you.
• Introductions open a group chat only after both people agree.
• Photos and files you send are stored in our file storage. They open through links that expire within minutes.
• Delivered and read: we record when a message reaches the other person’s phone and when they read it, and show that as ticks. You can turn read receipts off in Settings, which also hides other people’s from you.
• Notifications for a new message show the sender’s name and the start of the message, as your phone displays them.
• Encryption: messages are encrypted in transit and at rest, but they are not end-to-end encrypted. Our staff do not read your messages, except where you report a conversation, where we must investigate abuse or a security issue, or where the law requires it.
• Deleting: deleting a chat removes it from your view only. The other person keeps their copy. When you delete your account, your one-to-one chats and your messages in groups are deleted.

If you report someone, we receive the conversation’s last 15 messages, or the post or profile you reported. We never tell the reported person who reported them.

8. AI features

TIA, Tealfeed AI’s assistant, and the AI helpers (writing, workflow suggestions, importing a listing from a link, and answering questions about a shared deal) run only when someone uses them.

• What TIA reads: your request, the files you attach, and the workspace data it needs to answer (profile, services, bookings, contacts, tasks, notes and documents). It works only in the workspace you are signed in to, under your role’s permissions.
• Who processes it: Anthropic, through its commercial API. Web research, when on, sends your search query through Anthropic’s web search tool.
• Voice: if you talk to TIA, the audio goes to Sarvam AI for speech recognition and spoken replies. Voice notes are saved with the TIA conversation, so you can replay them, until you delete that conversation or your account.
• It asks first: anything that changes your data or reaches a client waits for your approval.
• No training: we do not use your data, or your Clients’ data, to train, fine-tune or improve any AI model, ours or anyone else’s. Our AI providers process it only to return a response.
• Advice: AI output can be wrong. It is not professional, legal, medical or financial advice, and you remain responsible for what you send or publish.

9. Google user data

You can sign in with Google, and you can connect Google Calendar and Google Meet. Each is separate and optional, shows Google’s own consent screen first, and can be disconnected at any time. We ask only for the narrowest access each feature needs.

Google sign-in

Scopes openid, userinfo.email and userinfo.profile: your name, email address and profile photo, to create and sign in to your account.

Google Calendar

• calendar.calendarlist.readonly: lists your calendars, so you can choose which ones to use.
• calendar.events.readonly: reads events on the calendars you choose, so your schedule shows in Tealfeed AI and busy times are never double-booked.
• calendar.events.owned: writes events on calendars you own. We create, update and cancel the events Tealfeed AI makes for your bookings, with the client as a guest. We change another event only when you act on it from your Tealfeed AI calendar (answer, move or remove it). We never change an event on our own.

Calendar events are read when needed to show your calendar and work out availability. We do not copy their contents into our database.

Google Meet

meetings.space.created: creates Meet links for your bookings. We cannot read or join meetings we did not create, and this connection has no access to your calendar.

How Google user data is protected and used

• Everything moves over encrypted connections.
• The refresh tokens Google issues are encrypted with AES-256-GCM before storage, and never reach your browser or another user.
• We do not sell Google user data, share it with advertisers or data brokers, or use it for advertising.
• We do not use Google user data to develop, improve or train any AI or machine learning model. It is never sent to any AI provider, in raw, aggregated or derived form, and TIA never reads your Google Calendar or Meet data.
• No one at Tealfeed reads your Google data, except with your explicit permission (for example, a support request you start), where needed for security or abuse investigation, or where the law requires it.

Tealfeed’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting Google Calendar or Meet in Settings, Integrations deletes the stored tokens for it at once. You can also revoke access from your Google Account permissions. Deleting your account revokes and deletes all of them.

10. Payments

We never collect or store card numbers. Payments happen between you and a regulated payment provider, and we receive only the outcome and reference.

• Stripe, Razorpay or Cashfree, connected by the Member to their own account, which the provider pays directly. Depending on the provider, it receives the payer’s name, email and phone number.
• Tealfeed Pay, an option for bookings in Indian rupees. The payment is collected on Tealfeed’s account through Razorpay Route, held until the booking is honoured, then transferred to the Member. The Member’s payout bank details are encrypted and sent to Razorpay to set up the transfer.
• Our own plans are billed through Stripe, which receives your name and email.

Each provider handles payment data under its own privacy policy, as an independent controller.

11. Who we share data with

We do not sell personal data, and we do not share it for advertising. Tealfeed AI contains no advertising or tracking code, and we do not track you across other companies’ apps or websites. We share data only:

• Between the people involved: a booking shares the details both sides need (names, service, time, meeting link), and messages reach the people you send them to.
• With service providers who process it for us, under contracts that require them to use it only on our instructions and keep it secure (listed below).
• With a channel you connect, such as WhatsApp (Meta) for a Member’s business number.
• For legal reasons: where the law, a court or a lawful government request requires it, and to protect people from harm, fraud or abuse.
• In a business transfer, as described in section 21.

12. Where data is stored, and transfers abroad

We store your data in India: our database, files and application servers are in Mumbai. Some providers above process data in other countries, mainly the United States and the European Union. DPDP allows these transfers except to countries the Government of India restricts, and we will follow any such restriction. For data from the EU, the UK or Switzerland, we rely on adequacy decisions or the European Commission’s Standard Contractual Clauses (and the UK addendum) with our providers, so the same protections travel with the data.

13. Cookies and storage on your device

• One essential cookie keeps you signed in to the web app (tf.app.sid). It is secure, HttpOnly and expires after 24 hours of inactivity. It cannot be switched off without signing you out.
• Storage on your device remembers your preferences (theme, layouts, TIA settings), unsent drafts (up to 7 days), and a copy of recent data so the app opens quickly (up to 7 days). This copy is cleared when you sign out or switch accounts.
• Analytics: the web app uses Vercel Web Analytics and Speed Insights, which set no cookies. Private parts of links are masked first.
• Checkout: the payment provider’s own code loads only when you pay, under its own policy.
• No advertising: no advertising cookies, tracking pixels or cross-site trackers. The marketing site tealfeed.ai has no analytics at all.

14. How long we keep data

We keep personal data only while we need it for the purposes above. When it is no longer needed, we delete it, or keep it in a form that no longer identifies you.

When you delete your account, we delete your personal data, revoke and delete your connected accounts, and keep only a record that the deletion happened. Two exceptions:

• We keep what the law requires us to keep, such as invoices.
• Records another business keeps about you as their client stay with that business. You can ask them, or us, to remove them.

Deleted data can remain in encrypted backups for a short time, until those backups expire.

15. How we protect data

• All traffic uses HTTPS (TLS), everywhere, including inside the apps.
• Data is encrypted at rest by our database and storage providers.
• Passwords for connected services, payment keys, bank details and refresh tokens get an extra layer of encryption (AES-256-GCM) before storage.
• Passwords are stored only as bcrypt hashes. Every sign-in needs a second step: a one-time code by email or text message.
• Sign-in, code and account-change attempts are rate-limited, and changing your email, phone or password needs a fresh code.
• Inside a workspace, each person sees and does only what their role allows. This is enforced on our servers, and changes are logged.
• Staff access to production is limited to the people who need it, requires two-factor authentication, and is bound by confidentiality.
• Private files open only through links that expire within minutes.

No system is perfectly secure, but we work continuously to find and fix weaknesses.

16. Your rights

Depending on where you live, you have these rights.

• Access: get a summary of your data, how we process it, and who we shared it with.
• Correction: correct, complete or update your data. Most of it you can edit yourself in the app.
• Erasure: delete your data. In the app, go to Settings, Personal, Delete account. On the web, see tealfeed.ai/delete-account.
• Portability: receive your data in a machine-readable format. You can download invoices yourself; ask us for everything else.
• Objection and restriction: object to processing based on our legitimate interests, or ask us to limit it.
• Withdraw consent: at any time, as easily as you gave it (see Consent).
• Nominate (India): name someone to exercise your rights if you die or become unable to.
• Grievance redressal: complain to our Grievance Officer (see section 1).

To use any right, email contact@tealfeed.com from the email on your account, or write to the Grievance Officer. We may ask you to confirm it is you. We respond within 30 days, and it is free.

• In India, if you are not satisfied with our answer, you can complain to the Data Protection Board of India.
• In the EU, the UK or Switzerland, you can complain to your local data protection authority.
• In California and other US states with privacy laws: we do not sell or share personal information for cross-context behavioural advertising, and we will not treat you differently for using your rights.

17. Consent, and withdrawing it

We ask for consent at the moment a feature needs it:

• contact sync, and your phone’s contacts permission;
• notifications, and your phone’s notification permission;
• the microphone, for TIA voice;
• connecting Google Calendar or Meet;
• product news by email.

To withdraw consent:

• turn the feature off in the app’s Settings;
• revoke the permission in your phone’s settings;
• disconnect the integration; or
• email us.

Withdrawing does not affect what we did before, but some features will stop working without it.

18. Children

Tealfeed AI is a business tool for adults. You must be at least 18 to create an account, and we do not knowingly collect personal data from children.

• A person under 18 who needs a booking should book through a parent or guardian.
• Members who serve children must obtain verifiable consent from a parent or guardian before keeping a child’s data on Tealfeed AI.
• If you believe a child has given us their data, write to us and we will delete it.

19. If something goes wrong

If a breach puts your personal data at risk, we will tell you without undue delay: what happened, what it may mean for you, and what we are doing about it. We will also report it to the Data Protection Board of India, and to other authorities as the law requires (within 72 hours where the GDPR applies).

20. If you are a business using Tealfeed AI

When you keep your Clients’ data on Tealfeed AI, you decide why you keep it, and we process it for you. We:

• process it only to provide the Services to you;
• keep it confidential and secure;
• use the providers listed above;
• help you answer your Clients’ requests;
• tell you of a breach that affects it;
• delete it when you delete it, or when your account ends.

Write to contact@tealfeed.com if you need a data processing agreement.

21. If Tealfeed changes hands

If Tealfeed is involved in a merger, acquisition, reorganisation or sale of assets, your data may pass to the new owner, still under this Policy. We will tell you before that happens, and you can delete your account first.

22. Changes to this Policy

We will post any change here, with a new date at the top. If a change is material, we will tell you by email or in the app before it takes effect. Where it needs your consent, we will ask for it again.

23. Contact

• Questions and requests: contact@tealfeed.com.
• Grievance Officer and Data Protection Officer: Rohit Garg, rohit@tealfeed.com.
• By post: Tealfeed Private Limited, 3rd Floor, Innov8, Orchid Centre, Golf Course Road, Sector 53, Gurugram, Haryana 122011, India.

Our Terms of Use cover your use of the Services more broadly.