1. Introduction
TalkSense ("TalkSense", "we", "us", or "our") is a social media automation platform operated by TalkSense Technologies Limited, a company registered in Nigeria. This Privacy Policy describes how we collect, use, disclose, retain, and protect information about you when you use our website at talksense.app and our web application (collectively, the "Service").
By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with its terms, please do not use the Service.
This policy is designed to comply with the Nigeria Data Protection Regulation (NDPR) 2019, and to meet the standards of applicable international privacy frameworks including the GDPR principles.
2. Who We Are
The data controller responsible for your personal data is:
TalkSense Technologies Limited
Abuja, Nigeria
Data Protection Officer & general enquiries: [email protected]
3. Data We Collect
3.1 Account Registration Data
When you create a TalkSense account, we collect your email address, name (optional), and a hashed version of your password (we never store passwords in plaintext).
3.2 Twitter / X OAuth Data
When you connect an X account via OAuth 2.0, Twitter provides us with your Twitter user ID, username, display name, and profile picture URL. Twitter also issues access and refresh tokens that authorise TalkSense to act on your behalf within the scopes you approve.
Token storage: Access tokens and refresh tokens are encrypted using AES-256-GCM before being written to our database. The encryption key is stored separately from the database and is never logged or transmitted in cleartext. We do not store your Twitter password.
3.3 Content & Action Data
TalkSense stores all Actions it generates or you create — including tweet text, reply text, target tweet IDs, scheduling times, and AI metadata (model used, confidence score, AI reasoning). This data constitutes your content history and feeds your analytics dashboard.
3.4 Configuration Data
Settings you configure — brand personality, tone, topic keywords, blacklists, forbidden topics, posting schedules, and engagement rules — are stored as part of your account.
3.5 AI Request Logs
For each AI request made on your behalf, we log the task type, model used, token counts, latency, success status, and any error messages. This data powers the AI usage analytics in your dashboard and helps us diagnose issues.
3.6 Billing Data
Payment processing is handled entirely by Paystack. TalkSense receives only the Paystack customer code, subscription code, and plan details after a successful payment. We never receive or store your card number, CVV, or bank credentials.
3.7 Usage & Technical Data
We collect standard server-side logs including IP addresses, browser type, request timestamps, and error traces solely for security, abuse prevention, and service reliability. These logs are retained for a maximum of 90 days.
4. How We Use Your Data
| Purpose | Data Used |
|---|---|
| Provide and operate the Service | Account data, Twitter tokens, content, configuration |
| Authenticate and secure your account | Email, hashed password, JWT tokens, IP address |
| Generate AI content on your behalf | Topics, brand settings, preferred model |
| Execute social actions on Twitter | Encrypted Twitter tokens, action content |
| Display your analytics dashboard | Action history, AI logs, engagement outcomes |
| Process subscription payments | Email (passed to Paystack), plan selection |
| Send transactional emails | Email address, account events |
| Prevent abuse and enforce limits | Rate-limit counters (stored in Redis), IP address |
| Improve the service | Aggregated, anonymised usage patterns |
| Comply with legal obligations | Any data required by applicable law |
5. Legal Bases for Processing
Where we are required to identify a legal basis for processing personal data (as required under NDPR and equivalent frameworks), we rely on the following:
- Contractual necessity: Processing required to provide you the Service under our Terms of Service — account creation, authentication, AI generation, and action execution.
- Legitimate interests: Security logging, abuse prevention, error monitoring, and aggregated service analytics, where these interests are not overridden by your rights.
- Legal obligation: Retaining records required by Nigerian tax, corporate, or regulatory law.
- Consent: Marketing emails, where applicable. You may withdraw consent at any time by clicking "unsubscribe" in any such email.
6. Data Sharing & Disclosure
6.1 Service Providers
We share data with the following categories of sub-processors strictly as required to deliver the Service:
- MongoDB Atlas — database hosting (account data, actions, settings)
- Upstash (Redis) — queue, rate-limit counters, OAuth state storage
- OpenRouter — AI inference routing (tweet content and brand context are transmitted to the model provider)
- Paystack — payment processing (email only; no financial data touches our servers)
- Render — application hosting
- Vercel — frontend hosting
Each provider is bound by data processing agreements and must process your data only as instructed by TalkSense.
6.2 Legal Disclosures
We may disclose your data if required to do so by Nigerian law, court order, or lawful request by a government authority. We will notify you of any such disclosure where legally permitted to do so.
6.3 Business Transfers
If TalkSense is acquired, merged, or undergoes a change of ownership, your data may be transferred to the successor entity. We will provide notice of any such transfer and the successor will be bound by this Privacy Policy or a materially equivalent one.
6.4 No Sale of Data
TalkSense does not sell, rent, auction, or otherwise transfer your personal data to any third party for their own commercial purposes. This commitment is unconditional and not subject to opt-out.
7. X (Twitter) Integration
TalkSense integrates with X (Twitter) via the official X API v2 and OAuth 2.0 PKCE protocol. By connecting your X account, you authorise TalkSense to:
- Read your public account information (user ID, username, name, profile picture)
- Post tweets on your behalf
- Reply to tweets on your behalf
- Like tweets on your behalf
- Read public tweet content (for topic listening and conversation context)
- Refresh your access token using the offline.access scope
TalkSense does not request access to your direct messages, followers list, or any data beyond the scopes listed above.
Your use of the X integration is also governed by X's Terms of Service and Privacy Policy. TalkSense is not responsible for X's data practices.
You can revoke TalkSense's access to your X (Twitter) account at any time from X's Connected Apps settings, or by disconnecting from the TalkSense dashboard. Revocation will not delete data already stored by TalkSense; a separate deletion request is required for that.
8. Data Retention
| Data Type | Retention Period |
|---|---|
| Account data (email, name, plan) | Duration of account + 30 days after deletion request |
| Encrypted Twitter tokens | Duration of connection; destroyed immediately on disconnect |
| Action history (posts, replies, likes) | Duration of account + 30 days after deletion request |
| AI request logs | 90 days rolling |
| Server / access logs | 90 days rolling |
| OAuth state tokens (Redis) | 10 minutes (TTL enforced) |
| Rate-limit counters (Redis) | 24 hours rolling |
| Backup snapshots | 30 days; purged after account deletion |
| Billing records | 7 years (Nigerian tax law requirement) |
9. Your Rights
Under the NDPR and applicable law, you have the following rights with respect to your personal data:
Right of Access
Request a copy of all personal data we hold about you.
Right to Rectification
Correct inaccurate or incomplete personal data.
Right to Erasure
Request deletion of your personal data, subject to legal retention obligations.
Right to Restriction
Ask us to limit how we process your data in certain circumstances.
Right to Portability
Receive your data in a structured, machine-readable format.
Right to Object
Object to processing based on legitimate interests.
Withdraw Consent
Withdraw consent for processing where consent was the basis.
Lodge a Complaint
File a complaint with the National Information Technology Development Agency (NITDA).
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before processing the request.
11. Data Security
We implement the following technical and organisational measures to protect your data:
- Encryption in transit: All communication between your browser and TalkSense servers uses TLS 1.2 or higher. All communication between TalkSense and Twitter, OpenRouter, Paystack, and our database providers uses TLS.
- Encryption at rest (Twitter tokens): Twitter access and refresh tokens are encrypted with AES-256-GCM using a key stored separately from the database.
- Password hashing: Passwords are hashed using bcrypt with a work factor of 12. We never store plaintext passwords.
- OAuth PKCE: The OAuth 2.0 flow uses PKCE (Proof Key for Code Exchange) with state parameter verification to prevent CSRF and code interception attacks.
- Access control: Only authenticated users can access their own data. Our APIs enforce ownership validation on every request.
- Least-privilege infrastructure: Internal services only have the database and Redis access they need to function.
No security system is impenetrable. In the event of a data breach affecting your rights, we will notify you within 72 hours of becoming aware of the breach, as required by NDPR.
12. International Data Transfers
TalkSense's servers and sub-processors may be located outside Nigeria. When we transfer your data internationally, we ensure adequate protections are in place, including contractual safeguards with sub-processors (data processing agreements that incorporate NDPR and, where applicable, GDPR-equivalent standard contractual clauses).
The countries in which our sub-processors operate include the United States (MongoDB Atlas, Upstash, Render, Vercel, OpenRouter). Each has agreed to handle your data in accordance with our instructions and applicable privacy law.
13. Children's Privacy
TalkSense is not directed at children under the age of 13 (or 16 in jurisdictions with a higher minimum age for digital services). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact [email protected] and we will delete it promptly.
14. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page will reflect the most recent revision. For material changes, we will notify you via email to your registered address or via an in-app notice at least 14 days before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.
Previous versions of this policy are available on request.
15. Contact & Data Protection Officer
Privacy & Data Protection Enquiries
Data Protection Officer & general contact: [email protected]
We endeavour to respond to all privacy enquiries within 30 days. For complex requests, we may need up to 90 days — we will notify you if this is the case.
You also have the right to lodge a complaint with the National Information Technology Development Agency (NITDA), Nigeria's data protection authority, at nitda.gov.ng.