Privacy policy
What we collect, why we process it, where it is stored, how long we keep it and how to have it removed. Written to be read, not to be survived. Last updated 4 August 2026.
What this policy covers
This policy explains what personal data Takallam collects, why it is processed, where it is stored, how long it is kept and what rights you have over it. It covers this website, takallam.ai, and the Takallam platform.
Takallam is built and operated in the United Arab Emirates. Takallam is pre-launch, so most of the processing described in the customer sections below begins only once a business has an account with us, and is governed by the written agreement signed with that business.
Two things are worth saying before anything else. We do not sell personal data. And we do not use one customer’s conversations to train models that serve another customer.
Last updated
4 August 2026.
The information we collect
If you visit this website
- The pages you view and the order you view them in.
- The page or search that referred you, where your browser sends it.
- An approximate location at city or country level, derived from your IP address.
- Device type, browser, and whether you are reading the English or the Arabic version.
This is aggregate measurement so we can tell which pages are useful. We do not build advertising profiles from it.
If you join the waitlist
- Your name and work email address.
- Your company name and website.
- The channels you are interested in and the languages your customers use.
- A rough monthly conversation volume.
- Anything you choose to type into the message field.
If you email us
Your email address, the content of your message, anything you attach, and the record of our reply.
If your business uses the Takallam platform
When a business uses Takallam to answer its own customers, those conversations pass through the platform. Depending on the channel, that can include:
- Voice recordings and their transcripts, from phone calls and QR voice sessions.
- Chat messages from the web embed or a mobile SDK.
- The number, session identifier or QR code the conversation arrived on, with timestamps.
- Anything the end customer volunteers in the conversation — a booking reference, an order number, a name, a complaint.
- The records the platform creates around the conversation: tickets, notes, escalations, workflow runs and analytics.
- Account data for the business itself — the names, email addresses and roles of the people who use the console.
Takallam processes end-customer conversation data on behalf of that business rather than for its own purposes. The next section explains what that means in practice.
Controller and processor
Data-protection law separates the party that decides why data is processed — the controller — from the party that processes it on the controller’s instructions — the processor. Which one Takallam is depends on whose data it is.
Where Takallam is the controller
For visitors to this website, waitlist submissions, people who email us and our own business contacts, Takallam decides why and how the data is processed, and is therefore the controller.
Where Takallam is the processor
For end-customer conversation data, the business using Takallam is the controller and Takallam is the processor. We act on that business’s documented instructions, as set out in the agreement between us. We do not decide what its customers are asked, what is retained, or what happens to the record afterwards.
- The business sets retention periods, and controls deletion and export.
- The business decides which of its people can see which conversations.
- If an end customer asks us directly to access or delete their data, we refer them to the business and help the business respond.
Why we process it
- To operate and secure this website, and to understand which pages are read.
- To respond to waitlist submissions and enquiries — to reply, to ask follow-up questions, and to put together a quote.
- To provide the platform to business customers: running agents, answering their customers, creating tickets, running workflows and producing analytics.
- To keep the service secure and free of abuse, including rate limiting, spam and fraud detection, and investigating incidents.
- To improve reliability and quality — diagnosing failures, and measuring latency and answer accuracy.
- To meet legal, tax and regulatory obligations.
Where processing depends on your consent — a non-essential cookie, or a marketing email — you can withdraw that consent at any time. Withdrawing it does not affect anything processed before you did.
Model training
We do not use one customer’s end-customer conversation data to train general-purpose models for other customers or for the public. Where conversation data is used to improve that customer’s own agents, the customer controls it in their settings and can switch it off.
Cookies and measurement
This site uses a small number of cookies and equivalent browser storage.
- Essential — remembering whether you are reading English or Arabic, keeping forms working, and protecting against automated abuse. These cannot be switched off without breaking the site.
- Measurement — counting visits, which pages are read, and where visits arrive from, in aggregate.
You can block or delete cookies in your browser, and the site will keep working without the non-essential ones. We do not run third-party advertising trackers on this site.
Where your data is stored
In the UAE region by default. Conversations, transcripts, knowledge bases, tickets and the analytics derived from them are held in the me-central-1 region, inside the United Arab Emirates.
Data is encrypted in transit and at rest.
Where a specific capability requires a sub-processor that operates outside the UAE, we transfer only the minimum needed for that function, under written contractual safeguards, and the arrangement is described in the agreement with the customer.
If your organisation requires that no processing at all leaves the region, raise it before signing rather than after. It is a legitimate requirement and we will tell you honestly which capabilities it constrains.
How long we keep it, and how to have it deleted
- Website measurement — individual-level records are kept for a limited period, then deleted or reduced to aggregates.
- Waitlist submissions — kept while we are evaluating and onboarding the first cohort, and deleted on request at any point.
- Emails — kept for as long as needed to deal with the matter and to keep a record of the correspondence.
- End-customer conversation data — kept for the retention period the business customer configures. When that period expires, the record is deleted.
- Account data — kept for the life of the account and deleted after it closes, other than what we are required to keep for legal or tax reasons.
Deletion is controlled by the customer
A business customer can delete an individual conversation, a knowledge base document, or an entire workspace from the console, and can set retention so that deletion happens automatically without anyone having to remember. Deletion removes the record from live systems straight away, and from backups as the backup rotation expires.
If you are not a customer
To have your waitlist entry or your email correspondence deleted, write to [email protected] and say so. You do not have to give a reason.
Sub-processors
Takallam uses a small number of third parties to deliver the service. By category, they cover cloud infrastructure and storage in the UAE region; speech recognition, speech synthesis and language models; telephony carriage for inbound numbers; transactional email delivery; error monitoring and logging; and payment processing once billing begins.
Each is bound by a written contract, receives only the data its function requires, and is not permitted to use that data for its own purposes.
We do not publish the list on this page, because it changes and a stale list is worse than no list. We maintain a current one and provide it to customers on request, together with advance notice before a new sub-processor begins processing customer data. Email [email protected] for the current version.
How we protect it
- Encryption in transit and at rest.
- Role-based access control on the principle of least privilege. Internal access to customer data is limited to what is needed to operate and support the service, and is logged.
- Multi-factor authentication on internal systems.
- Separate development and production environments, with no production customer data used in development.
- Audit logging of administrative actions taken in the console.
- Regular patching of dependencies and infrastructure.
- Backups, with restores tested rather than assumed.
What we do not claim
Takallam does not currently hold SOC 2, ISO 27001, HIPAA or PCI certification, and we will not imply otherwise on a page you might rely on. The platform is built to support that work — data residency, access control, retention control and audit logging are design properties rather than later additions — and this page will be updated when the status changes.
No system is completely secure. If you believe you have found a vulnerability, email [email protected] and we will respond.
What you can ask us to do
Depending on where you are and which law applies, you may have the right to:
- Ask what personal data we hold about you, and receive a copy of it.
- Have inaccurate or incomplete data corrected.
- Have data deleted.
- Restrict or object to certain processing.
- Receive your data in a portable format.
- Withdraw consent you previously gave.
- Complain to the relevant supervisory authority.
To exercise any of these, email [email protected]. We may need to verify your identity first, particularly for access and deletion requests. We will respond within the period the applicable law allows, and sooner where we can.
If your data reached us through a business
If you contacted a company that uses Takallam and your conversation was handled by one of its agents, that company is the controller of your data and your request should go to them. If you send it to us, we will pass it on and help them respond, but we cannot act on it directly.
Changes to this policy
We may update this policy. The version on this page is always the current one and carries its date. If a change materially affects how personal data is handled, we will update that date and, where a business has an account with us, notify the contact on that account.
Contact
[email protected] — Takallam, United Arab Emirates. A person reads it.
This policy was last updated on 4 August 2026.
Questions about how your data is handled?
Send them to [email protected]. If you are running a security or procurement review, say so and we will answer the questionnaire rather than send you a brochure.
Last updated 4 August 2026 · United Arab Emirates