Legal

Privacy Policy

Effective date: October 26, 2026 · Applies to telliola.com and the Telliola desktop app (beta)

1. Who we are

Telliola is a desktop app for Windows that records calls, transcribes them and writes recaps. It is currently in closed beta. The app, the built-in service and this website are provided by Costless Inc., 1207 Delaware Ave, 2979, Wilmington, DE, USA (“Telliola”, “we”, “us”).

For data we process for our own purposes — the website, the built-in service, beta accounts and emails you send us — we are the data controller. Questions about privacy: privacy@telliola.com.

2. This website

telliola.com does not use cookies, local storage, analytics, advertising pixels or any other trackers. Fonts and images are served from our own domain; we don't load third-party scripts.

The site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes technical data needed to deliver the pages and protect them from abuse — such as your IP address, browser user agent and the requested URL. We don't use this data to identify you.

3. Data that stays on your device

The Telliola app works locally. The following is created and stored on your computer, and we have no access to it:

• Recordings — audio files in WebM/Opus format, with your microphone on the left channel and the computer's sound (the other participants) on the right channel. Stored in Documents\Telliola (or another folder you choose).
• Transcripts and recaps, plus recording details such as title, date, duration, detected call app, speaker names and, if you connected Google Calendar, the matched calendar event — stored next to the recordings.
• Settings in %APPDATA%\Telliola. Secrets — your API keys and your Google sign-in token — are encrypted with Windows DPAPI, so they can only be decrypted by your Windows user account.

To detect calls, the app checks on your computer which app is using the microphone and the titles of browser tabs (to recognize Google Meet). This check happens only on your device; nothing about it is sent to us.

4. Using your own API keys

You can connect your own accounts with AI providers. In that case the app sends data directly from your PC to the provider, and Telliola does not receive or store it:

• ElevenLabs (speech-to-text) receives the audio of the recording you choose to transcribe.
• Anthropic or OpenAI (summaries) receives the transcript with speaker names and recording details (title, date, duration, call app) and, if you connected Google Calendar, the title of the matched event and the names or email addresses of its invitees. These help the model name the people who own action items.

The provider processes this data under your agreement with them and their own privacy policy. You can switch providers or remove keys at any time in the app's settings.

5. The built-in service

We are introducing a built-in service for beta testers who don't want to use their own keys. When you use it:

• The app uploads the recording's audio to our server on Amazon Web Services in the eu-central-1 (Frankfurt, Germany) region.
• We send the audio to ElevenLabs to transcribe it, and the transcript (with the same recording and calendar details described in section 4) to Anthropic to write the recap. The results are returned to your app.
• We keep the audio on our server for at most 24 hours, only to transcribe and summarize it, and then delete it.
• For your account we record usage metrics — minutes of audio processed, AI tokens used and their cost — together with an account identifier such as your email address. We use these only to run the service and enforce limits (during the beta, 10 hours of audio per month).

We don't use your recordings, transcripts or recaps to train AI models, and we don't sync anything else. Your recordings stay on your device.

6. Google user data

Signing in with Google is optional. If you connect your Google account, Telliola requests only these permissions:

Where Google data goes. The matched event details are saved on your device with the recording. As described in sections 4 and 5, the event title and invitee names or email addresses are included in the request that creates the recap (sent to Anthropic or OpenAI) — only to produce that recap for you. Your Google sign-in token is stored on your device, encrypted with Windows DPAPI. Google data is not sent to Telliola's servers, except as part of a recap request through the built-in service.

Limited Use. Telliola's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we:

• use Google user data only to provide and improve the user-facing features described above;
• transfer it to others only as needed to provide those features (such as the recap request), for security, or to comply with law;
• never sell it, never use it for advertising, and never use it to train or improve general AI or machine-learning models;
• don't allow humans to read it, unless you give us permission (for example, when asking for support), it's needed for security or to comply with law.

You can disconnect Google in the app's settings, which revokes Telliola's access. You can also remove access at any time at myaccount.google.com/permissions.

7. Contact look-ups

• LinkedIn. The LinkedIn button opens an ordinary LinkedIn people search for a participant's name in your web browser. Telliola does not scrape LinkedIn or receive any data from it.
• Apollo and Lusha. These buttons appear only if you add your own Apollo or Lusha API key. When you click one, the app sends that single person's name and email address directly from your PC to the provider to look up their public business profile. One person per click; nothing is sent in bulk. The provider handles the request under your agreement with them.

8. When you email us

If you write to hello@telliola.com or privacy@telliola.com — for example, to join the beta — we receive your email address, name and whatever you include in the message. We use it to reply, manage the beta and send you the information you asked for. Our email runs on Google Workspace.

9. Service providers

We use the following providers to run the website and the built-in service. Providers you connect with your own keys (section 4 and 7) work for you, not for us.

We don't sell personal data and don't share it with advertisers or data brokers.

10. International transfers

Our server is in the EU. Some providers above may process data outside the European Economic Area, for example in the United States. Where that happens, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or the provider's certification under the EU–US Data Privacy Framework.

11. Legal bases (GDPR)

• Contract — to provide the app, the beta and the built-in service you asked for.
• Consent — for optional features such as connecting Google. You can withdraw consent at any time; this does not affect processing that already happened.
• Legitimate interests — to keep the service secure, prevent abuse, enforce usage limits and answer your emails.
• Legal obligation — where the law requires us to keep or disclose data.

12. How long we keep data

13. Your rights

If the GDPR or similar laws apply to you, you have the right to access your personal data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent. To use these rights, email privacy@telliola.com. We'll answer within one month.

You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work.

14. Deleting your data

• On your PC: delete individual recordings in the app (they go to the Windows Recycle Bin — empty it to remove them for good), or delete the folders Documents\Telliola and %APPDATA%\Telliola. Uninstalling the app keeps both folders, so you don't lose recordings by accident; delete them yourself if you want everything gone.
• Google access: disconnect Google in the app or at myaccount.google.com/permissions.
• Built-in service and beta account: email privacy@telliola.com and we'll delete your account and usage data, except anything we must keep by law.

15. Security

We keep data on your device wherever possible, encrypt stored secrets with Windows DPAPI, use encrypted connections (HTTPS/TLS) to every service, and limit what our server keeps and for how long. No system is perfectly secure; if you notice a security issue, please tell us at privacy@telliola.com.

16. People in your recordings

Calls include other people's voices and words. You decide what to record, and you are responsible for telling participants that the call is recorded and for following the consent laws that apply to you and to them. When the built-in service processes a call, we do so only to give you its transcript and recap.

17. Children

Telliola is a work tool and is not directed at children. We don't knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we'll delete it.

18. Changes to this policy

We'll update this policy when the app or the law changes, and change the effective date above. If a change materially affects how we use your data, we'll tell beta testers by email or in the app before it takes effect.

19. Contact

Costless Inc., 1207 Delaware Ave, 2979, Wilmington, DE, USA
Email: privacy@telliola.com