TealeafPrivacy policy
Last updated 21 September 2026. This policy is provided in English; translations are for convenience once available, and the English text prevails.
The short version
- Your chat is read on your device. Only the two participants' messages are sent to us, once, when you press analyse.
- We never store the messages. For a paid AI read they are held in memory only while the report is written, then discarded.
- We keep the report, the statistics and the context you typed. Delete a report and it's gone.
- No advertising, no selling of data, no tracking pixels.
1. Who we are
The data controller is faktuo s.r.o., a company registered in the Czech Republic, registered office č.p. 707, 783 16 Dolany, company ID (IČO) 29503876, registered with the Regional Court in Ostrava, file C 103763. You can reach us about anything in this policy at [email protected].
2. What Tealeaf does
You upload an exported WhatsApp conversation between you and one other person. Tealeaf computes statistics from it (message counts, reply times, activity by time of day, emoji use) and, if you pay for an AI read, sends the messages to a language model that writes a report about the conversation.
3. What we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| The chat messages between you and the other person | Computing statistics on your device and, for a paid read, producing the AI report | Your explicit consent (Art. 6(1)(a) and Art. 9(2)(a)), given by the toggle before your first analysis. Conversations often contain sensitive information (health, sexuality, beliefs), which is why we ask for explicit consent. | Not stored. Statistics: computed in your browser. AI read: held in server memory only for the duration of the request, typically under two minutes, then discarded. |
| The context you enter: names as they appear in the export, age band, gender, relationship type, your question, any real-life moments you add | Shaping the analysis and labelling your report | Performance of the contract (Art. 6(1)(b)) | Until you delete the report or your account |
| The computed statistics and the finished report | Showing you your report and keeping it in your history | Performance of the contract (Art. 6(1)(b)) | Until you delete the report or your account |
| Your email address, sign-in tokens, session cookie | Signing you in without a password, keeping your reports under your account | Performance of the contract (Art. 6(1)(b)) | Email: life of the account. Tokens: 20 minutes. Sessions: 30 days. |
| Purchase records (pack, amount, Stripe session reference) | Crediting your account, accounting | Contract (Art. 6(1)(b)) and legal obligation to keep accounting records (Art. 6(1)(c)) | 10 years, as required by Czech accounting law |
| Language preference cookie | Showing the site in your language | Legitimate interest (Art. 6(1)(f)); strictly functional | 1 year |
| Technical logs (IP address, request path, timestamps, error messages) | Keeping the service running, preventing abuse and fraud | Legitimate interest (Art. 6(1)(f)) | 30 days |
We do not use the content of chats or reports for advertising, profiling for marketing, or training of our own models.
4. The other person in the chat
A conversation always involves someone who has not signed up for Tealeaf. We process their messages on the basis of your consent and our legitimate interest in providing the service you asked for. Their messages are not stored, not linked to any account of theirs, and not used for anything other than your report. You are responsible for only uploading conversations you are a participant in, and for treating the report as private. Please do not use Tealeaf on conversations with people who would object to it.
5. Who we share data with
We use a small number of service providers, all bound by data processing agreements:
- Anthropic, PBC (USA): runs the language model that writes AI reads. Receives the messages, the context and the statistics for the duration of the request. Anthropic does not use API data to train its models. Transfers are covered by the EU-US Data Privacy Framework and standard contractual clauses.
- Stripe Payments Europe, Ltd. (Ireland): processes payments. We never see your card number. Stripe's own privacy policy applies to the payment page.
- Sparked Host LLC (USA), data centre in France: runs our servers and database. Your data is stored in the EU; the provider's staff are bound by a data processing agreement with standard contractual clauses.
- ZeptoMail by Zoho Corporation: sends your sign-in links and test emails. Receives your email address and the link only, nothing about your chats.
We do not sell personal data and we do not share it with advertisers.
6. International transfers
Our servers are in France. Chat content leaves the EU only when an AI read is produced, to Anthropic in the United States, under the safeguards named above. Statistics-only reads never leave the EU. Our hosting and email providers are US-headquartered companies operating EU infrastructure; their access is governed by data processing agreements with standard contractual clauses.
7. Your rights
Under the GDPR you can ask us to access, correct, delete or export your data, to restrict or object to processing, and you can withdraw your consent at any time without affecting processing that already happened. Most of this you can do yourself: delete any report from its page, and contact us to delete your account entirely. For anything else, email [email protected] and we will respond within one month.
You also have the right to lodge a complaint with a supervisory authority. In the Czech Republic that is the Úřad pro ochranu osobních údajů (uoou.gov.cz). You may also complain to the authority in your own EU country.
8. Children
Tealeaf is for adults. You must be 18 or older to use it, and the age bands in the app start at 18. If a conversation you upload involves a minor, the analysis stays on friendship or family only and gives no romantic or dating advice.
9. Cookies
We use two cookies, both strictly necessary: a session cookie so you stay signed in, and a language cookie so the site remembers your language. There are no analytics or advertising cookies, which is why you see no cookie banner.
10. Security
All traffic is encrypted in transit. Secrets such as API keys are stored encrypted. Chat content is deliberately never written to disk or to the database, so a breach of our storage could not expose your messages. Reports and account data are protected by access controls and are only reachable by the account that created them.
11. Changes
If we change this policy in a way that matters, we will show a notice in the app before the change applies. The date at the top always tells you which version you are reading.