Legal

Privacy Policy

Last updated: 16 October 2026

1. 1. Who we are
2. 2. Data we collect and why
3. 3. Location data
4. 4. What other users see
5. 5. Who we share data with
6. 6. International transfers
7. 7. How long we keep data
8. 8. Security
9. 9. Your rights
10. 10. Age requirement
11. 11. Cookies
12. 12. Changes to this policy

1. Who we are

This privacy policy explains how personal data is processed by the controller, TalkFrst BV, a private limited company under Belgian law, with its registered office at Vrijputstraat 40, 8540 Deerlijk, Belgium, registered in the Crossroads Bank for Enterprises under number 1043.790.076 (VAT BE1043.790.076) (hereafter “TalkFrst”, “we” or “us”).

It applies to the TalkFrst mobile app (including test and beta versions), the website talkfrst.com and any communication with us (together, the “Service”).

We process personal data in accordance with Regulation (EU) 2016/679 (the “General Data Protection Regulation” or “GDPR”) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.

Questions about privacy? Contact us at hello@talkfrst.com or by post at the address above.

2. Data we collect and why

For each category below we explain what we collect, why, and the legal basis we rely on under Article 6 GDPR.

2.1 Beta and newsletter sign-up

When you leave your email address on talkfrst.com/beta, we store your email address, the date of sign-up and the version of this policy that was shown to you. We use it only to invite you to the public test version of TalkFrst and to send you occasional updates about its launch. Legal basis: your consent, which you can withdraw at any time by clicking the unsubscribe link in any email or by writing to us.

2.2 Account data

When you create an account we process your email address and a securely hashed password, or, if you sign in with Apple or Google, the identifier that provider gives us. We use this to create and secure your account and to log you in. Legal basis: performance of our contract with you (the Terms of Use).

2.3 Profile data

To use TalkFrst you create a lightweight profile: a display name, a profile photo, your country, the languages you speak, a few descriptive tags (such as “Student” or “Traveller”) and optional conversation starters (“Ask me about…”, “Tell me about…”). We also ask for your last name and date of birth, which are never shown to other users and are used only to confirm you meet the minimum age and to support trust and safety. You may optionally add contact details (phone number, LinkedIn, Instagram, Facebook); these stay private unless you choose to make them visible. Legal basis: performance of our contract; for optional contact details, your choice to share them.

Please think carefully about what you put in your profile. Information you choose to share, such as a photo, may indirectly reveal sensitive information about you. By choosing to share it with other users, you make it available to them.

2.4 Presence and activity data

When you use the app we process whether you are “on green” and until when, the TalkFrst Corners you check into, conversations you and another user confirm with “We said hi”, your Sparks balance and history, rewards you redeem at partner venues, and invitations you send or accept with a referral code. We use this to run the core features of TalkFrst, to award Sparks and to prevent abuse of the Sparks system (for example, repeated check-ins to farm rewards). Legal basis: performance of our contract and our legitimate interest in keeping the Sparks system fair.

2.5 Safety data

When you block or report another user, we store who blocked or reported whom, the reason and any description you provide. When we review a report, we may look at the profiles and activity data of the people involved. Legal basis: our legitimate interest, and that of our users, in keeping TalkFrst safe; and, where applicable, our legal obligations under the EU Digital Services Act.

2.6 Communication data

When you contact us by email, through the app or otherwise, we process your name, email address and the content of your message, to answer your question and handle your request. Legal basis: our legitimate interest in responding to you, or performance of our contract.

2.7 Product analytics and partner insights

If you leave the Product analytics setting on (Profile › Privacy & safety), we use information about how the app is used to understand which features work and to improve TalkFrst. If you turn on Partner insights (off by default), we may share anonymous, aggregated statistics with partner venues, for example how many TalkFrst users checked into their Corner in a given week. Partner insights never identify you. Legal basis: your consent, which you can withdraw at any time with the same switches.

2.8 Technical data

Like any online service, our servers process technical data such as your IP address, device type, operating system, app version and the time of requests. We use this to deliver the Service, to keep it secure and to diagnose errors. Legal basis: our legitimate interest in operating a secure, working service.

2.9 What we do not do

• We do not sell or rent your personal data.
• We do not use your data for third-party advertising or build advertising profiles.
• We do not take decisions about you based solely on automated processing that produce legal or similarly significant effects.

3. Location data

Location is essential to TalkFrst, so we want to be especially clear about it.

• When: the app asks for location permission when you open the map or go green. It uses your location while the map is open and while you are on green. You can withdraw the permission at any time in your phone's settings.
• What we store: your last known position, its accuracy and when it was updated, plus the Corner you are currently in, if any. Each new update overwrites the previous one. We do not keep a history of your movements.
• Why: to detect when you are in a TalkFrst Corner, to show how many green people are nearby, and to award location-based Sparks.
• Who sees it: nobody. Your exact coordinates are server-side operational data only and are never returned to other users (see section 4).
• Legal basis: performance of our contract, as location is necessary for the features you ask us to provide, together with the permission you give in your device settings.

The map in the app is drawn using map tiles from OpenStreetMap. To load the map, your device requests tiles directly from the OpenStreetMap tile servers, which see your IP address and the map area you view. See the OpenStreetMap Foundation privacy policy.

4. What other users see

• When you are not on green: nothing. You are not discoverable.
• When you are on green outside a Corner: other green users nearby only see a count of people nearby, not who you are or where you are.
• When you are on green inside a Corner: other green users at the same Corner can see your profile (display name, photo, country, languages, tags and conversation starters) and that you are at that Corner, never your precise position within it.
• Contact details are only shown if you explicitly make them visible.
• Blocking someone hides you from each other.

5. Who we share data with

We share personal data only where necessary, with:

• Service providers who process data on our behalf and under our instructions, such as our hosting and database provider, email delivery provider and IT support. They are bound by a data processing agreement.
• Apple and Google, if you choose to sign in with them or download the app from their stores. Their own privacy policies apply to their services.
• Partner venues: when you redeem a reward, the venue sees that a TalkFrst reward is being redeemed so it can honour it. With Partner insights on, venues receive only anonymous, aggregated statistics.
• Professional advisers such as accountants, auditors and lawyers, under a duty of confidentiality.
• Public authorities (such as police and judicial authorities) where required by law, by a court order, or where necessary to protect someone's vital interests or safety.
• A successor, in the event of a merger, acquisition or (partial) transfer of our activities, so that the Service can continue. We will inform you beforehand.

6. International transfers

We aim to store and process your personal data within the European Economic Area (“EEA”). Where a service provider processes data outside the EEA, we make sure an adequate level of protection is in place, for example through a European Commission adequacy decision or the EU Standard Contractual Clauses, together with additional safeguards where needed.

7. How long we keep data

We keep personal data only as long as necessary for the purposes described above, or as required by law.

8. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction and other unauthorised processing. These include encrypted connections (HTTPS/TLS), hashed passwords, short-lived access tokens, access restricted on a need-to-know basis, and keeping exact location data separate from public profile data. No system is perfectly secure, so please use a strong, unique password and tell us right away if you suspect your account has been compromised.

9. Your rights

Under the GDPR you have the right to:

• Access your personal data and receive a copy of it;
• Rectify inaccurate or incomplete data (much of it you can edit yourself in Profile › My information);
• Erase your data (“right to be forgotten”), for example by deleting your account in Profile › Privacy & safety;
• Restrict processing in certain circumstances;
• Object to processing based on our legitimate interest, and always to direct marketing;
• Data portability: receive your data in a structured, commonly used and machine-readable format, or have it transferred to another controller where technically feasible;
• Withdraw your consent at any time, without affecting processing that took place before;
• Lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be.

To exercise your rights, email hello@talkfrst.com from the address linked to your account, or write to TalkFrst BV, Vrijputstraat 40, 8540 Deerlijk, Belgium. We will respond within one month. We may ask you to confirm your identity before acting on your request.

10. Age requirement

TalkFrst is meant for people who meet in real life, so it is only for adults. You must be at least 18 years old to create an account. We do not knowingly collect personal data from anyone under 18. If we learn that a user is under 18, we will close the account and delete the data. If you believe a minor is using TalkFrst, please report it in the app or contact us.

11. Cookies

Our website and app use only technologies that are strictly necessary for them to work. Read more in our Cookie Policy.

12. Changes to this policy

We may update this policy, for example when we add features or when the law changes. The date at the top shows when it was last changed. If the changes are significant, we will notify you in the app or by email before they take effect.