Privacy Policy
Effective September 3, 2026. This policy explains what Telloo collects, why, and what you can do about it.
Telloo is a feedback board service. Organizations run a board on their own subdomain; their visitors post ideas, vote and comment. This means there are two kinds of people in this policy: customers (organizations and their team members who sign in) and visitors(people who use a customer's board, usually without an account).
For content posted on a customer's board, that customer is the data controller and Telloo acts as their processor. For accounts and billing, Telloo is the controller.
1. What we collect
If you sign in
- Account: name, email address, and profile image, as provided by Google when you sign in with Google.
- Sign-in tokens: the OAuth tokens Google issues for your session. We use them only to authenticate you.
- Membership: which organizations you belong to and your role in each.
If you use a board (with or without an account)
- Content you write: post titles, bodies and comments. If you post without an account you may supply a display name; leaving it blank shows "Anonymous".
- Votes: linked to your account if signed in, otherwise to a random identifier stored in your browser (see Cookies).
- Email, only if you ask for updates: if you choose to follow a post, we store the address you enter so we can email you when its status changes. Every such email has a one-click unsubscribe link.
Abuse prevention
To stop spam from unauthenticated writes, we apply a rate limit per source. We do not store your IP address. We store a one-way, keyed hash of it, which cannot be reversed back to the address, together with a counter. These records are deleted automatically once their time window has passed.
Billing (organizations only)
- Plan, subscription status, billing name, billing email, country and tax identification number where you provide one.
- For payment methods we store only what is needed to display them — for example the brand and the last four digits. We never receive or store full card numbers; those go directly to the payment provider.
Administrative audit log
We record administrative actions inside an organization (creating or deleting boards, changing post statuses, inviting or removing members, exporting data) with the acting user's email and a timestamp. This exists so organization administrators can see who changed what. Ordinary posts and votes by visitors are not recorded in the audit log.
2. Cookies
We use only cookies that are necessary to run the service. We do not use advertising or cross-site tracking cookies, and we do not run third-party analytics.
| Cookie | Purpose | Lifetime |
|---|---|---|
| Session cookie | Keeps you signed in. | Until sign-out or expiry |
anon_id | A random identifier so that a vote made without an account counts once and can be taken back. It is not linked to your identity. | 1 year |
locale | Remembers the language you selected. | 1 year |
Clearing your browser cookies removes these. Clearing anon_id means an earlier anonymous vote can no longer be recognised as yours.
3. Who we share data with
We do not sell personal data. We use the following service providers, each only to run Telloo:
| Provider | Purpose |
|---|---|
| Vercel | Application hosting and content delivery |
| Neon | Database hosting (United States) |
| Sign-in, only if you choose to sign in with Google | |
| Resend | Sending invitation and notification email |
When paid plans become available, a payment provider will be added here and will act as the merchant for your purchase. We will update this policy before that happens.
We may disclose data where required by law, or to protect the rights and safety of users and the service.
4. International transfers
Telloo is operated from the Republic of Korea and its infrastructure is located in the United States. Using the service involves transferring your data internationally.
5. How long we keep data
- Board content is kept while the organization exists. If a subscription lapses the board becomes read-only and later inaccessible, but content is not deleted for non-payment — it returns when the subscription resumes.
- Rate-limit records are deleted automatically once their window expires.
- Follow subscriptions are deleted immediately when you unsubscribe.
- Accounts and audit logs are kept while the account or organization is active, and deleted on request as described below.
6. Your rights
You can ask us to access, correct, export or delete your personal data, and to restrict or object to processing. You can change your display name and sign out at any time from your account page, and unsubscribe from any notification email using the link it contains.
For content posted on an organization's board, that organization controls it. If you ask us to remove such content, we may need to refer you to the organization, or act on their instruction.
To make a request, email privacy@telloo.io. We will respond within the period required by applicable law.
7. Security
Traffic is encrypted in transit. Access to production data is limited to the operator of the service. Sign-in cookies are HTTP-only. No service can promise perfect security, and we do not.
8. Children
Telloo is a business tool and is not directed at children. We do not knowingly collect data from children under 14.
9. Changes
If we change this policy we will update the effective date above, and for material changes we will notify account holders by email.
10. Contact
Questions about this policy: privacy@telloo.io.