Privacy Policy

Last Updated: 2026-09-16

Data Controller

Phelipe Santos Beserra, based in Valencia, Spain, acts as the data controller for Typical account data. For any privacy request, contact privacy@typical.so.

Privacy by Architecture (the core promise)

Typical cannot read the conversations you have with your clients in iMessage, WhatsApp, Signal, Telegram, SMS, or email. Apple's keyboard sandbox prevents that and there is no background scraping — every request is one you explicitly start. This is not a marketing claim; it is enforced by the way the product is built.

Apple's iOS keyboard sandbox prevents Typical from reading any other app's content. We do not request, and do not ship, any entitlement that would change this.
Unlike third-party "AI sales assistant" tools that proxy your WhatsApp Business account or hijack WhatsApp Web, Typical does not connect to WhatsApp, does not run a server-side inbox, and never sees the other side of any conversation.
The only message text that ever leaves your device is text you explicitly typed into the Typical keyboard, or content you explicitly pasted or shared into Typical.

Messages you ask Typical to write or transform are sent to OpenAI to generate the reply and to remember key client facts. OpenAI does not train on this data and deletes it within 30 days. The facts Typical derives and a short snippet of your latest exchange are stored encrypted in your account and synced across your devices, so your client memory follows you to a new phone.

Data We Process

Typical processes the following categories of data to deliver its drafting and client-record (CRM) features:

Account identifiers, including social sign-in identifiers from Apple or Google.
Usage metadata (timestamps, feature events, action outcomes).
Legal-consent timestamps.
User-provided content (client records, asset descriptions, voice notes, message drafts).

Sign-In with Google

When you sign in with Google, Typical receives only your Google account email, profile name, and a stable account identifier. We do not request access to your Gmail inbox or any other Google data through the sign-in flow.

Gmail Integration (Optional)

If you choose to connect Gmail to send messages from Typical, we request a single scope: gmail.send. Typical's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Typical can only send messages on your behalf — it cannot read, modify, or delete any message in your inbox.
Every send is triggered by a draft that you explicitly review and confirm in the in-app email review surface.
Refresh tokens and access tokens are stored encrypted in your private Firestore user document and are never shared with third parties.
You can disconnect Gmail at any time from Account Settings; this revokes Typical's tokens immediately.

Sign-In with Apple

Sign in with Apple is processed entirely between your device and Apple. Typical receives only the identifier and the optional name you choose to share on first sign-in.

Client Profile Fields

Client profile fields that you edit manually (for example budget, phone, email, and profession) are stored to keep CRM records accurate and to fill in drafts about that client.

Analytics Telemetry

Typical logs timestamped product usage events (for example AI assists generated and action outcomes) to power period-based analytics requested in the conversational interface. These analytics events are used for product reporting and are not sold to third parties.

Voice Note Processing

When you record voice notes, audio is securely transmitted to our backend and processed by OpenAI's transcription service to convert speech into text. This transcription is used only to power Typical features and is handled according to our data processing policies. Audio is not retained after transcription.

Contacts Processing

When you explicitly request a native contact import, Typical asks iOS Contacts permission and reads only the selected contact fields (name, phone, email, company, title, birthday) to prefill a CRM client draft. This access is read-only and only used to enrich the client dossier you approve.

OpenAI Usage

Typical uses OpenAI APIs to generate drafts, suggestions, transcriptions, and matching results. Content you submit for processing is sent to OpenAI under their API data usage policy. OpenAI retains API request data for up to 30 days for abuse monitoring and then deletes it. API request data is not used to train OpenAI models.

Storage & Security

Data is stored in Firebase services (Firestore, Authentication, Cloud Functions) hosted by Google Cloud and protected with standard technical controls including TLS in transit and encryption at rest. Consent and legal acceptance metadata are logged for compliance.

Data Boundaries (per surface)

Keyboard (ClefKeyboard): only text you explicitly type or paste into the Typical keyboard leaves the device. The keyboard cannot read other apps' content.
Share extension (ClefShare): only items you explicitly tap "Share to Typical" on are ingested. No network calls happen inside the extension itself; it only copies the file to a local App Group container for the main app to process.
Backend logging: per AI request, the server stores model name, token counts, and cost estimate in users/{uid}/ai_usage_events. It does not store the system prompt, the user message body, the conversation history, or the model's reply.
Diagnostic logs: when a request to a third-party service fails, the server writes a diagnostic line to Google Cloud Logging containing an event tag, your account id, the model, the HTTP status, and the upstream error code and message. Message bodies, recipients and access tokens are stripped before anything is written, and these logs are kept under Google Cloud Logging's default retention period.
CRM sync (main app): your saved clients — the facts Typical derives, the context-summary dossier, and a short snippet of your latest exchange truncated to about 600 characters — are stored encrypted in your private users/{uid} document and synced across your devices. This is a separate path from backend logging, and it is what lets your client memory follow you to a new phone.
OpenAI: the message you ask Typical to write or transform is sent to OpenAI to generate the reply and extract facts. Per OpenAI's API policy this data is not used to train their models and is deleted within 30 days.

Not in Production

Some capabilities exist in the codebase but are switched off in the build you can install. They do not run, and they do not process your data. As of the "Last Updated" date above, that includes:

Sequences and automated workflows. Multi-step outreach is not enabled. Nothing is sent on a schedule without you.
Paid plans. No payment is processed and no card details are collected. See the Terms of Service.
Gift and restaurant matching. Not enabled.
Reading your email. Typical has never requested a Gmail read scope and does not ship one. The only Gmail permission it can ask for is gmail.send.

If any of these is switched on, this page and the date above change before it reaches you.

Data Retention & Deletion

You can delete your Typical account at any time from Account Settings. For your security, we may ask you to sign in again to confirm it's you before deletion. Deletion removes your CRM records, drafts, voice notes, Gmail tokens, and analytics events from our production systems and propagates within 30 days. AI usage events older than 12 months are aggregated (per-event rows are dropped, only monthly totals are retained for billing and capacity planning). Firebase backups rotate on the standard 30-day cycle.

Data Subject Rights (GDPR)

If you are in the EU/EEA you have the following rights under the General Data Protection Regulation (Articles 15–22):

Right of access to your personal data (Art. 15).
Right to rectification of inaccurate data (Art. 16).
Right to erasure / "right to be forgotten" (Art. 17).
Right to restriction of processing (Art. 18).
Right to data portability in a machine-readable format (Art. 20).
Right to object to processing based on legitimate interests (Art. 21).
Right to withdraw consent at any time, without affecting the lawfulness of prior processing.
Right to lodge a complaint with a supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD).

To exercise any of these rights, write to privacy@typical.so. We respond within 30 days as required by Art. 12(3).

Jurisdiction

Typical is operated from Valencia, Spain. Privacy matters are governed under Spanish and EU law (GDPR and the Spanish Ley Orgánica 3/2018, LOPDGDD).