Privacy notice

How ON Comms Talkback handles personal data, under the UK GDPR and the Data Protection Act 2018. Last updated 1 November 2026.

1. Who we are, and what this covers

This notice covers ON Comms Talkback, the hosted intercom at oncommstalkback.com, and the ON Comms apps that connect to it: ON Comms for iPhone, Apple Watch, Android, Mac and Windows, ON Comms Tally and ON Comms Bridge. It is published by Steve Matthews, a sole trader, trading as ON Comms Talkback (“we”, “us”). We are the data controller for the purposes set out below. You can reach us at support@oncommstalkback.com.

It also covers the small amount of data we receive from ON Comms Server, the on-premises edition that runs on a customer’s own Mac or Windows PC — see §3.5. It does not cover anything else a customer does with their own systems.

2. Who is responsible for what

There are two different relationships here, and they carry different duties.

• Your account with us. When you sign up for a server, we decide what to collect and why. For that data we are the controller.
• The people on your server. Once your server is live, you add your crew, decide who may talk on what, and decide whether anything is recorded. For that data you are the controller and we are your processor: we act on your instructions and do not use it for our own purposes.

If you are a crew member and you want to know why your employer holds something about you, ask them — they decide. If you cannot reach them, write to us and we will pass it on.

3. What we hold

3.1 Your account with us

When you sign up at oncommstalkback.com: your email address, a password (kept only as a bcrypt hash — we cannot read it back), your company name, your first and last name, a phone number if you give one, and the server name you asked for. We use it to run your account, to check the sign-up before we approve it, and to email you about your service.

Lawful basis: performance of a contract with you (UK GDPR Article 6(1)(b)), and our legitimate interests in checking who is signing up (Article 6(1)(f)).

3.2 The people on your server

Each server holds its own accounts: a username, a display name, a password hash, a key for Stream Deck buttons, whether the account is an administrator, and whether it is switched off. It also holds which groups and partylines each person may talk or listen on, how they have arranged their keys and which lines they have made priority, and which camera they are on if you use tally. If you use ON Comms Tally or ON Comms Bridge, it keeps the address and app version each last connected with, and holds the computer’s name in memory.

We hold this as your processor. Each customer has a separate database — not a shared one with a column naming the customer — and each customer’s rooms and sign-ins are keyed and signed separately, so one customer’s server cannot reach another’s.

3.3 A record of what happened

Your server keeps an activity log: who joined and left a group and when, which lines their panel set up to talk on, administrator actions such as changing someone’s permissions, and sign-ins that were refused. It also notes what people change for themselves, such as their camera, their priority lines or their password, and when a panel has trouble connecting it adds a report of what went wrong: the error, the kind of route it tried and its browser’s user-agent string. The log is capped at the most recent 5,000 entries, and 2,000 more from people’s own panels, and is there so an administrator can answer “why could I not get in?” and see who changed what. It records the kind of device someone used (for example “Chrome on Windows”, “the iPhone app”) taken from the browser’s user-agent string.

3.4 What we deliberately do not keep

• Connection quality. Each panel measures its own buffer, round trip, loss and concealment and posts it every two seconds so an administrator can see who is struggling. It is held in memory for twenty seconds and never written to disk.
• Audio. See §4. Nothing is saved today. A Mic test line holds what you say in memory for a moment, to play it back to you.
• Tracking. No advertising, no analytics, no third-party trackers, no profiling, and no automated decision-making with legal effect. Our emails carry no open or click tracking.

3.5 On-premises servers (ON Comms Server)

If you run ON Comms Server on a Mac or a Windows PC, your crew’s accounts, permissions and audio never reach us — they stay on your computer, and you are the controller for all of it. What does reach us is the licence check-in: a one-way fingerprint of the machine, the computer’s name, whether it is a Mac or a PC, the activation, the app version and the address it checked in from. We keep these beside the customer name on the licence, so we can tell how many servers a key is running on. The server also asks our website whether there is an update and which client apps are current, and sends its licence when it downloads an update. That is ours as controller, and our basis is our legitimate interest in licensing the software we supply.

If you turn on Allow connections from the internet, the server asks a public STUN server run by Google for your network’s public address, when it starts and every five minutes after that. Google sees that address. With the setting off, the server does not ask.

4. Audio

4.1 Today, audio is carried and never saved

When someone holds a talk key, their audio passes through our server to the people listening and is not recorded, written to disk, or kept. There is one exception, a Mic test line, if an administrator has switched one on: what you say on it is held in our server’s memory, up to 20 seconds of it, played back to you alone when you let go of the key, and then discarded. It is never written to disk. Nothing else in the service plays back what was said. We do not listen to it, and it is not used to train anything.

4.2 How it is protected while it is carried

Audio is encrypted end-to-server with SRTP using AES-256-GCM. Our media server is built from source with a change that puts AES-256-GCM first, because otherwise browsers pick a weaker suite when offered the choice. A device too old to do AES-256-GCM connects on AES-128 instead of failing — and when it does, the panel says so on screen, so the protection in use is something you can read rather than something we assert. Signalling and the web panel are carried over TLS.

4.3 If recording is switched on (not built yet)

When recording exists, all of the following will apply.

• Off unless you turn it on. Recording will be off by default, and can only be switched on by an administrator of your own server, per group. We will never enable it for you.
• Visible to everyone being recorded. While a group is recording, every panel in that group — web, iPhone, Android and the watch — will show it plainly. Nobody will be recorded without being able to see that they are.
• You are the controller. Recording is your decision, so it is your lawful basis to establish and your duty to tell your crew, in advance and in terms they can understand. In most cases you will also need to complete a legitimate interests assessment, and recording people at work can require consultation. We are your processor and will only record when you tell us to.
• Encrypted at rest with AES-256-GCM, under a key belonging to your server alone and kept apart from the database, so a copy of the database is not a copy of the audio.
• Deleted automatically. You will set how long recordings are kept, within a maximum we publish; the default will be short. Deletion will be automatic and permanent — not a flag on a row, and not something anyone has to remember to do.
• Only administrators, and only through the product. Playback and download will be limited to administrators of your own server. Every playback, download and deletion will be written to your activity log with who did it and when.
• Staff cannot listen. No part of our staff portal will play back, download or search a customer’s recordings. Our staff see counts and licence state, never the contents of a server.
• One person’s audio can be removed. Each participant is recorded as their own track, so if someone exercises their right to erasure their audio can be deleted without destroying the rest of the recording.
• Yours to take away. You will be able to export your recordings in a standard audio format, and to have them deleted on request.
• Not used for anything else. Recordings will never be used to train models, to analyse your staff, or for any purpose of ours. They are yours.

5. How long we keep things

When a server is deleted, its data is moved aside rather than destroyed at once, so that an accidental deletion can be undone. Tell us when you are certain and we will destroy it.

6. Who else handles it

We keep this list short on purpose. Our processors are:

• IONOS — the server itself, in the United Kingdom.
• Cloudflare — DNS, TLS and protection in front of the service; it carries web and signalling traffic. Audio does not pass through it. It also forwards mail sent to our support address.
• Postmark — the emails we send you about your account.
• Google — the Gmail inbox that mail to our support address arrives in.

Our media server also asks public STUN servers run by Google and Twilio for its own public address. That question comes from our server and carries nothing about you. Your devices are pointed only at our own server for this, so they do not contact Google or Twilio.

We do not sell personal data, and we do not share it for anyone else’s marketing. We disclose data to others only where the law requires it.

7. Where your data is

The service runs on a server in the United Kingdom, and that is where your data is held. Three of our processors operate internationally: Cloudflare, Postmark and Google may process data outside the UK. Where that happens, transfers are covered by the UK’s International Data Transfer Addendum to the EU Standard Contractual Clauses, or by UK adequacy regulations.

8. How it is protected

• Audio encrypted with AES-256-GCM, and the panel reports the suite actually negotiated.
• Passwords stored as bcrypt hashes only, hashed off the main thread so a rush of sign-ins cannot stall the service.
• Separation between customers enforced by a database per customer, a separate signing secret per customer, and media rooms named per customer — not by a query filter.
• Backups encrypted with AES-256-GCM under a key that, on the server, only root can read.
• Staff access to our own portal is behind a second sign-in and an identity check, and what staff can see of a customer’s server is limited in the software to counts and licence state.
• The server takes SSH keys only, never passwords; our web server answers only Cloudflare, so the public web reaches the service only through it, and the only other ports the service uses are the ones media needs.
• One device at a time per account, so a session cannot be quietly shared.
• An activity log that records administrator actions, so changes can be traced.

No system is perfectly secure, and we do not claim otherwise. What we do claim is that the measures above are real and can be checked — the encryption in use is displayed in the product rather than asserted here.

9. Your rights

Under the UK GDPR you have the right to:

• ask what we hold about you, and get a copy;
• have inaccurate data corrected;
• have data erased, in the circumstances the law allows;
• restrict or object to how we use it, including objecting to anything we do on the basis of legitimate interests;
• receive data you gave us in a portable form;
• withdraw consent, where we relied on consent.

Write to support@oncommstalkback.com. We will answer within one month. If your data is on a customer’s server, we will pass your request to that customer, because it is theirs to answer.

If you are unhappy with how we have handled it you can complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113. We would rather you told us first.

10. Cookies and what the apps keep on your device

We use no analytics, and we set one cookie, which the web panel needs to work. It is a ticket that lets the panel receive its live events: scripts cannot read it, it goes only to your own server, and it lasts no longer than your sign-in. The web panel also keeps a few things in your browser’s local storage so it works: your sign-in token, your volume levels and settings. The website keeps your account’s sign-in there too. The phone apps keep your sign-in in the device’s secure storage, and they and ON Comms for Mac and Windows remember the servers you have used. None of it is sent anywhere but your own server. Signing out clears your sign-in and its ticket; your levels and settings stay on the device.

11. If something goes wrong

If there is a personal data breach that risks people’s rights, we will report it to the ICO within 72 hours of becoming aware of it, and tell affected customers without undue delay. Where we are your processor, we will tell you without undue delay so that you can meet your own duty.

12. Changes

If we change this notice we will update the date at the top. If a change materially affects how your data is handled — recording arriving is exactly such a change — we will tell account holders by email before it takes effect.

13. Contact

Steve Matthews, trading as ON Comms Talkback
support@oncommstalkback.com

We are the data controller for the data described in §3.1 and §3.5, and a processor acting on our customers’ instructions for everything on their own servers. If you would like our postal address in writing, ask at the address above and we will send it.