How Talon Labs handles personal data on talonlabs.dev and in a Talon Labs account. The self-hosted software sends us none of the data it holds; the release check it makes, and what an Enterprise key's check-in sends, are set out below. Cookies and website analytics have their own page.
Last updated 27 September 2026DRAFT — PENDING COUNSEL REVIEW
Who we are
Talon Labs is the data controller for the personal data described here. For anything relating to your data, including the requests in Your rights below, use the contact form (topic: Privacy or data request).
What we collect
Depending on how you use the site, we may hold:
Your account — your email address, your name if you give one, a profile picture if you upload one or sign in with Google or GitHub (we copy theirs once), which version of the Terms you accepted and when, and whether you have confirmed your address.
How you sign in — a password hash (never the password), the public half of any passkey (we never see biometrics: a passkey proves who you are to your own device, which then vouches for you to us), an authenticator-app secret encrypted at rest, hashes of your recovery codes, and the id Google or GitHub gives you if you link one.
Sign-in records — for each signed-in session, the IP address it came from, that address's country and the browser and operating system your browser reported. You can see and end every one under Sessions on your account page, which is what they are for.
Your licence keys — the Community key for Talon Studio, encrypted at rest. Each key carries a licence id and the name on your account — or “Talon Labs account holder” if you have not set one, never your email address. A key cannot be recalled once issued: deleting your account does not stop a key you already hold from working. (Keys issued before 27 September 2026 to an account with no name carried its address; your account page now hands out a copy that does not, but a copy already pasted into a server still names it.)
Enterprise licence check-ins — only from a server holding an Enterprise key, which is not on sale yet: on activation, and then about once a day and every six hours in the weeks before the key expires, it sends the key itself (which names who it was issued to), an instance id, its activation token once it has one, a check-in counter, the app version and its hostname. We keep the hostname and version against the licence, and the sending address shortened to its network (for example 203.0.113.0/24) in the licence's activity record. No usage, user or business data is sent.
Enquiries — what you type into the contact form, or leave through the site assistant so we can reply: your name, address, company and message. We store each one before it is mailed to our inbox. It is not linked to any analytics visit.
Site assistant conversations — your question as you typed it, the answer, the page you asked from and the documentation it cited. No IP address, user agent, cookie or account link is recorded — but the question is stored as typed, so anything personal you write into it is kept with it.
Website analytics — only if you consent. Full detail on the Cookies & Analytics page.
Abuse protection — to rate-limit sign-in and our forms, a count against a salted hash of the caller's address or of the email address tried. Each lasts from minutes to a day, and is then deleted by a daily sweep.
Server logs — our hosting provider records requests, including IP address, for security and abuse prevention. These are not analytics and are not used to build a profile of you.
Lists we no longer add to — the former Talon Studio waitlist (name, address, company, role and notes) and the ledger of a retired trial (address, licence id and, for 30 days, the requesting IP address).
No payment data — nothing is on sale. When Enterprise is, payments will go through Stripe, which will hold card details; we will not.
Self-hosted stays self-hosted
Talon Studio runs on your server, and sends us none of the data it holds. A Community key is never activated or checked in; an Enterprise key's check-in is described above. Talon Studio also fetches the public file talonlabs.dev/releases.json to show when a new release is out, and then that release's notes from talonlabs.dev/changelog/studio.md. The requests carry no licence, usage or account data (our host logs their IP address like any request), and TALON_DISABLE_UPDATE_CHECK=true turns them off for air-gapped installs. Its other default outbound calls go elsewhere: Studio pulls public detection content (SigmaHQ, Atomic Red Team and similar), and it calls the AI provider you configure, if you configure one.
Why, and our legal basis
Run your account
Performance of our contract with you — your account, your Community keys and the website itself.
Answer you
Legitimate interest in replying to people who contact us, or steps taken at your request before entering a contract.
Keep accounts secure
Legitimate interest in protecting the service and its users, and our legal obligation to secure personal data.
Validate and renew licences
Performance of our licence agreement with you.
Understand site use
Your consent, given through the banner and withdrawable at any time from the footer of any page.
Improve the assistant
Legitimate interest in understanding what our documentation fails to explain. The record is kept without identifiers and for 90 days, which is what keeps that interest balanced against yours.
Product and security updates
Legitimate interest in telling account holders about the software their keys are for — security notices, and the one announcement when Talon Studio launches. Every message that is not about your account's security carries an unsubscribe link.
Accounting and tax
Compliance with a legal obligation, once there is a sale to account for.
Who processes it
We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share it only with the providers that help us run the site — each named, with what it does, on Sub-processors — or where the law requires it. Google and GitHub, if you sign in with them, act as independent controllers.
Some of those providers are in the United States. Where personal data of people in the UK or the EEA is transferred there, we rely on the UK International Data Transfer Addendum and the European Commission's Standard Contractual Clauses, plus the safeguards in each provider's data processing terms. Ask us for the mechanism relied on for a particular provider.
Retention
Your account
Until you delete it. Deleting it — from your account page, or by asking us — removes the account, its sign-in methods and sessions, its Community keys and their activity records, any waitlist or trial entry for the address, and the enquiries sent from it. What stays is a receipt: a keyed one-way hash of the address, what was removed and when, so we can answer whether it was done.
Unconfirmed sign-ups
Anyone can type an address into the sign-up form, so an account can exist for an address that was never confirmed. It is not deleted automatically: it stays until whoever made it deletes it from its account page, the owner of the address takes it over with a password reset (which confirms the address) and deletes it, or you ask us to delete it. No licence key is issued to an address until it is confirmed.
Sessions
Until the session ends: 30 days after it was last used, and never more than 90 days from sign-in; sooner if you sign out or change your password. A session's record, with its IP address, country and browser, is deleted by a daily sweep once it has gone 30 days unused.
Licence records
Kept while the licence exists — for a Community key, until you delete your account. A server's activation record and its activity trail are kept with the licence.
Paid licences
Nothing is on sale yet. When it is, a paid licence's billing record will be kept as long as tax law requires, and deleting the account will remove your name and address from it.
Enquiries
Twelve months, then deleted.
Assistant conversations
90 days, then deleted.
Abuse-protection counters
Until their window passes, from minutes to a day, then deleted by a daily sweep.
Former Studio waitlist
Deleted twelve months after signing up, or sooner if you delete your account.
Retired trial ledger
The IP address is removed 30 days after the trial was taken. The address and licence id stay as the record that it was used, until you delete your account or ask us to remove them.
Website analytics
See Cookies & Analytics.
Your rights
Depending on where you live, you have some or all of the following rights over the personal data we hold about you: to access it, correct it, have it deleted, restrict or object to how we use it, receive it in a portable form, and — where we rely on consent — withdraw that consent at any time without affecting what was done beforehand.
Two of them you can use yourself: download your data or delete your account from your account page (Profile → Your data).
For anything else, use the contact form (topic: Privacy or data request). We will respond within one month. We do not charge for this, and we will not treat you differently for asking. If you are unhappy with how we have handled your data you can complain to your data protection regulator — in the UK the Information Commissioner's Office at ico.org.uk, in the EEA the supervisory authority for your country. We would rather you told us first, but you do not have to.
Changes and contact
Talon is a business product and is not directed at children; we do not knowingly collect personal data from anyone under 16. When we change what we collect or why, we update this page and the date at the top of it — and if the change affects what you consented to, the consent banner returns and asks again rather than assuming your previous answer still applies.