Privacy notice
Talia researches organisations from public sources, so it processes personal data about two groups of people: people who work at the organisations it researches, and its own customers. This notice explains what, why, for how long, and what you can ask of us.
In effect from 31 October 2026.
Who we are
Talia (usetalia.com) is operated from Dubai, United Arab Emirates. For this notice, “Talia”, “we” and “us” mean the operator of usetalia.com, which decides why and how the personal data described here is processed. Contact us at hello@usetalia.com.
People in the organisations we research
What we process
Only public professional information, as it appears in public sources:
- your name and the forms of it used in sources;
- your job title, your employer, the unit you work in and the city or site you work at;
- who you report to, and who reports to you, as stated or as inferred from public evidence (an inferred line is always marked as inferred);
- former roles and employers, and when you left a role;
- the address of your public professional profile;
- public professional statements: what you are quoted on, present on or publicly work on;
- for each of these, the source, the exact words in it, its date and a stored copy of the page.
We do not extract personal email addresses, phone numbers, home addresses, photographs, or information about health, religion, politics, sexual life, ethnicity, trade union membership or criminal records.
Where it comes from
Organisations' own websites, annual reports and filings, company registries, official releases, news and trade press, and people's own public professional profiles. We also receive lists of names and titles from data providers (see the sources below); these are only leads, and nothing from them is shown as a fact until its words are found in a stored public source.
Why
To produce reports for business customers who are researching an organisation: who works there, how it is organised, and who is likely to be involved in a purchase. Customers use them for business to business sales, partnerships, consulting and recruitment.
Our lawful basis, by region
- European Union, European Economic Area and United Kingdom (GDPR and UK GDPR): legitimate interests. Ours, in providing the service, and our customers', in understanding the organisations they do business with. We limit the data to public professional information, show its source, and honour objections and erasure requests. Because we collect from public sources and do not hold contact details for most people, we publish this notice rather than write to each person.
- United Arab Emirates: the processing of personal data that the person has made publicly available, and our legitimate business purposes, within the limits of the Personal Data Protection Law.
- United States: the data is publicly available information. We still honour access and erasure requests from anyone, wherever they live.
- Everywhere else: the same limits and the same rights apply.
How long
Personal data about a researched person is kept for up to 24 months after it was collected, then deleted unless a newer report has collected it again from a current source. If you ask to be erased, we delete you from every report and keep only a one way hash of your name and organisation so that you are not collected again. The hash cannot be turned back into your name.
Customers
What we process
- your account: email address, name if you give one, a hash of your password (never the password itself), sign in sessions;
- what you ask for: the organisations you research, what you sell, your chat questions, the reports and your corrections;
- your plan, credits and usage;
- billing: Dodo Payments collects your payment details as our merchant of record. We never see your full card number; we receive the transaction record, your plan and the country used for tax;
- the emails we send you, and a record that they were sent;
- technical data needed to keep the service secure, such as your IP address while you sign in, used for rate limiting.
Our lawful basis
- performing our contract with you (your account, reports, billing and emails about them);
- legitimate interests (security, preventing abuse, improving the research method from measurements of runs);
- legal obligations (tax and accounting records).
How long
Account data is kept while your account is open and deleted within 90 days after it is closed. Billing and transaction records are kept for as long as tax and accounting law requires, typically five years.
Contact messages and data requests
Messages sent through the contact form, and records of data requests and how we answered them, are kept for 24 months after the last exchange, then deleted. A record of an erasure keeps only the one way hash described above.
Cookies
One strictly necessary cookie keeps you signed in. Your light or dark theme choice is kept in your browser's local storage. We use no advertising or analytics cookies.
Who else handles personal data
Sources and independent controllers
These companies decide for themselves how they process personal data, under their own privacy notices. Talia receives data from them, or they handle payment, as independent controllers.
| Company | What it does for Talia | Personal data involved |
|---|---|---|
| Apollo | A data source: company and people data used only as leads to check | Names, titles and public profile links of people at researched organisations |
| Dodo Payments | Merchant of record: takes payment, handles sales tax and VAT, keeps transaction records | Customers' billing details and transactions |
Processors
These companies process personal data for us, under contract, only to provide their part of the service.
| Processor | What it does for Talia | Personal data involved |
|---|---|---|
| Resend | Sends account and notification emails | Customers' email addresses and the emails sent to them |
| OpenRouter and the model providers it routes to | Runs the language models that read stored pages, reason over the evidence and write answers | Text of public sources about researched people; customers' requests and chat questions |
| Apify | Fetches public web pages and public professional profiles | Public professional data about researched people |
| Serper | Web search | Search queries, which can include a researched person's name and employer |
| Infomaniak (Switzerland) | Hosts the server and database | All data Talia stores |
Some of these companies work outside your country, including in the United States. Where the law requires it, transfers are covered by the safeguards it sets, such as standard contractual clauses.
Your rights
Depending on where you live, you can ask us to:
- tell you whether we hold personal data about you, and give you a copy (access);
- correct it;
- erase it, and stop collecting it (erasure);
- stop or restrict processing it (objection and restriction);
- as a customer, give you your account data in a portable form.
You can also complain to your data protection authority. We would like the chance to put things right first.
How to make a request
Use the data request form or write to hello@usetalia.com. Tell us your name, the organisation you work at and, if you have one, your public profile address, so we can find you. We may ask you to confirm the request from an address that shows it is you. We answer within 30 days. Requests are free.
Security
Data is held on a server in Switzerland and reached over encrypted connections. Passwords are stored only as hashes, one time links only as hashes, and access to the database is limited to the operator.
Children
Talia is a business service for adults. We do not knowingly process data about children.
Changes
When this notice changes, we update the date at the top and, for material changes, tell customers by email.