Privacy Policy

01 Scope & who we are

Talon ("Talon", "the Service") is operated by RaptorLabs ("we", "us", "our"). This one policy covers the whole Talon platform — the flagship Talon Audit and the integrated tool Prospect — which share one account, one billing system and one set of privacy rules. For personal data of users in the EEA and UK, RaptorLabs acts as the data controller for account and usage data, and as a data processor for the website content you direct us to analyse. Tool-specific note: Prospect analyses only publicly observable information about a domain.

02 Information we collect

Account data

• Your email address.
• If you sign in with email and password: a cryptographic hash of your password (we never store or see your plaintext password — it is salted and hashed with PBKDF2 before storage).
• If you sign in with Google: the email address, name and profile photo Google shares with us via its Sign-In service, using only the openid, email and profile scopes. We use this solely to create and authenticate your Talon account and never request or receive access to your Gmail, Drive, contacts or any other Google data.
• Account timestamps (created, last sign-in).

Analysis data

• The URLs you submit for analysis.
• The rendered HTML, a screenshot, and structural signals of the target page, captured at the moment of analysis.
• The findings, scores and generated fix recommendations produced from that page.

Technical data

• A single essential session cookie (talon_session) to keep you signed in — see the Cookie Policy.
• Standard server and edge logs (IP address, request time, user agent) generated by our infrastructure provider for security and reliability.
• Aggregate, anonymous page-view and page-load performance analytics from Cloudflare Web Analytics, a cookieless analytics service — see the Cookie Policy for details.

We do not use advertising cookies, cross-site tracking pixels, or sell any data. Our analytics does not use cookies, local storage, persistent identifiers or fingerprinting, and cannot track you across sites.

03 How we use information

• To run the analyses you request and return findings and recommendations.
• To create and secure your account and keep you signed in.
• To store your analyses privately so you can revisit prior reports. Analyses are never published or listed publicly.
• To send the monitoring alerts you enable — to your account email and, if you configure one, to an alert webhook URL of your choosing (alert content: the monitored domain, its ship verdict and score, the titles of blocking findings, and a link to the report). You choose and control that destination.
• To operate, secure, debug and improve the Service, and to prevent abuse.
• To comply with legal obligations and enforce our Terms and Acceptable Use Policy.

We do not use your submitted content or account data to train foundation models.

04 The anonymised corpus

We aggregate anonymised, class-level statistics across all scans — finding type, severity, whether a finding was present or absent, a detected hosting-platform hint, and the scan's ship verdict — to publish periodic, aggregate research (e.g. what share of re-scanned sites still had a live blocking finding after their deployment platform's own publish gate). This aggregation deliberately has no column capable of identifying your domain, your account, or you: the underlying table stores no user id, no host, no URL and no scan id. You can exclude your own scans from this aggregation at any time in your workspace's Account tab ("Exclude my scans from the anonymised corpus"); this is honoured on every future scan going forward.

05 Legal bases (GDPR / UK GDPR)

• Contract — to provide the Service you request.
• Legitimate interests — to secure, maintain and improve the Service and prevent misuse, balanced against your rights.
• Consent — where required, e.g. optional communications; you may withdraw it at any time.
• Legal obligation — where processing is required by law.

06 Infrastructure & sub-processors

The Service runs entirely on Cloudflare's global platform. To deliver analyses we use the following categories of processing, all provided by Cloudflare, Inc.:

• Edge compute & hosting — to serve the application and run analyses.
• Headless browser rendering — to load and capture the target website you submit.
• AI inference — the submitted page content is processed by machine-learning models to reason about findings. This processing occurs within the infrastructure provider's platform; content is sent to the models only to produce your report.
• Object storage, database and edge cache — to store reports, screenshots, your account record and session state.

We also use these further sub-processors:

• Google Sign-In (accounts.google.com) — optional authentication method. If you choose it, Google shares your email, name and profile photo with us to create/authenticate your account; we send Google nothing beyond the standard OAuth request. You can review or revoke Talon's access anytime at myaccount.google.com/permissions.
• Cloudflare Web Analytics (Cloudflare, our infrastructure provider) — website analytics. A small script measures page views and page-load performance; it sets no cookies, uses no local storage or fingerprinting, and cannot track you across sites — reports are aggregate and anonymous.
• Resend (resend.com) — transactional email delivery (email verification, password reset, monitoring alerts, contact replies). Receives the recipient address and message body of those emails.
• Stripe (stripe.com) — subscription billing and checkout. Stripe is the controller for the payment-card data you enter with it; we never see or store card numbers, only a customer/subscription reference.
• DeepSeek — used by Prospect to summarise publicly observable page content. Sent only the input for that specific analysis; not used to train models.
• Firecrawl / Apify — optional passive page-fetch helpers for Prospect. Receive only the public target domain.

These providers act as our sub-processors (or, for Stripe's payment data, an independent controller) under their respective data-processing terms. We do not transfer your data to advertising networks or data brokers.

07 Websites you analyse (important)

When you submit a URL, you instruct us to fetch and render that website. You are responsible for ensuring you own the target or are otherwise authorised to test it, as required by our Acceptable Use Policy. Captured page content may incidentally include personal data present on that page; we process it solely to produce your analysis and act as your processor for that content. Do not submit targets you are not authorised to test.

08 Data retention

• Account data — kept while your account is active, then deleted within 30 days of account closure or an accepted deletion request.
• Reports & screenshots — reports owned by signed-in accounts are retained so you can revisit them until you delete the report, delete your account or submit an accepted deletion request.
• Guest analyses — a report run without an account, and the signed attestation issued with it, are deleted automatically after 30 days unless you save them to an account first.
• Signed attestations — kept with your account as a durable record (deleting a single report does not delete the attestations already issued for it); a published attestation stays verifiable until you unpublish it or delete your account.
• Operational logs — request and diagnostic logs are handled by our infrastructure provider (Cloudflare) and automatically rotated after a short period (currently on the order of a few days); we do not retain long-term raw logs ourselves.

We do not store raw response bodies, cookie values or browser-storage values; sensitive values (tokens, cookies, authentication headers) are redacted before any evidence is stored. Signed-in users can delete reports and accounts in the dashboard, or request deletion at any time (see §09); we complete accepted deletions within 30 days.

09 Security

We apply industry-standard safeguards: TLS in transit, salted PBKDF2 password hashing, HttpOnly, Secure, SameSite session cookies signed with HMAC, least-privilege access, and an edge-only architecture with no self-managed origin servers. No method of transmission or storage is perfectly secure, but we work to protect your data proportionate to its sensitivity.

10 Your rights

Depending on your location (including under GDPR, UK GDPR and the CCPA/CPRA), you may have the right to access, correct, delete, port, restrict or object to processing of your personal data, and to withdraw consent. California residents have the right not to be discriminated against for exercising these rights; we do not sell or "share" personal information as those terms are defined under the CCPA/CPRA.

To exercise any right, contact us at privacy@raptorlabs.dev. We will respond within the timeframe required by applicable law. You may also lodge a complaint with your local data-protection authority.

11 Children & changes & contact

The Service is not directed to children under 16, and we do not knowingly collect their data. We may update this policy; material changes will be posted here with a revised effective date. Questions or requests: privacy@raptorlabs.dev.