Privacy Policy

Talas Inc. ("Talas," "we," "us," or "our") provides a portfolio monitoring and analytics platform designed to help investment firms, their portfolio companies, and authorized users collect, organize, analyze, and share operating and financial information (the "Services").

We believe privacy is foundational to trust. Our mission is to help firms and their portfolio companies work together with clarity, accuracy, and appropriate confidentiality. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our Services.

This Privacy Policy applies to personal information we process as a data controller through our website, applications, communications, and Services that link to this Privacy Policy.

If Talas provides Services to an investment firm, portfolio company, or other organization under a separate contract, we may process some data as a service provider or processor on that organization's behalf. In those cases, our contract with that organization may govern certain processing activities. If you have questions about data provided through a firm or portfolio company, please contact that organization first.

Talas Commitments

We aim to build a platform that:

• Increases visibility without exceeding the scope of what firms and portfolio companies have authorized
• Handles sensitive commercial and financial information with the confidentiality it deserves
• Uses AI responsibly and transparently
• Protects our users and their organizations
• Gives firms and portfolio companies clear control over their data

1. Information We Collect

We collect information directly from you, automatically through your use of the Services, and from third parties you authorize or who work with us.

Our Collection Principles

Talas is built around data minimization. We collect only the personal information reasonably necessary and proportionate to operate, improve, secure, and deliver the Services users request.

We do not collect information simply because it may be useful later.

Where information is optional, we will identify it as such.

Information You Provide Directly

Depending on how you use Talas, we may collect:

• Name
• Business email address
• Password or authentication credentials
• Job title, role, and organizational affiliation (firm or portfolio company)
• Phone number
• Business address
• Messages sent through platform workflows
• Survey responses or feedback
• Payment or billing information (processed by third-party payment providers, if applicable)

Firm and Portfolio Company Content

We may collect content you upload, submit, or generate through the Services, such as:

• Financial statements, KPI reports, and operating metrics
• Board materials and management commentary
• Portfolio company scorecards, dashboards, and notes
• Documents, spreadsheets, and presentations
• Comments, annotations, and internal messages
• Files and text extracted from connected sources (see "Google Drive and Third-Party Integrations" below)

Automatically Collected Information

We and our service providers may collect:

• Device type
• Browser type
• Operating system
• IP address
• App version
• Usage logs
• Pages viewed
• Clickstream activity
• Session timestamps
• Referring URLs
• Crash diagnostics
• Approximate location inferred from IP address

Google Drive and Third-Party Integrations

Where a user authorizes Talas to connect to Google Drive or another third-party source, we access, retrieve, and process only the files and metadata reasonably necessary to deliver the requested functionality. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• Access is user-authorized. Talas requests only the OAuth scopes required to deliver the requested feature.
• Refresh tokens are encrypted. OAuth refresh tokens are encrypted at the application layer using Fernet symmetric encryption, with the encryption key stored in Google Secret Manager and backed by Google Cloud KMS.
• Extracted content is encrypted. Text and metadata extracted from connected Drive files are stored in Google Cloud SQL (PostgreSQL) with encryption at rest (AES-256) and encryption in transit (TLS 1.2 or higher).
• We do not sell Google user data. We do not transfer Google user data to third parties except as necessary to provide or improve the Services, comply with applicable law, or as part of a merger, acquisition, or sale of assets with appropriate notice to users.
• We do not use Google user data for advertising. We do not serve advertising against Google user data and do not permit third parties to do so.
• We do not use Google user data to train generalized AI models. Where AI features process Google user data, such processing is limited to delivering the requested user-facing feature, subject to the restrictions in Section 3.
• Humans do not read Google user data except (i) with the user's explicit consent, (ii) for security purposes such as investigating abuse, (iii) to comply with applicable law, or (iv) where the data has been aggregated and de-identified.

Users may revoke Talas's access to Google Drive at any time through their Google Account permissions page or by disconnecting the integration within Talas.

Information from Third Parties

We may receive information from:

• Authorized administrators at the firm or portfolio company managing your access
• Single sign-on or identity providers you use to access Talas (such as Google, Microsoft, or similar providers)
• Fraud prevention and security vendors
• Analytics vendors
• Publicly available business or market data sources

Cookies, Analytics, and Similar Technologies

Talas and our service providers may use cookies, local storage, software development kits (SDKs), pixels, log files, and similar technologies to operate, secure, and improve the Services.

These technologies may be used to:

• Keep users signed in
• Remember preferences and settings
• Measure traffic and feature usage
• Diagnose errors and performance issues
• Prevent fraud or abuse
• Understand how users interact with the Services

Talas does not use third-party tracking technologies for cross-site behavioral advertising or retargeting users based on activity across unrelated websites or apps.

We do not permit third parties to use tracking technologies on Talas for their own independent advertising purposes.

Users may be able to control certain cookie or device settings through their browser or device preferences, though some features may not function properly as a result.

2. How We Use Information

We use personal information to:

Provide the Services

• Create and maintain accounts
• Deliver portfolio monitoring dashboards, reports, and analytics
• Ingest, organize, and surface content from connected sources
• Enable collaboration between firm users and portfolio company users
• Support messaging and workflow features
• Provide customer support

Improve the Platform

• Analyze usage patterns
• Improve navigation and onboarding
• Measure feature effectiveness
• Test new features
• Troubleshoot errors

Provide Relevant Insights

• Surface trends across a portfolio
• Save preferences and progress
• Highlight metrics, changes, or anomalies for review

Safety, Integrity, and Compliance

• Detect fraud or abuse
• Enforce Terms of Use
• Respond to legal requests
• Protect rights, safety, and property

Communications

• Send service notices
• Confirm actions or milestones
• Respond to support requests
• Send optional marketing communications (you may opt out)

3. AI Features and Data Use

Talas may use artificial intelligence to help users summarize, extract, categorize, and analyze information within the Services.

Our AI Principles

We design AI to assist the humans doing the work, not to replace their judgment. AI features are intended to help users navigate portfolio data more efficiently — not to make investment, employment, or other significant decisions on their behalf.

We Do Not Use Black-Box AI for High-Stakes Decisions

Talas does not use fully automated AI systems to make legal or similarly significant decisions such as:

• Investment or divestment decisions
• Valuation determinations
• Hiring, compensation, or personnel decisions at portfolio companies
• Contractual eligibility or credit determinations

Those decisions remain with the relevant firm or portfolio company.

We Do Not Sell User Data for AI Training

We do not sell personal information to AI model providers. We do not use firm or portfolio company content to train generalized foundation models. Where we use third-party AI vendors to power Services features, we seek contractual protections restricting use of submitted data for model training and requiring appropriate confidentiality safeguards.

Human Review Matters

AI outputs may be incomplete or incorrect. Users should exercise judgment, and users remain responsible for their own decisions.

4. How We Share Information

We do not sell personal information.

We may share information in the following circumstances:

With Your Firm or Portfolio Company

If your account is provisioned, sponsored, or managed by an investment firm or portfolio company, we may share information with authorized administrators or other authorized users at that organization, including:

• Account registration and profile details
• Participation, engagement, and activity data
• Content you have submitted, shared, or made visible to the organization
• Aggregate or de-identified analytics
• Information necessary to administer the engagement or fulfill contractual obligations

Between Firms and Their Portfolio Companies

Talas is designed to facilitate structured information sharing between firms and their portfolio companies. Information a portfolio company submits, uploads, or connects to the Services may be visible to authorized users at the sponsoring firm consistent with the workspace configuration and the underlying commercial agreement. Information a firm shares with a portfolio company may be visible to authorized users at that portfolio company.

With Service Providers

We may share information reasonably necessary for vendors to perform services on our behalf, such as:

• Account identifiers
• Contact information
• Usage and technical data
• Support communications
• Payment or billing information where applicable

Our service providers include cloud hosting and infrastructure providers (including Google Cloud Platform), security and monitoring vendors, analytics vendors, and support tooling providers.

No Third-Party Advertising or Marketing Sharing

Talas does not share personal information with third parties for their own advertising, behavioral marketing, or independent commercial marketing purposes.

We do not permit third parties to use personal information we provide to market unrelated products or services to users.

We may use service providers to help us send communications on our behalf, subject to contractual restrictions and applicable law.

Legal and Safety Reasons

We may disclose any category of information reasonably necessary to comply with law, protect safety, investigate fraud, or enforce our rights.

Corporate Transactions

In connection with a merger, acquisition, financing, reorganization, or sale, relevant account, operational, and customer information may be transferred as permitted by law.

Any successor entity receiving personal information in connection with such a transaction must continue to protect previously collected personal information in a manner materially consistent with this Privacy Policy unless users receive advance notice of material changes and any choices required by applicable law.

5. Your Rights and Choices

Depending on your location, you may have rights to:

• Access your personal information
• Correct inaccurate information
• Delete your account or data
• Obtain a copy of certain data
• Opt out of marketing emails
• Limit certain processing activities where required by law

Where your account is provisioned or managed by a firm or portfolio company, some of these rights may be exercised through that organization. To exercise rights directly with Talas, contact us using the details below.

Account Controls

You may be able to:

• Edit your profile
• Update preferences
• Change notifications
• Disconnect third-party integrations (such as Google Drive)
• Delete certain content
• Close your account (subject to your organization's administrative controls)

6. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, maintain accounts, support users, comply with legal obligations, resolve disputes, and protect the security and integrity of Talas and its users.

Retention periods may vary depending on the type of information and how the Services are used. In general:

• Account information is retained while an account remains active and for a reasonable period afterward to support reactivation, security, fraud prevention, and legal compliance.
• Firm and portfolio company content is retained consistent with the underlying commercial agreement and the direction of the sponsoring organization.
• Support requests and communications may be retained for operational, training, and dispute-resolution purposes.
• Usage logs and technical data are typically retained for shorter periods unless needed for security investigations or legal obligations.
• De-identified or aggregated information may be retained longer where permitted by law.

When personal information is no longer reasonably needed, we will delete, anonymize, or de-identify it consistent with applicable law.

Users may request deletion of certain information or closure of their account, subject to legal, contractual, fraud-prevention, and recordkeeping requirements, and subject to the administrative rights of the firm or portfolio company managing the account.

7. Security

We use administrative, technical, and physical safeguards designed to protect information, including:

• All personal information transmitted to or from Talas is encrypted in transit using industry-standard secure protocols (TLS 1.2 or higher).
• Personal information stored in production systems is encrypted at rest using industry-standard controls (AES-256).
• Sensitive credentials and tokens, including OAuth refresh tokens, are encrypted at the application layer with keys managed through Google Secret Manager and Google Cloud KMS.
• Role-based access controls
• Authentication and credential protections
• Web application firewall and network-layer protections
• Logging and security monitoring
• Secure software development practices
• Vendor security diligence and contractual safeguards
• Measures designed to maintain the confidentiality, integrity, and availability of systems

No system is perfectly secure, and we cannot guarantee absolute security.

Security Incidents and Breach Notification

If we become aware of unauthorized access to personal information or another security incident affecting Talas, we will investigate promptly, take reasonable steps to contain and remediate the issue, and provide notifications required by applicable law.

Where legally required, we will notify affected individuals, firm or portfolio company customers, regulators, or other appropriate parties within the timeframes required by law.

Notifications may describe the nature of the incident, the types of information involved (if known), steps we have taken or plan to take, and recommended protective actions where appropriate.

8. Firm and Portfolio Company Accounts

Where Talas is provided through an investment firm or portfolio company:

• The organization may control certain account settings
• They may request reports or analytics about authorized users
• They may direct certain data processing activities
• Their own privacy notices may also apply

Users should review both this Privacy Policy and the organization's policies.

Accounts and Access

Accounts may be created and managed in different ways, including:

• Self-created individual accounts established directly by users, where offered
• Firm-managed or portfolio company-managed accounts created or administered by an authorized organization
• Single sign-on or federated accounts provided through approved identity providers where available

Where an account is managed by an organization, that organization may control certain settings, access permissions, onboarding status, or data processing activities consistent with applicable agreements and law.

Administrator Capabilities

Depending on the nature of the engagement or agreement, an authorized firm or portfolio company managing accounts may be able to:

• Create, invite, suspend, or deactivate user accounts
• Reset passwords or manage authentication methods
• Configure access permissions or workspace settings
• View reports or analytics regarding authorized users
• Request correction, export, or deletion of data consistent with applicable law and contractual obligations
• Manage onboarding, provisioning, or workspace participation workflows

Talas limits administrative access to authorized personnel and may require verification before honoring administrative requests.

Administrative capabilities may vary based on the Services provided and applicable agreements.

9. State Privacy Rights

As of the Effective Date of this Privacy Policy, residents of states such as California, Colorado, Virginia, Connecticut, Texas, Oregon, and others may have additional privacy rights under applicable law.

These may include rights to:

• Know what data we collect
• Access or correct data
• Delete data
• Obtain portable copies
• Appeal certain request denials
• Opt out of targeted advertising or profiling where applicable

Talas does not knowingly sell personal information.

To exercise applicable rights, contact us below.

10. International Users

Talas is based in the United States. If you use our Services from outside the U.S., your information may be transferred to and processed in the United States or other countries where our providers operate.

Where required, we use lawful transfer mechanisms.

11. Changes to This Policy

We may update this Privacy Policy from time to time.

If we make material changes, we will provide notice by updating the effective date, posting a notice in the Services, or using other appropriate communication methods.

12. Contact Us

Talas Inc.
Privacy Team
privacy@talas.co

If you submit a privacy request, we may take reasonable steps to verify your identity before responding.