Privacy notice

What we process, why, and on what basis

We hold the following sets of data about the people who use the pilot. Each is listed with its purpose, its legal basis under Art. 6(1) GDPR, and how long it is kept.

• Your account — your e-mail address, the display name recorded for you, your password (kept only as an Argon2id hash, never in readable form), your two-factor secret and recovery codes (both encrypted at rest), your role, and the times the account was created, last changed and last used to sign in. Source: for a pilot account, this initial data reaches us from the administrator at your employer who set up the pilot and invited you — not from you directly (Art. 14(2)(f)). Purpose: giving you access to the pilot and keeping that access secure. Basis: performance of the pilot arrangement with you, or our legitimate interest in performing the pilot agreed with your employer (Art. 6(1)(b) and (f)). Kept until the account is deleted.
• Your saved preferences — the anonymisation settings you save as personal defaults, including your "always hide" word list. That list can hold names or case references you typed yourself, so it is encrypted at rest. Purpose: applying your own defaults to a new case. Basis: as for the account above. Deleted with the account.
• Sign-in and security events — for each sign-in, two-factor check or administrative action: the time, the event type, its outcome, the account id, a keyed hash of the e-mail address used, and the IP address the request came from. Purpose: detecting and blocking password guessing and other abuse, and reconstructing what happened after a security incident. Basis: our legitimate interest in the security of the service (Art. 6(1)(f)). Kept for 365 days, then deleted automatically.
• Usage counters — one row per anonymisation or restore attempt, holding only an opaque account id, a small set of fixed category values, a count, and coarse duration and size buckets. It never holds a file name, document content, a case title, an e-mail address or an IP address. Purpose: capacity planning and improving the service; it is never used for profiling or marketing. Basis: legitimate interest (Art. 6(1)(f)). Kept for 730 days (24 months), then deleted automatically.
• Destruction records — when the re-identification mapping of a case is destroyed, we keep a four-column record of it: the reference of the destroyed case, whether the destruction was ordered or automatic, the account that ordered it, and the time. Purpose: being able to demonstrate that an erasure actually happened (Art. 5(2) GDPR). Basis: our legitimate interest in demonstrable accountability (Art. 6(1)(f)). These records have no expiry date, because a rolling window would in time erase the very proof they exist to give. They say nothing about the content of the case.
• Pilot-consent acceptance — when you accept the current version of this notice and the pilot terms, we record that acceptance: an opaque account id, the version you accepted and a fingerprint of the exact notice text shown to you, the time, and — like the sign-in ledger above — a keyed hash of the e-mail address used, not the address itself. Purpose: keeping a record that this notice was shown to you and that you acknowledged it, and when. The processing described here does not rely on your consent; it rests on the pilot arrangement and our legitimate interest (Art. 6(1)(b) and (f)). Basis: our legitimate interest in being able to demonstrate that the notice was shown and acknowledged and, where relevant, in establishing or defending a legal claim (Art. 6(1)(f)). Kept for 2,190 days (6 years) — the general limitation period under Polish law for a civil claim — then deleted automatically.

The documents you upload

The pilot terms forbid uploading files that hold real personal data: only synthetic files. We set out what happens to an uploaded file anyway, because a guarantee is only worth something once it is written down.

Uploads are processed on talari’s own appliance. Personal data in the file is detected automatically, though never completely, and replaced with reversible placeholders; the mapping from a placeholder back to the original value is encrypted at rest in a vault on that appliance and is never sent to a cloud service or to a third-party AI provider. Neither your files nor the mapping are used to train any model.

A case and its mapping stay until you or an administrator delete them. There is no automatic expiry unless a retention period was set for that case when it was created. You can destroy a case’s mapping yourself at any time from the case screen, and deleting your account deletes every case you own. Files queued for background processing are stored encrypted and are removed once the result is downloaded, and in any event within 24 hours.

If a file with real data is uploaded by mistake, tell us at once at legal@talari.ai. We delete the case, destroy its mapping and confirm that to you.

Cookies

Two cookies are strictly necessary to sign you in and keep the session safe. “anon_session” holds nothing but a signed session identifier and cannot be read by scripts in your browser; “anon_csrf” carries the token the application echoes back to prove a request really came from you. A session ends after 30 minutes without activity, and after 8 hours in any case.

Three further items are kept on your own device: a local-storage entry which remembers the language you picked, kept until you clear your browser storage and holding no personal data; a local-storage entry, keyed to your account by an opaque identifier and never by your e-mail address, which records the version of this notice you accepted so you are not asked again on every visit; and a second local-storage entry, keyed the same way, which records which version of your acceptance has been confirmed saved on our servers — both stay on your device until you clear your browser storage, and are removed earlier if you sign out on that device.

None of these items is used to track you or to build a profile. They sit on your device only to carry out what you asked for — showing the site in the language you chose, not re-asking for an acknowledgement you have already given, and keeping track of whether that acknowledgement has reached our records — which is why they are set without a separate consent prompt.

There are no analytics, advertising or third-party tracking cookies on this site, and no third-party analytics or tag manager of any kind.

Who else can see the data

We do not sell personal data and we do not share it for anyone else’s purposes. Two systems are involved in running the service:

• Hetzner Online GmbH, Germany — hosts the public entrance to anon.talari.ai. It terminates the encrypted connection, so the content of a request passes through that server in the clear while in transit. It does not store the account database, documents, the vault or the vault key — but, like any web server, it logs connection metadata for each request (the client IP address, the requested URL and the browser’s user-agent string) transiently, for operational and security purposes. The content of a request is never written to a log or to disk there. Where even that transient exposure is unacceptable, the same software also runs fully offline on the customer’s own premises, with no cloud component at all.
• talari’s own appliance, Poland — anonymisation, the account database and the vault run on hardware we operate ourselves. All personal data at rest is here.

Transfers outside the EEA

None. The two systems above are in Germany and Poland, and we do not transfer personal data to a country outside the European Economic Area.

Your rights

You may ask us for a copy of your data (Art. 15 GDPR), for it to be corrected (Art. 16), erased (Art. 17) or restricted (Art. 18), and for it in a portable form (Art. 20). You may object at any time to processing we base on a legitimate interest (Art. 21). Write to legal@talari.ai; we answer within one month.

Three limits are worth stating plainly:

• On erasure an administrator deletes your account, every case you own, every active session and your rows in the usage ledger. Your rows in the sign-in ledger are not deleted at that moment: they hold an opaque account id, a hashed e-mail address and an IP address, and they expire on their own after 365 days. We can also purge your usage rows on request without deleting your account.
• Your pilot-consent acceptance record is not deleted with your account either, and — unlike the sign-in and usage ledgers — we do not purge it early on request: its purpose is being able to show that you accepted this notice if that is ever disputed, so erasing it on request would defeat the reason it is kept. It expires on its own after 2,190 days (6 years).
• The destruction records described above are not erased on request. They record erasures already carried out, they hold nothing about you beyond the id of the account that ordered the deletion, and erasing them would defeat the control they exist to provide.

Automated decisions

The service detects personal data in a document automatically, but that detection makes no decision about you and has no legal or similarly significant effect on you. We do no profiling and take no automated decisions within the meaning of Art. 22 GDPR.

Changes

We update this notice when the service changes. The date at the top is the version in force; where a change is material, testers are asked to accept the notice again before their next upload.