Privacy Notice

Talden Inc. provides the Talden legal-work software. This notice covers our marketing website at taldenai.com, the application at demotalden.com/app, and related account, support and business activities. Our contact details and request routes are in the Contact Directory. A reference to Talden, we or us means Talden Inc. This notice explains personal-information processing; it does not grant us a general license to use confidential client materials.

We determine the purposes of account administration, billing, fraud prevention, our website and related business records. For client and matter content processed on a Customer's instructions, the Customer ordinarily determines the purposes, and the Data Addendum supplies our contractual processing obligations. A law firm or lawyer may itself act for a client. We will direct a request about that content to the responsible Customer where appropriate and comply with duties that apply to us directly. Signing up with a firm email address does not automatically give that firm access to an individual workspace.

Registration and professional details. You provide account identifiers, email, authentication and device-verification information, role, professional location and, where applicable, license and supervising-attorney details. We receive confirmation from a supervisor where required and may use proportionate public professional-register information to resolve an eligibility question. We do not represent that all Users' licenses have been independently verified.

Workspace and AI information. You may supply prompts, conversations, uploaded PDF, Word, spreadsheet, presentation, text or image files, pasted text, custom instructions, profile information, client and party names, matter facts and research websites. The Service generates drafts, answers, reviews, source records, task status and audit entries. It extracts text from files and may process scanned-page images for OCR. That information can contain confidential, privileged or personal material belonging to you or others. The contractual restrictions on unsupported data still apply.

Voice. When you activate dictation, we transmit microphone audio to the approved OpenAI speech route for transcription. When you request spoken playback, text needed for that playback is transmitted to the approved speech provider. Microphone activation is not permission to record another person's conversation unlawfully. Talden does not offer an undisclosed call-recording service or a voice-identification service under this beta. The interface identifies recording and lets you stop it. Retention of audio and resulting transcripts is described in the Data Addendum and approved provider register.

Connected information. When you connect Microsoft 365 and grant the separate permissions, we may access selected mail and message bodies, attachments, contacts, calendar items, OneDrive files, and expressly approved shared mailbox or SharePoint material. We receive and securely store authorization tokens rather than asking for your Microsoft password. A separately enabled responsibility can access the selected resources periodically while you are away. The launch connection is read-only. Disconnect in Talden to stop future access and remove its tokens; separately revoke Microsoft's grant through Microsoft personal-account permissions or Microsoft work/school applications, with administrator assistance if needed. Local disconnection does not erase imported copies; use Talden's deletion controls separately. Google Workspace and Clio information is processed only after those separate features are activated, under their contextual notices and source restrictions.

Technical and business information. We receive service events, token and credit counts, selected model identifiers, job timings, session/device information, IP or network information needed for operation and security, and payment status and transaction references. Talden supplies Stripe with account identifiers and transaction parameters; Stripe may collect card and billing details directly through checkout. Talden does not receive full card numbers. You may provide support messages and attachments; a Help widget is loaded only when you choose Help and does not automatically receive your matter content. We receive website information through the technologies described in the Cookie Notice. Information may also come from a person contacting us for your organization or from lawful incident and abuse reports.

We use information to authenticate accounts, supply selected legal-work functions, organize matters, run authorized jobs, generate and internally check work, provide approved personalization, process payments, meter usage, maintain security, investigate specific problems, respond to requests and comply with law. Separately, we use appropriate website and business-contact information to communicate about Talden and measure permitted website activity, subject to your choices and applicable law. We do not use client-matter content or connected-account data for advertising audiences.

Anthropic processes chat, drafting and internal review, ordinarily through Vercel AI Gateway. It may receive the selected request, conversation and attached text, matter context, approved memories and custom instructions needed for the task. OpenAI processes activated dictation, spoken playback, scanned-page OCR and any specifically enabled search function. Perplexity Research and search receive reduced issue-level queries and expressly named public targets such as cases, statutes or public filings; they do not receive files, matter records, memories or custom instructions through that route. Reduced queries are not necessarily anonymous. Hosting, database, storage and other recipients are described in the provider register.

Talden does not train models on Customer Content. Automated review within your task is inference used to prepare your work, not a shared-model training program. Our Agreement also restricts approved subprocessors from training or fine-tuning shared or general-purpose models on Customer Content. That is distinct from retention needed for processing or permitted security review: we do not claim that all information is instantly deleted by every provider or that no authorized human can ever access it. Provider-specific limits and settings must be those disclosed in the approved register. We do not use ordinary Service acceptance to obtain permission for a separate real-matter product-improvement dataset.

Memories are proposed by AI and used for personalization only after your approval for a matter, client or practice scope. They are not shared across Customers. Turning personalization off stops further use for personalization; delete stored memories separately to remove them, and consider related source conversations or files. Practice-wide memory can affect other matters in your own workspace because you approved that broader scope.

We disclose only information needed for the relevant purpose to approved AI, hosting, database, storage, authentication, email, security, support and payment providers; professional advisers bound by appropriate duties; and recipients you separately authorize. Website advertising and analytics providers may receive limited website information only when the corresponding permitted technology is enabled under the Cookie Notice. They do not receive authenticated workspace prompts, documents or connected-mail content from us for advertising.

We may disclose information when required by valid legal process, to protect security and enforce rights consistently with the Data Addendum, or in an authorized business transaction subject to confidentiality and continuing protections. A business transfer does not authorize repurposing client content. Restricted Google data, if that feature is activated, is not transferred in a merger or asset transaction without explicit prior consent where its policy requires consent. We do not sell Customer Content. A website advertising disclosure can be treated as sale, sharing or targeted advertising under some privacy laws even when no money changes hands; the choices and applicable opt-out process in the Cookie Notice apply to that activity. We do not treat a blanket no-sale slogan as a substitute for those controls.

Full transcripts, saved work, extracts and memories do not automatically expire merely because you stop using them. Trash has no automatic expiry and is not secure erasure. Ordinary originals are removed after extraction unless you choose Keep; extracts and generated work remain. Background attachments use the disclosed 24-hour or selected 30-day period. Deleting an original does not delete all content derived from it. Account closure is requested through Support, with export and deletion dates confirmed under Data Addendum Annex 3.

Under that schedule, a permanent deletion or full purge removes the selected content and associated production copies within 30 days, subject to limited legal holds and permitted non-content records; an account closure ordinarily includes a 30-day export opportunity before the production-deletion period unless you request immediate deletion. Isolated backups expire within 90 days after production deletion. Provider records have the approved disclosed retention periods. Raw audio follows the completed speech-retention entry in that schedule, shown before speech use; retaining a transcript and retaining the audio are separate choices and processes. Minimal legal, billing, consent and purchased-balance records may be retained for seven years after closure, subject to a different controlling legal requirement. Audit entries containing client names or matter titles are not exempt from content-deletion requirements merely because an audit log is append-only.

Operational security logs are generally limited to 90 days; approved support examples are removed when their purpose ends and within 30 days thereafter, subject to necessary investigation or legal holds. We periodically assess continued need. No policy promises restoration of every deleted item or an indefinite free archive. The separate cancellation of renewal does not itself delete saved work, revoke a Microsoft-side grant or remove lawful copies you already exported elsewhere.

You can update account information, export available work, remove content, manage approved memories, pause responsibilities, disconnect accounts, sign out sessions, cancel renewal and request account closure. Different controls have different effects. Contact Privacy and Data Requests for access, correction, deletion or other privacy requests, including a request that cannot be completed through the interface. Do not include confidential matter details beyond what is necessary to identify the request.

Depending on applicable law and our role, you may have rights to confirm processing, access and obtain a portable copy, correct inaccuracies, delete information, opt out of sale, sharing, targeted advertising or specified profiling, limit certain sensitive-information uses, withdraw a consent, or appeal a denied request. We will verify identity proportionately, recognize an authorized agent where required and protect others' rights and confidential materials. We will not discriminate unlawfully because you exercise a right. We respond within the applicable statutory period and explain any permitted extension or refusal. Where an appeal is available, send it to the same contact identifying the request and reason; we will review it and provide the required response and regulator complaint information.

For website sale/sharing or targeted-advertising choices, use Privacy choices and any recognized browser opt-out preference signal. We apply a signal to the browser or account as required and do not require an account solely to make a website choice. A Do Not Track signal is different from a legally recognized Global Privacy Control signal; we do not interpret every legacy Do Not Track signal as the same instruction, but honor applicable recognized opt-out signals. Unsubscribe from marketing through the message link; necessary billing, security and contract notices are separate from promotional email.

California-specific disclosures, where required: the categories, sources, purposes and recipient categories are those described in sections 2–4; retention is described in section 5. We use sensitive account-access and matter information for the requested service, security and other legally permitted limited purposes, not to infer personal characteristics for advertising. To be confirmed

The beta is offered to United States-based professional Customers. Processing may occur in the United States and the verified locations identified for approved providers; we do not promise a residency option, EU-only hosting or United States-only access by personnel. Where a transfer safeguard or additional notice is required, it must be established for the relevant processing before the route is enabled. A billing-country restriction does not eliminate rights that otherwise apply to a visitor or person whose information appears in a matter. An activated international rider supplies contractual transfer safeguards for its identified routes; it does not replace any additional notice required by applicable law.

Account use is limited to adults. We do not intentionally offer accounts to children. Information about a minor appearing in an authorized legal file is a separate processing issue and does not authorize a minor to open an account. Notify us of an account that does not meet the age requirement or information processed without authority.

We use the safeguards described in the Data Addendum and security overview, but no internet service is risk-free. We do not claim SOC 2, ISO certification, HIPAA-enabled processing or a contractual uptime level for this beta. We will date material notice changes and provide additional notice or obtain consent where required. Changes do not silently expand the permitted use of previously supplied Customer Content. The Contact Directory gives postal and electronic routes for questions, security reports and rights requests.