Privacy Policy

Who is responsible for your data

Knightsbridge Research Ltd ("Knightsbridge", "we", "us") provides Talos. We handle personal data in two different roles, and this policy covers both.

• Data about the people who use Talos: users' names, email addresses, sign-in records, settings and billing contacts. For this data we are the controller.
• Data customers put into Talos: the people, organisations, documents, captures and monitoring that a customer researches or uploads ("customer data"). For this data the customer is the controller and we are its processor: we handle it only on the customer's instructions, as our Terms of Service and any data processing agreement set out. If you are a person described in a customer's research and want to exercise your rights, contact that customer; if you contact us, we will pass your request to them where we can identify them.

What we collect about users

• Account details: name, email address, the accounts and roles you hold, profile photo and preferences.
• Security records: sign-in times, IP address and browser, two-factor and passkey registrations, API tokens you create, and the version of these terms you accepted and when.
• Usage records: an audit trail of changes you make to records, the pages and features you use, and the errors you hit, so we can secure, support and improve Talos.
• Billing details: the billing contact and plan. Card payments are handled by Stripe; we never see or store card numbers.
• Support messages: what you send us through the support form or the "Report a problem" action, with the page address, account and browser it was sent from.

How and why we use it

We use user data to provide Talos under our contract with the customer (signing you in, showing you your accounts, sending the emails you have asked for), to keep Talos and its customers' data secure, and to answer support requests. These are our legitimate interests in running a secure service, or are needed for the contract. We do not sell personal data, show advertising, or use third-party analytics or tracking.

We send service emails: invitations, security notices, notifications, digests and reports. Every recurring email has an unsubscribe link, and you can change them all in your notification settings.

Who we share it with

We use a small number of service providers (subprocessors) to run Talos, such as hosting and storage, email delivery, error monitoring, AI model and translation providers, and the data providers a customer chooses to use. Each receives only what it needs for its task, under a contract that requires it to protect the data. The full list, with what each receives and where, is on our subprocessors page.

Some of these providers are in the United States or elsewhere outside the UK. Where personal data is transferred outside the UK, we rely on the UK's adequacy regulations or on the UK International Data Transfer Addendum to the EU standard contractual clauses.

We disclose personal data to authorities only when the law requires it, and where allowed we tell the customer first.

Area Study accounts

What an Area Study subscriber records in Talos stays in their account. It never enters another account, a shared collection of records or a data product, and no background process looks it up or enriches it. A lookup runs only for a data source the account has turned on, only when someone in the account asks, and its results stay in the account.

To work at all, the tool uses these outside services, and only these, unless the account turns on a data source of its own:

• Mapbox draws the map in your browser, so it sees the map tiles and the area you are viewing.
• Geocodio finds an address you type on the map. If it cannot, the address goes to the USPS address service, the US Census Bureau geocoder or OpenStreetMap Nominatim.
• USGS The National Map supplies the base maps printed in a report. It receives the map's bounding box and size, never the places, people or notes on it.
• Amazon Web Services (S3) stores files you upload, the reports you print, and our database backups.
• Mailgun delivers the emails you ask for. A reminder names a study only to the person who owns it.
• AppSignal receives a report when something fails, with the details of the request that failed. That report can include text you typed into that request.

Knightsbridge staff with administrator access can read an Area Study account's records. They do so only to support the account, to keep the service secure, or when the law requires it. Their access is limited to those staff, and the records are never used to build or improve any other product or data set.

Closing an Area Study account deletes everything it recorded, including the people, places and sources in its studies and their change history, from the live service. Our database backups are not encrypted and are not deleted on a schedule, so a copy of what was deleted can remain in them.

How long we keep it

• User accounts are kept while you have access to Talos, and deleted or anonymised within 90 days of the customer removing you or closing its account, except the audit records described next.
• Audit and security records (who changed what, and sign-in records) are kept for as long as the records they describe, so that a customer's history stays accurate, and for up to two years for security investigations.
• Raw data returned by enrichment providers is erased after 180 days, or sooner where the provider's contract requires it; the facts an analyst accepted from it stay part of the customer's records.
• Customer data is kept for as long as the customer's account is active. When a customer leaves, we export it on request made within 30 days, then delete it from the live service. Our main database backups are not encrypted and are not deleted on a schedule, so a copy of deleted data can remain in them.
• Monitoring evidence under a legal hold set by a customer is kept until the customer releases the hold, then deleted with the rest of its data.

Getting your data out, and deleting it

Requests to export data or to delete an account are made from Settings › Privacy in Talos. A customer's account owner can ask there for a full export of its data, or for its deletion; some data can also be exported in Talos directly, such as monitoring exports and prospect list exports. We confirm a deletion with the account owner, then carry it out within 30 days.

As a user, you can see and correct your own details in Settings, and ask from Settings › Privacy for a copy or the deletion of your personal data. If you use Talos through a customer's account, we may need to check with that customer first, because your work is part of its records. If you cannot sign in, write to info@knightsbridge.ltd.

Your rights

Under UK data protection law you have rights to access your personal data, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable form. To use them, write to info@knightsbridge.ltd; we answer within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk), though we would like the chance to put it right first.

How we protect it

Talos is served only over encrypted connections. Access to customer data is limited by account, project and role, and every account's data is kept apart from every other's. Passwords are stored hashed, and two-factor sign-in is available. Our staff and contractors who can reach production systems are bound by confidentiality. If a breach affects your data, we will tell the customer without undue delay, and the regulator where the law requires.

Cookies

Talos uses only the cookies it needs to work: one that keeps you signed in, one that remembers the project you were working in, and one that protects forms against forgery. It sets no advertising or analytics cookies. Blocking these cookies will stop you from signing in.

Children

Talos is a professional service for organisations and is not meant for anyone under 18.

Talos Web Clipper browser extension

The Talos Web Clipper is a browser extension for Chrome, Firefox and Safari that sends web pages you choose to your Talos account. This section describes everything the extension reads, sends and keeps. It applies to the extension as published on the Chrome Web Store, Firefox Add-ons and the Mac App Store, and to builds made from its source.

What the extension reads

• Only the page in the tab you act on, and only when you act: when you open the extension's toolbar popup or choose Capture as… from the right-click menu on a selection. It has no standing access to websites and runs nothing on pages you do not click on.
• From that page, depending on what you capture: the address and title, the text you selected or the article text, the page's description and sharing metadata, the links visible on the page, a screenshot of the visible area, the whole page or an area you draw, and, on a supported profile page (LinkedIn, for example), the profile details shown on the page.
• It does not read your browsing history, your other tabs, your passwords or your cookies.

What it sends, and where

• A capture goes to one place only: the Talos server whose address you enter in the extension's Options, authenticated with the personal API token you create in Talos. It is filed into the Talos account and project you pick.
• Before you capture you choose the project, any people or groups to attach it to, and a note. Profile details and screenshots are shown for review before they are sent. Page links and metadata are sent only while Send page links & metadata with captures is on (in Options, or for that one capture in the popup).
• The extension makes one other kind of request, and only once you have allowed it: LinkedIn serves profile photos from a separate image server (media.licdn.com). After you allow downloads from it (Allow photo download in the popup, or Allow LinkedIn photos in Options), capturing a LinkedIn profile that shows a photo downloads that photo so it can be attached to the capture. In Safari, which manages website access itself, the download is attempted on each such capture and Safari's own website setting decides. Nothing is sent to LinkedIn beyond the download request. Options and Disconnect withdraw the permission.

Capturing a post into a monitor

On a supported social media post or app store review, the extension can send the post into one of your Talos account's monitors. That capture includes a screenshot of the visible page and a copy of the page's HTML as evidence. Before the HTML leaves your browser the extension removes the page's scripts (other than structured data), event handlers, embedded frames and plug-ins, and the security tokens in the page's meta tags and hidden form fields. The copy otherwise contains what the page shows, which can include the name or handle of the account you are signed in with on that site, as the screenshot does. Talos keeps these captures in the account's monitoring database.

What it stores in your browser

• Your Talos server address and API token, your Talos name and email address, the accounts and projects available to you and the account you picked, and your preferences, in the extension's local storage in this browser profile. None of it is synchronised to other devices.
• Recently used people and groups, and the last project and monitor you picked, so the popup can offer them again.
• Selections you tag with Capture as…, screenshots waiting to be sent, and links between profiles and Talos records, in the browser's session storage, which is cleared when the browser closes.

No third parties, no analytics

The extension contains no analytics, advertising, tracking or crash reporting, and loads no code from the internet. Apart from the photo download described above, it sends nothing to anyone but the Talos server you configure: not to Knightsbridge Research separately, and not to any third party. We do not sell or share data collected by the extension, and use it only to provide the capture you asked for. Once a capture is in Talos, it is stored and protected as part of your Talos account's data.

How to stop it and revoke access

• In the extension's Options, Disconnect deletes the stored token and the details stored with it, withdraws its access to your Talos site and to LinkedIn's image server, and clears the recent items, remembered projects and monitors, and session data listed above. Only your own preferences are kept.
• In Talos, the API Tokens page under Settings lists your tokens; revoking the extension's token stops it immediately, from any browser where it was saved.
• Removing the extension from your browser deletes everything it stored there.

Questions about the extension's handling of data can be sent to info@knightsbridge.ltd.

Changes to this policy

Each version of this policy is numbered. When we make a change that matters, we will tell customers in advance and ask users to accept the new version the next time they use Talos.

Contacting us

Questions about this policy or your data: info@knightsbridge.ltd. For help using Talos, the Talos Web Clipper or the Talos mobile apps, send a request through our support form.

Knightsbridge Research Ltd