Talebeacon Privacy Notice
Version 8.3 · Effective 13 October 2026
1. About this notice
Talebeacon Ltd. is an Israeli company.
Our service measures how AI engines describe a brand and produces analysis and a plan for that brand.
This notice covers information involved in our website, accounts, brand scans, product milestones, feedback notes, enquiries and the operation of Talebeacon.
For privacy questions or requests concerning your personal information, contact Talebeacon Ltd. at privacy@talebeacon.com.
Replies to privacy requests come from hello@talebeacon.com.
The founder is the only person at Talebeacon who reads the privacy mailbox and handles these requests.
2. Information involved in the service
Accounts and sign-in
We hold your email address, optional display name and role, sign-in method and timestamps, plan, invite code used, Terms-acceptance information, notification and analytics choices, and the brands associated with your account.
You can sign in using an email link, or choose to use your Google account.
If you choose Google sign-in, we receive your email address, name, Google account identifier and a link to your profile picture.
We use account information for sign-in and to associate you with your brands.
Email is required at signup, and a brand website is required during onboarding.
Brand scans
Customers supply a brand website and may provide competitors and a category during onboarding.
We crawl public pages and create synthetic buyer profiles and questions to put to AI engines.
Where the site was read, after the site audit, we send the page text already collected for that scan through OpenRouter to a Claude model to list what the company says about itself. We then send that list, or claims you gave us at onboarding if the site could not be read, with the scan's buyer-criteria labels and definitions through OpenRouter to Claude, GPT and Gemini models to match claims to criteria. We use the middle of their answers; if fewer than two answer, we make no match. We keep the claims and matching results with the scan in a claims file and a summary in the results file. This step fetches no additional pages.
We use crawled page text while a scan runs and delete that text when the scan finishes.
If the scan fails or is stopped, the page text is deleted within one day.
We keep page addresses and the findings derived from them, customer-visible scan questions and answers, scores, the plan for the brand and report files.
Public pages and the material being analysed can include information about real people, such as a founder’s biography.
Our buyer profiles are synthetic text.
Public AI-engine answers may incidentally name professionals. We collect and analyse those public answers to measure how AI engines describe brands. Talebeacon decides how to collect the answers and handle names appearing in them. We do not ask the app-reading services to identify your account or send them your account or scan identifier. If you are named in an answer, you may contact privacy@talebeacon.com to ask about it or request its removal from our records.
We keep public answers and incidental names with the relevant brand's scan records while that brand remains in the account, subject to an earlier removal required by applicable law.
We do not normally contact each person named in a public answer individually. Doing so would require us to collect contact details we do not otherwise seek for this limited activity. This notice explains the activity and gives you a way to make a privacy request.
We do not currently train our own models.
Planned category benchmarks and research
We plan to combine non-personal company-level scan scores and fixed-list classifications and scan information to create category comparisons, public research and marketing reports, and paid aggregate reports or data services for other customers or external recipients.
We do not currently produce these cross-customer benchmarks or aggregate research.
Eligible brands that you add through the owner account after expressly accepting Terms containing the programme are included unless you exclude them.
The eligibility rules also apply during the Founding Program Free Period.
Acceptance, approval, activation or renewal does not automatically include previously added brands or brands created through our internal administration tools.
You can exclude a covered brand on its Setup page or by emailing support@talebeacon.com.
Archiving does not exclude a brand; archived brands remain included while otherwise eligible, and you can exclude them by email without restoring them.
Exclusion concerns shared programme results and does not affect your brand's own scans and reports or internal operation and method improvement already permitted by the Terms.
Those internal uses remain subject to confidentiality, the existing limits on Customer Data use and retention, applicable personal-data law and any applicable DPA.
They do not authorise training models on Customer Data.
We will not use personal data, raw engine answers or customer-written narrative content as inputs to the programme's statistics.
Shared results will not identify a customer, brand or person.
An exclusion saved in Setup applies to calculations to prepare or create shared programme results started after it is saved; an email exclusion applies to those calculations started after we receive the request identifying the brand.
Such a calculation already started may finish.
Anonymous shared programme results lawfully created may be retained and used after exclusion.
Internal results cannot be turned into shared programme results to bypass an exclusion or the programme's eligibility rules.
If you later include the brand again, future calculations for shared results may use eligible scores generated under this programme, including scores from the time it was excluded.
Reinstatement does not bring an otherwise uncovered brand into the programme.
Service messages and operating records
We send account holders emails when a scan finishes, needs action or is taking longer.
We keep operator-access, execution, cost and debugging records as part of running the service.
Error messages in model-call logs can contain model-output text.
Supabase keeps request logs for the app’s server functions, including feedback submissions.
These logs can include the network address, browser user-agent, approximate location and, for signed-in requests, the account identifier.
The feedback request log does not contain the note’s text; separate error records may contain information returned in an error message.
Product milestones
Our servers record account creation, onboarding completion, brand creation, scan starts and scan completions linked to the account.
Brand-creation and scan events can recur throughout the life of the account.
These milestone events do not include page views, clicks or customer content.
We keep the milestones in our product database for 30 days and send our analytics provider daily counts that identify no one.
The product-analytics switch in Settings stops new milestone collection and deletes the account’s milestone events from our product-events table.
We record changes to that choice.
You can opt out without giving a reason or losing access to Talebeacon.
Feedback notes
Signed-in customers can send us a note from the Feedback button in the app.
Using this button is optional.
Your note and its accompanying feedback information are sent when you press Send.
We receive what you wrote, your account and the address and name of the screen you were on.
We also receive the brand reference and scan identifier for what you were viewing, when available and when your account is allowed to access them.
The feedback feature does not automatically attach screenshots, recordings, or device or browser details to your note.
We use a note to understand and address what you reported, and to email you at your account address if we need to ask you something.
Each note is stored in our product database and sent through Resend to our operator mailbox in Google Workspace.
That email contains the note’s text, your name and email address, your plan, the screen, and the brand and scan date where available.
Access to the feedback administration page is restricted to the operator.
The operator’s listing, closing, queuing and deleting of notes is logged.
When we turn a note into a work item, its text is copied into our internal working records.
The working-record and mailbox services described in Section 4 also apply to these copies.
You cannot view or delete sent notes inside the product; to ask for access to your personal information or its deletion, email privacy@talebeacon.com.
The conditions for these rights are explained in Section 7.
Enquiries and Founding Program applications
Enquiries include your name, work email, company or brand, message and any optional LinkedIn profile address you supply.
Founding Program applications also include a brand website, category and information about who would implement the work and their available capacity.
Name, work email and company are required on the contact form, and Founding Program applications also require answers to the two implementation questions.
We also record a source category, such as LinkedIn, Google, direct or other, derived from the referring page.
We use enquiry information to respond to your enquiry and assess your Founding Program application.
We store enquiry information separately from form-security events and restrict access to the enquiry records to the operator.
Our internal notification contains the company and a link to the stored enquiry rather than its message body, and replies form part of our email correspondence.
Approved Founding Program participants
If we approve your application, we keep a Founding Program record containing the contact name and work email, company or brand, website and category, the approval date and approving operator, the agreed programme terms, activation and promotional deadlines, start and end dates when set, participation indicators and relevant dates, and limited status, date and reason-category information needed to administer an invitation expiry or withdrawal, programme pause or early ending.
We use this record and linked account information to administer participation, access and agreed benefits and to send approval and necessary programme messages.
At approval we remove the application from the enquiries table; its implementation answers, message and LinkedIn address are not copied into the founding record.
Copies in database backups follow the rule under “Founding Program records and copies” in Section 6.
A testimonial indicator is not permission to publish a testimonial.
Form security
Our form-security records contain event types, times and a short-lived keyed code derived from the sender’s network address to monitor submissions and abuse.
The address itself is not stored in those form-security records.
Those records have no direct link to the enquiry.
Agreement, preference and notice-provision records
We hold records of Terms acceptance and product-analytics choices, including the relevant account or work email, action, wording-version field, surface, time and country.
Our enquiry records can reference the page build and notice link or version declared by that page.
That reference does not establish that you opened, read or agreed to the privacy notice.
We also keep each brand's benchmark-participation status and records of its initial status and changes.
These records identify the brand, the responsible account or operator, the time, the relevant wording and Terms versions, and whether the status came from accepted Terms, an owner choice or an operator action.
For email requests, we also record when the request was received and which brand it concerns.
Default inclusion is not recorded as affirmative consent.
We use these records to apply the setting and establish which permissions applied.
Changing participation is optional; we need to record a change to carry it out.
We send the owner a service email confirming each participation change and keep a copy in our support mailbox so that changes can be recovered after a database restore.
These emails contain the brand reference, change, effective time and relevant version information, without scan scores or scan content.
We also keep the limited deletion and account-closure records needed to prevent restored data from returning to the programme.
These records are administered through our product database and authorised operational access, and the service-email and mailbox providers described below.
They are not included in published or sold benchmark results.
Privacy requests
We keep a limited record of privacy requests, complaints and appeals, including when and how they were received, their nature, the verification outcome, our response and its date, reasons for any refusal, and the responsible handler.
We use it to handle the request and demonstrate how it was resolved.
Access is restricted to authorised people handling requests or compliance.
Payments
To start a purchase, we ask for your name, company and work email and record acceptance of the Terms.
We send your name and email to Airwallex when creating checkout, together with a purchase reference.
Airwallex collects your card details and the billing details it requires on its own payment page.
We receive payment status, a payment reference, payment time and renewal outcomes and associate the purchase with your account when it exists.
We do not receive your card number.
Our payment-services counterparty is Airwallex (Israel) Ltd.
For payment processing and its own regulatory purposes, Airwallex acts as an independent controller; its privacy policy explains that processing.
3. Purposes and legal bases
Except where expressly stated otherwise, the legal bases below apply where the EU General Data Protection Regulation applies.
The paragraphs on benchmark-participation records and privacy-request records also address the UK GDPR.
Where an AI-engine answer names a person in a public professional context, we rely on our legitimate interest in measuring and reporting public descriptions of brands. We keep the name with the relevant brand's scan records; we do not seek the person's contact details, build a profile of them, or make decisions about them. We do not use these names for marketing, model training or the planned cross-customer benchmarks, and we do not sell them. You may object or ask us to remove a name from our records by contacting privacy@talebeacon.com; we review and respond to such requests under applicable law. This is Talebeacon's controller activity for public-answer content, separate from personal data we process on a customer's behalf under Appendix A to the Terms.
For requested correspondence with company representatives, we rely on our legitimate interests in answering enquiries and handling the business enquiries or Founding Program applications people ask us to consider.
Where you personally are the prospective or actual contracting party, we rely on contractual necessity only for steps you request before entering that contract or processing objectively necessary to perform it.
These purposes do not include adding you to a marketing list.
For necessary contact, participation and linked account information used to administer a company's Founding Program access and agreed benefits, we rely on our legitimate interests in managing that requested business relationship and keeping an accurate record of its terms.
Where you personally are the contracting party, contractual necessity applies only to processing objectively necessary for the steps you request before that contract or its performance.
These Founding Program administration purposes do not include marketing-list enrolment or permission to publish a testimonial.
For necessary form-abuse prevention, we rely on our legitimate interests in protecting the availability and integrity of our forms and preventing automated flooding.
For necessary Terms-acceptance evidence and separately justified claims evidence, we rely on our legitimate interests in establishing contractual commitments and establishing, exercising or defending specific claims.
For necessary evidence of providing privacy information, our legal basis is compliance with the applicable GDPR transparency and accountability obligations.
For benchmark-participation records, where the EU or UK GDPR applies, we rely on our legitimate interests in administering the company's participation, respecting exclusions and maintaining necessary evidence of the permissions applied.
You may object to processing of your personal information on grounds relating to your particular situation by contacting privacy@talebeacon.com.
This basis concerns the participation records; it does not authorise use of personal data as benchmark inputs.
For privacy-request records, where the EU or UK GDPR applies, we process information needed to handle requests and demonstrate compliance with our obligations under that law.
Where keeping limited evidence goes beyond those obligations, we rely on our legitimate interests in demonstrating how we handled requests and addressing related complaints or claims, subject to necessity and your rights.
These records are not used for marketing or benchmark results.
Where we rely on legitimate interests, you may object on grounds relating to your particular situation.
For limited product-milestone measurement, we rely on our legitimate interests in understanding completion and repeat use of the core product steps so that we can improve the service.
For feedback notes, we rely on our legitimate interests in understanding and fixing what customers report.
Where you personally are the contracting party, contractual necessity applies only to support objectively necessary to perform that contract.
For necessary request and error logging, we rely on our legitimate interests in keeping the service working and diagnosing failures.
We use your purchase details to arrange and administer the subscription you request.
Where you personally contract with us, we rely on the steps you request before entering that contract and on performing it.
Where you act for a company, we rely on our legitimate interest in arranging and administering that company’s purchase.
4. Services involved and access
Supabase provides our product database, file storage and authentication.
A web-page rendering service helps us retrieve public brand-site pages for customer scans.
Lovable hosts our website and app.
Resend handles service emails, enquiry-notification emails and feedback-notification emails.
OpenRouter passes our prompts to the AI engines. OpenRouter states that it does not keep their text after generation, subject to its stated exceptions; the engines may retain requests under their own policies.
OpenRouter keeps request metadata, such as the model used, token counts and cost.
We use specialised app-reading services to read public ChatGPT and Gemini answers to buyer questions we write. They receive the question and a country; one also receives a language. We do not send them your account or scan identifier. If app reading fails, we use the AI-engine API through OpenRouter. The app-reading services act for Talebeacon in collecting public answers, which can incidentally name people.
Our backup app-reading provider receives the buyer questions we write and the public answers it collects. Its terms may allow it to retain and use material collected through its service for its own purposes. You may ask us to exclude it from your scans.
PostHog Cloud EU receives daily event counts.
Google provides optional Google sign-in and our Google Workspace email service.
Airwallex handles payment processing as described above.
The founder operates Talebeacon and can access stored information.
Working records are kept on the founder’s computer, and email correspondence is held in Google Workspace.
Google Drive holds backup copies of working records.
The founder uses Claude through connectors to read the mailbox and database on instruction.
ChatGPT holds a legal working pack containing synthetic facts.
5. Where information is stored and processed
Our primary product database and file storage are in Tokyo, Japan, through Supabase.
Supabase database backups are kept for seven days and do not include files in Storage.
Our main app-reading provider is established in the EU and states that it stores the questions, answers, logs and backups in Germany.
Our backup app-reading provider is established in Israel; we have not confirmed where it keeps answer copies or logs.
We use PostHog Cloud EU, which PostHog describes as hosted in Frankfurt, Germany.
Resend sends our service emails from its Ireland sending region.
Resend states that it stores message content and delivery records in the United States.
The founder’s working computer is in Israel.
Airwallex states that it hosts personal information primarily in Singapore, Belgium, the Netherlands, Japan, Australia, Malaysia and the United States.
6. How long information is kept
Adopted limits and reported operation
Our retention policy limits account-linked product-analytics events to a maximum of 30 days from each event’s collection, with earlier deletion when the linkage is no longer necessary.
Our retention policy sets a maximum of 12 months after the last substantive exchange for unsuccessful sales enquiries and Founding Program applications, with earlier deletion when the information is no longer needed.
Our retention policy sets a maximum of 30 days from collection for routine justified abuse metadata, with earlier deletion when the information is no longer needed.
Daily deletion rules are enabled for our product milestones, enquiries and form-security events.
A separate job checks form-security address codes for clearing every five minutes.
Resend states that it keeps email content and logs for 30 days on our plan, with backups kept on a separate seven-day cycle.
Founding Program records and copies
If an approved applicant does not create an account, our policy is to keep the founding record for no more than twelve months from the approval email or a later substantive exchange, with earlier deletion when it is no longer needed.
Routine reminders and resends do not restart that period.
Expiry or withdrawal of the invitation does not create a new retention period or require keeping the record for the full twelve months.
Once linked to an account, the founding record follows the account-closure and deletion timetable below, including earlier deletion when required, even if it is not otherwise Customer Data under the Terms.
The read-only and inactivity provisions below also apply to a Founding Program account whose free access ends without a paid subscription.
They permit closure after the stated inactivity period and notice; they do not mean that every inactive account is automatically closed after twelve months.
Copies of application and founding records in Supabase database backups expire within seven days under the database backup cycle.
The separate thirty-day retention of email copies by Resend is stated above.
Feedback notes
We delete a closed note from our product database six months after it is closed.
An open note is not deleted automatically; after 90 days it is flagged for the operator to close it or keep it open.
The operator can delete a note earlier.
When we delete your account’s profile record, its feedback notes are also deleted from our product database.
The email copy in our mailbox is kept as email correspondence and is not deleted by the six-month rule.
Text copied into our working records when a note becomes a work item is not deleted with the note.
Our policy is to keep identifiable feedback information only while needed to handle the report and follow-up, and to remove it from mailbox and working-record copies no later than the source note’s deletion, unless particular information remains necessary for a legal requirement or a specific legal claim.
Our policy also requires a recorded reason and a next review date when a note is kept open after review.
The routines for deleting these copies and recording reasons for keeping notes open are not yet in place.
The email service’s separate retention period is stated above.
Copies in Supabase database backups expire within seven days under the database backup cycle.
The database deletion rules described here do not extend any earlier deletion obligation under applicable law or our Terms.
Account closure and Customer Data
Under our Terms, we delete Customer Data under our control within 45 days after your written deletion request or account closure, subject to the Terms’ stated exceptions and applicable data-protection requirements.
A subscription ending does not by itself close the account or start that deletion period.
After the applicable recovery period, a lapsed account remains read-only without fees merely for that retention.
After twelve consecutive months without a sign-in by any authorized user, measured from the later of entry into read-only lapse and the most recent sign-in, using registration if there has never been a sign-in, we may give at least thirty days’ written notice of account closure.
Closure on that date depends on the account remaining lapsed and no authorized user signing in before then.
This permission to close an inactive account does not postpone earlier deletion required by your written instruction or applicable data-protection law.
We keep the current benchmark-participation setting while the brand remains in the account, including while it is archived, together with the change records needed to establish and apply its participation history.
We delete these records, including copies in our support mailbox and limited programme deletion or account-closure records, from active systems within 45 days after the brand is deleted or the account closes, unless earlier deletion is required by applicable law.
Copies in Supabase database backups expire within seven days under the database backup cycle; other routine backup copies expire under the applicable backup-retention cycle and are not used for the programme.
If a backup is restored, we reapply recorded exclusions and deletions before using restored data for the programme.
The email service's separate retention period is stated above; copies delivered to you are under your control.
If particular evidence must be retained to meet a legal requirement or establish, exercise or defend a specific legal claim, we restrict it to that purpose and retain it only while necessary.
Such retention does not permit further use of the brand's scores for shared benchmarks or research.
Privacy-request records
We keep the minimal request and response log for 24 months after our final response, including the response to any related appeal, and then delete it from active systems.
We delete privacy-request emails from our mailbox within 90 days after our final response, including the response to any related appeal.
We remove identity-check documents and other unnecessary supporting material when they are no longer needed for the request, rather than keeping them automatically for the full log period.
A different period applies where required by law or where particular evidence remains necessary for an unresolved complaint or specific legal claim; we restrict such evidence to that purpose and review the need to retain it.
Routine backup copies expire under their applicable retention cycles and are not used for other purposes.
This log-retention period does not shorten the life of an active benchmark exclusion or its necessary participation records.
7. Your privacy rights
Where the EU or UK GDPR applies, you have rights concerning access, correction, erasure, restriction, objection and portability, subject to the conditions for each right.
Where processing relies on your consent, you can withdraw it without affecting the lawfulness of processing before withdrawal.
Applicable data-protection law also provides safeguards concerning decisions based solely on automated processing, subject to its conditions.
You can complain to the relevant data protection authority, including the UK Information Commissioner's Office where applicable.
Under Israeli law, you may request access to personal information about you held in a database and request correction or deletion of information that is inaccurate, incomplete, unclear or outdated, subject to applicable conditions and exceptions.
Where applicable US state law gives you rights, you may request confirmation of processing, access, correction, deletion or a portable copy, and exercise applicable sale, targeted-advertising or profiling opt-out rights.
You may appeal a refusal where the applicable law provides that right.
Send privacy requests, complaints or appeals to privacy@talebeacon.com; we may need information reasonably necessary to verify your identity or authority.
These rights concern your personal information throughout the activities covered by this notice and are separate from the brand's contractual exclusion setting.
8. Cookies and similar technologies
The app uses browser storage for sign-in state and the sidebar preference.
Those local-storage items have no built-in expiry.
A walkthrough-dismissal cookie remembers dismissal for one year.
Lovable’s hosting cookie, __dpl, is set on both the website and app, with observed lifetimes of about one day on the site and seven days on the app.
Our website has its own first-party consent-record mechanism.
Fonts are hosted with our website and app rather than loaded from Google Fonts.
9. Protecting information
We restrict operator access to enquiry records and keep those records separate from form-security records.
Our milestone-event fields are constrained by a database rule.
10. Changes to this notice
We may update this notice from time to time.
This notice describes information practices; it does not amend the Terms of Service or any applicable data processing addendum.