Privacy Policy

Who we are

Talos Foundry is an independent software practice operated by Joms Calma, building custom AI agents and automation for businesses. For anything in this policy, the contact is talos@talosfoundry.ai.

What we collect

There are three ways data is processed through this site.

1. Google Analytics 4 measurement

Google Analytics 4 (GA4) loads immediately when you visit the site. It uses cookies and identifiers, plus standard device and usage data, to show us which pages and a small set of predefined site interactions are used. We use those measurements to understand whether the site is working and where it can be improved. This data is processed by Google under its terms. We do not send contact-form contents, URL queries, or page referrers to GA4, and advertising features are disabled.

2. The contact form

When you submit the form, we receive the fields you filled in: your name, your email address, your company name if you chose to give one, and the description of the work you want help with. There is a hidden anti-spam field; if it is filled in, the submission is discarded as automated.

3. Standard server logs

This site is hosted on Netlify, which records ordinary web server information when a page is requested — IP address, browser user agent, the page requested, and a timestamp. This is generated by the hosting infrastructure for delivery, security, and abuse prevention. We do not use it to build a profile of you and we do not combine it with form submissions.

What we do not use

• No advertising pixels.
• No heatmaps.
• No cross-site remarketing.
• No third-party scripts other than Google Analytics. The site’s Content Security Policy permits only the narrowly scoped Google endpoints required for GA4.

Why we use it, and on what basis

Form submissions are used for one purpose: to read your enquiry and reply to it, and to carry on that conversation if it continues. Where UK/EU GDPR applies, the lawful basis is legitimate interest — you contacted a business asking it to get back to you, and replying is the obvious expected use. Server logs are processed on the same basis, for keeping the site available and secure.

We use GA4 for our legitimate interest in understanding basic use of this business site and improving it. We limit that measurement to page views and a short list of predefined interactions, remove URL queries and referrers, exclude form contents, and disable Google signals and advertising personalization to reduce its privacy impact.

We do not add you to a mailing list, we do not run you through a nurture sequence, and we do not sell, rent, or share your details with anyone for marketing. If you never hear from us again after the reply, that is by design.

Who else touches the data

We keep the vendor list as short as it can be. Data reaches these providers only because they operate the infrastructure:

• Netlify — hosts the site and receives form submissions before they are forwarded to us.
• Our email provider — delivers and stores the message so it can be read and answered.
• Google — processes Google Analytics 4 measurement data under its terms.

Netlify and our email provider process form data on our instructions. Google processes GA4 measurement data under its terms. We do not pass enquiries to AI model providers — your submission is not sent to a language model for processing or training.

Where it goes

Our providers operate globally and may store or process data outside your country, including in the United States. They do so under the transfer safeguards in their own data processing terms. If your organisation has a data residency requirement that this does not satisfy, email us and we will handle your enquiry another way.

How long we keep it

Enquiries that do not lead anywhere are deleted within 24 months. If we end up working together, correspondence is retained for as long as the engagement runs and for the period afterwards required for tax and contractual records. Server logs are retained on our host’s standard schedule, which is a matter of weeks, not years.

GA4 user-level and event-level data is kept for the period selected in the GA4 property’s Data Retention setting and is then handled under Google’s retention controls. The operator must choose and document that setting before production launch; this policy will be updated to name the configured period once it is confirmed rather than assuming a duration that may not match the property.

Your rights

Depending on where you live, you may have the right to ask for a copy of the data we hold on you, to have it corrected, to have it deleted, to object to how it is used, or to ask for it in a portable format. You can also complain to your local data protection authority — in the UK, that is the Information Commissioner’s Office.

To exercise any of these, email talos@talosfoundry.ai. You do not need a formal request or a specific form of words — asking us to delete your enquiry is enough, and we will confirm when it is done. We aim to respond within 30 days.

Security

The site is served over HTTPS only, sets a strict Content Security Policy, and blocks framing and MIME-type sniffing. Access to submitted enquiries is limited to the people who need to read them, which today means one person. No system is perfect; if you find a security issue with this site, please report it totalos@talosfoundry.ai and we will fix it.

Children

This is a business-to-business site and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes

If this policy changes, the updated date at the top changes with it. Material changes to how we handle existing enquiries will be communicated directly to the people affected.