Privacy Policy

Talent Augmentation OS (TAOS) Last updated: 2026-09-25 Effective: 2026-09-24

1. Why this document exists, and how to read it

TAOS is not a single product. It ships through several distinct channels, and the way your data is handled depends entirely on which channel you use. This policy describes each channel separately. If a section is not relevant to how you installed TAOS, you can ignore it.

The three channels are:

A. Local install (Claude Code plugin, Claude Desktop Extension, stdio MCP server, universal system prompt pasted into another LLM). Everything runs on your own machine.
B. Hosted web app at https://taoshq.com. Browser-based, requires a sign-in (Google, or a one-time code sent to your email), runs on infrastructure operated by the Licensor.
C. Remote MCP endpoint at https://taoshq.com/mcp. The same hosted infrastructure as B, but accessed by an MCP client over OAuth 2.1.

In all three cases, the content of any conversation with the LLM (the actual reasoning model) is governed by the LLM provider's privacy policy, not this one. TAOS's privacy posture covers the data we control: your profile, your assessment results, your interaction logs, and your account.

2. Who we are (Data Controller)

For Channels B and C (the hosted services), the Data Controller under GDPR is:

Angelo Leone Email: hello@taoshq.com Contact form: https://taoshq.com/contact

For Channel A (local install), there is no controller other than yourself. TAOS running on your own machine processes your own data; we have no access to it.

3. Channel A: Local install

If you run the universal system prompt, the Custom GPT / Gemini Gem / Claude Project, the stdio MCP server, the Claude Desktop Extension, or the Claude Cowork plugin without using the hosted app or remote MCP endpoint:

What is stored

Profile files: ~/.talent-augmenting-layer/profiles/pro-*.md (or in the repo's profiles/ directory if you cloned the repo). Markdown, human-readable, editable by you.
Interaction logs: JSONL files alongside the profiles, recording task category, domain, engagement level, and skill signal.
Assessment session state: a transient JSON file while an assessment is in progress.

What is NOT collected

No data is transmitted from your machine to the Licensor.
No telemetry, analytics, or usage tracking.
No API keys or secrets are stored or read by TAOS.
No cookies, fingerprinting, or device identifiers.

Your data stays where you put it

The local channel is data-sovereign by construction. Use the talent_delete_profile MCP tool, or simply delete the files, to remove your data.

Important caveat about the LLM you use

The LLM you connect TAOS to (Claude, ChatGPT, Gemini, Cursor, Codex, etc.) sees your conversation and is governed by that vendor's privacy policy, not this one. TAOS does not change that. If you are subject to a corporate "no customer data to LLM training" requirement, configure your LLM tier accordingly (most paid tiers exclude training).

4. Channel B: Hosted web app

If you sign in at https://taoshq.com:

Personal data we collect and store

Category	Source	Why we store it	Retention
Email address, name, profile picture URL	Google OAuth on sign-in, or the email address you type when you sign in with a code (no name or picture comes with a code sign-in)	Authenticate you, send check-in reminders, identify you in the org admin dashboard	Until you delete your account
Google subject ID (`google_id`)	Google OAuth	Stable identifier to recognise repeat sign-ins	Until you delete your account
One-time sign-in codes (stored only as a keyed hash, with the email address they were sent to)	Created when you ask for a code by email	Let you sign in without a Google account, and limit how many codes one address can receive	Deleted daily; a code stops working after 15 minutes
Assessment conversation transcript	You typing into the assessment chat	Score the assessment, generate your profile	Until you delete your account or 24 months from creation, whichever comes first
Profile content (markdown, scores, calibration)	Generated from your assessment	Provide the personalisation TAOS exists to provide	Until you delete your account
Interaction telemetry: task category, domain, engagement level, skill signal, a short free-text note about the interaction, and a session id	Recorded by the assistant after each turn (via the `talent_log_interaction` tool call) and sent to the hosted API	Compute progression and atrophy signals shown in your dashboard	24 months rolling, then aggregated
Check-in survey responses	You answering the 2-week reminder	Track skill growth/atrophy over time	Until you delete your account
Per-turn assessment latency (`latency_ms`)	Server-side timing	Diagnose performance issues	90 days rolling
Organisation membership and role	Set by you or by your org admin	Multi-tenancy: scope analytics to your org	Until you leave or delete your account
OAuth audit data for the remote MCP endpoint (token jti, expiry, client)	OAuth 2.1 flow	Required for token revocation and security investigation	90 days after token expiry
Your "Prompts to try" library: example prompts written from your profile's role, industry, skills and tasks	Written the first time you open the page, and again when your profile changes	Show you prompts suited to your own work	Replaced when your profile changes; removed when you delete your account
Your shared "AI working style" card: first name, working style, the skills on your card with the level you rated each, and your readiness score if you choose to show it	Created only when you press a share button	Show the card you chose to share, at a link that only works if you hand it out, and never in search results	Until you press "Stop sharing" or delete your account
How you first found us: the campaign tags on the link you first arrived from (such as `utm_source=linkedin`), or the website that linked to us	The `taos_src` cookie described below, read once when you create an account	See which channels bring people who find TAOS useful, so we spend on the ones that work	Until you delete your account

Cookies

We set three first-party cookies and no third-party ones. No advertising or analytics tracker from any other company runs on our site.

Cookie	What it holds	Why	How long
`tal_session`	A signed sign-in token	Keeps you signed in	72 hours
`session`	Temporary state for the sign-in handshake (Google, or an emailed code)	Makes sign-in secure	Up to 14 days
`taos_src`	The campaign tags of the link you first arrived from, and nothing else. It contains no identifier.	Tells us which channel brought you, if you go on to create an account	30 days

We never set taos_src if your browser sends Global Privacy Control or Do Not Track, and you can delete it in your browser at any time; nothing else depends on it.

We also count visits per source per day (for example, twelve visits from LinkedIn on a given day). Those counts store no IP address, no device details and no cookie.

What we do NOT store

We do not store passwords. You sign in through Google, or with a one-time code we email you.
We never store your payment card details. Our merchant of record (currently Polar, operated by Polar Software, Inc.) is the seller of record for your purchase and handles invoicing, VAT, and payment details directly. We store only a customer ID and your subscription status.
We do not log full LLM prompts or LLM outputs to disk by default. Only the structured telemetry described above (recorded via the talent_log_interaction tool call) is persisted.

Contract: storing your profile and assessment results is necessary to provide the service you signed up for (Article 6(1)(b)).
Legitimate interest: aggregate, anonymised analytics for service improvement (Article 6(1)(f)). You can opt out by deleting your account.
Legitimate interest (how you found us): recording the channel that brought you when you create an account, so we can tell which ways of reaching people work (Article 6(1)(f)). Your browser's Global Privacy Control or Do Not Track setting switches it off, and deleting your account deletes it.
Legitimate interest, with a dedicated opt-out (usage insights): we pool a small set of structured, non-sensitive interaction fields (task mode, domain category, engagement level, and your answer to the "was that the right amount of friction?" question) into k-anonymous aggregates (minimum group size 5) to improve TAOS's default calibration (Article 6(1)(f)). This is on by default; the "Usage insights" switch in your dashboard's Coaching controls turns it off at any time, which is also how you exercise your Article 21 right to object for this purpose. Free-text notes, issue reports, and conversation content are never pooled, and aggregates never identify you.
Consent: optional pilot telemetry export to Google Drive (Article 6(1)(a)). Off by default; you can withdraw consent at any time.

Subprocessors

The hosted app uses the following third-party processors. By using the hosted app you consent to data transfer to these processors. We will publish prior notice of any change to this list.

Subprocessor	Purpose	Data shared	Region
Render, Inc.	Application hosting and managed PostgreSQL	All persisted data listed above	US (default region; EU region available on request)
Google LLC (OAuth 2.0)	Authentication only	Email, name, profile picture URL, Google subject ID	Global
Google LLC (Gemini API)	Powers the conversational assessment and writes your "Prompts to try" library	Assessment turn content during the assessment session; your role, industry, skill names and levels, and task list when prompts are written	Global; "no-train" enforced via paid API tier
Resend (Plus Five Five, Inc.)	Sends transactional email: sign-in codes, check-in reminders, billing and trial notices, org invites	Email address, user name, message content	US
Google LLC (Drive API), optional	Anonymised pilot telemetry export	De-identified aggregated metrics; never email or name	Global
Polar Software, Inc.	Merchant of record for subscription billing if you sign up for a paid tier (invoicing, VAT/tax handling, payment details). Polar uses Stripe as its payment processor.	Email, billing details, subscription state	US, EU, UK

Data residency

The default Render region is US-East. For pilot or commercial customers with an EU residency requirement, we can deploy a separate instance in Render's EU region (Frankfurt). Contact hello@taoshq.com to request EU residency before signing up.

Retention and deletion

You can delete your account and all associated data through the dashboard, or by emailing hello@taoshq.com with the subject "DELETE my TAOS account". On deletion we hard-delete: user row, profile rows, assessment sessions, chat logs, check-in reminders, OAuth tokens, and any pilot survey responses. Aggregated, fully anonymised analytics may persist beyond deletion.

We will respond to deletion requests within 30 days and confirm completion in writing.

5. Channel C: Remote MCP endpoint

If you use an MCP client (Claude Desktop, Claude Code, Cursor, Codex CLI, etc.) configured to point at https://taoshq.com/mcp:

The data handling is identical to Channel B (the hosted web app). The MCP endpoint is the same FastAPI service, the same PostgreSQL database, the same OAuth flow. The only difference is the access surface.

Additional considerations specific to the remote MCP channel:

OAuth 2.1 + PKCE. Your MCP client performs an OAuth handshake in which you sign in with Google or an emailed code; we issue access tokens (JWTs) that are required for every tool call. Tokens are short-lived; refresh tokens are stored encrypted at rest in PostgreSQL.
No persistent connections. The endpoint uses Streamable HTTP, not long-lived sessions, so there is no idle connection holding state about you.
CORS allow-list. The MCP endpoint accepts cross-origin requests from any origin to support browser-based MCP clients; this does not weaken authentication, which is still required.
Rate limiting and audit logging apply to MCP requests on the same basis as the hosted web app.

6. Pilot programmes

If you are a participant in a research pilot run with TAOS (e.g. Solita, Vanguard):

Your participation is governed by a separate Participant Information Sheet that the pilot operator provides at consent time. That document specifies the additional data collected, the lawful basis, and your withdrawal rights for the pilot.
Pilot-specific tables (pilot_surveys, chat_logs with elevated detail) are populated only during the pilot window.
Pilot data may be exported to Google Drive in fully anonymised form (no email, no name, no Google subject ID) for academic or operational analysis. This export is opt-in at the pilot level; ask the pilot operator if you are unsure.
Pilot data is deleted, or fully anonymised and aggregated, within 90 days of pilot completion.

Regardless of channel, where applicable law gives you the following rights, you can exercise them by emailing hello@taoshq.com:

Access: receive a copy of all personal data we hold about you.
Rectification: correct inaccurate data.
Erasure ("right to be forgotten"): delete your account and all associated data.
Restriction: ask us to stop processing while a complaint is investigated.
Portability: receive your profile and interaction logs in machine-readable form (we will export markdown + JSON).
Objection: object to processing based on legitimate interest.
Withdrawal of consent for any consent-based processing (e.g. pilot telemetry export).
Complaint: lodge a complaint with your supervisory authority. For EU residents, this is your national Data Protection Authority. For UK residents, the ICO.

We respond to subject-access requests within 30 days.

8. Data security

We apply the following technical and organisational measures:

Encryption in transit: TLS 1.2+ on all hosted endpoints.
Encryption at rest: Render's managed PostgreSQL encrypts data at rest; access keys are managed by the platform.
Authentication: Google OAuth or a one-time emailed code for end users; OAuth 2.1 + PKCE for remote MCP clients.
Access control: only the Licensor (and explicitly designated personnel, currently none) has administrative access to the production database.
Secret management: production secrets are held in Render environment variables, not in source control.
Dependency scanning: GitHub Dependabot is enabled on the source repository.
Audit logging: administrative actions on the hosted service are logged; the audit log is available to organisation admins for actions on their own org.
Incident response: in the event of a personal-data breach, we will notify affected users and supervisory authorities within 72 hours where required by GDPR Article 33.

We do not currently hold a SOC 2 or ISO 27001 certificate. We are in the process of building a SOC 2 readiness programme and expect to pursue Type I attestation in the next 6 to 12 months. Up-to-date status is available on request.

9. Children

TAOS is not directed at children under 16. We do not knowingly collect data from minors. If you believe a child has signed in, contact us and we will delete the account.

10. International data transfers

Where the hosted app processes personal data outside the EU, we rely on the European Commission's Standard Contractual Clauses with the relevant subprocessor (Google, Render, Resend, Polar). Where we have offered EU data residency to a specific customer, transfers outside the EU are minimised to the operationally necessary minimum (e.g. Google OAuth metadata).

11. Changes to this policy

We will publish material changes to this policy at the same URL with an updated "Last updated" date and, where the change affects how we process your data, send a notification to the email address on file at least 30 days before the change takes effect. Continued use after the effective date constitutes acceptance.

12. Contact

hello@taoshq.com for any privacy question, subject-access request, or DPA enquiry. For commercial-licensing or security-questionnaire questions, see also COMMERCIAL.md and the security section of the README.

Questions about this document? Contact us.