Legal · Privacy
Privacy Policy
Pre-incorporation draft. The status note below explains what that means.
This Privacy Policy explains what personal data Talisman processes, on what lawful basis, who we share it with, how long we keep it, and the rights you have under UK GDPR and the Data Protection Act 2018. It is written to be read, not skipped.
Status. Pre-incorporation draft. The data controller will be Talisman Music CIC once incorporated; until then, the Talisman Project operates as the controller for the limited processing under way during the closed beta. ICO registration will be filed in advance of public launch and the registration number added here. Bracketed
[TBC]markers indicate items pending sign-off.
1. Controller, contact, and DPO
The data controller for personal data processed in connection with the Service is the Talisman Project (pre-incorporation), to be reissued on incorporation as Talisman Music CIC, registered office [TBC], ICO registration number [TBC].
For data-protection enquiries, including subject-access requests, contact support@talismanproject.org with the subject prefix DATA:. We will respond within one calendar month, with one extension of up to two further months for complex requests, in line with UK GDPR Article 12(3).
We will appoint a Data Protection Officer if and when the threshold criteria in UK GDPR Article 37 apply to our processing. As of the date of this Policy, those criteria do not apply; the controller's designated point of contact is the address above.
2. The data we process
We organise our processing into the following categories:
2.1 Account data
- Account identifier (Talisman handle)
- Email address
- Display name and artist name
- Password hash (we use industry-standard hashing; we never store passwords in plain text)
- Account-creation timestamp and last-login timestamp
- Optional profile information you choose to add (bio, location at city granularity, links)
- Account role flags (Artist, Listener, organisation roles)
2.2 Identity verification data (where you choose to enable age-gated features)
- Zero-knowledge age verification proof
- Cryptographic verification record (ML-DSA-44 signed)
- We do not retain biometric data or passport images. The biometric match is performed on your device. The passport is read on your device. What is sent to our servers is the cryptographic proof of age over a threshold; the underlying personal data does not leave your device.
2.3 Content metadata
- Track, album, artwork metadata you provide (titles, descriptions, tags, lyrics, identifiers such as ISRC and ISWC where you supply them)
- Artist credits, splits, and rights claims you record
- Upload timestamps and content fingerprints (used for AI-generation detection, copyright matching, and integrity verification)
2.4 Listening, library, and listening-time data
- Tracks added to your Library (title, artist, identifiers)
- Tracks for which you have spent listening-time credit
- Aggregate listening counts at track level (used for artist-payout accounting)
- Quest and conditional-unlock events (which condition was met, when)
- We do not record per-second listening telemetry, dwell times, session lengths, or session-completion rates. The Principles · Invariant 3 commitment that no time-spent metric is collected anywhere in the system is binding on this Policy.
2.5 Transaction data
- Payment-processor reference (Stripe charge ID), purchase amount, currency, and timestamp
- Address (where required for physical fulfilment of merch or vinyl)
- VAT records as required by HMRC
- We do not see or store full payment-card numbers. Payment data is collected by Stripe under their own controllership and we receive only the reference and the outcome.
2.6 Device and technical data
- Device type, operating system version, and Talisman client version (used for compatibility and crash diagnostics)
- IP address (used for security, fraud prevention, and rate limiting; truncated or short-retention where used for analytics)
- Crash and diagnostic logs you opt to send
2.7 Communications data
- Direct messages (encrypted end-to-end on the wire and at rest using Double Ratchet; we cannot read them in transit; metadata such as send-timestamp and conversation participants is processed for delivery)
- Group messages (encryption being rolled out per the messaging roadmap)
- Notifications you have received from us
- Support-ticket correspondence and other contact you initiate with us
2.8 Mesh and proximity data (where you opt in)
- Bluetooth-based nearby-peer discovery records (anonymous, short-lived, with a 2-second debounce)
- IPFS node identifiers and aggregate mesh-participation metrics
Mesh and proximity features default OFF and require explicit opt-in. See Principles · Invariant 6.
2.9 Analytics and crash reporting
We use a minimal analytics setup focused on technical health (error rates, page-load completion, payment-flow success rates) rather than behavioural tracking. We do not use third-party advertising or behavioural-tracking pixels on the Service or the website. The Cookie Policy lists what is set on the website.
2.10 Waitlist data
If you join the waitlist on talismanproject.org we record your email address, whether you ticked "I'm an artist", and the time you signed up. Nothing else: we do not record your IP address or browser details against the entry. Your IP address is used briefly to limit repeated sign-up attempts and is discarded within the hour.
We do not process special-category data (UK GDPR Article 9) unless you voluntarily provide it (for example, content you choose to publish that reveals such data) or unless required for a specific feature with your explicit consent.
3. Why we process it (purposes and lawful bases)
For each category, we rely on one or more of the lawful bases in UK GDPR Article 6:
| Purpose | Categories used | Lawful basis |
|---|---|---|
| Operating your account, authenticating you, providing the Service | Account, technical | Contract (Article 6(1)(b)) |
| Processing purchases, managing payouts, complying with tax law | Transaction, account | Contract (Article 6(1)(b)); legal obligation (Article 6(1)(c)) |
| Verifying age for age-gated features | Identity verification | Consent (Article 6(1)(a)); legal obligation under the Online Safety Act 2023 (Article 6(1)(c)) |
| Hosting and distributing your Content | Content, metadata, technical | Contract (Article 6(1)(b)) |
| Detecting fraud, abuse, and infringement; protecting the Service and other users | Account, technical, content fingerprints | Legitimate interests (Article 6(1)(f)) — namely the interest in operating a safe Service |
| Sending operational and transactional messages (purchase receipts, security alerts, policy changes) | Account, communications | Contract (Article 6(1)(b)); legal obligation (Article 6(1)(c)) where applicable |
| Sending marketing emails and announcements | Account, communications | Consent (Article 6(1)(a)); the soft opt-in under Privacy and Electronic Communications Regulations (PECR) regulation 22 where applicable |
| Sending waitlist members project updates and early-access invitations, and inviting artists first | Waitlist | Consent (Article 6(1)(a)), given when you join the waitlist |
| Responding to legal and regulatory requests | Any relevant | Legal obligation (Article 6(1)(c)) |
| Aggregate analytics and platform health | Technical, content (de-identified) | Legitimate interests (Article 6(1)(f)) — operating and improving the Service |
We balance our legitimate interests against your rights and freedoms. Where we cannot, we do not rely on legitimate interests. You have the right to object to processing relying on legitimate interests (section 9 below).
We do not use automated decision-making with legal or similarly significant effect on you (UK GDPR Article 22). The Talisman AI Verification pipeline produces advisory signals; final decisions on Content removal and account action are made by human reviewers.
4. Who we share it with
We share personal data only as set out below.
4.1 Service providers and processors
We use the following categories of processor:
- Payment processing: Stripe Payments UK Ltd. (and Stripe affiliates as principals or co-controllers for their fraud-prevention and regulatory functions). Stripe is regulated as an authorised payment institution.
- Email and transactional messaging:
[TBC: provider name to be added]for transactional and operational mail. - Hosting and infrastructure: cloud and bare-metal infrastructure providers as needed for the Service. Customer Content is stored on Talisman-controlled hardware where feasible and on IPFS-addressed distributed storage; both are operated under processor contracts that meet UK GDPR Article 28.
- Website hosting and waitlist storage: Vercel, which hosts talismanproject.org and stores the waitlist in its key-value store.
- Crash reporting and diagnostics:
[TBC]. - Customer support tooling:
[TBC].
A current list with provider names will be maintained on this page once finalised at sign-off. We require processors to handle personal data only on our instructions, to use appropriate security measures, and to support our compliance with data-subject rights.
4.2 Other Talisman accounts and the public Service
Aspects of your account are visible to other users in the natural course of using the Service (your handle, artist name, profile, posts, releases). We make clear at the point of choice what is public, what is friends-of-friends, and what is private. Direct-message content is end-to-end encrypted between participants and is not visible to us or to other users.
4.3 Co-creators and collaborators
If you set up a track with co-writers, featured artists, or producers, the relevant payout and rights metadata is shared with the named collaborators in line with the contractual arrangement they agree at the point of join.
4.4 Legal and regulatory requests
We disclose personal data where required by law, by court order, or by a regulator with jurisdiction over us. We assess each request, push back on overbroad or improper requests where appropriate, and will publish quantitative figures on requests received and complied with as part of our quarterly Transparency reporting once the CIC is operational.
4.5 Mergers and corporate events
If we are reorganised or transfer parts of the Service to a successor entity (including the planned transition to Talisman Music CIC on incorporation), personal data may transfer to that entity. The CIC asset lock means any such transfer must be to another asset-locked body. We require any such transfer to maintain or improve the protections in this Policy and to give you a meaningful opportunity to delete your account before the transfer takes effect, where consistent with the legal basis of the transfer.
4.6 We do not sell or rent personal data
We do not sell or rent personal data to third parties. We do not share personal data with advertising networks or data brokers.
5. International transfers
Where personal data is transferred outside the United Kingdom, we rely on one or more of the following safeguards under UK GDPR Articles 44–49:
- An adequacy decision adopted by the UK Government in respect of the destination country (the European Union, the European Economic Area, and other countries listed by the ICO).
- The UK International Data Transfer Agreement (IDTA) or, where applicable, the UK Addendum to the EU Standard Contractual Clauses, with appropriate supplementary measures.
- Other lawful safeguards under Article 46.
A current list of jurisdictions to which personal data is transferred and the safeguards relied on will be added at sign-off. Stripe processing typically involves transfers to the United States; the IDTA or UK Addendum applies, with Stripe's published transfer-impact assessment as supplementary measure.
6. How long we keep it
We retain personal data only for as long as we need it for the purposes set out in this Policy, after which we delete or anonymise it.
| Category | Retention |
|---|---|
| Account data | While the account is open. After closure, retained for up to 90 days in soft-deleted state for restore-on-mistake, then erased except for fields needed for legal, tax, or audit reasons. |
| Transaction and tax records | Retained for the period required by HMRC and applicable tax law (currently six years from the end of the relevant accounting period). |
| Identity-verification records (zero-knowledge proofs) | Retained for the duration of the verified-age status, then erased. The underlying biometric/passport data never leaves your device, so there is nothing to retain there. |
| Listening, library, and listening-time records | Aggregate, payout-relevant data retained for artist-accounting and audit (currently six years). Per-event records erased after payout reconciliation. |
| Direct and group messages | Retained on encrypted infrastructure until you or the recipient deletes them, or you close the account. |
| Crash and diagnostic logs | Retained for up to 90 days. |
| Waitlist entries | Until you ask to be removed, or until you are invited and either create an account or decline, whichever comes first. We then delete the entry. |
| Marketing-consent records | Retained for as long as you remain subscribed plus a record of the unsubscribe to honour your preference. |
| Notice-and-takedown records | Retained for up to seven years for evidentiary purposes (consistent with limitation periods for related litigation). |
| Backups | Backups are retained for up to 90 days and rotate through full erasure. Erasure requests trigger backup-aware deletion with the next backup cycle. |
We may retain data for longer where required by law, to enforce these Terms, or to defend ourselves in legal proceedings.
7. Security
We protect personal data using a combination of technical and organisational measures, including:
- Encryption in transit (TLS) and at rest where supported by the storage layer.
- Quantum-resistant cryptography (ML-DSA-44 signatures, ML-KEM-768 encryption) for application-layer signing and key exchange in the Talisman protocol.
- End-to-end encryption (Double Ratchet) for direct messaging.
- Role-based access controls, audit logging, and least-privilege defaults.
- Penetration testing and security review on a recurring schedule.
- A responsible-disclosure programme; see Contact until the formal programme is published.
No system is completely secure. If we discover a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours where required by Article 33 UK GDPR, and we will notify you directly where required by Article 34.
8. Cookies and similar technologies
The Talisman website at talismanproject.org uses a small set of cookies. The Talisman application uses local storage and on-device encrypted databases for offline-first operation. Details, including which cookies are strictly necessary and which require your consent under PECR regulation 6, are in the Cookie Policy.
9. Your rights
Under UK GDPR you have the following rights, subject to the conditions and exemptions set out in the law:
- Access (Article 15): obtain a copy of your personal data and information about how we process it.
- Rectification (Article 16): correct inaccurate or incomplete data.
- Erasure (Article 17), also known as the right to be forgotten, in the circumstances listed in the Article.
- Restriction of processing (Article 18) in certain circumstances.
- Data portability (Article 20) for data you provided to us, processed by automated means under contract or consent.
- Object (Article 21) to processing based on legitimate interests, including direct marketing.
- Withdraw consent at any time, where processing is based on consent (Article 7(3)). Withdrawal does not affect lawfulness before withdrawal.
- Lodge a complaint with a supervisory authority. In the United Kingdom, that is the Information Commissioner's Office (ICO), at ico.org.uk. You also have the right to a judicial remedy.
To exercise any of these rights, contact support@talismanproject.org with the subject prefix DATA:. We may need to verify your identity before responding to a request relating to your data.
We do not charge a fee for responding to requests, except where requests are manifestly unfounded or excessive (UK GDPR Article 12(5)).
10. Children
The Service is not intended for children under 18. We do not knowingly collect personal data from children. If we become aware that a child under 18 has provided personal data, we will erase it. The age policy in Principles · Invariant 8 is binding.
11. Direct marketing
We will only send you marketing communications where you have opted in or where the soft opt-in under PECR regulation 22(3) applies. You can unsubscribe at any time using the link in any marketing email or by contacting support@talismanproject.org. Operational and transactional messages (purchase receipts, security alerts, policy changes) are not marketing and continue while your account is open.
12. Changes to this Policy
We may change this Policy. The "updated" date in the document header will reflect the date of change. Material changes will be notified to you in-app or by email at least 14 days before they take effect, unless the change is required to comply with law or to address a security risk. Your continued use of the Service after the change takes effect indicates acceptance.
13. Contact
For any privacy enquiry, including subject-access requests, contact:
- Email:
support@talismanproject.org(subject prefix:DATA:) - Postal:
[TBC: registered office on incorporation]
For complaints about our handling of your data, you can complain to us first or directly to the Information Commissioner's Office: ico.org.uk/make-a-complaint, helpline 0303 123 1113.
Drafted in pre-incorporation form, 28 April 2026, for review and finalisation by qualified UK counsel. Controller name and registered office, ICO registration, processor and infrastructure-provider names, DPO appointment status, and international-transfer specifics are to be confirmed at sign-off.