Talon Privacy Policy

ScoutHawk ("we," "our," or "us") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect information in connection with Talon, our interview-integrity product — including the Talon dashboard, the Talon agent that runs on a candidate's machine during a monitored interview, and our website (collectively, the "Services").

Talon exists to answer one question for an interviewer: what is actually running on the candidate's machine during this interview? It watches the machine, never the person. Talon does not record video, audio, screen content, or keystrokes. This policy describes exactly what it does collect, and why.

Our Services and Privacy Approach

Talon Dashboard (Interviewers)

• What: The web application interviewers and their organizations use to create sessions, watch live risk scores, and download evidence reports.
• Data Collection: Account and organization details, session metadata, and the detection signals produced by monitored interviews.
• Privacy Model: Organization-scoped. Sessions and results are isolated to the organization that created them.

Talon Agent (Candidates)

• What: A lightweight Windows agent a candidate runs, unprivileged, only for the duration of a single monitored interview. It closes when the session ends.
• Data Collection: Machine signals only — process names, window attributes, audio device names, and virtual-machine / remote-desktop markers. No screenshots, no keystrokes, no audio, no video, no screen capture.
• Privacy Model: Minimal collection and a deliberate "privacy turn" — process names we cannot attribute to a known assist tool are hashed, not stored in the clear.

Talon Website

• What: Our marketing website and communications.
• Data Collection: Standard web analytics and marketing communications.
• Privacy Model: Industry-standard data practices with transparency and user control.

1. Contact Information

Data Controller: ScoutHawk
Product: Talon
Privacy Contact: privacy@scouthawk.in

Where Talon is used by a hiring organization to monitor a candidate's interview, that organization is the entity that invites the candidate and receives the results. In that context ScoutHawk processes candidate session data to provide the Service to the organization, and the organization is responsible for its own use of the resulting reports.

2. Information We Collect

2.1 Talon Dashboard (Interviewer Accounts)

Information You Provide Directly

• Account Information: Name, email address, and organization name.
• Team Information: Members you invite to your organization and their roles.
• Communication Data: Messages you send us, support requests, and feedback.

Session Metadata

• Session Details: Session identifiers, join codes, timestamps, and which interviewer created the session.
• Detection Results: Risk scores, attributions, detection methods, confidence levels, and the evidence reports generated for each session.

2.2 Talon Agent (Candidate Machine)

When a candidate runs the Talon agent for a monitored interview, the agent observes a strictly limited set of machine signals and posts them to our servers in batches for the duration of the session. Specifically:

What the Agent Collects

• Process names: The names of running executables, used to detect known interview-assist tools.
• Window attributes: Properties such as whether a window is topmost, layered, or rendering outside the shared region — never the window's contents.
• Audio device names: The names of audio devices and virtual cables (for example, VB-Audio, Voicemeeter), used to detect audio-routing tools — never audio content.
• Environment markers: Indicators of virtual machines and remote-desktop software (for example, VirtualBox, VMware, QEMU, TeamViewer, AnyDesk).
• Technical context: The join code entered, agent version, and basic operating-system information needed to interpret the signals.

What the Agent Does NOT Collect

• No screenshots and no screen recording.
• No video and no webcam access.
• No audio recording and no microphone content.
• No keystrokes or keylogging.
• No file contents, documents, browsing history, or personal data on the machine.

The Privacy Turn — Hashing Unattributed Processes

• Process names that Talon cannot attribute to a known assist tool are hashed (SHA-256). The interviewer sees a token, not the name of your password manager, side project, or job-search tools.
• A process name surfaces in the clear only when a signature attributes it to a known interview-assist tool. Names and hashes never cross between what the interviewer sees and what stays private.

2.3 Information We Collect Automatically (Website)

• Usage Data: How you interact with our website — pages viewed, features used, time spent.
• Device Information: IP address, browser type, operating system, and device identifiers.
• Cookies and Tracking: We use cookies and similar technologies for analytics and functionality on our website.

3. How We Use Your Information

Providing the Service

• Creating and managing interviewer accounts and organizations.
• Running monitored interview sessions and processing agent signals.
• Generating risk scores, attributions, and evidence reports, and regenerating reports from stored signals during your retention window.
• Running detection server-side, including re-scoring completed sessions when new signatures ship.
• Providing customer support and sending transactional emails (account updates, session notices, security alerts).

Detection and Improvement

• Maintaining and improving our signature set and detection accuracy.
• Identifying and fixing technical issues.
• Understanding aggregate usage to develop new features.

Marketing Communications (with consent)

• Email: Product updates, announcements, and newsletters, sent only with consent.
• Note: You can unsubscribe from marketing emails at any time.

Legal and Security

• Complying with legal obligations.
• Protecting against fraud and security threats.
• Enforcing our Terms of Service.

4. Candidate Notice and Consent

• Notice before it runs: The candidate accepts an on-screen notice and enters a session code before the agent begins observing.
• Session-scoped: The agent runs only during the interview session, unprivileged, and closes when the session ends. It requires no installer, admin rights, or restart.
• On-machine only: Talon detects on-machine assistance during the session. It does not monitor the candidate outside the session and cannot see other devices.
• Results go to the organization: The detection results for a session are made available to the hiring organization that initiated the interview.

5. Legal Basis for Processing (GDPR)

For individuals in the EU/EEA and UK, our legal bases for processing include:

• Contract: Processing necessary to provide the Services to interviewers and their organizations.
• Legitimate Interest: Preserving the integrity of an interview process, securing the Service, and improving detection — balanced against individual rights, and limited by Talon's minimal-collection design.
• Consent: For marketing communications and non-essential analytics.
• Legal Obligation: For compliance with applicable laws and regulations.

6. Information Sharing and Third Parties

We share information with:

6.1 The Hiring Organization

• Detection results, risk scores, and evidence reports for a monitored session are shared with the organization that created the session. Session data is isolated to that organization and is not shared with any other organization.

6.2 Service Providers

• Cloud Hosting and Infrastructure: For application hosting, data storage, and processing.
• Email and Communication Platforms: For transactional and (with consent) marketing email.
• Analytics Providers: For understanding website usage and improving the Service.

6.3 Legal Requirements

• When required by law, court order, or government regulation.
• To protect our rights, property, or safety.
• In connection with a business transfer or acquisition.

6.4 With Your Consent

• Any other sharing will be done only with your explicit consent.

We do not sell your personal data.

7. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit and at rest.
• Organization-scoped access controls and authentication.
• Hashing of unattributed process names.
• Regular security assessments and updates.
• Incident response procedures.

8. Data Retention

• Session Signals and Reports: Raw observations are retained for 90 days by default, configurable by your organization, and auto-purged after the retention window. Evidence reports regenerate from stored signals for as long as the window runs; once purged, they cannot be regenerated.
• Account Data: Retained while your account is active and for legitimate business purposes.
• Analytics Data: Typically retained for up to 2 years for product improvement.
• Marketing Data: Until you unsubscribe or withdraw consent.
• Legal Requirements: Some data may be retained longer where required for legal compliance.

9. International Data Transfers

• Our infrastructure and service providers may process data in different regions.
• Where personal data is transferred internationally, we rely on appropriate safeguards, including Standard Contractual Clauses where applicable.

10. Your Rights

10.1 Rights for All Individuals

• Access: Request a copy of your personal data.
• Correction: Update or correct inaccurate information.
• Deletion: Request deletion of your personal data, subject to legal requirements.

10.2 Candidates

• Because a monitored session is created and controlled by a hiring organization, requests about candidate session data may be directed to that organization or to us at privacy@scouthawk.in, and we will work with the organization to honor them.

10.3 EU/EEA and UK Residents (GDPR)

• Portability: Receive your data in a machine-readable format.
• Restriction: Limit how we process your data.
• Objection: Object to processing based on legitimate interest.
• Withdraw Consent: Withdraw consent where processing is based on it.

10.4 California Residents (CCPA)

• Right to know what personal information is collected.
• Right to delete personal information.
• Right to opt out of sale (we do not sell personal data).
• Right to non-discrimination for exercising your rights.

11. Marketing Communications and Consent

• Marketing emails require opt-in consent, and you can unsubscribe at any time using the link in every email.
• Transactional emails (session notices, receipts, security alerts) are necessary for the Service and are not marketing.

12. Cookies and Tracking

We use cookies and similar technologies on our website for analytics and functionality. You may block cookies and trackers through your browser settings.

13. Children's Privacy

Talon is a professional hiring tool and our Services are not intended for children under 13 (or 16 in the EU). We do not knowingly collect personal data from children.

14. Updates to This Policy

We may update this Privacy Policy periodically. We will:

• Post updates on our website.
• Send notification emails for material changes.
• Update the "Last Updated" date.

15. Supervisory Authority

EU/EEA and UK residents have the right to lodge a complaint with their local data protection authority if they believe we have violated their privacy rights.

---

For questions about this Privacy Policy, please contact us at privacy@scouthawk.in.