Privacy Policy
What personal data Teleon handles, why, and the choices you have.
Who this policy is for
Teleon, Inc. (“Teleon”, “we”, “us”) operates the Teleon trust layer for AI agents. This policy explains what personal data we handle, why, who else sees it, and what rights you have.
| You are | Teleon acts as |
|---|---|
| A customer, or a person using the Teleon console on a customer’s behalf | Controller of your account and billing data |
| An end user of a customer’s AI agent | Processor, on the customer’s instructions. Direct requests to the company operating the agent; see section 10 |
A visitor to teleon.ai | Controller |
Who is responsible
- Controller
- Teleon, Inc., a Delaware corporation
- Privacy contact
- privacy@teleon.ai
- Data protection contact
- dpo@teleon.ai
Individuals in the EU or UK may contact us at dpo@teleon.ai for any matter they would otherwise raise with a representative.
What we collect
Account and billing data
| Category | Examples | Why |
|---|---|---|
| Identity | Name, work email address, job title | Creating and securing the account, service notices |
| Organisation | Company name, billing address, tax identifier | Invoicing and tax compliance |
| Credentials | Password and API key hashes, MFA enrolment | Authentication |
| Console activity | Sign-ins, IP address, actions taken in the console | Security and the customer’s audit log |
| Billing | Payment provider identifiers, invoice history | Taking payment |
Agent audit data, processed for customers
Metadata about the activity of a customer’s AI agents: policy decisions, identifiers, model and usage metadata, and hashes of prompt and tool-call content. Prompt and response content is processed to evaluate it but is not stored in the audit ledger. Fields a customer classifies as sensitive are replaced with tokens.
Website visitors
Server access logs (IP address, user agent, page, time) are kept for security. If you consent to measurement, we also collect pseudonymous usage analytics through PostHog and Google Analytics; this never includes your name, email address or anything you type. See section 11.
What we do not do
- We do not sell or share personal data, as the CCPA/CPRA defines those terms.
- We do not use customer data to train AI models.
- We do not store prompt or response content in the audit ledger.
Legal bases
| Processing | Basis |
|---|---|
| Providing the Service, account management, invoicing | Performance of a contract |
| Security, abuse and fraud prevention | Legitimate interests |
| Handling data-subject requests and meeting legal retention duties | Legal obligation |
| Establishing or defending legal claims | Legitimate interests |
| Product communications and optional analytics | Consent, withdrawable at any time |
Where Teleon processes end-user data on a customer’s behalf, the legal basis is determined by the customer.
International transfers
Teleon is based in the United States and works with service providers and affiliates in other countries. When personal data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses, the UK Addendum, or another lawful safeguard.
Customers in the EU have their data stored in the EU; other customers have their data stored in the US. A copy of the relevant safeguards is available from dpo@teleon.ai.
How long we keep it
| Data | Retained for |
|---|---|
| Agent audit events | Per plan, from 7 days to 7 years; see section 5 of the Terms of Service |
| Account data | Duration of the subscription, then 90 days |
| Compliance bundles | 7 years by default |
| Data-subject request records | 3 years after completion |
| Security and access logs | Up to 90 days |
| Optional analytics data | Up to 7 years (PostHog) or up to 14 months (Google Analytics), or until deleted |
| Billing and tax records | As required by tax law |
| Support correspondence | 2 years after resolution |
Customers can configure retention within limits set by their plan and any compliance regime they select. On account closure, customers have 30 days to export their data, after which it is deleted within 90 days unless the law requires us to keep it.
Security
We protect personal data with encryption in transit and at rest, tenant isolation, role-based access control, multi-factor authentication for staff, and audited, time-limited production access. No system is perfectly secure; if a breach affects your data, we will notify you as required by law. Report vulnerabilities to security@teleon.ai.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent at any time. Teleon does not make solely automated decisions with legal or similarly significant effects on individuals.
Residents of California and other US states with privacy laws may request access to, correction or deletion of their personal information, and will not be discriminated against for doing so. Teleon does not sell or share personal information, so there is nothing to opt out of.
How to make a request
Use the portal at dsr.teleon.ai or write to dpo@teleon.ai. We respond within 30 days and may need to verify your identity. If your request concerns data Teleon processes for one of its customers, we will forward it to that customer and tell you who they are.
You also have the right to complain to your data protection authority.
Children
Teleon is a business product and is not directed at children. We do not knowingly collect personal data from anyone under 16.
Changes to this policy
We notify account administrators of material changes at least 30 days before they take effect. The version and effective date are shown at the top of this page.
Contact
- Privacy questions
- privacy@teleon.ai
- Data protection and rights requests
- dpo@teleon.ai
- Security
- security@teleon.ai