Legal
Hangar Privacy Policy
How TALOS Defence handles personal information in Hangar: what it collects, why, who receives it and how long it is kept.
Version 1.0. Effective date: 27 October 2026.
This policy explains how TALOS Defence Pty Ltd (ABN 24 696 691 906), trading as TALOS Defence ("we", "us"), handles personal information in connection with Hangar. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
1. What this policy covers#
1.1 This policy covers personal information about:
- people who sign up for, own or use a Hangar account;
- people who visit gethangar.au or use the Hangar command line tool, SDK or API;
- people who contact us about Hangar.
1.2 Your workloads. The data, files, models and outputs that a customer uploads to or produces on Hangar ("Customer Content") can contain personal information. The customer decides what that content contains and why. We process it only to run the customer's workloads, as the Hangar Data Processing Terms set out. If your personal information is in a customer's content, please contact that customer first.
2. The personal information we collect#
2.1 When your organisation signs up#
- Your name and work email address.
- Your organisation's legal name, its ABN or ACN, and the country whose people or entities control it. For a sole trader, these details identify you.
- The result of our check of the ABN or ACN on the Australian Business Register: the registered entity name, its status, its GST registration and its state.
- The result of our screening of the declared and registered names against the Australian sanctions Consolidated List.
2.2 When you sign in#
- The public key and identifier of your passkey. The private key stays on your device or security key. We never receive it.
- A session identifier, held in a cookie (section 9).
- A record of your role in the account (owner, member or viewer) and of invitations.
2.3 When you pay#
Stripe takes card payments for us. Stripe collects your card details. We do not receive or store your full card number. We receive from Stripe:
- the payment status, amount and date;
- the card brand, the last four digits and the country of the billing address;
- a card fingerprint, which we store only as a one-way digest;
- Stripe's fraud risk assessment of the payment;
- the tax invoice details: your organisation's name and ABN or ACN.
If you claim a free sandbox hour, we store a one-way digest of your card fingerprint. We use this digest only to allow one free hour for each card.
2.4 When you use Hangar#
- Records of your bookings, runs, sessions, uploads, top-ups, refunds and acceptance of our terms, with the person who acted and the time.
- Run certificates. A certificate names your organisation, its ABN or ACN, the account that booked, and the person at TALOS Defence who operated the run.
- Technical information such as the IP address, the time of each request, the route used, and the browser or tool version, in our security and access logs.
- Email delivery events, such as delivery, bounce and complaint notices, for messages we send you.
2.5 When you contact us#
- The content of your email and our reply, and any details you give us.
2.6 Information we do not ask for#
We do not ask for sensitive information, such as health or biometric information, about you. If you send us personal information that we did not ask for, we decide whether we could have collected it lawfully. If we could not, we destroy or de-identify it when it is lawful and reasonable to do so.
3. How we collect it#
We collect personal information from you directly, from the people in your organisation who manage the account, from Stripe, and from public sources: the Australian Business Register and the Australian sanctions Consolidated List.
4. Why we collect and use it#
We collect, hold and use personal information to:
- create and manage your account, and sign you in;
- confirm that your organisation is a genuine Australian business;
- meet our obligations under sanctions, export control, tax and other laws;
- take payment, issue tax invoices, apply credit and reconcile our records;
- run your bookings and workloads, and issue certificates;
- send service messages about your account, bookings, runs, credit, retention, security and changes to our terms;
- send offers of paid retention to account owners who have not opted out;
- prevent fraud and misuse, and keep Hangar, our infrastructure provider and other customers secure;
- answer your questions and complaints;
- understand and improve Hangar, using aggregated information.
If you do not give us the information we ask for at sign-up, we cannot open an account for your organisation.
Anonymity. You can read gethangar.au and our documentation without telling us who you are. You cannot open or use an account anonymously or under a pseudonym, because we must identify the organisation we supply and bill.
5. Automated decisions#
5.1 Hangar uses computer programs to make, or to substantially assist in making, some decisions that can affect you or your organisation. These programs use the personal information shown below.
| Decision | Made by the program alone, or with a person | Personal information used |
|---|---|---|
| Whether a sign-up opens at once, is held for review, or is declined because the ABN or ACN is cancelled or unknown on the register | The program opens or holds the sign-up. A person reviews every sign-up that the program declines. | Your name and email, the organisation's legal name, ABN or ACN, declared country of control, and the register and sanctions check results |
| Whether a name matches the sanctions list | The program flags a possible match. Two people at TALOS Defence decide it. | The declared and registered names |
| The new-account limits on top-ups, concurrent bookings and the free sandbox hour | The program applies the limits. A person reviews a limit on request. | Account history, and the card digest |
| Whether a top-up is held for review because of its fraud risk | The program, using Stripe's risk assessment, holds the top-up. A person decides whether to accept or refuse it. | Payment details and Stripe's risk assessment |
| Whether a booking, top-up or run can proceed, based on your credit, your limits and your acceptance of the current terms | The program decides. | Account records |
5.2 You can ask a person to review any of these decisions. Write to privacy@talosdefence.com.au.
6. Who we disclose it to#
6.1 We disclose personal information to these service providers, only so they can provide their services to us:
| Provider | What it does for Hangar | Personal information it receives | Where it holds the information |
|---|---|---|---|
| Amazon Web Services | Hosts Hangar's website, API, database, storage, logs and compute | All the personal information in this policy, other than card details | Australia: AWS Asia Pacific (Sydney) and AWS Asia Pacific (Melbourne) |
| Stripe | Takes card payments, screens payments for fraud, and issues tax invoices | Your organisation's name and ABN or ACN, the email for the invoice, card and payment details | Australia and overseas (section 7) |
| Microsoft (Azure Communication Services) | Sends Hangar's service email, when it is the configured email provider | Your email address and a short notice: a sign-in code, or a link with an opaque reference. No Customer Content | Stored in Australia. It can be processed in other countries during delivery (section 7) |
| Resend, Inc. | Sends Hangar's service email, when it is the configured email provider | Your email address and a short notice: a sign-in code, or a link with an opaque reference. No Customer Content | Sent from Tokyo, Japan. Account data, metadata and logs are held in the United States (section 7) |
| Microsoft 365 | Holds TALOS Defence's support mailbox | The content of your support email | Australia |
6.2 We send your organisation's ABN or ACN to the Australian Business Register's ABN Lookup service to check it.
6.3 We may also disclose personal information:
- to a law enforcement agency, regulator or court, when the law requires or authorises it;
- to our professional advisers, under a duty of confidence;
- to our infrastructure provider, when it is needed to investigate misuse of Hangar;
- to a buyer of the Hangar business, who must handle it under this policy;
- with your consent.
6.4 We do not sell personal information. We do not use it for advertising.
7. Overseas disclosure#
7.1 Stripe. Stripe stores and processes payment information in Australia and overseas, including in the United States and India, and in other countries where Stripe or its service providers operate. We have a contract with Stripe that requires it to protect the information.
7.2 Email delivery. Hangar sends service email through one of two providers at a time. Azure Communication Services stores email data in Australia. Microsoft states that data can transit or be processed in other countries to deliver the service. Resend, Inc. sends email from Tokyo, Japan, and holds account data, metadata and logs in the United States. An email also passes through your own email provider, which may be outside Australia.
7.3 Everything else in this policy is held in Australia.
8. How we protect it#
We protect personal information with technical and organisational controls. These include: encryption of data in transit and at rest; sign-in with passkeys; access to production systems limited to authorised TALOS Defence personnel; two-person approval for sensitive operator actions; signed, append-only records of account events; and cloud account policies that keep Hangar's data in Australian regions.
9. Cookies and browser storage#
9.1 Hangar uses only cookies that it needs to work. After you sign in, Hangar sets HTTP-only cookies that keep you signed in and identify your device for sign-in. We use no advertising or tracking cookies, and no third-party analytics.
9.2 Hangar also keeps a few items in your browser storage, such as the last email address used to sign in on that device, your theme, and a booking in progress while you pay. These stay on your device.
10. How long we keep it#
| Information | How long we keep it |
|---|---|
| Account, booking, payment, refund, tax invoice and terms acceptance records | 7 years after the transaction or the end of the financial year it relates to, whichever is later |
| Sign-up check and sanctions screening records | 7 years after the account closes, or after the sign-up is declined |
| Run certificates and their signed records | At least 7 years after they are issued, so they stay verifiable |
| Security and access logs | 365 days (1 year), then deleted |
| Support email | 7 years after the matter closes |
| Card digest for the free sandbox hour | While the account is open, and 12 months after it closes |
When we no longer need personal information for any purpose that the law allows, we destroy or de-identify it.
11. Marketing messages#
We send offers of paid retention only to account owners. Each offer has an unsubscribe link that works at once. You can also turn offers off in your account settings. Service messages about your account, bookings, runs, security and deletions have no unsubscribe link, because you need them.
12. Access and correction#
12.1 You can ask for access to the personal information we hold about you, and ask us to correct it. Write to privacy@talosdefence.com.au. You can correct most account details yourself in Hangar.
12.2 We respond within 30 days. We do not charge for a request. If we refuse a request, we tell you why and how to complain.
13. Data breaches#
If a data breach is likely to result in serious harm to you, we notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.
14. Complaints#
14.1 To make a complaint about how we handle your personal information, write to our Privacy Officer at privacy@talosdefence.com.au. We acknowledge your complaint within 7 days and aim to resolve it within 30 days.
14.2 If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.
15. Children#
Hangar is for organisations. It is not for people under 18, and we do not knowingly collect their personal information as account users.
16. Changes to this policy#
We may update this policy. We publish the new version on gethangar.au with its effective date, and we email account owners about a material change.
17. Contact#
Privacy Officer, TALOS Defence Pty Ltd: privacy@talosdefence.com.au. Support: support@gethangar.au. Security: security@gethangar.au.
© TALOS Group Pty Ltd, used under licence by TALOS Defence Pty Ltd.