Ptarmigan-1 · Talus Bio

PTARMIGAN PRIVACY POLICY

Last Updated: October 1, 2026

Talus Bioscience, Inc. (“Talus,” “we,” “our,” or “us”) respects your privacy and is committed to protecting it through our compliance with this Privacy Policy. This Privacy Policy describes how we collect, use, process, retain, and disclose personal data when you access or use Ptarmigan-1 and any related websites, hosted applications, application programming interfaces, software, documentation, and services that link to this Privacy Policy (collectively, the “Services”), and our practices for maintaining, protecting, and disclosing that information.

This Privacy Policy applies to information we collect through the Services; in email, support requests, and other electronic communications between you and the Services or Talus concerning the Services; and from service providers and business partners that support the Services. It does not apply to information collected by a third party through any application, website, content, or service that may link to or be accessible from the Services.

We may provide additional or different privacy notices that apply to particular products, features, services, jurisdictions, or activities. If a separate notice conflicts with this Privacy Policy, the separate notice will control with respect to the matter addressed in that notice.

Please read this Privacy Policy carefully to understand our practices. By accessing or using the Services or providing information to us, you acknowledge the practices described in this Privacy Policy.

1. About Ptarmigan-1

Ptarmigan-1 is a structure-free protein-ligand binding prediction platform designed to support scientific research. A user selects a protein target and compound library, the Services screen the library against the target, and the user may inspect the resulting computational predictions.

The Services are intended for research use and are not medical, diagnostic, clinical, therapeutic, or regulatory services. The Services are not designed to receive protected health information, identifiable patient information, or human-subject information.

2. Personal Data and Other Information We Collect

“Personal data” means information that identifies, relates to, describes, or could reasonably be linked, directly or indirectly, with an individual. Personal data does not include information that has been aggregated or deidentified so that it cannot reasonably be linked to an individual.

2.1 Account and Contact Information

We may collect your name, business or institutional email address, mailing address, telephone number, employer or institutional affiliation, job title, username, account credentials, account preferences, and other contact information you provide.

2.2 Subscription, Transaction, and Payment Information

We may collect information about your subscription, account history, purchases, transactions, usage limits, and billing status. If payments are processed by a third-party payment processor, we may receive limited payment-related information, such as confirmation of payment, payment method type, billing address, and transaction identifiers. We do not intend to store full payment card numbers through the Services.

2.3 Research and Scientific Data

When you use the Services, we may receive and process information submitted by or on behalf of you or your organization, including:

• protein targets, sequences, and structures;
• compound libraries and molecular structures;
• screening parameters, search requests, and project metadata;
• uploaded files and related research information; and
• predictions, scores, rankings, screening results, reports, analyses, and other outputs generated through the Services.

We refer to this information collectively as “Research Data.” Research Data may include proprietary, confidential, or trade secret information belonging to you or your organization. Research Data is not necessarily personal data, but we will treat Research Data as personal data to the extent it identifies or can reasonably be linked to an individual.

2.4 Communications and Support Information

We may collect information you provide when you contact us, request support, report a problem, provide feedback, participate in a survey, or otherwise communicate with us. This may include the contents of your communications, attachments, and contact details.

2.5 Device, Log, and Usage Information

When you interact with the Services, we may automatically collect technical and usage information, including your Internet Protocol address, browser type and settings, operating system, device characteristics, preferred language, referring URLs, pages or features viewed, dates and times of access, session information, API usage, request volume, download errors, system activity, and security and diagnostic logs.

2.6 Cookies and Similar Technologies

We use cookies and similar technologies to authenticate users, maintain sessions, remember preferences, protect the Services, prevent fraud, and understand how the Services are used. We also use Google Analytics to collect information about interactions with the Services, such as pages or features viewed, session activity, device and browser information, and general usage patterns. Google Analytics may use cookies or similar technologies to collect and process this information. A cookie is a small file placed on your device when you interact with the Services.

You may configure your browser to refuse or delete cookies or alert you when cookies are being sent. If you disable cookies, some features of the Services may be unavailable or may not function properly. You may also use Google’s available browser tools to limit Google Analytics collection. We do not sell personal data or use cookies or similar technologies for cross-context behavioral advertising.

2.7 Aggregated and Deidentified Information

We may derive statistical, aggregated, or deidentified information from personal data, Research Data, or usage information. We will not attempt to reidentify information that we maintain as deidentified, except as permitted by law to test whether our deidentification processes are effective.

If we combine non-personal information with personal data in a manner that identifies or can reasonably be linked to an individual, we will treat the combined information as personal data.

3. How We Collect Information

3.1 Information You Provide

We collect information directly from you when you create or update an Account, subscribe to or use the Services, upload or submit Research Data, communicate with us, request support, complete forms, or otherwise provide information to us.

3.2 Information Collected Automatically

We collect device, log, usage, cookie, and similar information automatically when you access or interact with the Services. This information helps us operate, secure, troubleshoot, and understand use of the Services.

3.3 Information from Organizations and Service Providers

If you use the Services through an employer, university, research institution, or other organization, that organization may provide us with account, authorization, or contact information about you. We may also receive limited information from service providers that support authentication, hosting, security, payment processing, communications, analytics, and customer support.

4. How We Use Information

We may use personal data and other information to:

• provide, operate, maintain, and support the Services;
• create and administer Accounts and authenticate users;
• process Research Data and generate predictions and other outputs requested by users;
• manage subscriptions, transactions, payments, usage limits, and billing;
• respond to inquiries, support requests, feedback, and other communications;
• provide administrative, security, service, and policy notices;
• monitor performance, diagnose errors, and improve reliability and usability;
• protect the Services, users, Talus, and others from fraud, misuse, security threats, and unlawful activity;
• enforce our Terms of Service and other agreements;
• comply with legal obligations and respond to lawful requests;
• establish, exercise, or defend legal claims;
• create and use aggregated or deidentified information as described in this Privacy Policy;
• analyze, in aggregated or deidentified form, general trends in protein targets of interest to users in order to understand market needs and inform business development discussions, provided that such analysis does not identify a customer or user or disclose customer-specific Research Data; and
• carry out any other purpose described when information is collected or for which you provide consent.

5. Research Data and Model Training

We recognize that Research Data may contain highly sensitive scientific, technical, proprietary, or trade secret information.

Talus does not use Research Data or outputs generated specifically for a customer to train, fine-tune, retrain, or otherwise develop generalized artificial intelligence or machine-learning models without that customer’s prior written consent.

This restriction does not prevent Talus from:

• processing Research Data to provide the Services and generate requested outputs;
• accessing Research Data as reasonably necessary to respond to a customer-authorized support request, correct errors, maintain security, or investigate misuse;
• using aggregated or deidentified usage information, including general trends in protein targets of interest, to operate and improve the Services, understand market needs, and inform business development discussions, provided that the information does not identify a customer or user or disclose customer-specific Research Data, outputs, or confidential scientific activity;
• using information Talus develops independently without use of Research Data or customer-specific outputs; or
• retaining or disclosing information as required by applicable law.

6. How We Disclose Information

We do not sell personal data or Research Data. We do not share personal data for cross-context behavioral advertising. We may disclose information in the following circumstances:

6.1 Service Providers

We may disclose information to contractors, cloud hosting providers, authentication providers, payment processors, security vendors, communications providers, analytics providers, customer support providers, professional advisers, and other service providers that perform services on our behalf. Our current service providers include Amazon Web Services and Modal Labs for cloud hosting and computing infrastructure, WorkOS for authentication and account services, Resend for email communications, and Google Analytics for usage analytics. These parties may access information only as reasonably necessary to perform services for Talus and are subject to applicable contractual, confidentiality, data protection, and security obligations.

6.2 Affiliates

We may disclose information to our subsidiaries and affiliates where reasonably necessary to operate, support, secure, or administer the Services, subject to the protections described in this Privacy Policy.

6.3 Your Organization and Authorized Users

If your Account is associated with an employer, university, research institution, or other organization, we may disclose Account, usage, and administrative information to authorized administrators of that organization. Those administrators may be able to manage your Account or access information associated with the organization’s use of the Services, subject to the organization’s settings and agreements with Talus.

6.4 Business Transfers

We may disclose or transfer information in connection with an actual or proposed merger, financing, acquisition, reorganization, bankruptcy, receivership, sale of assets, or similar transaction. Any successor that receives personal data will be subject to applicable legal requirements and the commitments in this Privacy Policy unless and until the policy is lawfully updated.

6.5 Legal Process and Protection

We may disclose information to comply with a court order, law, subpoena, or other legal process; respond to a governmental or regulatory request; enforce our agreements; collect amounts owed; detect or prevent fraud, misuse, or security incidents; or protect the rights, property, safety, or security of Talus, our users, our customers, or others.

6.6 At Your Direction or With Your Consent

We may disclose information to fulfill the purpose for which you provide it, at the direction of you or your organization, for another purpose disclosed when the information is collected, or with your consent.

7. Personnel Access to Research Data

Talus does not routinely inspect customer Research Data. Authorized Talus personnel, contractors, affiliates, and service providers may access Research Data only to the extent reasonably necessary to provide, maintain, secure, or support the Services; respond to a customer-authorized support request; prevent or investigate misuse or security incidents; or comply with applicable law.

Persons with access to Research Data are subject to access controls and appropriate confidentiality obligations. Talus remains responsible for its personnel’s and service providers’ handling of Research Data as provided in its agreements with customers and applicable law.

8. Your Choices

8.1 Account Information

You may review and update certain Account information through the Services or by contacting us. You are responsible for keeping your Account information accurate and current.

8.2 Communications

You may opt out of non-transactional marketing emails by using the unsubscribe link in the communication or contacting us. Even if you opt out of marketing communications, we may continue to send service, security, billing, legal, and other non-promotional communications.

8.3 Cookies

You may manage cookies through your browser settings. Disabling necessary cookies may prevent you from accessing or using certain portions of the Services.

9. U.S. State Privacy Rights

Depending on your state of residence and subject to applicable exceptions, you may have the right to:

• confirm whether we process your personal data and obtain access to that data;
• obtain a portable copy of personal data you previously provided;
• correct inaccuracies in personal data we maintain about you;
• request deletion of personal data;
• opt out of the sale of personal data, targeted advertising, or certain profiling; and
• appeal our decision regarding a privacy rights request.

The precise scope of these rights varies by state, and we may not be obligated to fulfill a request in certain circumstances. Talus does not sell personal data or process personal data for cross-context behavioral advertising. We do not use personal data to make decisions that produce legal or similarly significant effects concerning individuals.

To exercise an applicable right, contact us at [email protected]. We may request information reasonably necessary to verify your identity and authority to make the request. We will not discriminate against you for exercising an applicable privacy right.

9.1 Authorized Agents

Where permitted by law, you may designate an authorized agent to submit a request on your behalf. We may require evidence of the agent’s authority and may ask you to verify your identity directly with us.

9.2 Global Privacy Control

Some browsers and browser extensions support the Global Privacy Control (“GPC”), which may communicate a request to opt out of certain data processing. Where required by applicable law and technically feasible, we will treat a recognized GPC signal as a request to opt out for the browser or device through which the signal is sent.

10. California Privacy Disclosures

If and to the extent the California Consumer Privacy Act, as amended, applies to Talus, California residents may have the rights described in Section 9. The categories of personal information we may collect are described in Section 2, the purposes for which we may use personal information are described in Sections 4 and 5, and the categories of recipients to which we may disclose personal information are described in Sections 6 and 7.

Talus does not sell personal information or share personal information for cross-context behavioral advertising. Talus does not knowingly sell or share the personal information of consumers under 18 years of age.

California residents may exercise applicable rights by contacting us at [email protected].

11. Children’s Privacy

The Services are intended for researchers, institutions, and business users and are not directed to children under 18 years of age. We do not knowingly collect personal data directly from children under 18. If we learn that we have collected personal data from a child under 18 without appropriate authorization, we will take reasonable steps to delete it.

12. Data Security

We use commercially reasonable administrative, physical, and technical measures designed to protect personal data and Research Data from accidental loss or destruction and from unauthorized access, use, alteration, or disclosure. These measures may include access controls, authentication, encryption, monitoring, audit logging, vendor controls, and security review processes.

No website, application, system, electronic storage method, or online service is completely secure, and we cannot guarantee the security of information transmitted to or through the Services. Email and other communications may not be secure, and you should carefully consider the information you send through those channels.

The safety and security of information also depend on you. You are responsible for protecting your Account credentials and promptly notifying us at [email protected] of any actual or suspected unauthorized access to or use of your Account.

13. Data Retention

We retain the categories of personal data described in this Privacy Policy for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy or as otherwise permitted or required by law, including to provide and maintain the Services, administer Accounts, comply with legal obligations, resolve disputes, enforce agreements, prevent fraud, and protect security and integrity. In determining retention periods, we consider the nature and sensitivity of the information, the purposes for which it is processed, applicable legal and contractual obligations, and the potential risks of harm from unauthorized use or disclosure.

Unless continued retention is required by law or authorized by the applicable customer:

• customer-submitted Research Data will be deleted from active production systems within thirty days after deletion by the customer or termination of the applicable Account;
• residual copies may remain in encrypted backups for up to an additional seven days and will be deleted or overwritten through Talus’s ordinary backup cycle; and
• security, access, and operational logs are generally retained for up to thirty days, but may be retained for a longer period where reasonably necessary for security investigations, fraud prevention, troubleshooting, compliance with law, or the establishment, exercise, or defense of legal claims. Talus does not use logs to reconstruct compound libraries or other substantive Research Data except where reasonably necessary to investigate a security incident, misuse, or technical issue.

At the end of the applicable retention period, personal data will be deleted, destroyed, or deidentified, subject to technical limitations and applicable legal requirements.

14. International Data Transfers

Talus and its service providers may process and store information in the United States and other jurisdictions. Those jurisdictions may have data protection laws that differ from the laws where you reside.

The Services are initially offered primarily to users in the United States, but Talus may make the Services available to users in other countries. Where required by applicable law, we will provide any additional privacy disclosures, use appropriate safeguards for international transfers of personal data, and enter into a data processing addendum or similar agreement with an organizational customer when Talus processes personal data on that customer’s behalf. Contact us at [email protected] for additional information about applicable transfer safeguards or data processing terms.

15. Third-Party Services

The Services may contain links to, integrate with, or use third-party websites, applications, software, data, models, or services, including the service providers identified in Section 6.1. Those third parties may process information on Talus’s behalf or, in some circumstances, under their own privacy notices. This Privacy Policy does not govern a third party’s independent privacy practices, and we are not responsible for third-party content, security, or privacy practices. We encourage you to review the applicable third-party privacy notices before providing information directly to those third parties.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will identify the date the Privacy Policy was last updated at the top of this page and will provide any additional notice required by applicable law. We may also provide notice through the Services or by email when changes are material.

We encourage you to review this Privacy Policy periodically to understand our current practices.

17. Contact Information

To exercise your rights, ask questions, or submit comments about this Privacy Policy or our privacy practices, contact us at:

Talus Bioscience, Inc.
Email: [email protected]

If you have a security concern, contact us at [email protected].