Privacy

This page specifies how little personal data the Talent License Protocol needs, what each side may send and keep, and what a license server must publish about retention.

End users

TLP-PRV-1. A platform MUST identify an end user by a stable ID scoped to the platform, and MUST NOT send an email address, name, phone number or other direct identifier as that ID or anywhere else in a check. TLP-PRV-2. A license server MUST store end-user IDs only as a keyed HMAC, and MUST NOT disclose them, or the HMAC key, to any party other than the platform that sent them.

Prompts and inputs

A platform chooses how much prompt text it sends with prompt_handling.mode:

Mode	The platform sends	Effect
`full`	The text as the model receives it	Rules that need the text are checked at the check
`redacted`	The text, with personal data removed first	As `full`, on the redacted text
`withheld`	No text: structured fields and media digests only	Rules that need the text are checked on the output, or reported as `unchecked`

TLP-PRV-3. A license server MUST honor the mode a platform sends. With withheld, it MUST NOT require text, and its receipts for the check MUST be attested (TLP-DEC-29). TLP-PRV-4. A license server MUST delete the prompt text of a check decided allow once the check is decided; the receipt keeps the request digest. It MAY keep the text of a check decided deny or escalate for review and disputes, for a period it publishes. With prompt_handling.retention set to none, it MUST delete the text as soon as the check is decided, whatever the decision. TLP-PRV-5. A platform MUST NOT put personal data in metadata, and MUST NOT send personal data that the model does not receive, other than the end-user ID.

Use of what a license server receives

TLP-PRV-6. A license server MUST use the prompts, inputs, outputs and fingerprints it receives only to decide, prove and audit decisions, and MUST NOT train models on them. TLP-PRV-7. A license server SHOULD delete a file submitted for verification once the verification is done, keeping only the result.

Biometric data

TLP-PRV-8. A license server MUST hold a talent’s face and voice templates only while the talent has protection turned on, and MUST delete them within 30 days after it is turned off. TLP-PRV-9. A license server MUST NOT store embeddings it computes from the reference images and voice samples it receives in a check or a resolution unless they match a protected talent, and MUST publish how long it keeps a match.

What public objects contain

TLP-PRV-10. Receipts, receipt pages, the talent index and the discovery document MUST NOT contain an end user’s identity, prompt text or input media. The talent index MUST contain only names, aliases and transliterations the talent confirmed.

Retention

TLP-PRV-11. A license server MUST publish how long it keeps each kind of data it receives or derives, and MUST keep nothing longer than it publishes. The Talent API’s published retention (informative):

Data	Kept
Prompt text on `allow`	Deleted once the check is decided; the receipt keeps the `request_digest`
Prompt text on `deny` or `escalate`	30 days, for review and disputes
Artifacts on `allow`	Deleted within 24 hours; `sha256` and fingerprint kept for the license term plus 3 years
Artifacts held for release	Until release or expiry, plus 30 days
Reference embeddings	Not stored unless they match; matches kept 90 days
Receipts, usage records, statements	7 years
End-user HMACs	13 months
Talent face and voice templates	While protection is on; deleted within 30 days after

For prompts and outputs, Reflections processes data for the platform under a data processing agreement. For talent identity data, it is the controller, acting for the talent.

What the Talent API receives and keeps, explained.

Privacy modes

Full, redacted and withheld prompts, and their cost.

​End users

​Prompts and inputs

​Use of what a license server receives

​Biometric data

​What public objects contain

​Retention

​Related