Privacy Policy

Last updated: March 2025

1. Information We Collect

Employer/User Data: Account details (name, email, company), billing information, job descriptions, search queries, and usage analytics.

Candidate Data: Resume content (work history, skills, education, contact info), evaluation results (outcome chips, reason codes), and interaction history (views, exports).

Technical Data: IP address, browser type, device info, cookies, and session logs for security and performance.

2. How We Use Information

  • Provide and improve the Service
  • Generate outcome signals and explainable rankings
  • Process billing and payments
  • Communicate about Service updates and support
  • Analyze usage patterns to enhance features
  • Detect fraud and ensure security

3. Lawful Basis / Consent

Employer data: Processed based on contract performance (Terms of Service) and legitimate interest (Service improvement).

Candidate data: Processed based on legitimate interest for pre-employment evaluation. Outreach requires explicit consent.

We do not sell candidate data or use it for unrelated purposes. Candidates may request access, rectification, or deletion per applicable law.

4. Data Retention

Active users: Candidate data retained for duration of active search + 90 days, or per your agreement.

Deleted accounts: Data deleted within 30 days, except as required by law (e.g., tax records, legal holds).

Aggregated/anonymized data may be retained indefinitely for analytics and product improvement.

5. Sharing & Disclosure

We may share data with:

  • Service providers: Cloud hosting, payment processing, analytics (under strict confidentiality)
  • Legal requirements: If required by law, court order, or to protect rights and safety
  • Business transfers: In case of merger, acquisition, or asset sale (with notice to you)

We do NOT sell candidate data to third parties or use it for advertising.

6. User Rights

Access: Request a copy of your data we've processed.

Rectification: Correct inaccurate information.

Deletion: Request removal of your data (subject to legal retention requirements).

Portability: Receive your data in a structured, machine-readable format.

To exercise these rights, contact privacy@talentgpt.com. We'll respond within 30 days.

7. Security

We implement industry-standard security measures:

  • Encryption in transit (TLS 1.3) and at rest (AES-256)
  • Role-based access controls and MFA for admin accounts
  • Regular security audits and penetration testing
  • Separation of production and development environments
  • Incident response plan with breach notification procedures

8. Cookies & Tracking

We use cookies for:

  • Essential: Session management, authentication
  • Analytics: Usage patterns, performance monitoring (Google Analytics)
  • Preferences: UI settings, language

You can manage cookie preferences in your browser. Disabling essential cookies may impair functionality.

9. Children's Privacy

TalentGPT is not intended for users under 18. We do not knowingly collect data from children. If you believe we have such data, contact us immediately for deletion.

10. International Transfers

Data may be processed in India and other countries where our service providers operate. We use Standard Contractual Clauses (SCCs) or equivalent mechanisms for cross-border transfers outside India/EEA.

11. Google API Services & Workspace Data

If you connect a Google account to TalentGPT, we request only the following scopes: send-only Gmail access (gmail.send), calendar events (calendar.events), and your basic profile (name and email address). We deliberately do not request any Gmail read scope: TalentGPT never reads, stores, or processes the content of your Gmail mailbox through Google APIs.

Data received from Google APIs is used solely to provide user-facing features you initiate: sending messages you compose or approve from your own address, reading your calendar's free/busy times so interviews are only offered when you are available, and creating interview events on your calendar. OAuth tokens are encrypted at rest (AES-256-GCM), used only server-side, and deleted when you disconnect the account.

TalentGPT's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

TalentGPT does not use any raw or derived data obtained through Google Workspace APIs to develop, improve, or train generalized or foundational AI/ML models, and never transfers such data to third-party AI services. Our AI features operate exclusively on data from non-Google sources: professional profile data from our licensed data providers, resumes submitted to us, and text our users provide. Google user data is never sold, never used for advertising, and never shared with data brokers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email 30 days in advance. Continued use after changes constitutes acceptance.

13. Contact Us

For privacy inquiries, contact privacy@talentgpt.com.