Privacy Notice

• Account data — name, work email, role, hashed password
• Tenant data — job posts, candidate applications, interview notes, offers
• Uploads — CVs, portfolios, candidate-supplied documents
• Audit trail — every login, AI call, and data mutation (IT-security evidence)
• Operational telemetry — IP, user agent, rate limit counters, error stack traces (when Sentry is active)

• Records (KV) — Vercel KV / Upstash Redis, encrypted at rest by the platform. The application runs in Vercel Frankfurt (fra1) and Washington DC (iad1), but the KV database itself is one instance in a single physical region. Picking a data region on /account records your preference and locks it as the migration target; it does not route your records to a separate regional database
• Uploaded files — Vercel Blob when active; the local filesystem otherwise, and lost outright on a read-only serverless filesystem. The Blob store behind this deployment is provisioned public-only, so a private write is rejected and CVs, assessments, portfolios, offer documents and attachments are still written with public access. Those bytes are protected by an unguessable URL that is never published or handed to a browser, and by a check on every read through our authenticated /api/upload/[id] route (session, owning tenant, agency scope, MFA) — not by an access check at the object store. A private Blob store is not yet provisioned. Only careers-site assets — tenant logos, careers-page imagery, and job descriptions attached to a public vacancy — are served from a public URL by design
• AI inference — Anthropic Claude API; per Anthropic's policy, prompts are NOT used for model training

• Candidate records: kept while the tenant remains active; deleted when the tenant or admin deletes them
• Audit events: held in a single platform-wide list capped at the most recent 2,000 events across all tenants, trimmed on every write. There is no fixed time window — how far back the trail reaches depends on how busy the whole platform has been, and a high-volume period can push older events out within hours. The rows are not hash-chained or write-protected, and GDPR erasure rewrites matching rows in place, so the list is not immutable or tamper-evident. For retention beyond that window, export the trail as CSV from /audit (admin/CHRO) or stream events to your own SIEM
• Sessions: 14 days from issuance, auto-expire on the server
• Invite + reset tokens: 7 days / 1 hour respectively, one-time use, cleared on consumption

TalentOS is built to honour data-subject rights across major data-protection regimes worldwide. The specific right that applies depends on where your data subjects are located, not where you (the tenant) operate:

• GDPR (EU/EEA) + UK GDPR — access, rectification, erasure, restriction, portability, objection
• NDPR + NDPA (Nigeria) — access, rectification, erasure, restriction, portability
• CCPA / CPRA (California) — know, delete, correct, opt-out of sale, limit sensitive personal info
• POPIA (South Africa) — access, correction, deletion, objection
• LGPD (Brazil) — confirmation, access, correction, anonymisation, portability, deletion
• PIPEDA (Canada) — access, correction, challenge accuracy
• PDPA (Singapore) — access, correction, withdraw consent
• Privacy Act (Australia) — access, correction, complaint to OAIC
• DPA 2019 (Kenya) — access, rectification, erasure, objection

Tenants can exercise rights through the platform self-serve:

• Access + portability — full JSON export of all tenant data at /account (admin/CHRO only)
• Erasure / right to be forgotten — irreversible tenant delete at /account (admin only, typed confirmation)
• Rectification / correction — direct edit via the platform UI or API
• Restriction / objection — contact privacy@talentosglobal.co

We respond to verified data-subject requests within the shortest applicable statutory window (typically 30 days under NDPR/GDPR; CCPA gives 45). Customer (the data controller) retains primary responsibility for fielding and authenticating requests from their data subjects; we provide the tooling.

The EU AI Act classifies recruitment AI as a high-risk system. Three controls in TalentOS address its transparency and record-keeping obligations. Each has limits, stated inline below rather than left to a footnote:

• PII scrubbing before AI inference. Text prompts sent to our model provider (Anthropic Claude) are passed through a regex-based scrubber that replaces emails, phone numbers, SSN / NIN / BVN identifiers, and the candidate's known name with [REDACTED_*] placeholders. The scrubber is text-only, and two paths bypass it. First: a CV uploaded as a PDF or an image is sent to Anthropic as the original file with no redaction at all — the model sees the name, email, phone number and anything else printed on the document exactly as it appears. DOCX, ODT, TXT and Markdown CVs are converted to text on our side first and are scrubbed. Second: job description parsing never calls the scrubber in any format — a PDF JD is sent as the original file and a TXT or Markdown one as raw text, so a hiring manager's name, email or phone number printed on a JD reaches the model unredacted. A CV parse that sends a file records document block (not scrubbable) or image block (not scrubbable) in the audit row instead of a redaction count, so that bypass is visible in the trail. A JD parse writes an audit row too, but it carries no scrubbing field at all, so nothing in the trail marks the unredacted send. For text, the scrubber runs by default; a workspace admin can switch it off from Settings → Security & compliance → AI safety (piiScrubEnabled = false) with explicit risk acknowledgement, and the opt-out is itself logged.
• Candidate transparency notice. Before a candidate submits an application on a tenant career portal, a disclosure surfaces above the submit button: “AI may be used to screen your application. Your CV and answers may be analysed by an AI system that scores match against the role. The final hiring decision is made by a human. You can request human-only review by emailing the recruiter.” The apply form keeps its submit button disabled until the applicant ticks the acknowledgement, but that check runs in the browser only: /api/careers/apply has no acknowledgement field, accepts a direct POST without one, and stores no acknowledgement flag on the application. The separate data-processing consent tick is enforced server-side and is stored on the candidate record with its policy version and timestamp. Workspace admins outside EEA-mandated jurisdictions can switch the notice off from Settings → Security & compliance → AI safety (aiTransparencyMode = "hidden"); the default is shown everywhere — the safer choice.
• AI decision log. Every AI call that produces a candidate-affecting output (screen, offer draft, attrition risk) appends a row to the AI decision log. Captured: tenant, candidate, vacancy, model id, SHA-256 hash of the (scrubbed) prompt, verdict + a short output summary, confidence, decided-by classification (ai-only / ai-assisted / human-override), recruiter identity, and the redactions made. The full prompt text is NOT persisted — only its hash — so the log itself doesn't double up on PII storage. Admins + CHROs can export the log for downstream bias review at /audit/ai. Storage shape is the same as the audit trail: one platform-wide list capped at the most recent 5,000 decisions across all tenants and trimmed on every write, so it is a rolling window rather than a durable archive. Export it on your own cadence if you need to keep decisions for longer.

See docs/EU-AI-ACT-COMPLIANCE.md in the platform repo for the operator-facing breakdown of which Articles each control addresses and what the customer (as data controller) remains responsible for.

• Anthropic — generative AI (Claude); processes prompt text + tenant context for inference
• Vercel — hosting, KV, Blob, edge middleware
• Upstash — Redis-compatible KV backing Vercel KV
• hCaptcha — bot protection on login, signup and candidate job applications; each check sends the end user's IP address and the challenge token to hCaptcha, including for candidates applying to a role
• Resend (when active) — transactional email for invites + password resets
• Sentry (when active) — error tracking + perf monitoring; scrubs PII on capture

• General questions: hello@talentosglobal.co
• Data-subject requests (NDPR / GDPR): privacy@talentosglobal.co
• Security / vulnerability disclosure: security@talentosglobal.co — see our coordinated disclosure policy for scope, safe-harbor, and reporting steps.
• Customer support: support@talentosglobal.co

We respond to data-subject requests within 30 days as required by NDPR + GDPR.