Privacy Notice

• Account data — name, work email, role, hashed password
• Tenant data — job posts, candidate applications, interview notes, offers
• Uploads — CVs, portfolios, candidate-supplied documents
• Audit trail — every login, AI call, and data mutation (SOC 2 / IT-security)
• Operational telemetry — IP, user agent, rate limit counters, error stack traces (when Sentry is active)

• Records (KV) — Vercel KV / Upstash Redis, Frankfurt (fra1) + Iowa (iad1) edge regions, encrypted at rest
• Uploaded files — Vercel Blob (CDN-fronted) when active; ephemeral memory otherwise
• AI inference — Anthropic Claude API; per Anthropic's policy, prompts are NOT used for model training

• Candidate records: kept while the tenant remains active; deleted when the tenant or admin deletes them
• Audit events: append-only, retained indefinitely as a compliance record
• Sessions: 14 days from issuance, auto-expire on the server
• Invite + reset tokens: 7 days / 1 hour respectively, one-time use, cleared on consumption

TalentOS is built to honour data-subject rights across major data-protection regimes worldwide. The specific right that applies depends on where your data subjects are located, not where you (the tenant) operate:

• GDPR (EU/EEA) + UK GDPR — access, rectification, erasure, restriction, portability, objection
• NDPR + NDPA (Nigeria) — access, rectification, erasure, restriction, portability
• CCPA / CPRA (California) — know, delete, correct, opt-out of sale, limit sensitive personal info
• POPIA (South Africa) — access, correction, deletion, objection
• LGPD (Brazil) — confirmation, access, correction, anonymisation, portability, deletion
• PIPEDA (Canada) — access, correction, challenge accuracy
• PDPA (Singapore) — access, correction, withdraw consent
• Privacy Act (Australia) — access, correction, complaint to OAIC
• DPA 2019 (Kenya) — access, rectification, erasure, objection

Tenants can exercise rights through the platform self-serve:

• Access + portability — full JSON export of all tenant data at /account (admin/CHRO only)
• Erasure / right to be forgotten — irreversible tenant delete at /account (admin only, typed confirmation)
• Rectification / correction — direct edit via the platform UI or API
• Restriction / objection — contact privacy@talentosglobal.co

We respond to verified data-subject requests within the shortest applicable statutory window (typically 30 days under NDPR/GDPR; CCPA gives 45). Customer (the data controller) retains primary responsibility for fielding and authenticating requests from their data subjects; we provide the tooling.

TalentOS is built to satisfy the EU AI Act's classification of recruitment AI as a high-risk system. Three audit-grade controls run on every AI-touching workflow:

• PII scrubbing before AI inference. Every prompt sent to our model provider (Anthropic Claude) is passed through a regex-based scrubber that replaces emails, phone numbers, SSN / NIN / BVN identifiers, and the candidate's known name with [REDACTED_*] placeholders. The scrubber runs by default; a tenant can opt out (piiScrubEnabled = false) with explicit risk acknowledgement, and the opt-out is itself logged.
• Candidate transparency notice. Before a candidate submits an application on a tenant career portal, a disclosure surfaces above the submit button: “AI may be used to screen your application. Your CV and answers may be analysed by an AI system that scores match against the role. The final hiring decision is made by a human. You can request human-only review by emailing the recruiter.” Acknowledging the disclosure is a hard precondition of submission. Tenants outside EEA-mandated jurisdictions can switch the notice off (aiTransparencyMode = "hidden"); the default is shown everywhere — the safer choice.
• AI decision log. Every AI call that produces a candidate-affecting output (screen, offer draft, attrition risk) appends a row to the AI decision log. Captured: tenant, candidate, vacancy, model id, SHA-256 hash of the (scrubbed) prompt, verdict + a short output summary, confidence, decided-by classification (ai-only / ai-assisted / human-override), recruiter identity, and the redactions made. The full prompt text is NOT persisted — only its hash — so the log itself doesn't double up on PII storage. Admins + CHROs can export the log for downstream bias review at /audit/ai.

See docs/EU-AI-ACT-COMPLIANCE.md in the platform repo for the operator-facing breakdown of which Articles each control addresses and what the customer (as data controller) remains responsible for.

• Anthropic — generative AI (Claude); processes prompt text + tenant context for inference
• Vercel — hosting, KV, Blob, edge middleware
• Upstash — Redis-compatible KV backing Vercel KV
• Resend (when active) — transactional email for invites + password resets
• Sentry (when active) — error tracking + perf monitoring; scrubs PII on capture

• General questions: hello@talentosglobal.co
• Data-subject requests (NDPR / GDPR): privacy@talentosglobal.co
• Security / vulnerability disclosure: security@talentosglobal.co — see our coordinated disclosure policy for scope, safe-harbor, and reporting steps.
• Customer support: support@talentosglobal.co

We respond to data-subject requests within 30 days as required by NDPR + GDPR.