Privacy

Draft. This text describes the product accurately as of the date above, but it has not been reviewed by a lawyer, and the bracketed details below have to be filled in before it is published. It is not yet in force.

Who this is about

Two different groups of people appear in TalentIQ, and they are treated differently.

• Customers — recruiters, talent-acquisition leads, hiring managers and founders who use the product. They have accounts and have agreed to the terms.
• Candidates — professionals whose public work history the platform scores against a customer’s open roles. They have not signed up, which is why most of this page is about them.

What is held about a candidate

Only what a match score is computed from, and the record of where it came from:

• name, headline, location and current employer;
• work history with dates, education and listed skills;
• publicly visible professional signals, such as how long someone has been in a role, and events at their employer — funding, layoffs, size;
• the source of each of those facts and when it was collected, so any statement about a person can be traced back.

Contact details are not held until the person has replied and agreed. Email addresses and phone numbers are not readable columns in the database: they are returned only by a function that first checks that the workspace owns the record and that consent has been granted. Until then the platform holds only what it scores on, and the product refuses to show contact details at all. CVs sent to a customer directly are the exception — those carry contact details because the person supplied them.

Where it comes from

• public professional profiles, collected through a third-party service;
• public startup and company directories, and public layoff records;
• CVs that candidates or agencies sent to the customer;
• what a recruiter records in the product: stages, notes and decisions.

Why it is lawful to hold it

For candidate data the basis is legitimate use for recruitment: matching professionals to roles they are plausibly suited to, and approaching them about it. For customer data the basis is the contract between the customer and TalentIQ.

India’s Digital Personal Data Protection Act was published in August 2023, its Rules were notified in November 2025, and the substantive obligations — notice, consent, erasure and breach reporting — become enforceable in May 2027. TalentIQ is being built against that deadline rather than after it: the consent record, the audit trail and the source of every fact exist in the schema today.

Outreach

No message has been sent to any candidate through TalentIQ to date — the sending service is not built. When it is, every first message will say where the profile was found and how to be removed, and a reply asking for removal will suppress the record. The limits that govern sending are enforced in the database rather than left to a screen: one recruiter owns a relationship, no second message for the same role inside 21 days, and a ceiling on how many people at one employer may be approached in a week.

How long it is kept

Each workspace sets its own retention policy: how many months a record may stay cold before it is re-confirmed or deleted, and how long a hired candidate’s record is kept as an employment record.

Not automated yet. Those periods are configured in the product, but no job currently deletes or re-confirms records when they elapse. Deletion is carried out on request, by hand, until that is built. This paragraph has to change the day it is.

Who it is shared with

• The customer whose workspace holds the record. Workspaces are separated in the database, and a candidate with a CV or purchased enrichment is visible only to the workspace that paid for it.
• Processors we use to run the service — hosting and database (Supabase, on AWS in Mumbai), the profile-collection service, and the model used to write a short assessment of a match. Names and contact details are never sent to the embedding model.
• Nobody else. Candidate data is not sold, and is not shared between customers.

Where it is stored

In ap-south-1 (Mumbai). DPDP does not require blanket localisation; Indian residency is a product and trust choice, and a dedicated tenant is available so that no two customers share a candidate store.

Your rights, if you are a candidate

You can ask us to:

• tell you what is held about you and where it came from;
• correct anything that is wrong;
• delete your record entirely;
• stop contacting you, while keeping only enough to honour that.

Ask at the address below and we will answer within 30 days. You do not need an account, and you do not have to explain why.