Your information should work for you—not surprise you.

This notice explains what Ask The Talent processes, why, for how long, and the choices available to profile owners and visitors.

Effective: 2026-09-02 · Version 1.0

1. Controller and contact

The controller is Ask The Talent Preview, Temporary preview configuration pending. Privacy requests may be sent to preview@askthetalent.com. General support: preview@askthetalent.com.

2. Data we process

Profile owners

Account details, password hash, CVs and supporting documents, extracted text, interview answers, professional-profile settings, privacy choices, public-profile content, session records, and limited security metadata.

Public-profile visitors

Questions submitted to a profile, the short conversation history sent with the request, technical request data needed to deliver and secure the service, and pseudonymized security-event identifiers when a security control is triggered. Ask The Talent does not store visitor chat transcripts in its own database.

Browser data

The application uses essential session and CSRF cookies. A private onboarding draft may be held in the browser’s session storage until sign-out, account deletion, browser-session end, or manual clearing. No advertising or cross-site tracking cookies are used by this build.

3. Purposes and legal bases

Providing accounts, document processing, profile management, and chat: performance of the service contract or steps requested before entering it (GDPR Art. 6(1)(b)).
Publishing owner-selected information: the owner’s informed choice and consent (Art. 6(1)(a)). Publishing is optional and can be withdrawn by deleting the account; additional unpublish controls may be introduced.
Security, fraud prevention, reliability, and limited operational logs: legitimate interests in protecting users and the service (Art. 6(1)(f)).
Compliance and legal claims: legal obligations (Art. 6(1)(c)) or legitimate interests in establishing, exercising, or defending claims (Art. 6(1)(f)).

4. AI processing and recipients

To answer a visitor, the service sends the question, limited recent chat history, relevant public profile evidence, and privacy instructions to OpenAI’s API. Requests are made with storage disabled at the API request level. OpenAI states that API inputs and outputs are not used to train its models by default; standard abuse-monitoring logs may nevertheless contain prompts and responses and may normally be retained for up to 30 days, unless approved Modified Abuse Monitoring or Zero Data Retention controls apply.

Other recipient categories are the configured hosting provider (DigitalOcean, LLC), transactional email provider (Preview mode), database/storage operators, security-monitoring providers, professional advisers, and authorities where legally required. They receive only data needed for their role and should be bound by data-processing and confidentiality terms.

5. International transfers

Some service providers, including the AI provider, may process data outside the European Economic Area. Before production, the operator must document each provider, processing region, Data Processing Agreement, and applicable transfer safeguard—such as an adequacy decision, EU Standard Contractual Clauses, or another lawful mechanism. Where available and appropriate, EU regional processing and stricter API retention controls should be enabled.

6. Retention

DataRetention rule

Unverified account and uploaded dataAutomatically deleted after 1 day.

Verification and reset tokensExpire after 30 minutes; only hashes are stored and expired hashes are cleared by the daily retention job.

Active account, documents, answers, and profileUntil the owner deletes the account or the service is terminated, unless a legal obligation requires limited further retention.

SessionsActive for up to 8 hours; expired or revoked session rows are removed after 7 days.

Visitor chat in Ask The TalentProcessed for the response and not stored in the application database.

OpenAI API processingRequest storage is disabled; standard abuse-monitoring content may be retained by OpenAI for up to 30 days unless stricter approved controls apply.

Security and error metadataKept only for the documented monitoring period configured by the production operator, then deleted or anonymized. It excludes CV text, prompts, passwords, tokens, email addresses, and filenames.

BackupsDeleted data may remain in encrypted, access-restricted backups until the production backup cycle expires; it must not be restored except for disaster recovery and is deleted again after restoration.

7. Account deletion

A signed-in owner can permanently delete the account from Account settings. The action requires the current password and the phrase “DELETE MY ACCOUNT.” It immediately removes the public profile and primary database records, revokes sessions through deletion, and removes or quarantines uploaded files for cleanup. This cannot be undone.

8. Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, portability, or object to processing. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. You may complain to the competent data-protection supervisory authority. To exercise a right, contact preview@askthetalent.com; identity verification may be required.

9. Security

Controls include Argon2id password hashing, revocable sessions, CSRF and origin validation, strict upload limits and isolated parsing, privacy-scoped AI retrieval, encryption in transit in production, least-privilege containers, structured security events, vulnerability scanning, and monitored dependency health. No system is risk-free; suspected incidents should be reported to the privacy contact.

10. Changes

Material changes will be dated on this page and, where required, communicated before they take effect. A new legal basis or materially different purpose will not be applied silently.