Privacy Policy

Talent@ (“we”, “us”, “our”) operates a curated job board and employment agency for Web3, AI, and Robotics roles. We are committed to complying with the Singapore Personal Data Protection Act 2012 (“PDPA”) and protecting your personal data. This policy explains what data we collect, why, and how you can exercise your rights.

1. Personal Data We Collect

We collect the following categories of personal data:

2. Purposes for Collection and Use

We collect and use your personal data for the following purposes:

• Job matching: To match your profile with relevant job opportunities using AI-powered semantic search and CV analysis.
• Employer sharing: To share your CV and profile with potential employers only when you explicitly apply to a role or opt in to be headhunted.
• Job alerts: To send you notifications about new roles matching your preferences (email, push, or Telegram).
• Search improvement: To improve search relevance and job recommendations based on aggregated usage patterns.
• Account management: To create and manage your account, authenticate your identity, and provide customer support.
• AI processing: Your CV data is processed by third-party AI services (Anthropic Claude, Voyage AI) for parsing, embedding generation, and job-fit scoring. This data is sent via encrypted API calls and is not retained by these providers beyond processing.
• Legal compliance: To comply with applicable laws, prevent fraud, and enforce our terms of service.

3. Disclosure and Sharing

We do not sell your personal data. We may share your data only in the following circumstances:

• Hiring companies: Your CV and profile are shared with a specific hiring company only when you apply to their job listing or explicitly opt in. We never share CVs in bulk without per-application consent.
• Service providers: We use third-party services for hosting (Railway), email delivery (SMTP), analytics (Google Analytics, with your consent), AI processing (Anthropic, Voyage AI), and payment processing (Stripe). These providers process data on our behalf under contractual obligations.
• Referral program: If you are referred by a recruiter, limited information (referral status) is shared with the referring party. Your full CV is not shared with referrers.
• Legal requirements: When required by law, regulation, or court order, or to protect our legal rights.

Every instance of CV sharing with a hiring company is logged in our audit system for compliance records.

4. Data Retention

• Active accounts: Your profile, CV, and preferences are kept for as long as your account is active.
• Inactive accounts: Accounts are retained for 2 years after your last login. After this period, we will notify you before deleting your data.
• Analytics data: Usage logs (search events, click data) are automatically purged after 90 days.
• Deletion requests: Upon request, your data is permanently deleted within 30 days. An audit record (timestamp and user ID only) is retained for compliance.
• Referral records: Referral submission records are retained for the duration of the hiring process plus 1 year for dispute resolution.

5. Your Rights Under the PDPA

Under the PDPA, you have the right to:

• Access: Request a copy of all personal data we hold about you. Use the “Download My Data” button in your profile settings, or email our DPO.
• Correction: Request correction of inaccurate or incomplete data. You can update most data directly in your profile, or contact us for assistance.
• Deletion: Request permanent deletion of your account and all associated data. Use the “Delete My Account” button in your profile settings, or email our DPO.
• Withdraw consent: Withdraw your consent for data processing at any time. Note that this may affect our ability to provide job matching services.
• Data portability: Export your data in a machine-readable JSON format via the “Download My Data” feature.

We will respond to all data access and correction requests within 30 days as required by the PDPA.

6. Cookies and Tracking

We use the following types of cookies:

How to opt out: On your first visit, you will see a cookie banner. Choose “Essential only” to disable analytics cookies. You can also clear cookies in your browser settings at any time. Analytics scripts are not loaded until you give consent.

7. Data Security

We implement industry-standard measures to protect your data:

• Encrypted connections (HTTPS/TLS) for all data in transit
• Passwords hashed with PBKDF2-SHA256 (260,000 iterations)
• CSRF token validation on all state-changing requests
• Parameterized SQL queries to prevent injection attacks
• Rate limiting on authentication endpoints
• Secure session management with rolling 30-day expiry

8. Cross-Border Data Transfer

Our servers are hosted on Railway (US-based infrastructure). Your data may be transferred to and processed in countries outside Singapore, including the United States. We ensure that appropriate safeguards are in place as required by the PDPA, including contractual obligations with our service providers to maintain equivalent data protection standards.

9. Data Protection Officer

We have appointed a Data Protection Officer (DPO) to oversee our PDPA compliance. For any privacy-related inquiries, data access requests, or complaints:

If you are unsatisfied with our response, you may lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore at www.pdpc.gov.sg.

10. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes:

• We will update the “Last updated” date at the top of this page.
• We will increment the consent version number.
• For significant changes, we will notify registered users via email.
• Continued use of our services after notification constitutes acceptance of the updated policy.