Privacy at Talent Intelligence Lab ATS.

Who we are and what this policy covers

This Privacy Policy explains how Talent Intelligence Lab ("we", "us") collects, uses, discloses, and protects personal data. It applies to this website (talentintelligences.com) and to the Talent Intelligence Lab applicant tracking system (the "Service").

For visitors to this website and for the account holders who use the Service, we are the organisation responsible for your personal data. For candidate and applicant information that a customer (an employer or recruitment agency) collects or uploads through their workspace, that customer is the party responsible for the data; we process it on their behalf and on their instructions as a data intermediary. Candidates should raise requests with the relevant hiring organisation in the first instance — see “Your rights and choices”.

Singapore's Personal Data Protection Act 2012 (PDPA) is our primary data-protection framework. Other privacy laws apply only to the extent that they govern the relevant processing or individual.

Information we collect

Website visitors

• Details you submit through the contact form: your name, work email, and any message.
• Technical data such as your IP address and request metadata, used to operate the site securely and to rate-limit abuse, together with standard server logs kept by our hosting provider.
• This website does not use analytics or advertising cookies (see “Cookies and similar technologies”).

Prospective account users

• Your name, work email, proposed organisation name, and verification status when you request or create a workspace.
• Verification and account-activation messages and the security information needed to complete signup.

Account holders (recruiters, hiring managers, administrators)

• Your name and email, profile details (avatar, role, department, reporting line), and the workspace(s) you belong to.
• Authentication, session, login, and security information managed by our identity service.
• Content you enter in the Service, including preferences, connected-tool settings, and messages you send to the in-product help assistant.
• Activity, audit, usage, and diagnostic information about actions taken in the Service.

Candidate and applicant data (processed on behalf of customers)

We may receive candidate data directly from a candidate, from a customer or its authorised users, or from a source or tool that the customer directs us to use. The following information may be processed in the customer's workspace:

• Identity and contact details, including name, email, phone, and a professional-profile URL.
• CV/resume files, attachments, and the structured profile we extract from them, including skills, work history, and education.
• Cover letters, application answers, take-home work, source information, and consent records.
• Applications, pipeline status, notes, interview feedback, scorecards, assessment results, communications, offers, and onboarding records.
• Candidate-portal session and security information, including verified candidate email, a salted hash derived from the connection address, browser user-agent information, and session timestamps.

Depending on how a customer configures its workspace, this may include current or expected compensation, notice period, and visa or right-to-work information. Standard forms do not require protected or special-category information such as race, religion, or health information. Free text, uploaded documents, and customer-configured questions may nevertheless contain it. Customers decide what they collect and are responsible for ensuring that it is lawful and necessary.

How we use information, and our legal basis

• Website data — to respond to enquiries, arrange demonstrations, provide requested access, prevent abuse, and maintain appropriate support, security, and business records.
• Account data — to authenticate users, provide and administer the Service, manage workspaces and permissions, communicate with users, support the Service, and protect it from misuse.
• Candidate data — to provide recruiting workflows and features on the customer's instructions. Each customer determines and documents the lawful basis for its candidate processing.
• Operational data — to diagnose failures, enforce security, maintain auditability, meet legal obligations, and establish or defend legal claims.

Under the PDPA, we collect, use, and disclose personal data with consent or where another basis permitted by law applies. Where the EU or UK GDPR applies to processing for which we are responsible, our bases may include performing a contract, complying with law, our legitimate interests in responding to business enquiries and securely operating the Service, and consent where we ask for it.

We do not sell personal data, and we do not use candidate or customer information for unrelated advertising.

AI features and automated processing

The Service includes AI-assisted features. A single external AI processing service supports all of them, apart from the Senior Help handoff described below, and receives data for a defined task rather than unrestricted access to a workspace. The information sent depends on the feature, and, apart from the contact masking described for CV extraction below, free text is not subject to personal-data redaction.

Apart from help-assistant replies, the AI processing service also receives a pseudonymous workspace tag, derived from your workspace identifier, to keep requests isolated. This is not a candidate identifier.

Recruiting assistance

Job-description drafting sends job and role information that a user has approved. Interview-question generation sends the job title with its published rubric criteria or stored job requirements; it does not include candidate information. Drafting an assignment rubric with the AI assistant sends the job title and description, the assignment brief and settings, and the recruiter's setup conversation. Calibrating that rubric sends the sample answers the customer's team supplies, with the brief and rubric but not the expected scores. These requests do not read candidate records, but sample answers are sent as entered.

The earlier resume-scoring feature has been retired. Candidate comparison compares saved Candidate Fit reviews (see below) and does not send a new request to the AI processing service.

The same service may process text extracted from a CV when our own parser cannot produce a usable profile, or produces only a sparse one. Before the text is sent, email addresses, links, phone numbers, address and personal-details lines, referee sections, and any candidate name our parser has found are masked, and contact details are recovered locally. The service then helps recover details such as skills, work history, and education. Masking is pattern-based, so the text may still contain identifying details. File bytes are not sent for this purpose; the extracted text is.

When a candidate submits a take-home case study, the AI processing service receives the text extracted from the submitted file together with the assignment brief and the approved assessment rubric so the submission can be assessed against that rubric. The result supports a recruiter's review and does not advance or reject a candidate by itself.

Screening and organisation research

The Service contains separately controlled Candidate Fit and organisation-research capabilities. Candidate Fit provider processing is not active in the current release. If activated for a workspace, it may send minimised candidate skills and work evidence, education only where a published criterion requires it, the job rubric, and reviewed organisation context. Direct contact details, compensation and visa information, protected fields, employer and institution names, and unrelated pedigree information are excluded from that request.

Organisation research is disabled by default. When deliberately enabled and submitted, it may send an organisation name and bounded text retrieved from its official public website. Public pages may still contain incidental personal data.

Analytics dashboard chat

When you use Create with chat in Analytics, the AI processing service receives your instructions, recent report-chat history, and the current dashboard definition, including chart and metric names, titles, dates, and filter labels. It proposes dashboard changes; it does not receive the underlying query dataset, calculated results, resumes, or automatically loaded candidate records. Text you enter may still contain personal or confidential information; it is not automatically redacted. Report values are calculated separately using your workspace permissions. This AI processing takes place outside Singapore.

In-product help assistant

The same AI processing service handles the in-product help assistant, which is available on every plan, including Free. It receives your current message, recent help-chat history, the screen path, your workspace name, your plan and role, and aggregate count-only figures such as how many jobs or candidates exist and how many sit at each pipeline stage. It does not receive an individual candidate, job, application, or other person's record. If you choose Ask Senior Help, the help conversation and the screen path are passed to a separate assisted support workflow that we operate, which may use a different external AI service, outside Singapore, to prepare a reply. No human response is promised.

AI outputs can be inaccurate, incomplete, or biased. They support meaningful human review and do not themselves advance, reject, or hire a candidate. Customers and their authorised users remain responsible for every hiring decision. See “Your rights and choices” for rights that may apply to automated processing.

Cookies and similar technologies

This marketing website does not currently use advertising cookies, cross-site tracking, or third-party analytics. Its hosting infrastructure may still create standard request and security logs. The signed-in Service uses first-party, strictly necessary cookies and similar browser storage to maintain authentication, select the active workspace, and protect sessions. Depending on their function, these controls use protections including Secure, SameSite, and, where appropriate, HttpOnly. They are not used for cross-site advertising.

A public job-application form may save an unfinished draft in that browser tab's session storage. The draft can include the applicant's name, email, phone, professional-profile URL, cover letter, and answers to customer-configured questions; consent is not restored from the draft. The draft is removed after a successful submission or deliberate clear, and session storage normally ends when the tab or browser session ends.

The signed-in interface may keep workspace-scoped search recents and interface preferences in local browser storage. Search recents can include a candidate's name, title, and company or a job label; they are scoped to the verified user and workspace and are cleared on sign-out.

Service providers and other disclosures

We share personal data only with service providers that support the website and the Service, and only as far as needed for the relevant function. Where required, our agreements restrict processing and require appropriate protection. Our provider categories are:

• Managed database and private file-storage services that hold account, workspace, candidate, and uploaded-file data in Singapore.
• Managed authentication and optional third-party social sign-in services used to verify identity, activate accounts, and maintain login sessions.
• Application hosting and compute services that run the website and the Service. The Service's application compute is configured for Singapore; this marketing website is a separate deployment without a pinned processing region.
• An external AI processing service that supports the AI features described above: the optional recruiting and analytics features, and the in-product help assistant included on every plan. The data sent depends on the feature and is processed outside Singapore (see “International transfers”).
• An assisted support workflow that prepares replies to Senior Help requests and may use a separate external AI service to process the escalated help conversation outside Singapore.
• Email delivery and inbound-reply services used to send product messages, receive and thread candidate replies, and deliver website-enquiry notifications to our team.
• Email and calendar services that a customer connects to its workspace, and a scheduling account we use when we create a video-meeting event on the customer's behalf.

We keep these categories current. Customers may request the current named sub-processor schedule and information about material changes under their applicable agreement.

Where a customer connects their own tools to their workspace (for example their email and calendar, or their own AI tools), data those tools access is shared at the customer's direction and under their control. We may also disclose personal data if required by law, or to protect rights, safety, and the integrity of the Service. We do not sell personal data.

International transfers

The database and file storage that hold account and candidate data are located in Singapore, and the Service's application compute is configured for Singapore. Some supporting services operate outside Singapore, so personal data may also be transferred to and processed in other countries.

• Optional recruiting AI features process the CV, case-study, and job information described in Section 04 outside Singapore.
• The in-product help assistant processes help messages, recent help-chat history, screen path, workspace descriptors, and aggregate count-only figures outside Singapore. A Senior Help request may also be processed outside Singapore.
• Optional third-party social sign-in may process account identity and authentication data in the locations used by that service.
• The marketing website, traffic delivery, provider logs, email delivery, and website-enquiry notifications may be processed in other regions.
• Interview calendar events and connected email activity are processed in the location selected by the customer-connected service or by the scheduling service we use. A calendar event may include the candidate's name, job title, interview type, start and end time, time zone, location or meeting link, and the names and email addresses of the candidate, hiring manager, panel members, and other attendees.

Where personal data is transferred outside Singapore, we use measures intended to provide protection comparable to the PDPA, including appropriate due diligence, contractual protections, security controls, and limiting the data transferred. Where another transfer regime applies, we use the safeguard required for that transfer. Contact hello@talentintelligences.com for information about the safeguards relevant to your data.

Data retention

• Website enquiries — retained in business email and operational records while needed to respond, manage the relationship, maintain appropriate records, or meet legal obligations. There is no automated fixed deletion schedule for mailbox copies today.
• Account and workspace data — retained while an account or workspace is active and afterwards only while needed for closure, security, operational, or legal purposes.
• Escalated help conversations — scheduled for deletion after 90 days. The full conversation and last user message are retained during that period so the Senior Help workflow can prepare a reply.
• Saved analytics dashboards — retain their latest 30 chat messages and 10 dashboard-definition revisions for as long as the dashboard is retained. Sharing a dashboard with the workspace also makes that saved conversation and definition history available to its permitted readers. Underlying report data remains subject to each viewer's access permissions. Unsaved recovery drafts are stored locally for the browser tab and scoped to your account and workspace.
• Candidate and recruiting records — retained according to the customer's instructions and retention decisions. Administrators can delete candidate and application records; jobs are closed, cancelled, or archived rather than deleted. Confirmed workspace closure initiates deletion of associated workspace data and stored files.
• AI outputs stored in a workspace — retained with the related candidate, application, job, assessment, or other record.
• Candidate-portal sessions — terminal or expired sessions are scheduled for deletion after 30 days.
• Append-only audit and security records — may remain after an underlying record or workspace is deleted where needed for security, accountability, fraud prevention, or legal claims. Access remains restricted.
• Backups, provider logs, and queued deletion systems — deleted information may remain temporarily until the applicable retention or backup cycle completes.

We delete or anonymise personal data when its purpose has ended and it is no longer needed for a legal or business purpose. Deletion from active systems may not remove every backup copy immediately.

How we protect personal data

We use technical and organisational safeguards appropriate to the data and risk, including application-level workspace authorisation, database access policies with row-level security on browser-facing paths, encryption in transit, provider-managed encryption at rest, additional encryption of connected-tool secrets, role-based access, audit logging, rate limiting, and browser security controls. No method of transmission or storage is completely secure, but we work to protect personal data and address issues promptly. You can read more on our Security page.

If we have credible grounds to believe that a breach affects data we process for a customer, we will notify that customer without undue delay and assist with its assessment. Where we are the responsible organisation, we will assess whether notification to the Personal Data Protection Commission and affected individuals is required and notify them as applicable.

Your rights and choices

Under the PDPA (Singapore)

• Request access to the personal data we hold about you, and information about how it has been used or disclosed.
• Request correction of inaccurate or incomplete data.
• Withdraw any consent you have given (we will tell you the likely consequences).
• Ask us to stop using or delete data where another applicable right, our agreement, or the circumstances permit it.

To make a request, email hello@talentintelligences.com. We will verify your identity and respond within the legally required period. If we cannot complete a PDPA access or correction request within 30 calendar days, we will tell you when we expect to respond. If we cannot fully meet a request, we will explain why.

If the GDPR applies to you (EEA / UK)

• You also have the rights to erasure, restriction, data portability, to object to processing (including profiling), and rights regarding decisions based solely on automated processing.
• You have the right to lodge a complaint with your local supervisory authority.

If the CCPA / CPRA applies to you (California)

• You have the right to know, delete, and correct your personal information, and to opt out of any sale or sharing.
• Where applicable, you may limit certain uses or disclosures of sensitive personal information, and we will not discriminate against you for exercising your privacy rights.
• Sections 02, 03, and 06 describe the categories of personal information, sources, purposes, and recipient categories relevant to the preceding 12 months. You or an authorised agent may submit a request using the contact details below; we will verify it as required by law.
• Where California law treats a feature as automated decisionmaking technology and requires a notice or access or opt-out right, we will provide that right before using the feature as required.
• We do not sell or share personal information as those terms are defined under the CCPA.

Candidates and applicants

If you applied to a job through a customer's careers page, that organisation controls your data. Please contact them directly to access, correct, or delete your application. We will support our customers in responding to your request.

Children and minors

The website and account-holder features are intended for business users and are not directed to children. Customers may receive applications from minors where recruiting that person is lawful. In that situation, the customer is responsible for the required notice, consent, or other legal basis, and we process the applicant data on its instructions. Contact the hiring organisation or us if you believe a minor's data was provided unlawfully.

How to contact us

Our privacy contact can be reached at hello@talentintelligences.com for any privacy question or request, including access, correction, or withdrawal of consent.

If you are not satisfied with our response, you may contact the Personal Data Protection Commission of Singapore (PDPC). If the GDPR applies to you, you may also contact your local data protection authority.

Changes to this policy

We may update this policy as the product and our practices evolve. We will post the updated policy here with a new effective date, and for material changes we will take reasonable steps to notify you.

This 2026-09-25 update reflects the move of every AI feature other than the Senior Help handoff to one external AI processing service, the disclosure of assignment-rubric drafting and calibration requests, the retirement of resume scoring, and current CV-extraction masking and case-study inputs. The 2026-09-09 update added the data processing, storage, and sharing details for conversational analytics dashboards; the earlier 2026-09-03 update clarified data sources and purposes, provider categories, international processing, retention, security boundaries, minors' data, and applicable rights.