Privacy at Talent Intelligence Lab ATS.

Who we are and what this policy covers

This Privacy Policy explains how Talent Intelligence Lab ("we", "us") collects, uses, discloses, and protects personal data. It applies to this website (talentintelligences.com) and to the Talent Intelligence Lab applicant tracking system (the "Service").

For visitors to this website and for the account holders who use the Service, we are the organisation responsible for your personal data. For candidate and applicant information that a customer (an employer or recruitment agency) collects or uploads through their workspace, that customer is the party responsible for the data; we process it on their behalf and on their instructions as a data intermediary. Candidates should raise requests with the relevant hiring organisation in the first instance — see “Your rights and choices”.

We handle personal data in accordance with Singapore's Personal Data Protection Act 2012 (PDPA), our primary framework. Where other data protection laws apply to you — for example those of other Asia-Pacific jurisdictions in which we operate, the EU/UK GDPR, or the California Consumer Privacy Act (CCPA/CPRA) — the relevant sections below also apply.

Information we collect

Website visitors

• Details you submit through the demo or contact form: your name, work email, company, team type, and any message.
• Technical data such as your IP address and request metadata, used to operate the site securely and to rate-limit abuse, together with standard server logs kept by our hosting provider.
• This website does not use analytics or advertising cookies (see “Cookies and similar technologies”).

Account holders (recruiters, hiring managers, administrators)

• Your name and email, profile details (avatar, role, department, reporting line), and the workspace(s) you belong to.
• Authentication data managed by our identity provider.
• Content you enter in the Service, including messages you send to the in-product help assistant.
• Activity and audit logs of actions taken in the Service.

Candidate and applicant data (processed on behalf of customers)

When a customer uses the Service to manage hiring, the following information about candidates is processed in their workspace:

• Identity and contact details: name, email, phone, and LinkedIn.
• CV/resume files and the structured profile we extract from them (skills, work history, education).
• Cover letters, answers to the customer's application questions, and the consent recorded at the time of application.
• Pipeline status, interview feedback, scorecards, AI assessment results, communications, and offers.

Depending on how a customer configures their workspace, this may include more sensitive details such as current or expected salary and compensation, notice period, and visa / right-to-work status. Customers decide what they ask candidates for. We do not request special categories of data (such as race, religion, or health) by default, and the current release does not operate any diversity / EEO data collection.

How we use information, and our legal basis

• Website data — to respond to your enquiry, arrange a demo, manage invite/beta access, and keep a record of the enquiry. Our basis is your consent and our legitimate interest in responding to business enquiries.
• Account data — to provide, secure, support, and improve the Service, manage access and workspaces, and troubleshoot. Our basis is the performance of our agreement with the customer and our legitimate interest in operating the Service securely.
• Candidate data — processed only to provide the Service to the customer, on the customer's instructions. The customer is responsible for having a lawful basis (such as consent) to collect and use candidate data.

We do not sell personal data, and we do not use candidate or customer information for unrelated advertising.

AI features and automated processing

The Service includes optional AI features. AI assists recruiters — it does not make hiring decisions on its own, and a human reviewer remains responsible for any decision.

• Resume scoring, candidate comparison, interview-question generation, and job-description drafting use a third-party AI provider, Moonshot AI (the “Kimi” models). Only the relevant resume content (skills, experience, and education) and job details are sent, for the duration of the request; we do not send a candidate's name, email, or phone for scoring. Moonshot AI is headquartered in China — see “International transfers”.
• The in-product help assistant uses DeepSeek. Only your help messages — your current message and recent help-chat history — and the current screen path are sent; the assistant has no access to your workspace records. If you escalate a conversation for further help, its messages are retained so our team can respond.

If the GDPR applies to you, you may object to processing and to any decision based solely on automated processing — see “Your rights and choices”.

Cookies and similar technologies

This marketing website does not set advertising or cross-site tracking cookies and does not run third-party analytics. The signed-in Service uses strictly necessary cookies to keep you logged in and to remember your active workspace; these are set with HttpOnly, Secure, and SameSite protections. We do not use cookies for cross-site tracking.

Service providers and disclosure

We share personal data only with trusted third-party service providers who process it on our behalf to operate the website and the Service, and only as far as needed. These fall into a small number of categories:

• Cloud hosting, database, and file-storage providers that run the Service and store its data.
• AI providers that power the optional AI features described above.
• Email delivery providers used to send transactional messages and to deliver website enquiries to our team.

We require these providers to protect personal data under contract and to use it only to provide services to us. Our current sub-processors are:

• Supabase — managed Postgres database and file storage (hosted on Amazon Web Services in Singapore); holds account and candidate data.
• Vercel — application hosting and compute (Singapore region); runs this website and the Service.
• Moonshot AI (Kimi) — optional product AI features such as resume scoring, candidate comparison, interview-question generation, and job-description drafting; processed outside Singapore (see “International transfers”).
• DeepSeek — the in-product help assistant; processes help messages, recent help-chat history, and the current screen path outside Singapore (see “International transfers”).
• Resend — delivery of transactional emails and of website-enquiry notifications to our team.
• Google Workspace — only where a customer connects its own Google account to its workspace for email and calendar.

We keep this list current and will give customers reasonable notice of material changes to our sub-processors.

Where a customer connects their own tools to their workspace (for example their email and calendar, or their own AI tools), data those tools access is shared at the customer's direction and under their control. We may also disclose personal data if required by law, or to protect rights, safety, and the integrity of the Service. We do not sell personal data.

International transfers

The database and file storage that hold account and candidate data are located in Singapore, and the Service's application servers run in Singapore. Some of our service providers operate outside Singapore. In particular, resume content and job details sent to optional Moonshot AI (Kimi) features, and help messages sent to DeepSeek, are processed outside Singapore. Email delivery and certain other providers operate in other countries, including the United States. Your personal data may therefore be transferred to and processed outside Singapore.

When we transfer personal data overseas, we take steps so that it receives a standard of protection comparable to the PDPA, including contractual commitments with our providers (such as standard contractual clauses where applicable). If you are in the EEA or UK, we rely on appropriate safeguards under Chapter V of the GDPR for transfers outside those regions.

Data retention

• Website enquiries — we keep enquiry details for up to 24 months to follow up and keep a record, then delete or anonymise them, unless we must keep them longer for legal reasons.
• Account and workspace data — retained while an account is active, and for a limited period after closure (generally up to 12 months) as needed for operational, legal, or security purposes, then deleted or anonymised.
• Audit logs and escalated help-assistant messages — retained for a limited period (generally up to 12 months) for security, support, and accountability, then deleted.
• Candidate data — controlled by the customer in their workspace. When a workspace is closed or a deletion is requested, we delete the associated candidate records and remove the uploaded files as part of that process, except where we must retain limited information to meet legal obligations.

Customers can also delete individual candidate, job, and application records from their workspace at any time.

How we protect personal data

We use technical and organisational safeguards appropriate to the data, including: tenant isolation enforced at the database level (row-level security), encryption of data in transit (TLS/HSTS) and at rest, additional encryption of integration secrets, least-privilege and role-based access, audit logging, and hardened browser security headers. No method of transmission or storage is completely secure, but we work to protect personal data and to address issues promptly. You can read more on our Security page.

If a data breach affecting personal data occurs, we will act promptly to contain and assess it and notify affected customers without undue delay. Where a breach is notifiable under the PDPA, we will notify the Personal Data Protection Commission and affected individuals in line with our obligations. Where we process candidate data on a customer's behalf, we will support that customer in meeting its own breach-notification duties.

Your rights and choices

Under the PDPA (Singapore)

• Request access to the personal data we hold about you, and information about how it has been used or disclosed.
• Request correction of inaccurate or incomplete data.
• Withdraw any consent you have given (we will tell you the likely consequences).
• Ask us to stop using, or to delete, data where appropriate.

To make a request, email hello@talentintelligences.com. We will verify your identity and respond within a reasonable time, generally within 30 days. If we cannot fully meet a request, we will explain why.

If the GDPR applies to you (EEA / UK)

• You also have the rights to erasure, restriction, data portability, to object to processing (including profiling), and rights regarding decisions based solely on automated processing.
• You have the right to lodge a complaint with your local supervisory authority.

If the CCPA / CPRA applies to you (California)

• You have the right to know, delete, and correct your personal information, and to opt out of any sale or sharing.
• We do not sell or share personal information as those terms are defined under the CCPA.

Candidates and applicants

If you applied to a job through a customer's careers page, that organisation controls your data. Please contact them directly to access, correct, or delete your application. We will support our customers in responding to your request.

Children's data

The website and the Service are intended for business use and are not directed to children. We do not knowingly collect personal data from children.

How to contact us

Our Data Protection Officer can be reached at hello@talentintelligences.com for any privacy question or request, including access, correction, or withdrawal of consent.

If you are not satisfied with our response, you may contact the Personal Data Protection Commission of Singapore (PDPC). If the GDPR applies to you, you may also contact your local data protection authority.

Changes to this policy

We may update this policy as the product and our practices evolve. We will post the updated policy here with a new effective date, and for material changes we will take reasonable steps to notify you.