Legal

Privacy Policy

Last updated 7 August 2026

On this page

This policy explains what we collect, why we collect it, where it lives, and the choices you have. It is written to be read: if anything here is unclear, write to us and a person answers.

If you are a candidate or a reviewer

The rest of this policy is written for our customers, the organisations that use Talent Autopilot. If you reached a scheduling, application-status or candidate-review page through a link someone sent you, the organisation that sent it is responsible for your personal data and decides how it is used; Talent Autopilot only processes that data on their behalf. Ask that organisation, or the recruiter who sent you the link, about the purposes and legal basis for their use of your data, and to exercise your rights of access, correction, deletion, objection and portability. Those are the organisation’s questions to answer, not ours. But the product gives them the tools to answer quickly: a consent record, a per-candidate data export, and one-click erasure.

Who we are, and the roles we play

Talent Autopilot ("TAP", "we") provides a recruiting platform to business customers. For the account data our customers give us and for this website, we act as the data controller. For the candidate data our customers bring into their workspace, the customer is the controller and we are their processor, acting on their documented instructions under a data processing agreement. Our full company details are stated in your agreement and are available on request.

What we collect

Three categories. Account data: your name, work email, role and workspace membership, given when an account is created for you. Candidate data: the CVs, skills, work history, notes, evaluations and pipeline activity your organisation brings into or creates in its workspace; the organisation decides what this contains. Technical data: IP address, browser type, and server logs needed to run the service securely, plus the small set of cookies and stored preferences listed in the Cookie Policy.

Where data comes from

From you and your team as you use the product; from the imports your organisation runs (Flowcase or CSV); and from candidates themselves when they use a public page your organisation sent them: booking an interview slot, checking an application status, or a reviewer submitting feedback through a review link.

How we use it, and on what legal basis

To provide the service: indexing candidates, ranking them against projects, running the features your team uses (performance of contract). To keep the service secure and reliable: authentication, rate limiting, abuse prevention, logging (legitimate interest). To support you when you ask for help (performance of contract). To understand which pages of this website are useful, using cookieless aggregated analytics you can decline (legitimate interest). And to meet legal obligations where they apply. We do not sell personal data, and we do not use it for advertising.

AI processing, specifically

The AI features index candidate profiles for meaning-based search, score candidates with sufficient profile information against approved project requirements, and answer your team’s questions with citations where the feature supports them. For each request, only the data needed for that request crosses the workspace boundary to the AI provider: OpenAI by default, or a model endpoint your organisation hosts itself. Candidate data is never used to train shared models, ours or anyone’s. Saved evaluations include dimension scores and an AI-generated explanation; a separate export records the score, timestamp, model and methodology version. The AI supports hiring decisions but does not make them: rejecting a candidate is always a human action, by design.

Blind screening and data minimisation

Workspaces can mask names, photos and identity signals workspace-wide, per project, or per candidate, and policy can require a second approver before anyone unmasks. The pipeline that prepares candidate data for AI processing strips or masks personal identifiers where they are not needed. Log lines redact tokens and personal identifiers before they are written.

Who we share data with

A minimal set of sub-processors that run the platform: hosting, database, the AI provider, and the integrations your organisation chooses to connect. The current list, with what each vendor processes and where, is published at /subprocessors. We add a vendor to that list before it processes customer data. Beyond sub-processors, we disclose personal data only if the law requires it.

International transfers

Workspace databases and files are hosted in the EU/EEA. Some sub-processors are established outside the EU/EEA; where that is the case, transfers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses, as set out in our data processing agreement.

How we protect it

Encryption in transit and at rest, an isolated database per workspace, role-based access enforced on the server, credential encryption for connected integrations, and a workspace audit trail covering exports, unmasks and permission changes. The full picture (including what we will not claim yet) is on the Security page.

How long we keep it

Account and workspace data is kept for as long as your account is active, and deleted or returned when the agreement ends. Candidate data is under your organisation’s control throughout: the product includes per-candidate erasure with a governed retention window, and candidate-level data export. Server logs are kept only as long as security and reliability require.

Your rights

If we are the controller for your data (account holders and website visitors), you can ask for access, correction, export, deletion, restriction, or object to processing based on legitimate interest, by writing to us. We answer within a month. You also have the right to lodge a complaint with a supervisory authority; in Norway that is Datatilsynet.

Cookies and browser storage

We use a small set of strictly necessary cookies for signed-in sessions, a few stored preferences (language, theme), and cookieless aggregated analytics you can decline. The full inventory, with names and durations, is in the Cookie Policy at /cookie-policy.

Children

Talent Autopilot is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16 outside the candidate data our customers control.

Changes

We may update this policy as the product evolves. Material changes are announced to customers, and the date above always reflects the current version. Earlier versions are available on request.

Get in touch: contact@talentautopilot.com