HeyTalent is a B2B recruiting platform powered by AI. We collect the data necessary to provide our service, support you when things go wrong, and keep the platform secure and stable.
Our databases are hosted in the European Union, in Stockholm and Ireland. Some of the sub-processors that help us run the platform — error monitoring and file storage among them — process data outside the European Economic Area under EU-approved Standard Contractual Clauses (see Sections 6 and 7). We never sell your data, and we share it only with the sub-processors who help us run the platform.
1. Who We Are
HeyTalent ("we", "us", "our") is a B2B recruiting platform that helps recruiters and agencies manage their talent pipeline using AI-powered tools. This Privacy Policy explains how we collect, use, and protect your personal data when you use our platform.
This policy applies to our platform users — recruiters, hiring managers, and agency professionals who have a direct contractual relationship with us. It does not cover candidates whose data is processed through the platform on your behalf (see Section 5 for details on candidate data).
2. What Data We Collect
Account Data. When you create an account, we collect your name, email address, and organization name. This is necessary to provide you with access to the platform.
Candidate Data. The candidate profile data you source and manage through the platform. See Section 5 for full details.
Error & Diagnostic Data. To detect and fix bugs, our servers record technical diagnostic data when something goes wrong: the error and its stack trace, the URL where it happened, your User ID and email address, and a Request ID used to correlate logs. Sensitive data such as passwords, tokens, and authentication headers is automatically filtered out before anything is written to a log. This data is handled by our error-monitoring sub-processor, which is located outside the EEA; that transfer is covered by Standard Contractual Clauses (see Section 7).
We do not use product analytics tools, and we do not record your screen. There is no session replay in HeyTalent.
3. Why We Collect It
- Provide the service. Data used: account data, candidate data. Example: managing your talent pipeline, running AI-powered searches.
- Technical support. Data used: error and diagnostic logs, plus whatever you send us when you report a problem. Example: when you report a bug, we trace its Request ID through our logs to see exactly what happened.
- Security & stability. Data used: error and diagnostic logs. Example: detecting and fixing crashes before they affect more users.
4. Legal Basis for Processing
Under the GDPR, we process your data based on the following legal grounds:
Contract performance (Art. 6(1)(b)) — Processing your account data and candidate data is necessary to provide the recruiting service you've contracted with us for.
Legitimate interest (Art. 6(1)(f)) — We keep error and diagnostic logs in order to provide effective technical support and to keep the platform secure and stable. Given our B2B relationship and the professional context of your usage, we believe this is a reasonable and expected use of your data. We have conducted a Legitimate Interest Assessment (LIA) and concluded that the benefits of being able to diagnose and fix problems — both for us and for you as a user — outweigh any potential impact on your privacy. You can object to this processing at any time (see Section 11).
5. Candidate Data
HeyTalent processes candidate profile data (sourced from public LinkedIn profiles and other sources) as part of the recruiting service. In most cases, you (our client) are the data controller for candidate data, and HeyTalent acts as a data processor on your behalf.
Candidate data is stored in our database in the European Union. We process this data solely to provide the service you've contracted for. Where the service applies AI to candidate data — to filter or rank profiles, for example — the request is sent to one of the AI model providers listed in Section 6. Files uploaded through the platform are held by a storage sub-processor that may process them outside the EEA under Standard Contractual Clauses.
Candidate data retention is governed by your account configuration and our Data Processing Agreement (DPA). If you need a signed DPA, please contact us.
6. Sub-Processors & Third Parties
We share your data only with the sub-processors that help us run the platform. We do not sell, rent, or trade your data to anyone.
- Database & backend hosting. Purpose: storing and serving your data. Data shared: account data, candidate data. Location: European Union (Stockholm and Ireland). Compliance: SOC 2, GDPR.
- Error monitoring. Purpose: detecting and diagnosing bugs and crashes. Data shared: error and diagnostic data (see Section 2). Location: outside the EEA, under Standard Contractual Clauses. Compliance: GDPR.
- AI model providers. Purpose: the AI features of the platform, such as profile filtering, ranking, and search. Data shared: the account and candidate data needed to run each request. Location: as specified in our DPA. Compliance: GDPR.
- File storage. Purpose: storing the files uploaded through the platform. Data shared: those files and their metadata. Location: outside the EEA, under Standard Contractual Clauses. Compliance: GDPR.
An up-to-date list of our sub-processors, naming each provider and its region, is available on request and forms part of our DPA.
We do not share candidate data with any parties beyond these sub-processors. All sub-processors are bound by data processing agreements that require them to protect your data in accordance with the GDPR.
7. International Data Transfers
Your account data and the candidate data you manage are stored in our database inside the European Union, in Stockholm and Ireland.
Some processing takes place outside the European Economic Area: the error and diagnostic data sent to our error-monitoring provider, and the files held by our storage provider. Wherever a sub-processor processes personal data outside the EEA, the transfer relies on EU-approved Standard Contractual Clauses under Article 46(2)(c) of the GDPR, and we assess the safeguards that provider has in place.
We regularly review our sub-processors' data protection practices to ensure ongoing compliance. If you need details about a specific transfer, or a signed DPA listing each sub-processor and its region, contact us.
8. Data Retention
- Account data — retained while your account is active, plus 30 days after account closure.
- Error & diagnostic logs — retained for 90 days, then automatically deleted.
- Candidate data — retained according to your account configuration and applicable DPA terms.
After the retention period, data is automatically deleted from the respective systems.
9. Security
We take the security of your data seriously and implement the following measures:
- EU databases — the account and candidate data you store with us lives in our database in the European Union, in Stockholm and Ireland.
- Encryption in transit — all data transmitted between your browser and our servers is encrypted using HTTPS/TLS.
- Encryption at rest — data stored in our database is encrypted at rest.
- Access control — platform access is protected by authentication, and internal access to production systems and logs is restricted to authorized team members.
- Data filtering — sensitive data (passwords, authentication tokens, auth headers) is automatically stripped before anything is written to a log.
- Governed transfers — where a sub-processor sits outside the EEA, the transfer is governed by Standard Contractual Clauses (see Section 7).
10. Cookies
We use only the cookies that are strictly necessary to operate the platform — the ones that sign you in and keep your session alive.
We do not use analytics cookies, advertising cookies, or third-party tracking cookies, and we do not run session replay.
11. Your Rights (GDPR)
If you are located in the European Economic Area, you have the following rights regarding your personal data:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct any inaccurate data.
- Erasure — request deletion of your account and associated data.
- Data portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interest.
- Restriction — request that we limit how we process your data while a complaint is being resolved.
- Complaint — lodge a complaint with your local Data Protection Authority.
To exercise any of these rights, contact us at the address below. We will respond within 30 days.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for legal and regulatory reasons. If we make material changes, we will notify you by email before the changes take effect.
We encourage you to review this page periodically. The "Last updated" date at the top of this policy indicates when it was most recently revised.
13. Contact Us
If you have questions about this Privacy Policy, want to exercise your data rights, or have any concerns about how we handle your data:
Email: contact@heytalent.app
Subject line: "Privacy Request — [Your Name]"
We aim to respond to all privacy-related inquiries within 30 days.