Privacy Policy

• To authenticate you and maintain your session
• To power AI job matching, ranking, resume tailoring, and all career tools — your profile data is sent to OpenRouter (Claude AI) under our API key; see Section 5
• To send transactional emails: verification codes, job search results, job alert digests, and resume analysis notifications
• To perform liveness checks on job postings you are tracking
• To enforce usage limits and manage your subscription via Stripe
• To debug errors, improve reliability, and develop new features
• To comply with legal obligations

We do not sell your data, use it for advertising, share it with third parties for their own marketing, or use it to train AI models.

We rely on the following legal bases to process your personal data:

• Contract performance — processing necessary to provide the service you have signed up for
• Legitimate interests — security logging, error monitoring, and feature improvement, where these interests are not overridden by your rights
• Legal obligation — where we are required by law to retain or disclose data
• Consent — for optional features such as job alert emails, where you explicitly enable them

Talnt.Fit operates primarily under Canadian privacy law (PIPEDA / provincial equivalents). If you are located in the European Economic Area or UK, the GDPR also applies and you have additional rights under Section 7. If you are a California resident, the CCPA applies; see Section 8.

Your account and profile data is retained for as long as your account is active. Job search results and AI rankings are kept for 90 days, after which they are automatically purged. Uploaded resume files are stored in Cloudflare R2 and deleted when you remove them from your account or close your account. AI-generated career content (cover letters, STAR stories, negotiation scripts, etc.) is retained until you delete it or close your account. Financial data (salary, offer details) is deleted immediately when you remove the relevant application. You may request deletion of all your data at any time by contacting us (see Section 11).

We use the following sub-processors to deliver the service. All are bound by contractual data protection obligations. Most are US-based; see Section 9 for international transfer details.

AI API calls to OpenRouter are made under our API key. Your data is not used to train any AI model. OpenRouter's data processing is governed by their Privacy Policy.

We use a single session cookie set by NextAuth.js to maintain your login state. The cookie is HTTP-only (not accessible to JavaScript), scoped to this domain, and marked Secure in production. We do not use third-party advertising or tracking cookies. You can clear cookies in your browser at any time; this will sign you out.

You have the right to:

• Access — request a copy of all personal data we hold about you
• Correction — update incorrect profile information directly in the app, or ask us to correct it
• Deletion — delete your account and all associated data; we will comply within 30 days
• Portability — export your profile data in JSON format (coming soon)
• Restriction — ask us to pause processing while a dispute is resolved
• Objection — object to processing based on legitimate interests
• Opt-out of emails — unsubscribe from job alerts and non-essential notifications at any time via account settings or the unsubscribe link in any email

To exercise any of these rights, contact us or email privacy@talnt.fit. We will respond within 30 days. If you are in the EEA or UK and are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.

If you are a California resident, you have the right to know what personal information we collect, to delete it, and to opt out of its sale. We do not sell personal information. To submit a verifiable consumer request, contact us at privacy@talnt.fit. We will not discriminate against you for exercising your CCPA rights.

Talnt.Fit is headquartered in Canada. Our sub-processors (including OpenRouter, Stripe, Cloudflare, Resend, Upstash, and Sentry) are primarily based in the United States. By using the service, you acknowledge that your data may be transferred to and processed in the US or other jurisdictions with different privacy laws than your own. Where required, we rely on Standard Contractual Clauses or other approved transfer mechanisms under GDPR.

All data is transmitted over HTTPS/TLS. Passwords are hashed with bcrypt (never stored in plain text). Session cookies are HTTP-only and Secure. Database access is restricted to application credentials with least-privilege roles. Uploaded files are stored in a private Cloudflare R2 bucket accessible only via signed URLs. We perform regular security reviews and dependency audits.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users and relevant authorities within 72 hours of becoming aware, as required by applicable law.

Talnt.Fit is not directed at individuals under 16 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

We may update this policy from time to time. We will notify you of material changes by posting a notice in the app or emailing your registered address at least 14 days before the change takes effect. The “Last updated” date at the top of this page always reflects the most recent revision. Continued use after changes constitutes acceptance.

Questions about this policy? Contact us or email privacy@talnt.fit.