Privacy Policy

1. Introduction

This Privacy Policy explains how your personal data is collected, used, and protected when you submit a job application through this careers website (“Service”). We are committed to protecting your privacy in compliance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), and other applicable data protection laws.

2. Data Controller

The data controller responsible for the processing of your personal data through this Service is:

3. Data Processor

This careers page is operated on behalf of SalesPatriot, Inc. (“Client”), the company for which recruitment is being conducted. SalesPatriot acts as a data processor, processing your personal data solely on our instructions and for the purposes described in this policy. For information about how SalesPatriot handles personal data in its own services, please refer to the SalesPatriot Privacy Policy.

4. Data We Collect

When you submit a job application through this Service, we collect the following personal data:

• Full name
• Email address
• LinkedIn profile URL (if provided)
• GitHub or portfolio URL (if provided)
• CV / resume file (if uploaded)
• Job position and company identifier
• Record of your consent to this privacy policy
• Timestamp of your application
• Anonymized usage data (page views, button clicks) — collected only with your explicit consent via our cookie banner

We do not collect sensitive personal information (as defined under GDPR or CCPA/CPRA).

This Service uses PostHog, a product analytics platform, to collect anonymized usage data such as page views and interactions. This data is only collected if you consent via the cookie banner displayed on your first visit. If you decline, no analytics cookies are set and no usage data is collected. You can change your preferences at any time by clearing your browser cookies and revisiting the site.

5. Purpose of Processing

We process your personal data solely for the following purposes:

• Evaluating your job application and assessing your qualifications
• Communicating with you about your application status and scheduling interviews
• Sharing your application with SalesPatriot, Inc. for their recruitment decision-making
• Complying with legal obligations

6. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data on the following legal bases:

• Consent (Art. 6(1)(a) GDPR): You have given explicit consent to the processing of your personal data by checking the consent box on the application form.
• Pre-contractual measures (Art. 6(1)(b) GDPR): Processing is necessary for steps taken at your request prior to entering into an employment contract.
• Legitimate interest (Art. 6(1)(f) GDPR): Processing is necessary for the legitimate interests of the data controller and the Client in managing recruitment, provided these interests are not overridden by your fundamental rights and freedoms.

7. Data Retention

Your application data will be retained for a maximum of 12 months from the date of submission. If your application is unsuccessful, we will delete your personal data after this period unless you have given us separate consent to retain it for future opportunities. If you are hired, your application data will be transferred to SalesPatriot, Inc. and become part of your employee records, subject to their data retention policies.

8. Sub-processors and Third-Party Services

Your personal data is stored and processed using the following third-party sub-processors:

• Supabase, Inc. (United States) — Database hosting and file storage. Your application data and uploaded CV files are stored in encrypted databases and storage buckets managed by Supabase. Supabase acts as a sub-processor on our behalf. For details, see the Supabase Privacy Policy.
• Vercel, Inc. (United States) — Website hosting and application delivery. Vercel serves this website and processes API requests. For details, see the Vercel Privacy Policy.
• PostHog, Inc. (United States) — Product analytics. With your consent, PostHog collects anonymized usage data (page views, interactions) to help us improve this Service. No data is sent to PostHog unless you accept analytics cookies via the cookie banner. For details, see the PostHog Privacy Policy.

We do not sell, rent, or share your personal data with any parties beyond those listed above. Each sub-processor is contractually bound to process your data only as instructed and to maintain appropriate security measures.

9. International Data Transfers

Your personal data may be transferred to and processed in the United States, where our sub-processors (Supabase, Vercel, and PostHog) and our Client (SalesPatriot, Inc.) are located. Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on the EU-U.S. Data Privacy Framework, to protect your data in accordance with GDPR requirements.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (TLS/HTTPS)
• Encryption of data at rest in our database and storage
• Row-level security policies restricting access to application data
• Write-only access patterns — submitted applications cannot be read or modified through the public API

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security.

11. Your Rights Under GDPR

If you are located in the EEA or the United Kingdom, you have the following rights regarding your personal data:

• Right of access (Art. 15): You may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): You may request that we correct inaccurate personal data.
• Right to erasure (Art. 17): You may request that we delete your personal data (“right to be forgotten”).
• Right to restriction (Art. 18): You may request that we restrict the processing of your personal data.
• Right to data portability (Art. 20): You may request your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): You may object to the processing of your personal data based on legitimate interests.
• Right to withdraw consent (Art. 7(3)): You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

To exercise any of these rights, please contact us at privacy@talentflank.com. We will respond to your request within 30 days.

12. Your Rights Under California Law (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• Right to know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to delete: You have the right to request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to correct: You have the right to request that we correct inaccurate personal information we maintain about you.
• Right to opt-out of sale or sharing: We do not sell or share your personal information as defined under CCPA/CPRA.
• Right to limit use of sensitive personal information: We do not collect or process sensitive personal information as defined under CCPA/CPRA.
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

Categories of Personal Information Collected

Under CCPA/CPRA categories, we collect the following:

• Identifiers: Name, email address
• Professional or employment-related information: LinkedIn profile, GitHub/portfolio URL, CV/resume
• Internet or network activity: Anonymized page views and interactions, collected only with your consent via the cookie banner

We do not sell your personal information. We do not use your personal information for cross-context behavioral advertising. To submit a request, contact us at privacy@talentflank.com. We will verify your identity before processing your request and respond within 45 days.

13. Children's Privacy

This Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe that we have inadvertently collected data from a minor, please contact us and we will promptly delete it.

14. Supervisory Authority

If you are located in the EEA and believe that our processing of your personal data violates data protection laws, you have the right to lodge a complaint with a supervisory authority. The lead supervisory authority for the data controller is:

You may also lodge a complaint with the supervisory authority in the EU/EEA member state of your habitual residence or place of work.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last updated” date. We encourage you to review this policy periodically. Your continued use of the Service after changes constitutes acceptance of the updated policy.

16. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us: