Privacy Policy

TalentFlow is a product of Gventure Technology (“we”, “us”, “Gventure”). This policy explains how we collect, use, share, store, and protect personal data when employers and candidates use TalentFlow (the “Service”), including when you connect third-party accounts such as LinkedIn or Facebook / Meta.

We design our practices to align with the EU General Data Protection Regulation (GDPR), the UK GDPR where applicable, and India’s Digital Personal Data Protection Act, 2023 (DPDP Act), together with other applicable privacy laws.

1. Who we are (roles)

• Controller / Data Fiduciary (our own account data): For TalentFlow sign-in accounts, billing contacts, product analytics needed to run the platform, and support tickets you send us, Gventure is the data controller (GDPR) / Data Fiduciary (DPDP Act).
• Processor / Data Processor (customer hiring data): When a company workspace uses TalentFlow to run hiring (jobs, applications, resumes, scores, interviews), that company is typically the controller / Data Fiduciary for candidate and employee personal data. Gventure processes that data on their instructions as a processor / Data Processor.
• If you are a candidate, please also review the privacy notice of the employer whose job you applied to — they decide the hiring purpose and retention rules for your application.

Contact for privacy requests: privacy@gventure.net

2. Who this policy covers

• Workspace admins and recruiters who sign in to TalentFlow
• Candidates who apply to jobs or complete interviews through TalentFlow
• People who connect social accounts (for example LinkedIn) to publish job campaigns
• Website visitors who load TalentFlow pages (technical logs as described below)

3. Personal data we collect

• Account data: name, work email, password (hashed), workspace membership and role
• Company & hiring data: company profile, job descriptions, scoring settings, campaign media, and pipeline activity
• Candidate data: application details, resume/CV files, scores, interview notes or recordings where enabled, and contact details you or the employer provide
• Integration tokens: OAuth access/refresh tokens for connected channels (encrypted at rest), account identifiers (for example LinkedIn person URN), and posting status
• Technical data: IP address, browser/device type, timestamps, and security logs needed to operate and protect the Service

We do not intentionally collect special-category data under GDPR (for example health, religion, or biometric data used for identification) unless an employer configures a feature that requires it and has a lawful basis. Please do not upload such data unless required for the role and permitted by law.

4. Purposes and legal bases (GDPR)

Where GDPR or UK GDPR applies, we rely on these legal bases:

• Contract: create and operate your TalentFlow account; provide hiring workflows you request
• Legitimate interests: secure the Service, prevent abuse, improve reliability, and support customers — balanced against your rights
• Consent: optional features such as connecting LinkedIn/Meta, certain cookies or marketing communications, or AI features where consent is required — you may withdraw consent at any time without affecting prior lawful processing
• Legal obligation: tax, accounting, fraud prevention, and responding to lawful requests

Employer workspaces are responsible for establishing their own lawful basis for candidate processing (typically recruitment / legitimate interests or consent, as applicable).

5. Purpose limitation & consent (India — DPDP Act)

Where the DPDP Act applies:

• We process digital personal data for clear purposes stated in this policy and in product notices (account operation, hiring workflows, integrations you enable, security, and support).
• Where consent is the ground for processing, it will be free, specific, informed, unconditional, and clear. You may withdraw consent through the product controls (for example disconnecting integrations) or by emailing privacy@gventure.net.
• We may process certain data for legitimate uses permitted under the DPDP Act (for example employment-related purposes instructed by an employer workspace, or compliance with law) where consent is not required.
• We do not sell personal data. We do not use LinkedIn or Meta user data to build advertising profiles unrelated to operating TalentFlow for your workspace.

6. How we use information

• Provide hiring workflows (jobs, applications, AI scoring, voice agents, offers)
• Publish job campaign posts you authorize on LinkedIn or other connected channels
• Authenticate users, prevent abuse, and maintain security
• Improve product reliability and customer support
• Comply with law and respond to lawful requests

7. Sharing & subprocessors

We share personal data only as needed to run the Service: with your workspace members according to roles; with cloud hosting, email/SMS, AI providers (resume scoring / coaching), voice interview vendors, and social networks (LinkedIn, Meta) when you connect them; and with professional advisers or authorities when required by law. Subprocessors process data under contracts that require confidentiality and security appropriate to the data.

8. Social platform data (LinkedIn / Meta)

• When you connect LinkedIn (or Meta), we receive credentials and profile identifiers needed to post as the destination you choose (for example your member profile).
• Post content is limited to job campaign material you configure (role title, location, apply link, creative). We do not post candidate personal data to social networks.
• You can disconnect integrations at any time in the product Integrations area (when signed in), which withdraws that processing for future posts.

9. International transfers

TalentFlow may process data in India and in other countries where we or our subprocessors operate (including the EU/EEA, UK, or United States). Where GDPR requires safeguards for transfers outside the EEA/UK, we use appropriate mechanisms such as Standard Contractual Clauses (SCCs) or an adequacy decision, plus supplementary measures where needed. Where Indian law restricts cross-border transfer of personal data, we will follow applicable DPDP Act rules and government notifications.

10. Retention

We keep personal data only as long as needed for the purposes above. Account and hiring data are retained while your workspace is active and for a limited period afterward for backups, disputes, and legal obligations. OAuth tokens are removed when you disconnect an integration or when we complete a deletion request. Candidate data generally follows the retention settings and instructions of the hiring workspace that collected it, unless law requires longer retention.

11. Security

We use encryption in transit (HTTPS), encrypt sensitive secrets (such as integration tokens) at rest, role-based access within workspaces, least-privilege access for staff, and operational controls appropriate to a hiring platform. No method of transmission or storage is 100% secure; please use a strong password and protect your login.

12. Your rights

12.1 GDPR / UK GDPR

If GDPR or UK GDPR applies to you, you may have the right to:

• Access your personal data and receive a copy
• Rectify inaccurate data
• Erase data (“right to be forgotten”) in certain cases
• Restrict or object to certain processing
• Data portability (receive data in a structured, commonly used format)
• Withdraw consent where processing is based on consent
• Lodge a complaint with your local supervisory authority (for example in the EEA or the UK ICO)

12.2 India — DPDP Act (Data Principal rights)

If the DPDP Act applies to you as a Data Principal, you may have the right to:

• Obtain a summary of personal data being processed and the processing activities
• Correction, completion, and updating of your personal data
• Erasure of personal data when it is no longer necessary for the stated purpose, or when you withdraw consent (subject to legal retention)
• Withdraw consent easily
• Nominate another individual to exercise rights in case of death or incapacity, where provided by law
• Grievance redressal through our contact below, and escalation to the Data Protection Board of India as permitted under the DPDP Act

How to exercise rights: email privacy@gventure.net with enough detail for us to verify your identity. For deletion specifically, see Data deletion. We aim to acknowledge within 7 days and complete requests within 30 days (or sooner where law requires), unless a lawful exception applies. If you are a candidate, we may need to coordinate with the employer workspace that controls your application data.

13. Children

TalentFlow is intended for professional hiring. It is not directed to children. We do not knowingly collect personal data from children under 16 (GDPR) or under 18 where Indian DPDP child rules apply. If you believe a child has provided data, contact us and we will delete it promptly.

14. Automated decision-making & AI

TalentFlow may use AI-assisted scoring or coaching to help recruiters review applications. These tools support human decision-making; hiring decisions remain with the employer workspace. You may ask us (or the employer) how AI features affected an assessment where applicable law gives you that right. We do not use automated decisions that produce legal or similarly significant effects solely without meaningful human involvement for our own account-level processing.

15. Cookies & similar technologies

We use essential cookies or local storage required to keep you signed in and to secure the Service. Where we use non-essential analytics or marketing cookies, we will request consent where required by law. You can control cookies through your browser settings; blocking essential cookies may prevent sign-in.

16. Contact & grievance redressal

Privacy / Data Principal / Data Subject requests:
privacy@gventure.net
Gventure Technology — gventure.net

If you are in the EEA/UK and are unsatisfied with our response, you may contact your supervisory authority. In India, after exhausting our grievance process, you may approach the Data Protection Board of India as provided under the DPDP Act.

17. Changes

We may update this policy from time to time. The “Last updated” date above will change when we do. For material changes, we will provide additional notice where required (for example in-app or by email). Continued use of the Service after an update means you acknowledge the revised policy; where consent is required, we will ask again.