Privacy Policy

1. Two kinds of data, two different roles

TalentRewind handles two categories of personal data, and our responsibility differs between them.

• Your account data — the email address you sign in with, your display name, your workspace name and your role. For this, we are the Data Fiduciary: we decide why it is held.
• Candidate data — the resumes you upload and everything extracted from them. For this, you are the Data Fiduciary and we act as a Data Processor on your instructions.

That second point carries an obligation for you, not us: you must have a lawful basis for holding those resumes and for uploading them here. Candidates who ask us directly about their data will be referred to the agency that holds it. Section 11 sets out who runs this project.

2. What we collect

• Email address. Required to sign in. We do not use passwords — we email a six-digit code, store only a SHA-256 hash of it, and it expires in ten minutes.
• Resume files you upload, kept in their original form.
• Fields extracted from those resumes — name, contact details, employers, titles, skills, education, location, salary and notice period where the resume states them.
• Activity within your workspace— status changes, notes, field edits, and each time a user reveals a candidate's contact details. This history is append-only by design: it is how your team answers “who contacted this person, and when”.
• Your agreement to these documents — your email address, which version you accepted, and when.

We do not collect anything else. There is no behavioural profiling, no advertising identifier, and no data purchased about you from anyone.

3. No cookies, no analytics

TalentRewind sets no cookies at all, and loads no analytics, advertising or session-recording scripts. There is nothing to consent to and no banner to dismiss, which is why you have not seen one.

The only thing stored in your browser is your sign-in token, and a note of your most recent upload batch so the page can show its progress if you navigate away. Both are kept in your browser's local storage, are readable only by this site, and are cleared when you sign out.

4. Who else processes it

Running the product requires third-party providers: cloud hosting for the servers and database, object storage for the resume files, an email service for login codes and notifications, and language-model providers for extraction. They receive only what the task needs, and only to provide that service to us.

Resume text is sent to a language model in order to extract fields from it. That is the core of how the product works and cannot be switched off while still using it. The text is not used to train models. We do not sell personal data, and we do not share it with anyone beyond the providers above.

5. Where it is held

The servers, the database and the resume files are held with third-party cloud providers. Language-model providers may process text outside India. If cross-border processing is a problem for your clients, raise it before you upload anything.

6. How long we keep it — and how deletion actually works

We keep your data for as long as your workspace exists. There is no automatic expiry: a resume uploaded today is still there in two years unless you ask us to remove it.

Deletion is currently a manual process, not a button in the product. Today you can remove a team member, cancel an invitation and delete a saved search yourself. Deleting individual candidates, deleting the resume files, or closing a workspace entirely requires emailing privacy@talentrewind.com. We will complete it within 30 days and confirm when it is done.

This is stated plainly because a policy claiming self-serve erasure that does not exist would be a false promise. Self-serve deletion is on the roadmap; until it ships, the email address above is the mechanism.

One exception: the record of your agreement to these documents is kept after deletion, because its entire purpose is to evidence that consent was given. It holds an email address, a version and a timestamp.

7. Your rights

Under the Digital Personal Data Protection Act, 2023 you may ask for access to your personal data, correction of it, erasure of it, and nomination of someone to act for you. Write to privacy@talentrewind.com and we will respond within 30 days.

If a candidate contacts us about a resume in your workspace, we will tell them which agency holds it and notify you, because the request is yours to answer.

8. Security

These are properties of how the system is built, not aspirations.

• Every workspace is isolated at the database layer. Queries for tenant data carry the workspace identity automatically, and a code path that failed to establish one cannot read tenant data at all — it errors rather than returning someone else's rows.
• There are no passwords to leak. Sign-in is a one-time code, stored only as a hash, valid for ten minutes, with a limit on attempts.
• Contact details are hidden until deliberately revealed, and every reveal is recorded against the user who did it.
• Access within a workspace is per-person: who may search, who may see contact details, who may write history, who may add profiles.
• All traffic is served over HTTPS. The database is not reachable from the internet.

No system is impossible to breach. If we discover a breach affecting your data we will tell you and the Data Protection Board without waiting to be asked.

9. Children

TalentRewind is a tool for businesses and is not directed at children. Do not upload resumes of people under 18.

10. Changes

Material changes get a new version string, and the version at the top of this page is always the one in force. When it changes we email workspace owners. The version you agreed to is recorded, so a later change is never applied retroactively to an agreement you did not see. Re-prompting existing users for acceptance at sign-in is not built yet; until it is, that email and this page are the notice.

11. Who runs this

TalentRewind is run as The TalentRewind project: a free, non-commercial project rather than a registered company. There is no registered office and no named grievance officer, so the address in section 12 is the contact for everything, complaints included.

The Digital Personal Data Protection Act, 2023 expects a Data Fiduciary to identify itself. This project does not, and that is worth knowing before you upload: for the candidate data you hold here, you are the identified party.

12. Contact and grievances

Every request — access, correction, deletion, or a complaint — goes to privacy@talentrewind.com, which reaches the person who runs The TalentRewind project. It is the only channel, and there is no registered address or named officer behind it, for the reasons in section 12.

If you are not satisfied with the answer you may complain to the Data Protection Board of India.