Privacy Policy

1. Introduction

FindTalent ("we," "us," or "our") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services.

This policy applies to all users of FindTalent, including employers, talent (freelancers), and visitors. By accessing or using our platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

We comply with applicable data protection laws including the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), Lei Geral de Proteção de Dados (LGPD), and other relevant privacy regulations worldwide.

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide when using our platform:

• Account Information: Name, email address, password, phone number, date of birth, gender, language, timezone, and profile photo.
• Profile Information: Professional title, skills, hourly rate, work history, education, portfolio, bio, voice note, social links, and location. For employers, the company name, website, description and logo.
• Identity Verification: A photo of your government-issued ID and a selfie. They are kept in our private file storage and checked by our own team, not by AI.
• Payment Information: Employers pay through Stripe, which collects card details and billing address on its own payment page. Affiliates can give us PayPal or bank account details so we can pay their commission.
• Communications: Messages exchanged through our platform, support inquiries, and feedback.
• Job-Related Information: Job postings, applications, contracts, and work deliverables.

2.2 Information Collected Automatically

We automatically collect certain information when you access our platform:

• Device Information: IP address, browser type, operating system, device identifiers, and screen resolution. In our analytics and referral logs, we scramble IP addresses with a value that changes every day, so they cannot be turned back into addresses. Elsewhere we use your IP address as it is: to limit how many requests one visitor can make (short-lived counters kept by Upstash, and our server logs, kept by Vercel, when a limit is reached); in the email we send when your password is changed; and, if you allow advertising, in what we send Meta about sign-ups, first purchases and recruitment calls, and with your browser details at each checkout, where we remove them from Stripe once a first purchase has been reported, but Stripe keeps them for later checkouts. Password resets and chat sign-in codes are limited the same way by your email address, so those counters and logs can also hold your email address.
• Usage Data: Pages visited, features used, search queries, click patterns, and session duration.
• Location Data: Your approximate location (country), worked out from your IP address. We do not use your device's precise location.
• Cookies and Tracking: Information collected through cookies, pixels, and similar technologies.

2.3 Information from Third Parties

We may receive information from third-party sources:

• Google: If you sign in with Google, Google shares your name, email address and profile photo with us. The photo becomes your profile picture until you replace it.
• Payment Processors: Transaction details and payment status from Stripe.
• Calendly: When you book a call with our recruitment team, Calendly shares the meeting time and link with us.

3. How We Use Your Information

We use your information for the following purposes:

3.1 Providing Our Services

• Creating and managing your account
• Facilitating connections between employers and talent
• Processing job applications and contracts
• Enabling communication through our messaging system
• Processing subscription payments for employer plans
• Providing customer support

3.2 Improving Our Platform

• Analyzing usage patterns to enhance user experience
• Developing new features and services
• Improving our AI-powered search and matching
• Conducting research and analytics

3.3 Safety and Security

• Verifying user identities through KYC processes
• Detecting and preventing fraud, abuse, and security threats
• Enforcing our Terms of Service and policies
• Complying with legal obligations

3.4 Communications

• Sending transactional emails (account verification, payment confirmations)
• Notifying you of job matches and opportunities
• Providing platform updates and announcements
• Marketing emails to employers (each one has an unsubscribe link)
• Hiring interests: If you are an employer, we note the kinds of talent you look for: the roles in the jobs you post and the searches you make while signed in. If you allow advertising, we also use the role you searched for before signing up, and the ad keyword or page that brought you to us. We use this to choose which talent our marketing emails and pages show you. Our team can see it. We stop using it if your account is deleted.

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process personal data based on the following legal grounds:

• Contract Performance: Processing necessary to fulfill our contract with you (account services, payments, job matching).
• Legitimate Interests: Processing for our legitimate business interests (platform improvement, fraud prevention, security) where not overridden by your rights.
• Consent: Processing based on your explicit consent (marketing communications, optional data sharing).
• Legal Obligation: Processing required to comply with applicable laws (tax reporting, responding to legal requests).

5. Information Sharing and Disclosure

We may share your information in the following circumstances:

5.1 With Other Users

• Your public profile information is visible to employers and other platform users.
• If you are an approved talent, your profile is public. Anyone can see it without signing in: your first name and last initial, photo, headline, overview, skills, rate range, age, city, country, language, voice note, work history, education, portfolio, reviews and when you last signed in. Search engines can list it with your first name and last initial, photo, headline, overview, skills and location. Our robots.txt file also lets AI crawlers, such as those of OpenAI, Anthropic, Google and Perplexity, read it.
• When you apply for jobs, employers can view your profile and application details.
• If you are an employer, your job posts are public and show your company name, logo, website, size, industry and location. Your employer profile is public too: anyone can see your full name, photo, country and language, with your company details, without signing in.

5.2 With Service Providers

These companies handle personal data for us:

• Supabase: Hosts our database and file storage. It holds your account, profile, messages and uploaded files, including the ID photo and selfie used for identity checks. It also handles sign-in and sends the emails that confirm your email address, reset your password and invite new affiliates.
• Vercel: Hosts the website. Every visit passes through Vercel, including your IP address. With your consent, Vercel Analytics counts page views.
• OpenAI: Powers our AI features. What we send it, and why, is listed below.
• Resend: Sends our other emails. It receives your email address, your name and what each email says.
• Stripe: Takes payments. It receives your name or company name, email address, card details and billing address. For employer plans, it also receives which talent's profile you were looking at when you chose to buy, if any, and, depending on your cookie choices, which ad or link brought you to us and your Google Analytics IDs. If you allow advertising, it also receives your IP address and browser details at checkout. For a first purchase we remove them once the purchase has been reported to Meta; for later checkouts Stripe keeps them.
• Upstash: Counts requests so we can stop abuse. It receives your IP address or account ID, and for password resets and chat sign-in codes, your email address.
• Google: With your consent, Google Analytics shows us how people use the site. Before you choose, or if you say no, Google Analytics still loads with its cookies switched off: Google then receives only the page you visited, with the IP address and browser details every web request carries, and no cookies or events from us. When a purchase follows a click on one of our Google ads, we tell Google Ads the click ID, time and amount, so we can see which ads work: for purchases made since this policy was updated, only if you allowed advertising. Earlier purchases are sent as before. If you allow analytics, our server may also tell Google Analytics when you sign up or buy a plan, with your account ID. If you also allow advertising, those events include a scrambled (hashed) copy of your email address. If you sign in with Google, Google shares your name, email address and profile photo with us.
• Meta (Facebook): With your consent, the Meta Pixel tells Meta which pages you visit and what you do on the site, such as signing up, searching or viewing profiles. This helps us measure our ads and show them to the right people. If you allow advertising, our server also tells Meta when you sign up, buy a plan or book a call with our recruitment team. It sends a scrambled (hashed) copy of your email address, name, phone number, country and account ID, and can include your IP address and browser details.
• Microsoft Clarity: With your consent, records how visitors use the site, with personal details masked, and builds heatmaps (see section 8.3).
• Calendly: Books calls with our recruitment team. It receives your name, email address, company and the details of the role you want to fill.
• Zight: Hosts the feedback videos our team records about a talent's profile. The videos can show that profile.
• Notion: Keeps our record of signed client and recruiter agreements: the signer's name, company, reference number and signing date.

Our team also uses its own email accounts, provided by Google and Microsoft. Signed client and recruiter agreements, with the signer's name, email address, company and drawn signature, are emailed to accounts with both. Recruitment requests, including your WhatsApp number if you give one, are emailed to our team, including our Google account. Recruitment calls are held on Google Meet, and the invites come from that Google account.

What we send to OpenAI, and why:

• Talent profiles: Name, profile photo, job title, headline, overview, skills, hourly rate, work history, education and portfolio descriptions. AI checks the profile and photo, looks for contact details and suggests improvements. It can also approve or turn down a new profile, and our team can review these decisions. We also send a talent's first name when AI writes the opening line of a feedback email.
• Search and matching: The text of talent profiles and job posts, and what people type into search, so we can match talents with jobs and show the best results.
• Chat messages: What you type in the help chat and the talent finder chat, so the AI can reply.
• Job posts: The details an employer gives our AI job post writer, and the text of job posts, which AI checks for contact details and scams.
• Support messages: The first message of a support ticket, so AI can write its title, and support messages, so our team can see the most common questions.

We remove email addresses from chat and support messages before we send them. We never send your ID photo or selfie to OpenAI.

5.3 For Legal Reasons

• To comply with applicable laws, regulations, or legal processes.
• To respond to lawful requests from government authorities.
• To protect our rights, privacy, safety, or property.
• To enforce our Terms of Service and other agreements.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change and any choices you may have regarding your information.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required by law.

• Active Accounts: We keep your data while your account is open.
• Deleted Accounts: To delete your account, email info@findtalent.ph. Deleting an account takes the profile out of search, takes down any live job posts and marks the account as deleted. It does not erase your data. We keep it, including the ID photo and selfie used for identity checks.
• Hiring Interests: We keep the record of the kinds of talent you look for like the rest of your account, including after the account is deleted. Once an account is deleted we no longer use it for marketing, and our team no longer sees it in our reports.
• Transaction Records: Financial records are retained for 7 years to comply with tax and accounting regulations.
• Legal Claims: Data may be retained longer if necessary for pending legal claims or disputes.
• Anonymized Data: Aggregated, anonymized data may be retained indefinitely for analytics purposes.

7. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

7.1 Rights for All Users

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data. Section 6 explains what deleting an account does and what we keep.
• Portability: Request a copy of your data in a portable format.
• Withdraw Consent: Withdraw consent for processing where consent is the legal basis.

7.2 Additional Rights for EEA Users (GDPR)

• Restriction: Request restriction of processing under certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Automated Decision-Making: Right not to be subject to decisions based solely on automated processing.
• Lodge Complaint: Right to lodge a complaint with a supervisory authority.

7.3 Additional Rights for California Residents (CCPA)

• Know: Right to know what personal information is collected and how it is used.
• Delete: Right to request deletion of personal information.
• Opt-Out: Right to opt-out of the sale of personal information (we do not sell personal information).
• Non-Discrimination: Right not to be discriminated against for exercising privacy rights.

7.4 Exercising Your Rights

To exercise any of these rights, email us at info@findtalent.ph. You can also correct your own details in your account settings or on your profile page. We will respond to your request within 30 days (or sooner as required by applicable law). We may need to verify your identity before processing your request.

8. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our platform.

8.1 Types of Cookies We Use

• Necessary Cookies: Keep you signed in and keep the platform secure. These are the only cookies we use without asking you first.
• Analytics Cookies: Help us understand how users interact with our platform (page views, click patterns). Google Analytics loads on every visit with its cookies switched off: until you allow analytics it sets no cookies, we send it no events, and it receives only anonymous signals about your visit. Vercel Analytics and Microsoft Clarity load only after you allow analytics.
• Advertising Cookies: Help us measure our ads on Meta and Google and show them to the right people. They are used only after you allow advertising.
• Attribution and Referral Cookies: Our own cookies that remember which ad or partner link brought you to us, and the role you last searched for before signing up. We set and read them only if you allow advertising, and delete them if you say no. Any set before this policy was updated are kept, but are used only once you allow advertising.

8.2 Managing Cookies

You can change your choices at any time in Cookie settings, which is also linked in the site footer, or through your browser settings. Note that disabling certain cookies may affect platform functionality.

8.3 Session Recording and Heatmaps

With your analytics consent, we use Microsoft Clarity to record anonymised sessions and build heatmaps showing where visitors click and scroll. This helps us find the parts of the platform that are confusing or broken. Recordings are processed by Microsoft under their privacy statement.

Recording does not start until you grant analytics consent. If you withdraw it in Cookie settings, recording stops straight away. Anything you type, email addresses and numbers are masked before they leave your browser. Your account area, messages, contact details and identity verification are masked in full. Recording does not start on sign-in, sign-up, password, messages, admin or ID verification pages, but once it has started on another page it continues when you move to them, and the sign-in and employer sign-up pop-ups can be recorded, with what you type masked. Content on public pages, such as job listings and public profiles, can appear in recordings.

8.4 Do Not Track

Our platform currently does not respond to "Do Not Track" browser signals. However, you can manage tracking preferences through our cookie settings.

9. Data Security

We implement robust security measures to protect your personal information:

• Encryption: All data is encrypted in transit (TLS/SSL) and at rest (AES-256).
• Access Controls: Strict access controls and authentication for employees and systems.
• Security Monitoring: Continuous monitoring for security threats and vulnerabilities.
• Regular Audits: Periodic security audits and penetration testing.
• Incident Response: Established procedures for responding to data breaches.
• Employee Training: Regular security awareness training for all staff.

While we strive to protect your information, no method of transmission or storage is 100% secure. We encourage you to use strong passwords and keep your account credentials confidential.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws.

When we transfer data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Data processing agreements with all third-party service providers.
• Compliance with applicable data transfer frameworks and regulations.

11. Children's Privacy

Our platform is not intended for children under the age of 18. We do not knowingly collect personal information from children under 18.

If we find that a child under 18 has an account, we will delete the account, as described in section 6. If you believe we have collected information from a child under 18, please contact us immediately at info@findtalent.ph.

12. Third-Party Links and Services

Our platform may contain links to third-party websites and services. We are not responsible for the privacy practices of these third parties.

We encourage you to review the privacy policies of any third-party services before providing them with your personal information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy.
• Notify you via email or through the platform.
• Request your consent where required by law.

Your continued use of our platform after the effective date of any changes constitutes acceptance of the updated Privacy Policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For EEA Users: You have the right to lodge a complaint with your local data protection authority if you believe your privacy rights have been violated.

For California Residents: You may also contact the California Attorney General's office for information about your rights under the CCPA.