Last updated: October 22, 2026

This Privacy Policy explains how TalentProof.ai (“TalentProof,” “we,” “us,” or “our”) collects, uses and shares personal information when you use talentproof.ai and related applications (the “Service”). TalentProof is a hiring assessment platform: candidates complete a short, job-specific assessment and recruiters get a verified scorecard before the interview. Questions about this Policy? Email privacy@talentproof.ai.

1. What We Collect

We collect information you provide or that is generated through your use of the Service, including:

• Account details: Name, email address, and authentication credentials (via Google Sign-In or email).
• Profile information: Public profile handle, verified skills, and career-related data you provide.
• Resumes and job-related inputs: Resume text, job descriptions, and related content you upload or paste.
• Assessment data: Responses, scorecards, practice and job-practice runs, job-match analyses, and session-integrity events (such as proctoring signals when enabled).
• WorkProof (optional): If you connect GitHub or generate a WorkProof profile, we store an encrypted GitHub access token, a cached snapshot of GitHub activity we fetch with that token (for example repositories, languages, and recent events/PR metadata), and an AI-generated "WorkProof" graph on your account (skill clusters, a short public summary, growth-edge text, and which sources contributed). We also store your WorkProof visibility preferences and your private-repo-signal opt-in setting in the dashboard.
• Device and usage data: IP address (stored as a one-way hash for rate limiting and abuse prevention), user-agent string, and approximate location derived from network headers (country, city, region).
• Photos, ID images and recordings: Profile photos captured during assessments; a photo of your ID document and a selfie when an employer requires ID verification; and video and audio recordings of your answers when an assessment asks for them. See section 5.
• Identity-check results: When an employer runs an identity check on your application, the result returned by our third-party identity-verification providers. See Identity verification.

If you use the Service as a guest (without creating an account), we still collect assessment responses, approximate location, and device data associated with your session.

Google user data

You can sign in to TalentProof with your Google account (Google Sign-In). We use Google Sign-In only to authenticate you. This section explains what we receive from Google and how we handle it.

• What we receive: when you sign in with Google, we request only the basic sign-in scopes (openid, email and profile). Google shares your name, email address, profile picture and Google account ID with us. We do not request access to your Gmail, Google Calendar, Google Drive, contacts or any other Google data, and we receive nothing else unless you choose to grant it.
• How we use it: to create and secure your TalentProof account, to identify you when you sign in, and to contact you about your account and the roles you apply to or manage.
• What we never do with it: we do not sell Google user data, we do not use it for advertising, and we do not use it to train generalized AI models.
• Sharing: we share Google user data only with service providers needed to run the Service (such as Google Cloud and Firebase for hosting, authentication and storage), under confidentiality and data processing terms, or when required by law.
• Storage and protection: Google user data is stored in our Google Cloud and Firebase infrastructure, encrypted in transit and at rest, with personally identifiable fields encrypted with AES-256 (see Encryption & Security). Access is limited to the systems and staff that need it to operate the Service. We keep it only as long as needed, and delete it on request.
• Revoking access and deletion: you can revoke TalentProof's access at any time from your Google Account permissions page. To delete the Google data we hold, or your whole account, email privacy@talentproof.ai.

TalentProof's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

WorkProof and GitHub

WorkProof is an optional layer that combines your TalentProof assessment signal with optional GitHub data to produce a structured, shareable view on your public profile. Connecting GitHub uses OAuth: you authorize access on GitHub's site; we receive an access token and store it encrypted at rest. We use that token only to request GitHub data needed to refresh your WorkProof snapshot and do not post or modify content on GitHub on your behalf. Private-repo metadata is used only when you explicitly opt in via the dashboard setting.

GitHub's collection and use of data when you use their login and API is governed by GitHub's Privacy Statement. You can disconnect GitHub by contacting privacy@talentproof.ai or requesting account deletion; we will revoke stored tokens and remove associated connector data as part of your deletion workflow.

2. Browser Extension

If you install the TalentProof browser extension (for example from the Chrome Web Store), it connects to the same Service and account as the website. The extension may run on supported job sites (such as LinkedIn and certain applicant-tracking domains) to show job-fit and profile features and to open TalentProof when you choose.

• Local storage:The extension stores a short-lived sign-in token and optional UI preferences in your browser's local storage (for example, extension layout on a job page). This data stays on your device unless you use features that call TalentProof servers.
• Network: When you are signed in, the extension communicates with TalentProof APIs (including extension-specific endpoints) to load match and profile information. Requests are sent over HTTPS.
• Clipboard: If you use a copy action inside the extension, text you choose to copy may be placed on your system clipboard so you can paste it elsewhere (for example into an application form). We do not copy anything without your action.
• Third-party pages:Job sites you visit are governed by those sites' own terms and privacy policies. The extension only uses page context as needed to show TalentProof features on supported sites.

We do not sell your personal data. Questions: privacy@talentproof.ai.

3. Cookies & Analytics

We use cookies and similar technologies to operate and improve the Service. You can manage your preferences at any time via the cookie banner or the "Cookie Preferences" link in the footer.

Cookie Inventory

Your Choices

Essential cookies are required for the site to function and cannot be disabled.

Analytics cookies (Google Analytics) are used by default to measure site traffic and product usage. You can opt out at any time via Manage on the cookie banner, or the "Cookie Preferences" link in the footer (turn Analytics off, then Save). See Google's cookie policy for details. Analytics is on until you turn it off; when you turn it off we stop loading Google Analytics and remove its cookies.

Our own usage logs. We also keep first-party logs of how features are used (for example which pages and buttons are used, and when). These are stored in our own database. Signed-in activity is linked to your account. For visitors who are not signed in, we link activity to the random tp_anon_id only while analytics is on. We also keep daily totals of how many visitors turn analytics on or off, with no visitor ID attached.

Marketing emails (including open/click tracking in those emails) apply when we already have your address, from an account or from outreach. That is not a cookie-banner choice. Signed-in users can change Email Preferences in account settings. Anyone can opt out via the unsubscribe link in each email.

We use Google reCAPTCHA Enterprise on certain pages to protect against automated abuse. reCAPTCHA may collect hardware and software information; see Google's Privacy Policy.

4. How We Use Data

We use data to operate and improve the Service, generate AI-powered scorecards and career recommendations, support recruiter-candidate workflows, track profile views (location-level analytics visible to profile owners), prevent abuse, communicate with you, and comply with law. Recruiters are notified about a recruiter-led assessment only after you explicitly submit your scorecard. If you use WorkProof, we also process assessment and (if connected) GitHub snapshot data to generate and refresh your WorkProof graph and to show an appropriate public summary on your profile according to your settings.

Practice runs are processed to provide feedback to you and may be labeled or excluded from recruiter pipelines when marked as practice. They should not be relied on as verified hiring records unless clearly submitted to a live role.

Recruiter-facing outputs (job match, resume flags, integrity signals, scorecards) are provided to help humans review candidates. TalentProof does not make employment decisions on behalf of recruiters or employers.

Integrity & session signals

When proctoring or integrity features are enabled, we may store session events (for example tab visibility, copy-paste patterns, timing, enrollment or periodic face-presence checks performed on your device, and related metadata). Face comparison for in-session identity re-checks runs in your browser; we do not store facial templates from those re-checks on our servers. ID verification and recordings work differently; see section 5. Authorized recruiters may see summarized integrity signals on scorecards. These signals are informational and are not, by themselves, determinations of misconduct.

Identity verification by a third-party provider

Some employers turn on identity checks for their jobs. If you apply to one of those jobs, a member of the hiring team can choose to run one check for your application. To do that, we share the information you submitted with that application with a third-party provider we use to perform identity checks: your name, email address, phone number (if you gave one), location, the links you provided (such as LinkedIn, GitHub, a portfolio or personal website), and your resume and profile details (headline or summary, employers and job titles, education, and skills). The provider uses this to look exclusively at publicly accessible professional sources (for example company websites, professional networking profiles, public registries, publications, and code hosting sites) and tell us whether they consistently describe you; it does not access private or restricted-access accounts, personal consumer financial or health records, or non-public databases. We do not share your assessment answers, scores, recordings, or proctoring data for this purpose.

The result (a confidence score, the sources found, and any questions to clarify) is shown only to the hiring team for that job. You will not see it in the product, and it is not shown on shared or public scorecards. Because public third-party sources can be incomplete, out of date, or refer to another person with a similar name, the result is a probabilistic signal for the hiring team to verify with you—not proof, and not a consumer report. It is never used to reject you automatically or produce automated legal effects, and TalentProof does not make hiring decisions. If something in a check is wrong, you can tell the hiring team or contact us at privacy@talentproof.ai, and we will help correct the record.

We keep identity-check results only as long as reasonably needed for the hiring purpose and our legal obligations, then delete or de-identify them. You can ask us to delete them at any time by emailing privacy@talentproof.ai, and we act on requests within a reasonable time. Our identity-verification providers process the information only to run the check for us, and are required to delete it once the check is done, except where the law requires them to keep it.

5. Camera, Microphone, ID Images & Recordings

We only turn on your camera or microphone after you allow it in your browser, and we tell you on screen before we capture anything.

Face-presence checks

During proctored assessments we may check that a face is in view. That check runs in your browser. We do not send those frames to our servers. A profile photo, if the assessment takes one, is stored in our cloud storage with your session.

ID document and selfie verification

Some employers require ID verification for a role. If so, we ask you to take a photo of a government ID and a selfie holding that ID, and we ask for your consent first. We send both images to our servers, where our AI service providers compare the face on the ID with your selfie and check that the ID looks genuine. We store the images encrypted.

• Who sees it: the hiring team for that role sees the result (Pass, Fail or Pending) and small thumbnails of the images. We do not show it on public or shared scorecards.
• How long we keep it: only as long as reasonably needed for the hiring purpose and our legal obligations, then we delete or de-identify the images. If you are signed in, a passing check may stay on your account for a period so you can reuse it for other roles. You can ask us to delete them at any time by emailing privacy@talentproof.ai, and we act on requests within a reasonable time.
• Your choice: you can decline. The employer may then treat ID verification as incomplete for that role.

Video and audio recordings

Some assessments ask you to answer on video, or record your screen, camera and microphone while you work. When they do, we upload and store the recording in our cloud storage. We use AI service providers to transcribe it and to review it for integrity, for example signs that the voice does not match the person on camera, that answers are being read aloud or played back, that another person is speaking, or that the audio or video may be synthetic. These checks feed the Session Confidence signal on your scorecard. They are prompts for a human to review and never reject you on their own.

We may share recordings with third-party providers that help us check whether a recording shows a real, live person (liveness and deepfake detection). They process recordings only to return results to us, may not use them to train their models or for any other purpose, and are required to delete them once the check is done, except where the law requires them to keep them. Liveness, voice, and deepfake checks are statistical—a result is a signal, not proof, and can be affected by short clips, background noise, compression, lighting, microphone or camera quality, accents, speech differences, or assistive technology.

• Who sees it: you, and the hiring team for the role you submitted to. Recordings are not shown on public scorecards.
• How long we keep it: only as long as reasonably needed for the hiring purpose and our legal obligations, then we delete or de-identify recordings. You can ask us to delete them at any time by emailing privacy@talentproof.ai, and we act on requests within a reasonable time.
• Dictation: if you dictate a text answer, we keep the text, not the audio.

Biometric information notice (U.S.)

Comparing the face on your ID with your selfie, and checking recordings for integrity, can involve biometric information under some state laws (including Illinois, Texas and Washington). This section is our written notice and policy:

• Purpose: to confirm that the person taking the assessment is the person applying, and to support the integrity of the assessment. Nothing else.
• Consent: we ask for your consent on screen before we capture ID images, selfies or recordings. That consent covers processing by us and by the service providers named by type in this section, including third-party providers that help us check whether a recording shows a real, live person (liveness and deepfake detection). You can say no.
• No sale: we do not sell, lease, trade or otherwise profit from biometric information. We share it only with the service providers who process it for us (including third-party providers that help us check whether a recording shows a real, live person (liveness and deepfake detection), which process recordings only to return results to us, may not use them to train their models or for any other purpose, and are required to delete them once the check is done, except where the law requires them to keep them), the hiring team for your role, or where the law requires.
• Retention and destruction: we keep biometric information only as long as reasonably needed for the purpose above and our legal obligations. We permanently destroy it when that purpose has been met, and in any case within three years of your last interaction with us. You can ask us to delete it at any time by emailing privacy@talentproof.ai, and we act on requests within a reasonable time.
• Security: we store it encrypted in private storage, process any derived numerical face or voice representations in isolated environments solely to return the verification or integrity result, and protect it at least as carefully as our other sensitive data.

6. Encryption & Security

We encrypt personally identifiable information (such as names, emails, resume text, and locations) with AES-256 encryption before storing it. AI-generated outputs use placeholders (e.g., [CANDIDATE_NAME]) instead of real names; actual names are injected server-side only at display time. We use industry-standard controls and reputable cloud providers. No method is 100% secure, but we continuously improve safeguards.

7. AI Processing & Data Usage

We use third-party AI providers (such as Google Cloud Vertex AI or Google AI with an API key in development) to generate insights, scorecards, career recommendations, practice interview conversations, and optional WorkProof summaries and skill clusters from the inputs described in this Policy. Your data is processed to deliver these features.

• Personalization: If enabled, we use your resume and verified skills to provide tailored advice. You can control this in your settings.
• Training: We do not use your personal data to train our public AI models unless you explicitly opt-in to help improve TalentProof.
• No Sale: We do not sell your personal data to third parties.

8. Retention

In general, we keep personal information only as long as needed, and delete it on request. The one stated maximum applies to biometric information only: we destroy it within three years of your last interaction with us.

Draft recruiter-led assessments may be automatically deleted after a period of inactivity. Practice runs may be retained for your records but are excluded from recruiter-facing workflows when marked as practice. Submitted scorecards and application artifacts are retained to support recruiter workflows, unless you delete them or request account deletion, subject to legal obligations. WorkProof data, GitHub connector records, and cached GitHub snapshots are retained until you disconnect GitHub, delete the associated data, or delete your account, except where we must retain minimal records to meet legal obligations.

Identity-check results are stored with the application they relate to and are visible only to that job's hiring team.

We keep identity-check results, ID and selfie images, and video and audio recordings only as long as reasonably needed for the hiring purpose and our legal obligations, then delete or de-identify them. Biometric information is always destroyed within three years of your last interaction with us. You can ask us to delete any of it at any time by emailing privacy@talentproof.ai, and we act on requests within a reasonable time. See section 5.

9. Sharing

We share your scorecards and application materials with recruiters for jobs you submit to (where the hiring company acts as an independent controller for its own hiring decisions), and with sub-processors and service providers (cloud, email, AI, geocoding, identity verification, liveness and deepfake detection, and payments) who process data on our behalf under written confidentiality and data-protection obligations. If you make a scorecard or profile public, it is accessible to anyone with the link. If you enable WorkProof and set your visibility to allow public display, visitors to your public profile URL may see your WorkProof summary and high-level skill clusters as described in this Policy; we do not expose your GitHub access token or raw private repository contents on the public page.

Panelists and feedback links. When a recruiter invites interview panelists, we share the minimum information needed for that round (for example candidate context configured by the recruiter and the feedback form) with panelists who access the Service via invite links. Recruiters control who is invited.

Recruiter uploads. If a recruiter uploads your resume or invites you before you create an account, they represent they have a lawful basis to provide that data to us for the stated job.

Identity-verification providers. For employers that turn on identity checks, we share the information you submitted with an application (resume, profile details, links, and contact information) with third-party providers we use to perform identity checks, so they can check public professional sources and help confirm your identity. See Identity verification by a third-party provider.

Liveness and authenticity providers. We may share recordings with third-party providers that help us check whether a recording shows a real, live person (liveness and deepfake detection). They process recordings only to return results to us, may not use them to train their models or for any other purpose, and are required to delete them once the check is done, except where the law requires them to keep them. See Video and audio recordings.

When you connect GitHub, GitHub processes your authorization as a separate controller under their policies. We do not sell personal data.

10. Public Profiles & Scorecards

You may create a public profile at a custom handle (e.g., talentproof.ai/p/yourname). Public profiles display your name, verified skills, scores, and professional archetype. If you generate WorkProof, the same public page may also show a short AI-written summary, skill-cluster summaries derived from your assessments and optional GitHub activity, and badges indicating which sources contributed (such as TalentProof assessments and GitHub). Deeper or citation-level detail may be limited or withheld based on your WorkProof consent settings and product configuration. Profile view analytics (viewer country, city, and approximate coordinates) are collected and shown to you. You can toggle scorecard visibility between public and private where available.

11. Data Ownership & Portability

Candidate-Owned Data. Your personal profile, resume, assessment responses, skill verifications, scorecards, career copilot conversations, and job-match analyses are your data. You own it. No recruiter, company, or third party acquires ownership of your data by virtue of you applying to a job, accepting an invitation, or completing an assessment on the Service.

Company-Owned Data. Recruiters and companies own the job postings, assessment configurations, evaluation criteria, interview feedback, pipeline decisions, and internal notes they create. They do not own candidate data.

Recruiter Access Is a License, Not Ownership. When you submit an assessment to a recruiter-led job, the recruiter's company may access your scorecard and application materials to evaluate and advance you on that role—including sharing with hiring managers, clients, or an ATS as part of that hiring process, and using in-product download or share features (such as a verified scorecard PDF). That access is a limited, revocable license for hiring purposes only—not a transfer of ownership. Recruiters must not use your data for unrelated marketing, resale, or building unrelated talent pools, and must honor withdrawal or deletion as described below. See our Terms of Service for permitted and prohibited recruiter uses.

Screening & automated filtering. Optional pre-screening or knockout rules are configured by the recruiter per role. Job-match scores and resume flags are advisory unless the recruiter enables auto-reject on rules they configure. TalentProof does not make final hiring decisions for recruiters.

Data Portability. You may request a copy of your personal data at any time by contacting privacy@talentproof.ai. We will provide your data in a commonly used, machine-readable format within 30 days.

Right to Deletion. You may delete your account at any time, which triggers deletion of your profile, assessment sessions, scorecards, proctoring data, identity-check results, WorkProof graphs and related preferences, encrypted GitHub connector tokens and cached GitHub snapshots stored for your account, and associated records. This also revokes any recruiter access to your data. Company-created content (their job postings, their interview feedback) is retained separately as it belongs to the company.

12. Your Choices

You can control public/private visibility of scorecards and profiles, discard drafts before submitting, and request deletion of certain data. You can also ask whether an identity check was run on an application, see what it found, correct it, or ask us to delete it. For data access, correction, or deletion requests, email us at privacy@talentproof.ai or use our Contact form (no account required).

13. Children

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

14. International Transfers

Your data may be processed in the United States or other locations where we and our providers operate. We maintain protections consistent with this policy regardless of where data is processed.

15. U.S. State Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information we hold about you, and to opt out of certain processing (such as targeted advertising or, where applicable, certain analytics). We do not sell personal information for money. To exercise rights, email privacy@talentproof.ai. We will verify requests as required by law. Authorized agents may submit requests with proof of authorization. We will not discriminate against you for exercising privacy rights. California residents may also contact us for information about categories of data collected and disclosed in the preceding 12 months.

Sensitive personal information. ID document images, and biometric information from face matching or recording checks, are sensitive personal information under California law. We use it only to verify identity and support assessment integrity, as described in section 5, and not to infer characteristics about you. We do not sell or share it for advertising.

16. India (Digital Personal Data Protection Act, 2023)

If you are in India, this Policy is our notice to you under the Digital Personal Data Protection Act, 2023. We process your personal data for the purposes described in section 4 (running assessments and scorecards, supporting hiring workflows, identity and integrity checks, security, and communicating with you), based on the consent you give when you sign up, apply or start an assessment, or as the law otherwise allows.

• Withdrawing consent: you can withdraw consent at any time, as easily as you gave it, by emailing us or deleting your account. Withdrawal does not affect processing already done, and some features (such as submitting to a role) may stop working.
• Your rights: you can ask for a summary of the personal data we hold and how we use it, ask us to correct, complete, update or erase it, and nominate another person to exercise your rights if you die or become unable to.
• Grievance Officer: email privacy@talentproof.ai with the subject “Grievance”. We will acknowledge within 7 days and aim to resolve within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
• Transfers outside India: your data may be processed in the United States and other countries where we and our providers operate, except any country the Government of India restricts.
• Children: the Service is not for anyone under 18 in India, and we do not knowingly process their data.

17. Changes

We may update this Policy and will post the latest version at talentproof.ai/privacy. Material changes will be highlighted within the Service.

18. Contact

Questions or requests? Email privacy@talentproof.ai or use the in-app Contact form.