This Privacy Policy explains how Talent & Story ("Talent & Story", "we", "us", "our") handles personal data when you visit or use our website, application, public tools, blog, documentation, and related services (the "Service"). The controller of your personal data is the operator of Talent & Story. You can contact us through our contact form; for privacy requests, select Privacy or data request.
We do not publish a separate company name, postal address, or individual contact details. All privacy requests are handled through the contact form so that we can verify the request and reply through the appropriate channel.
Who we are and what this policy covers
Talent & Story is an online career workspace for building a professional record and generating resumes, cover letters, business cards, application kits, interview preparation, and related documents. The Service also includes public editorial pages, documentation, and browser-based tools.
This policy applies when you browse the Service, create an account, use the workspace, contact us, or subscribe to a paid plan. It does not apply to third-party websites or services that we do not control.
The Service is intended for people aged 16 or over. It is not directed to children, and we do not knowingly collect personal data from anyone under 16.
Information we collect
- Account and profile data — your email address, password hash, account status, sessions, name, profile photo, headline, bio, and preferences.
- Career content — resumes and versions, cover letters, business cards, achievements and stories, job applications, application kits, offer details, interview preparation, notes, tags, collections, and the photos or logos you upload.
- Billing data — your plan, subscription status, billing interval, invoices, and payment status. Payments are processed by Stripe, our payment provider. Card details are handled by Stripe and do not reach our servers.
- Communications — the name, email address, topic, and message you submit through the contact form, and our support correspondence.
- Usage and technical data — page and feature events, language, IP address, device and browser information, security and rate-limit logs, cookie choices, and, where applicable, first-touch acquisition source and UTM parameters.
- Derived data — completion, ATS, match, strength, readiness, and similar scores generated from your content.
Our public analysis tools process your text in your browser. We do not use your content to train AI models, and the product does not send your documents to a third-party AI service.
How we use information
We use personal data to provide and secure the Service, store and synchronise your records, generate exports, enforce plan limits, process payments and taxes, respond to support and privacy requests, prevent abuse, understand aggregate usage, and comply with the law.
Where the GDPR or UK GDPR applies, we rely on:
- performance of a contract — to provide the Service you request;
- legitimate interests — to secure the Service, prevent abuse, support users, and improve the product;
- consent — for optional analytics, advertising where introduced, and product emails; and
- legal obligation — for tax, accounting, and legal records.
We do not use your personal data for automated decisions that produce legal or similarly significant effects. Our scores and suggestions are informational.
Cookies and analytics
We use cookies and local storage to keep you signed in, secure your account, remember preferences, and, with your consent, measure aggregate usage through Google Analytics 4. Analytics loads only after you consent, and we do not send your resume, cover-letter, or other account content to Google. You can change your choices at any time through the footer Manage preferences control. See our Cookie Policy.
We do not currently display advertising in the Service or on the pages where you create content.
Sharing
We do not sell your personal data for money and we do not share it with third parties for their own direct marketing. We share data only with service providers that help us run the Service — for hosting, authentication, database and file storage, payments, analytics, email, and contact-form delivery — under contracts that limit their use of the data.
We may also disclose data to professional advisers, authorities, or courts where required by law, to protect rights or safety, to investigate abuse, or as part of a merger, acquisition, or transfer of the Service. We may share aggregated or de-identified information that cannot reasonably identify you.
International transfers
Our providers may process data outside your country, including outside the EEA and the UK. Where required, we rely on appropriate safeguards such as the Standard Contractual Clauses, the UK International Data Transfer Addendum, an adequacy decision, or another lawful transfer mechanism.
Retention
We keep personal data only as long as needed for the purposes in this policy.
- Account and career content — while your account is active. After deletion, we aim to permanently delete non-billing data within 30 days, subject to backups and legal retention.
- Billing records — up to 10 years after account closure where required by tax and accounting law.
- Logs and analytics — for a limited period for security, troubleshooting, and aggregate reporting.
- Backups — a rolling provider-managed period until overwritten.
Your rights
If you are in the EEA, the UK, or Switzerland, you may have the right to access, correct, delete, restrict, or object to processing, receive a portable copy of your data, withdraw consent, and complain to your local data-protection authority. You can download a copy of your account data and delete your account from your settings, or use our contact form for other requests. We may verify your identity and normally respond within one month.
If you are in the United States, your state may give you the right to know, access, correct, or delete personal data, opt out of sale or sharing for targeted advertising, limit certain sensitive data, and be free from discrimination for exercising your rights. We do not sell personal data. Where advertising is introduced, you can opt out through the consent tool or a Global Privacy Control signal. Use our contact form to exercise a right; we may verify your request and, where applicable, explain how to appeal a refusal.
Security
We use access controls, row-level security, authentication, HTTPS, and restricted production access to protect your data. No system is perfectly secure, and we cannot guarantee that unauthorised access or loss will never occur. If a security incident requires notification by law, we will notify you and the relevant authorities.
Children
The Service is intended for people aged 16 or over. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us so we can delete it.
Changes to this policy
We may update this policy as the Service or the law changes. The "last updated" date shows when it was revised. If a change is material, we will provide reasonable notice through the Service or by email where appropriate.
Contact
For privacy questions or requests, use our contact form and select Privacy or data request. You also have the right to complain to your local data-protection authority.