Privacy policy

Draft. Highlighted items are still to be filled in or confirmed by Talent Founders before this page goes live.

What we collect, why, and for how long

Contents

1. Who we are
2. Using the app without an account
3. Your account
4. Cloud save
5. Online races
6. Security logs
7. Why we are allowed to use your data
8. Who else handles your data
9. Where your data is stored
10. How long we keep it
11. How we protect it
12. What we do not do
13. Your rights
14. Deleting your account and data
15. Children
16. Not affiliated with Thomas International
17. Changes to this policy
18. Contact us

1. Who we are

CareerIntel (the "app") is published by Talent Founders [COMPANY LEGAL FORM], registered at [COMPANY ADDRESS], [COUNTRY], company number [COMPANY NUMBER] ("we", "us").

We are the data controller for the personal data described in this policy. For any privacy question or request, email privacy@talentfounders.com [confirm address].

This policy covers the CareerIntel apps for iPhone, iPad and Android and the server that powers accounts, cloud save and online races.

2. Using the app without an account

You can practise without creating an account. In that case your practice sessions, scores, settings, respect points, rank, awards and daily objective streak are stored only on your device. Nothing is sent to us or to anyone else, and we cannot see it.

This data stays on your device until you delete the app or clear its data. The app does not ask for access to your contacts, location, camera, microphone or photos.

3. Your account

An account is optional. You need one only if you want cloud save or online races. You can sign in in three ways:

• Email code: you enter your email address and we email you a 6-digit code to type into the app. There is no password.
• Sign in with Apple: Apple tells us an account identifier and an email address. If you choose "Hide My Email", Apple gives us a private relay address that forwards to you, and we never see your real address.
• Sign in with Google: Google tells us an account identifier and your email address.

We never receive your Apple or Google password. Apple and Google are only involved if you choose to sign in with them.

For your account we store:

• your email address (or Apple private relay address);
• your Apple or Google account identifier, if you signed in that way;
• the player name you choose. Other players see it in online races, so we suggest a nickname rather than your full name;
• sign-in session tokens, which keep you signed in. We store them only in hashed form, so they cannot be read back from our database;
• the date your account was created.

Sign-in codes are emailed to you through an email delivery provider (see section 8). We use your email address only to sign you in and, if needed, to answer you about your account or a privacy request. We do not send marketing emails.

4. Cloud save

When you are signed in, the app saves your progress to our server so you can keep it if you change or lose your device, and use it on several devices. Cloud save contains:

• finished practice sessions: the section, mode, difficulty level, date, score, and for each question your answer, whether it was correct and how long you took;
• your game profile: respect points, awards, and the days you practised (your streak).

These results are practice data only. We use them to show you your history, progress and coaching in the app. We never send them to employers, recruiters or test publishers.

5. Online races

A signed-in player can host a race and invite friends with a 5-letter code. Everyone in the race gets the same questions at the same time. To make this work, our server stores:

• the race code and settings (section, difficulty level, duration, who is host);
• for each player: their player name and live progress (questions answered, correct answers, score, and whether they have finished).

Other players in the same race can see your player name and live progress. That is the point of a race, so only join races with people you are happy to share this with. Your email address is never shown to other players.

Race rooms, including every player's progress in them, are deleted automatically after 24 hours. If you are signed in, your own result of the race is also kept in your cloud save like any other session.

If you share a race code using your device's copy or share function, the app you choose (for example a messaging app) handles that message under its own terms. We do not receive your contacts or messages.

6. Security logs

Like almost every online service, our server records technical information about requests it receives: IP address, date and time, the part of the service requested, and basic device and app information sent with the request. We use these logs to keep the service secure and to prevent abuse, for example to limit how many sign-in codes can be requested for an email address or from one network. Logs are deleted after 14 days.

7. Why we are allowed to use your data

Under the EU General Data Protection Regulation (GDPR) we rely on the following legal bases:

• Performance of a contract (Article 6(1)(b) GDPR): creating and running your account, sending sign-in codes, cloud save and sync, and online races. Without this data we cannot provide these features. You can still use the app without an account.
• Legitimate interests (Article 6(1)(f) GDPR): security logs, abuse prevention and backups. Our interest is keeping the service secure, available and free from abuse. We keep this data for a short time and use it for nothing else. You can object to this use (see section 13).

We do not use automated decision-making that has legal or similarly significant effects on you. Scores and coach tips are calculated automatically only to help you practise.

8. Who else handles your data

We do not sell or rent your data, and we do not share it with advertisers or data brokers. Your data is handled only by:

• Hetzner Online GmbH (Germany): hosts our server, database and encrypted backups in data centres in Germany. Hetzner acts as our processor under a data processing agreement and may not use the data for its own purposes.
• [EMAIL PROVIDER] ([EMAIL PROVIDER LOCATION]): delivers sign-in code emails. It receives your email address and the email content, acts as our processor under a data processing agreement, and keeps delivery logs for [EMAIL PROVIDER LOG RETENTION].
• Apple or Google, only if you choose to sign in with them. They handle the sign-in under their own privacy policies (Apple, Google).
• Other players in the same online race, who see your player name and live progress (see section 5).
• Authorities, only if the law requires us to disclose data, and only what is required.

9. Where your data is stored

Our server, database and backups are located in the European Union, in Hetzner data centres in Germany. We do not transfer your data outside the European Economic Area ourselves.

If our email delivery provider processes data outside the EEA, the transfer is protected by an adequacy decision or by the European Commission's Standard Contractual Clauses [confirm once the email provider is chosen]. When you sign in with Apple or Google, they may process your data in other countries under their own safeguards.

10. How long we keep it

• Data on your device: until you delete the app or its data.
• Account and cloud save: until you delete your account. If you do not sign in for 24 months [confirm], we delete your account and its cloud data automatically.
• Race rooms: deleted automatically after 24 hours.
• Server logs: 14 days.
• Backups: 14 days. Data you delete disappears from our backups within 14 days.

11. How we protect it

• Connections between the app and our server are encrypted (HTTPS) [confirm].
• Session tokens are stored only in hashed form.
• Backups are encrypted.
• Access to the server is limited to the people at Talent Founders who need it to run the service.
• Sign-in codes are rate-limited to prevent abuse.

No system is perfectly secure. If a breach ever puts your data at risk, we will notify the supervisory authority and, where required, you, as the GDPR requires.

12. What we do not do

• No advertising, and no advertising identifiers.
• No analytics or tracking tools from third parties.
• No tracking of you across other apps or websites.
• No selling or renting of personal data.
• No profiling for marketing.
• No sharing of your results with employers, recruiters or Thomas International.

13. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy;
• rectify it if it is wrong (you can change your player name in the app at any time);
• erase it (see section 14);
• data portability: receive the data you gave us in a structured, machine-readable format;
• object to our use of your data based on legitimate interests;
• restrict our use of your data in certain cases;
• complain to a data protection supervisory authority.

To use any of these rights, email privacy@talentfounders.com from the email address linked to your account (so we can check it is you). We answer within one month. It is free.

Our lead supervisory authority is the Commission Nationale de l'Informatique et des Libertés (CNIL), France, www.cnil.fr [confirm once the company's country is confirmed]. You can also complain to the authority in the EU country where you live or work.

14. Deleting your account and data

In the app: open Account, scroll to Danger zone and tap Delete my account. Your account and all its cloud data (email address, provider identifier, player name, session tokens, cloud-saved sessions and game profile) are deleted immediately. Race rooms, including your progress in them, are deleted automatically within 24 hours in any case. Copies in our backups disappear within 14 days.

Without the app: email privacy@talentfounders.com from the email address linked to your account with the subject "Delete my CareerIntel account". We will delete the same data within one month, usually much sooner, and confirm by email.

On your device: practice data stored on your device is not affected by deleting your account. It stays there until you delete the app or clear its data.

If you signed in with Apple, you can also stop using Sign in with Apple for CareerIntel in your Apple ID settings. If you signed in with Google, you can remove access in your Google Account settings.

15. Children

CareerIntel is designed for adults and older teenagers preparing for job and education assessments. It is not directed at children under 16, and children under 16 should not create an account. Without an account, the app sends us no personal data at all.

If you believe a child under 16 has created an account, contact us and we will delete it.

16. Not affiliated with Thomas International

CareerIntel is an independent practice app. It is not affiliated with, endorsed by or sponsored by Thomas International. "GIA" and "Thomas" are trademarks of Thomas International and are used only to describe what the app helps you practise. The questions in the app are original practice items, not real test content. We never share any data with Thomas International.

17. Changes to this policy

If we change how we handle your data, we will update this page and the "Last updated" date. If a change is significant, for example a new type of data or a new recipient, we will tell you in the app before it applies.

18. Contact us

Talent Founders [COMPANY LEGAL FORM]
[COMPANY ADDRESS], [COUNTRY]
Email: privacy@talentfounders.com [confirm]

See also our terms of use.