Introduction

TalentCafe ("we," "our," or "us") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our career coaching platform and services.

Information We Collect

Personal Information You Provide

Account Information: Name, email address, password, and profile details
Professional Information: Resume, work history, skills, career goals, and preferences
Payment Information: Credit card details and billing information (processed securely through Stripe)
Communication Data: Messages with coaches, support tickets, and feedback
Assessment Data: Results from career assessments and AI-generated insights

Automatically Collected Information

Usage Data: Pages viewed, features used, time spent on platform
Device Information: Browser type, operating system, IP address
Cookies and Tracking: Session cookies needed to keep you signed in, and — on our public marketing pages only — analytics cookies you can refuse. See “Cookies, Analytics, and Tracking Technologies” below.

How We Use Your Information

We use your personal information to:

Provide personalized career coaching and AI-powered recommendations
Match you with suitable coaches based on your goals and background
Process payments and manage your subscription
Communicate with you about your account and our services
Improve our platform and develop new features
Ensure security and prevent fraud
Comply with legal obligations

AI and Machine Learning

Our AI systems analyze your professional information to provide personalized coaching recommendations. This includes:

Career path analysis and goal setting
Coach matching algorithms
Skill gap identification and development planning
Market trend analysis and opportunity identification

All AI processing is designed to benefit your career development while maintaining your privacy and data security.

Cookies, Analytics, and Tracking Technologies

What We Use

Essential cookies — required to keep you signed in and to keep the service secure. These cannot be turned off, because the service does not work without them.
Google Analytics 4 — measures how our public marketing pages are used.
Meta (Facebook) SDK — measures whether visits to our marketing pages came from our advertising.

Where We Do Not Use Them

Google Analytics and the Meta SDK are loaded only on our public marketing pages. They are not loaded on any page you reach after signing in, on any page that displays client records, session notes, invoices, or contracts, or on any page reached through a private link we emailed you. This is enforced in our code by an allow list of public pages, so pages added in future are excluded unless they are explicitly listed as public.

Where a page address contains an identifier — such as a client, session, or document reference — that identifier is removed before any measurement tool sees the address.

Your Choices

You can accept or reject analytics and advertising cookies when you first visit, and you can change your answer at any time using the Cookie Preferences link in the footer of any page. Rejecting them does not reduce your access to the service.

If you are in the European Economic Area, the United Kingdom, or Switzerland, analytics and advertising storage stay switched off until you accept. We do not use Google Analytics for advertising personalisation anywhere.

Practice Websites

Practices that publish a website through TalentCafe may connect their own Google Analytics property to that website. Where they do, that practice — not TalentCafe — controls that data, and it is collected under their own Google account. The Cookie Preferences choice above applies to those tags too.

Connected Email Accounts (Gmail and Outlook)

Providers on TalentCafe may optionally connect a personal email account — Google (Gmail) or Microsoft (Outlook / Microsoft 365) — so that their email conversations with clients appear in their private client timeline. This feature is entirely opt-in: we access a mailbox only after you explicitly grant permission through Google's or Microsoft's consent screen, and you can disconnect at any time.

What We Access

Account identity: the email address and account identifier of the mailbox you connect
Email messages (read-only): message headers (sender, recipients, subject, date) and message content from the connected mailbox, via the Google Gmail API (gmail.readonly) or Microsoft Graph (Mail.Read)
Offline access: a refresh token (offline_access for Microsoft) so synchronization can run periodically without you being signed in
Sending (with your consent): the Microsoft connection requests send permission (Mail.Send) so that messages you compose or approve in TalentCafe can be sent from your own mailbox and appear in your real Sent folder. Automated sending on your behalf occurs only if your practice explicitly enables it for follow-up automation. A future Google connection would request gmail.send under the same rules

How We Use This Data

Connected-mailbox data is used only to provide user-facing features you request:

Displaying your email history with a client on that client's timeline
Matching messages to your client records by correspondent email address
Detecting client replies so automated follow-up sequences pause instead of double-messaging
Assisting you, at your request, with drafting replies (for example, suggesting a draft you review and edit before anything is sent)

We do not use email data for advertising, do not sell it, and do not allow humans to read it except with your explicit permission, when necessary for security or abuse investigation, or to comply with applicable law. We do not use data obtained from Google Workspace APIs or Microsoft Graph to develop, improve, or train generalized artificial intelligence or machine learning models; email content is processed by AI only to provide the specific features described above, on your behalf and at your direction.

How It Is Stored and Who Can See It

OAuth tokens are stored encrypted in a dedicated secrets vault and are never exposed to your browser or to other users
Synced email is private to the account owner by default — practice teammates and administrators cannot see it; administrators can see only that a connection exists and whether it is healthy
If sharing controls are available, sharing a thread with your practice is an explicit, per-thread choice you make, with per-message redaction

Disconnecting and Deleting

You can disconnect a mailbox at any time from your integration settings; disconnecting revokes our access and destroys the stored tokens
When disconnecting, you can also choose to permanently delete all email data synced from that mailbox
You can additionally revoke TalentCafe's access from your Google Account permissions page (myaccount.google.com/permissions) or your Microsoft account settings
Deleting your TalentCafe account removes your connected-mailbox data under our normal retention rules

TalentCafe's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Data Security

We implement robust security measures to protect your information:

Encryption: Data encrypted in transit (TLS 1.3) and at rest (AES-256)
Access Controls: Role-based access with multi-factor authentication
Regular Security Audits: Periodic penetration testing and vulnerability assessments
Secure Infrastructure: Google Cloud Platform with SOC 2 compliance
Data Minimization: We collect and retain only necessary information

Your Rights and Choices

Access and Portability

You can request a copy of your personal information in a machine-readable format.

Correction and Updates

You can update your profile information at any time through your account settings.

Deletion

You can request deletion of your account and personal information. Some data may be retained for legal or legitimate business purposes.

Marketing Communications

You can opt out of marketing emails by clicking the unsubscribe link or contacting us directly.

Analytics and Advertising Cookies

You can reject analytics and advertising cookies, or withdraw consent you previously gave, at any time using the Cookie Preferences link in the footer of any page. Withdrawing is as easy as giving consent and has no effect on your access to the service.

International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your information during such transfers.

Data Retention

We retain your information for as long as your account is active or as needed to provide services. Specific retention periods:

Account Data: Until account deletion + 90 days
Communication Records: 7 years for legal compliance
Payment Records: 7 years for tax and legal requirements
Analytics Data: at most 14 months, which is the longest Google Analytics 4 retains user-level data

Children's Privacy

Our services are not intended for users under 18. We do not knowingly collect personal information from children under 18.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through our platform. Your continued use of our services after such changes constitutes acceptance of the updated policy.

Contact Information

For questions about this Privacy Policy or our data practices, please contact us:

Email: privacy@talentcafe.net
Address: TalentCafe, Inc., Phoenix, AZ
Data Protection Officer: dpo@talentcafe.net

Regional Privacy Rights

For European Union Residents (GDPR)

Under GDPR, you have additional rights including:

Right to be informed about data processing
Right to access your personal data
Right to rectification of inaccurate data
Right to erasure ("right to be forgotten")
Right to restrict processing
Right to data portability
Right to object to processing

For California Residents (CCPA/CPRA)

Under the CCPA as amended by the CPRA, you have the right to:

Know what personal information we collect and how it's used
Request deletion of personal information
Correct inaccurate personal information
Opt out of the sale or sharing of personal information
Non-discrimination for exercising your privacy rights

We do not sell your personal information for money. However, the analytics and advertising tools described above may transmit online identifiers, such as cookie identifiers and IP addresses, to Google and Meta in a way that California law can treat as “sharing” for cross-context behavioural advertising. You can stop this at any time using the Cookie Preferences link in the footer of any page, which serves as our “Do Not Sell or Share My Personal Information” control. These tools are never loaded on pages showing client records or session notes.

This Privacy Policy is part of our Terms of Service and incorporates our commitment to transparency and user privacy.

Privacy Policy