Privacy Policy

This Privacy Policy is published by TalentSpotify Private Limited (CIN: U72900KA2022PTC157845, GST: 29AAJCT1805A1ZN), registered at Sy No. 135/1, No. 87, Ground Floor, Flushing Meadows Layout, Yettakodi, Malur, Kolar, Karnataka, India – 563130 ("TalentSpotify", "we", "us", or "our").

TalentSpotify operates an AI-powered human-resource performance management platform that includes TARA (an AI voice agent for structured performance review conversations), OKR management, recognition, and people analytics.

For personal data processed through our platform on behalf of our business customers, TalentSpotify acts as a Data Processor (or Sub-Processor under GDPR). Our customers — the organisations that subscribe to TalentSpotify — are the Data Fiduciaries / Data Controllers responsible for determining the purpose and means of processing employee personal data.

For personal data we collect directly (website visitors, trial users, marketing contacts), TalentSpotify acts as the Data Fiduciary / Controller.

This policy applies to:

• Visitors to our website at www.talentspotify.com and any related subdomains.
• Trial and prospective customers who submit demo requests, sign up for free trials, or contact our sales team.
• Subscribers — authorised users (employees, managers, HR administrators) of organisations that have purchased a TalentSpotify subscription.
• Data Principals — employees of our customers whose personal data is processed through our platform as part of performance management workflows.

This policy does not cover third-party websites linked from our platform. We encourage you to review the privacy policies of any third-party services you access through links on our site.

We collect and process the following categories of personal data, depending on your relationship with us:

3.1 Data you provide directly

3.2 Data collected automatically

We do not intentionally collect sensitive personal data (such as health information, biometric data, caste, religion, political opinions, or sexual orientation). If such data is incidentally mentioned in a TARA voice review, it is not extracted, stored separately, or used for any purpose other than providing the review summary in the context in which it was shared.

We use personal data only for the purposes for which it was collected or to which you have consented:

• Service delivery: To operate the TalentSpotify platform, including running OKR cycles, performance reviews, TARA conversations, and recognition workflows on behalf of our customers.
• Bias signal analysis: TARA analyses review transcripts to surface potential cognitive, social, and calibration bias signals. This analysis is provided to HR for human review only — it does not make, record, or recommend final employment decisions.
• Account management: To create and manage user accounts, authenticate users, and process subscription billing.
• Customer support: To respond to queries, resolve technical issues, and provide onboarding assistance.
• Security: To detect and prevent fraud, unauthorised access, and security incidents.
• Platform improvement: To analyse aggregated, anonymised usage patterns to improve features and user experience. We do not use identifiable Customer Data to train AI models made available to third parties without explicit written consent.
• Marketing communications: To send product updates, newsletters, and promotional materials to individuals who have opted in. You can unsubscribe at any time.
• Legal compliance: To comply with applicable laws, respond to lawful government requests, and enforce our Terms & Conditions.

Under India's Digital Personal Data Protection Act, 2023 (DPDPA), we rely on the following grounds to process personal data:

• Consent (§7 DPDPA): For TARA voice recordings, marketing emails, and any optional data collection. Consent is obtained before data collection and may be withdrawn at any time.
• Contractual necessity: To deliver the services you or your employer has subscribed to.
• Legitimate uses (§7(f)–(i) DPDPA): For security monitoring, fraud prevention, legal compliance, and aggregated analytics.
• Legal obligation: Where processing is required by applicable Indian law.

GDPR Lawful Bases (EEA/GCC users)

For users located in the European Economic Area or jurisdictions where GDPR applies, we rely on:

• Article 6(1)(b): Performance of a contract — to provide the services your organisation subscribed to.
• Article 6(1)(a): Consent — for optional processing such as marketing communications and voice recordings.
• Article 6(1)(f): Legitimate interests — for security, fraud prevention, and product analytics, where these interests are not overridden by your rights.
• Article 6(1)(c): Legal obligation — where processing is required by EU or member-state law.

Where we rely on consent as the lawful basis for processing, we ensure that consent is:

• Freely given — not bundled with acceptance of terms unrelated to the processing.
• Specific — obtained for a defined purpose, not a blanket permission.
• Informed — provided only after a clear, plain-language description of what data is collected and how it is used.
• Unambiguous — via a positive opt-in action (e.g., checking a box, tapping an on-screen confirmation before a TARA session starts).

TARA Voice Recording Consent

Before any TARA-assisted performance conversation begins, all participants (manager and employee) receive an in-app and/or verbal notification that the conversation will be recorded and analysed by TARA. The session does not commence until all participants have confirmed consent. Participants may withdraw at any time by ending the session — any recording made up to that point is deleted.

Withdrawing Consent

You may withdraw consent at any time by contacting us at contact@talentspotify.com or via the account settings in the platform. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

We do not sell, rent, or share your personal data with third parties for their own marketing or commercial purposes. We share data only in the following circumstances:

• Within your organisation: Authorised HR administrators and managers in your organisation can access data relevant to their role as permitted by your organisation's configuration.
• Sub-processors: We engage trusted third-party service providers to help us deliver the Platform. Each sub-processor is bound by a data processing agreement that requires them to protect data to at least the same standard as this policy.
• Legal requirements: Where required by applicable law, court order, or a lawful government request, we may disclose personal data. We will notify you of such a request where legally permitted.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

Key Sub-Processors

A full list of current sub-processors is available on request at contact@talentspotify.com.

All personal data processed through TalentSpotify is stored on AWS Mumbai (ap-south-1) servers located in India. Data does not leave India unless:

• You have explicitly enabled cross-border features (e.g., GCC entity management).
• Required by a lawful order of a government authority.
• A sub-processor listed above operates infrastructure partially outside India (in which case Standard Contractual Clauses or equivalent safeguards apply).

GDPR Transfers

For customers in the EEA or GCC, transfers of personal data outside those jurisdictions are protected by:

• EU Standard Contractual Clauses (SCCs) for transfers to third countries without an adequacy decision.
• Adequacy decisions where applicable (e.g., transfers to countries with equivalent protection recognised by the European Commission).

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, to comply with legal obligations, or to resolve disputes. Our standard retention schedule is as follows:

On termination of a subscription, Customer Data will be available for export for 30 days. After this period, data is securely deleted or anonymised in accordance with the schedule above.

We implement and maintain technical and organisational security measures appropriate to the risk and nature of the personal data we process:

Despite these measures, no system is completely secure. In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, in accordance with applicable law.

Depending on your location and the applicable law, you may have the following rights over your personal data:

Rights under DPDPA 2023 (India)

Additional Rights under GDPR (EEA / GCC users)

We use cookies and similar technologies on our website and platform. Cookies are small text files placed on your device that help us recognise you and provide a better experience.

You can manage cookie preferences through your browser settings or our cookie banner. Please note that disabling certain cookies may affect the functionality of the platform. For platform (logged-in) users, essential cookies cannot be disabled as they are required for secure authentication.

We use Cloudflare Turnstile for bot protection on our public forms. Cloudflare's privacy practices are governed by Cloudflare's own privacy policy.

The TalentSpotify platform is a B2B enterprise product designed for use by employed adults in a professional context. We do not knowingly collect, process, or solicit personal data from individuals under the age of 18.

If you believe that a person under 18 has provided personal data to us without appropriate parental or guardian consent, please contact us immediately at contact@talentspotify.com. We will take prompt steps to verify and delete such data.

In accordance with the Information Technology Act, 2000 (as amended), the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, we have appointed a Grievance Officer to address complaints related to personal data processing:

If your complaint is not resolved to your satisfaction by our Grievance Officer, you may escalate your complaint to the Data Protection Board of India, once constituted under the DPDPA 2023.

For customers and data subjects in the European Economic Area or jurisdictions where GDPR applies, enquiries related to data protection may be directed to our Data Protection contact:

You also have the right to lodge a complaint with the supervisory authority in your country of residence. In India, the relevant authority is the Data Protection Board of India (once constituted). For EEA users, this is the relevant national Data Protection Authority.

We may update this Privacy Policy from time to time to reflect changes in law, our data practices, or our services. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Send an email notification to all active subscribers at least 30 days before the changes take effect.
• Display a prominent banner on the platform for the notice period.

For changes that reduce your privacy rights, we will seek fresh consent where required by law. Your continued use of the Platform after the effective date of the revised policy constitutes acceptance of the updated terms.

We encourage you to review this policy periodically. Prior versions are available on request.

For any questions, concerns, or requests related to this Privacy Policy or our data processing practices, please contact us:

We aim to respond to all privacy-related enquiries within 5 business days and to resolve requests within 30 days. For complaints that we cannot resolve, you may contact the relevant data protection authority in your jurisdiction.