xTalent

Privacy Policy

Last updated: June 2026

1. Introduction

Welcome to xTalent ("we," "our," or "us"). This Privacy Policy describes how xTalent collects, uses, discloses, and protects your personal information when you use our recruiting platform and related services (the "Service").

We are committed to protecting the privacy and security of all personal data we process, including data of our customers, their candidates, visitors to our website, and data accessed through third-party integrations such as Google.

2. Information We Collect

Account Information: when you create an account, we collect your name, email address, hashed password, organization name, and role. If you sign up via Google OAuth, we receive your name, email, and profile picture from Google.

Candidate Data: customers upload candidate information including resumes, names, email addresses, phone numbers, work history, education, and skills. This data is processed on behalf of customers, who are the data controllers.

Usage Data: we collect information about how you interact with the Service, including pages visited, features used, timestamps, browser type, and IP address.

AI Processing Data: when resumes are parsed by our AI system, extracted text is sent to a third-party AI provider for structuring. We do not send candidate contact information to AI providers for skill extraction tasks. We do not use Google user data for any AI processing or model training (see Section 4).

Communication Data: email communications sent through the platform are processed through our email provider, Resend.

3. Google User Data — What We Access

When you connect your Google account to xTalent (via Google OAuth) to enable Gmail and Google Calendar features, we access the following Google user data, strictly to provide the features you have enabled:

  • Gmail data: with your authorization, we access email messages and metadata related to candidate communications so the Service can sync, display, and associate candidate correspondence within your hiring pipeline.
  • Google Calendar data: with your authorization, we access calendar events, availability, and event metadata so the Service can schedule, display, and manage interviews and related events.
  • Basic profile data: your name, email address, and profile picture, used to identify your account.

We request the minimum scopes necessary to provide these features. You may revoke xTalent's access at any time through your Google Account security settings or within the Service.

4. How We Use Google User Data (Limited Use)

We use Google user data solely to provide and improve user-facing features of the Service — specifically, syncing and displaying candidate email correspondence and scheduling and managing interview events.

xTalent’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We do not use Google user data for serving advertisements of any kind (including targeted, personalized, retargeted, or interest-based advertising).
  • We do not sell, transfer, or disclose Google user data to data brokers, information resellers, or other third parties for advertising or any purpose unrelated to providing the Service.
  • We do not use Google user data to train, develop, or improve generalized or non-personalized artificial intelligence or machine learning models.
  • We do not use Google user data to build or augment databases for purposes other than providing the features you have enabled.
  • Humans do not read Google user data except (a) with your explicit consent for specific messages, (b) where necessary for security purposes such as investigating abuse, (c) to comply with applicable law, or (d) where the data has been aggregated and anonymized and is used for internal operations in accordance with applicable privacy and other laws.

We retain Google user data only to provide the features you have enabled — specifically, to maintain your synced candidate email correspondence and interview calendar history within your hiring workspace. You remain in control of this data and can delete it at any time (see "Data Retention and Deletion").

5. How We Use Other Information

We use other collected information to:

  • Provide and maintain the Service
  • Parse and structure candidate resumes using AI (this does not involve Google user data)
  • Generate vector embeddings for semantic candidate search (this does not involve Google user data)
  • Send transactional emails
  • Improve the Service through aggregated, anonymized usage analytics
  • Ensure security and prevent fraud

6. Data Sharing, Transfer, and Disclosure

We do not sell personal data, and we do not sell, transfer, or disclose Google user data to third parties except as necessary to provide the Service, as described here.

We share data only with:

  • AI providers — for resume parsing and structuring. Google user data is not shared with AI providers.
  • Resend — for transactional email delivery.
  • Infrastructure providers such as Hetzner and Cloudflare — for hosting and storage.
  • When required by law — court order, or governmental regulation.

We do not transfer or disclose your information, including Google user data, to third parties for purposes other than those described in this policy.

7. Data Storage and Security

The Service is hosted on Hetzner Cloud servers in Falkenstein, Germany. All data is stored within the European Union.

PostgreSQL data is encrypted at rest. Backups are performed daily and stored encrypted on Cloudflare R2 in the EU region.

Resumes and attachments are stored in private Cloudflare R2 buckets with server-side encryption and access via time-limited signed URLs.

Google user data accessed through integrations is protected with the same security controls: encryption in transit (TLS 1.2+) and at rest, access restricted to authorized processing, and stored within the EU.

Passwords are hashed with bcrypt, session tokens are cryptographically signed, and OAuth uses OAuth 2.0 / OpenID Connect.

All data in transit is encrypted using TLS 1.2+ and the Service is accessible only via HTTPS.

8. Data Retention and Deletion

Account data is retained for the duration of the account plus 30 days after deletion.

Candidate data is retained while the organization's account is active and is permanently deleted within 30 days after account deletion.

Google user data (Gmail and Calendar): We retain synced Gmail and Calendar data for as long as your Google account remains connected, in order to provide the email-history and interview-scheduling features within your workspace. You are in control of this data:

  • Revoke access at any time through your Google Account security settings or within xTalent. Revoking access stops any further syncing immediately.
  • Delete your synced data at any time. When you disconnect your Google account in xTalent, you can choose to delete all previously synced emails and calendar data at that moment. You may also request deletion of this data at any time by contacting [email protected].
  • On account deletion: when you delete your xTalent account, all associated Google user data is permanently deleted.

If you choose to keep your synced communication history after disconnecting (for example, to preserve a record of candidate correspondence), that data remains stored under the same protections described in this policy and is never used for any purpose other than providing the features described here.

Usage logs are retained for 90 days for security and debugging. Database backups are retained for 7 days on a rolling basis.

You may request deletion of your data at any time by contacting [email protected].

9. Your Rights (GDPR)

If you are in the EEA, you have the right to access, rectify, erase, restrict processing of, port, and object to the processing of your personal data, and to withdraw consent at any time.

To exercise these rights, contact [email protected]. We will respond within 30 days.

10. Candidate Rights

Candidates whose data is stored by our customers can request access to or deletion of their data through the organization that collected it, or contact us directly at [email protected].

11. Cookies

The Service uses essential cookies for authentication and session management. We do not use advertising cookies or third-party tracking cookies.

12. Children's Privacy

The Service is not intended for individuals under 16 years of age. We do not knowingly collect data from children.

13. International Data Transfers

All data is processed and stored within the EU. If you access the Service from outside the EU, your data will be transferred to and processed in Germany, which is subject to EU data protection laws.

14. Changes to This Policy

We may update this Privacy Policy from time to time and will notify users of material changes via email or in-app notification at least 30 days before changes take effect.

15. Contact

For privacy inquiries, email [email protected].