Legal
Data Processing Agreement
Last updated 13 July 2026
This DPA forms part of the Terms of Service and applies automatically to every account. Organisations that need a countersigned copy can request one.
1. Parties & roles
Processor / Controller: Inkname Studio · Bangladesh, operating Talenthic.
- For account, billing and platform-operations data we act as controller.
- For content you upload to run a task — CV documents, cover letters, application answers — we act as processor on your instructions.
- Opportunity listings scraped from public sources are public business information, not personal data of our members.
2. Subject matter & duration
Processing lasts for as long as your account is active, plus the retention periods in section 6. Purpose: delivering personalised opportunity matching, alerts, CV tooling and Auto Apply.
3. Categories of data & data subjects
- Data subjects: account holders (students, graduates, founders) and any referees named in an uploaded CV.
- Data: identity and contact details, education and employment history, skills, location preferences, CV documents, application records, payment metadata, device/usage telemetry.
- We do not knowingly process special-category data. Do not put health, religious, political or biometric information in your CV.
4. Our obligations
- Process personal data only on documented instructions (your use of the product).
- Bind everyone with access to confidentiality.
- Implement the technical measures in section 5.
- Assist with data-subject requests within 30 days.
- Delete or return data on termination, per section 6.
- Make available the information needed to demonstrate compliance.
5. Security measures
- TLS 1.2+ in transit; AES-256 at rest on the managed database and object storage.
- Row-level security on every member-owned table — access is authorised per row by the signed-in user's identity, not by application code alone.
- Private storage buckets for CVs and receipts; downloads via short-lived signed URLs.
- Least-privilege service credentials, rotated on demand; secrets never in source code.
- Role-separated admin access with a dedicated roles table and audited actions.
- Automated daily backups with point-in-time recovery on the primary database.
- Automated dependency and database security scanning.
6. Retention & deletion
| Data | Retention |
|---|---|
| Account & profile | Until you delete your account |
| CV / resume documents | Until deleted by you, or 12 months after account deletion request completes (0 days — purged immediately) |
| Applications & Auto Apply packs | 24 months, then anonymised |
| Alert & email delivery logs | 12 months |
| Invoices, receipts & ledger entries | 6 years (statutory bookkeeping) |
| Analytics events | 13 months, aggregated after 90 days |
| Server & security logs | 30 days |
You can export everything we hold, or erase your account, yourself from Settings → Privacy. Erasure is immediate and irreversible, except invoices and ledger entries which are retained for statutory bookkeeping in a form detached from your profile.
7. Subprocessors
You give general authorisation for the subprocessors listed on the Subprocessors page (8 today). We give 30 days' notice before adding a new one and remain liable for their performance.
8. AI processing
AI features run on Groq. Content is sent per task, never used to train third-party models, and outputs are labelled as AI-generated. Full detail: AI Disclosure.
9. Breach notification
We notify affected account holders and, where applicable, the relevant authority without undue delay and within 72 hours of becoming aware of a personal-data breach, including what happened, the categories affected, likely consequences and the remedial steps taken.
10. Audit
On reasonable written notice, once per year, we will answer a security questionnaire and provide the artefacts we hold. On-site audits are not offered for a service of this size.
11. Requesting a signed copy
Email inknamestudio@gmail.com with your organisation's details.
