Privacy Policy
Effective date: July 17, 2026
TalentIDs is a character strengths assessment service available at beta.talentids.com. This policy explains what personal data we collect, how we use it, and what rights you have.
1. Data We Collect
Account data may include: your name; email address (optional for some messenger-only accounts until you add one); a hashed password when you set one; messenger account identifiers (Telegram, Viber); consent records (age 16+ confirmation and acceptance of the Terms of Service and Privacy Policy); test answers and results; preferred language and display theme; optional industry and profession; referral codes; and session or authentication tokens. Cookies: we use two cookies — (1) talentids_lang, a strictly necessary cookie that stores your chosen interface language (set immediately, no consent required); (2) talentids_anon, a functional cookie that stores an anonymous session token so you can take the test without registering (set only after you give consent). We do not use advertising or marketing tracker cookies. When product analytics is enabled, we record first-party operational funnel events on our servers (for example test started or completed) without advertising cookies; we may optionally load a cookieless self-hosted Umami script. These events do not include your email, name, or raw test answers.
2. How We Use Your Data
We use your data exclusively to: operate and personalise the strengths assessment service; display and share your test results; and send transactional email when you request it (verification codes, password-reset links, or results). We do not sell, rent, or share your personal data with third parties for advertising purposes. We do not send marketing emails, newsletters, or promotional campaigns.
3. Authentication Methods
Depending on which integrations are enabled for the deployment, you may create an account or sign in with Google, Facebook Login, LinkedIn, Telegram, Viber, or email and password. We do not offer Sign in with Apple. Sign-in via Google, Facebook, or LinkedIn is processed by those providers under their own privacy policies; we receive only the basic profile information granted by your OAuth consent (typically name and email when available). We store OAuth tokens solely to maintain your authenticated session. Telegram and Viber web sign-in use our private bots with opaque one-time tokens — we do not put personal data in public deep links. You may also link messengers later from your cabinet using a private link code.
4. Email Communications
Email is used for transactional messages only: verification codes sent on your request from account settings (a soft reminder that does not restrict access to core features such as the cabinet, payments, or sending results); secure one-time password-reset links for accounts that have a password; and test results when you ask us to email them. We do not use email for marketing, newsletters, or promotional mailings.
5. Anti-Abuse Measures
To protect the service from bots and abuse we may use Cloudflare Turnstile (a privacy-friendly challenge) and rate limits on registration, login, password reset, email verification, and related endpoints. Full challenge tokens, reset tokens, and verification codes are not logged.
6. Data Retention
Account data is retained for as long as your account is active. When you request deletion (right to be forgotten) from account settings, all personal identifiers — name, email, password, messenger connections (Telegram, Viber), referral codes, industry and profession data — are immediately and irreversibly removed, and all cross-account connections are severed. Before your messenger account identifiers are removed, a deletion notification is sent to connected bots. Test results and professional assessment data remain in the database as fully anonymous statistical records — they cannot be linked to any identifiable individual. Re-registration creates a completely new account with no connection to previous data.
7. Your Rights (GDPR)
If you are located in the EU/EEA, you have the right to: access the personal data we hold; correct inaccurate data; request erasure of your data (right to be forgotten) — all personal identifiers are irreversibly anonymised, messenger bot connections are terminated with prior notification, and cross-account links are severed; withdraw consent at any time. Data export (right of access) from account settings includes the personal data you provided and test results only for positions you have unlocked. The scoring algorithms, derived rankings, and internal assessment models constitute trade secrets protected under GDPR Art. 15(4) and Recital 63, and are not included in data exports. To exercise these rights, use your account settings or contact us at [email protected].
8. Security
Passwords are stored as bcrypt hashes. All data is transmitted over TLS/HTTPS. OAuth tokens are stored securely and never shared with third parties.
9. Contact
For any privacy-related questions or requests, contact us at: [email protected]