Privacy Policy

TalentRiver AB. Version 1.1. Effective date: 1 November 2026

This policy explains how TalentRiver AB collects, uses and protects personal data in connection with our platform, our website and our sales and marketing.

1. Who we are

TalentRiver AB is a Swedish company that provides a recruitment and talent sourcing platform as a service. Company: TalentRiver AB. Registration number: 559455-0005. Address: C/O SSE Business Lab, Box 6501, 113 83 Stockholm, Sweden. Email: hello@talentriver.ai. Privacy contact: Tim Tellqvist, CEO, hello@talentriver.ai.

TalentRiver AB is the data controller for: our database of publicly available professional profiles (section 4); accounts that candidates create directly with TalentRiver (section 3.2); our customers' user accounts, billing and security logs; and our website and marketing.

When a customer uses TalentRiver to manage its own recruitment, for example candidates who apply to the customer's vacancies, candidates the customer imports from our database, and messages the customer exchanges with candidates, the customer is the data controller and TalentRiver AB is the data processor. That processing is governed by our Data Processing Agreement, not by this policy. If you are a candidate in a customer's recruitment process, contact that customer to exercise your rights.

2. Who this policy applies to

• Users of the TalentRiver platform: recruiters, hiring managers and administrators who use the service on behalf of a subscribing organisation

• Candidates who create a TalentRiver account

• People whose publicly available professional information is in TalentRiver's candidate database

• Visitors to talentriver.ai

• Business contacts: people we are in contact with for sales, marketing or partnerships

3. What personal data we collect and why

3.1 Platform users

When you register or are given access to TalentRiver by your organisation, we process your full name, work email address, job title and employer, login credentials (managed through Firebase Authentication), platform usage data (features used, actions taken, session timestamps, and recordings of your sessions in the platform used to improve the product) and your support communications.

Legal basis: performance of the contract with your organisation (Art 6(1)(b)). For usage data and session recordings used to improve the platform, our legitimate interest (Art 6(1)(f)).

3.2 Candidates with a TalentRiver account

You can create an account with TalentRiver and add your CV and profile. When you do, we process the data you give us: name, email address, phone number, your CV, work history, education and skills, your preferences for roles and locations, and your account settings.

By creating an account and adding your profile you ask us to make it searchable for employers and recruitment agencies that use TalentRiver, so that they can find you for open roles. Your profile is then part of our candidate database (section 4) and recruiters at our customers can find it when it matches a search. You can edit or delete your profile at any time in your account; deleting it removes it from the database.

Legal basis: performance of our contract with you (Art 6(1)(b)). Job alerts and other emails from us are opt-in and based on your consent (Art 6(1)(a)), which you can withdraw in your account settings.

When you apply to a customer's vacancy through your account, the customer becomes the controller for your application, and the customer's privacy notice applies to it.

3.3 Website visitors

When you visit talentriver.ai we collect your IP address and approximate location, browser and device information, pages visited, time spent and referral source, and cookie identifiers (section 9).

Legal basis: legitimate interest (Art 6(1)(f)) for security and analytics. Cookies that are not strictly necessary are set only with your consent (Art 6(1)(a)).

3.4 Marketing and business contacts

When we are in contact with prospective customers, partners or event attendees, we process your name, work email address, job title and organisation, and our communication history with you.

Legal basis: legitimate interest (Art 6(1)(f)) in marketing our services to relevant business contacts, and consent (Art 6(1)(a)) where the law requires it. You can opt out at any time by replying to any email or writing to hello@talentriver.ai.

4. Our candidate database

TalentRiver maintains a database of professional profiles built from publicly available information. Recruiters at our customers search it to find people who may fit an open role. This section is our notice to you under Article 14 of the GDPR if your profile is in it.

Where the data comes from. We collect professional information that you have made publicly available, such as on professional networking sites, company websites and public CVs. We collect it directly and through data partners that gather data from such public sources. We do not collect data from private sources, and we do not collect sensitive data such as health, religion, political opinions or union membership from any source.

What data we hold. Name, current and past employers and job titles, education, skills, location, a link to your public profile, and, where publicly available, a work email address or phone number. We may infer professional characteristics, such as seniority or skill area, from this information to make search results more relevant.

Why we process it and on what legal basis. We process this data in our legitimate interest, and that of our customers, in helping employers find suitable candidates for open roles using information those candidates have chosen to make public (Art 6(1)(f)). We have carried out a legitimate interest assessment and will provide a summary on request. The safeguards we apply: professional data only, no sensitive data, no selling of data, no automated decisions about you, and removal on request.

Who receives it. Our customers, which are employers and recruitment agencies that subscribe to TalentRiver, when your profile matches a search they run. A customer that imports your profile into its own recruitment process becomes the controller for that copy, and its own privacy notice applies. We also use the sub-processors in section 7 to run the service.

AI in the database. Our AI features search, sort and summarise large volumes of profiles for the recruiter who runs a search. They help the recruiter decide which profiles to look at. They do not make any decision about you, and no decision with legal or similar effect is taken by automated means.

Why we do not contact you individually. Because the database holds a very large number of profiles collected from public sources, and we have no relationship with the people in it, contacting each person would involve a disproportionate effort (Art 14(5)(b)). We make this notice public instead, and we provide the removal route below. If a customer contacts you about a role, that contact will tell you that your profile was found through TalentRiver.

How long we keep it. We keep a profile for as long as it is necessary for the purpose of helping employers find candidates and while the source information remains public. We remove a profile when you ask us to.

Your rights and how to be removed. You can ask to see, correct or remove your profile, and you can object to this processing, at any time. Write to hello@talentriver.ai, or see talentriver.ai/candidates. We will remove your profile within 30 days and tell customers that hold a copy of it. If you have a TalentRiver account, you can edit or delete your profile there directly.

5. Platform integrations

TalentRiver offers optional integrations that a user can connect to their account. Data from a connected integration is processed on the customer's instruction, and TalentRiver acts as processor for it.

Email integration: when a user connects their own Gmail or Outlook account through OAuth, TalentRiver reads email data (subject, content, sender and recipient addresses, timestamps) and stores only the threads that match a candidate in the customer's account. The user's email provider remains the user's own service provider and is not a sub-processor of TalentRiver. TalentRiver uses this data only to show the relevant threads in the platform, never for advertising or for training models.

Messaging integration: when a user connects a messaging account, TalentRiver processes message history (content, participants, timestamps) on behalf of the customer to support candidate outreach.

People who send or receive messages that appear through these integrations may exercise their rights by contacting the customer.

6. AI features

TalentRiver uses artificial intelligence to search, sort and summarise large volumes of candidate profiles against the criteria a recruiter sets. This happens in the pre-screening phase and helps the recruiter decide which profiles to review. The AI does not make decisions about candidates and is not used to reject anyone. Recruiters make every decision.

Our AI features run on Microsoft Azure OpenAI Service and Google Cloud Vertex AI, both hosted in the EU. Personal data processed by these features is not used to train or improve the models, by TalentRiver or by the providers.

The EU AI Act classifies AI used to evaluate job candidates as high-risk, with obligations that apply from 2 December 2027. We are preparing for them and will update this policy when they apply.

7. Sharing of personal data

We do not sell personal data. We share personal data only with the sub-processors we need to run the service and our business, and only to the extent needed. The current list is also published at talentriver.ai/subprocessors together with a change log.

Platform sub-processors (candidate and user data):

Sales and support tools (customer, prospect and user contact data only, no candidate data):

Where a supplier is outside the EU/EEA, we rely on a European Commission adequacy decision, the EU-US Data Privacy Framework, or Standard Contractual Clauses under Article 46 with a transfer assessment.

8. Data retention

We keep personal data only as long as needed for the purposes in this policy or as the law requires.

When data is no longer needed it is deleted or anonymised. Backups are overwritten within 7 days.

9. Cookies

Our website uses cookies and similar technologies. Strictly necessary cookies are needed for the site to work and require no consent. Analytics cookies (PostHog and Datadog) help us understand how visitors use the site and are set only with your consent. You can change your choice at any time in the cookie banner or your browser settings.

10. Your rights

Under the GDPR you have the right to access your personal data, to have it corrected, to have it erased, to restrict processing, to receive your data in a machine-readable format, to object to processing based on legitimate interest including direct marketing, and to withdraw consent at any time without affecting earlier processing.

To exercise a right, write to hello@talentriver.ai. We respond within one month; for complex requests we may take up to three months and will tell you if so. We may need to verify your identity first. If your request concerns a customer's recruitment process, we will forward it to that customer, who is the controller.

11. Right to complain

If you believe we have not handled your personal data correctly, you can complain to the Swedish supervisory authority: Integritetsskyddsmyndigheten (IMY), www.imy.se, imy@imy.se, +46 8 657 61 00. You can also complain to the authority in the EU country where you live or work.

12. Security

We protect personal data with technical and organisational measures including encryption in transit and at rest, role-based access control, single sign-on and multi-factor authentication for customers, logging of access, and daily encrypted backups stored in the EU. Our Data Processing Agreement describes the measures in detail.

13. Children

Our services are directed at working professionals and employers. We do not knowingly collect data about anyone under 16. If you believe we hold such data, contact us and we will delete it.

14. Changes and contact

We may update this policy. For material changes we notify users by email or a notice in the platform before they take effect. The current version is always at talentriver.ai/privacy.

Questions: hello@talentriver.ai, or TalentRiver AB, C/O SSE Business Lab, Box 6501, 113 83 Stockholm, Sweden.