Privatliv

Privacy Policy

Effective date: 14 October 2026

This policy explains how TalentAssisto handles personal data. It is also our personal data processing policy (política de tratamiento de datos personales) under Colombian Law 1581 of 2012 (habeas data) and Decree 1377 of 2013, now part of Decree 1074 of 2015.

1. Who is responsible

Devspeak S.A.S. ("we"), a company incorporated in Colombia with its principal office in Bogotá D.C., operating under the brand DevSpeak Labs, runs TalentAssisto at https://www.talentassisto.com. Contact for privacy requests: info@devspeak.dev.

For the account, billing and usage data of our customers, we are the controller (responsable del tratamiento).
For personal data inside the documents and chats our customers put into TalentAssisto (for example candidates' CVs or employee policies), the customer is the controller and we process that data on its behalf (encargado del tratamiento), only to provide the Service. People named in those documents should contact the organisation that uploaded them; we will help that organisation answer.

2. What we collect and why

Account data: email address, password (stored only as a hash by our sign-in service), display name and optional profile image. Source: you. Purpose: create and secure your account and send account emails.
Workspace data: company and workspace settings, assistants, prompts and folders. Source: you. Purpose: provide the Service.
Uploaded files, their text excerpts and their embeddings (numeric representations used for search). Source: you. Purpose: answer questions from your documents.
Chat messages and AI answers. Source: you and the AI provider. Purpose: provide the chat and keep your history.
Plan, trial and subscription status, and usage counts (AI interactions, web-search interactions and images per billing month or trial). Source: the Service and Dodo Payments. Purpose: enforce plan limits and manage billing.
Checkout, cancellation and withdrawal consent records. Source: you, at checkout. Purpose: legal proof required by automatic-renewal and withdrawal law.
IP address and request metadata. Source: your browser. Purpose: security (sign-in rate limiting, abuse prevention) and error logs.
Page-view statistics (pages viewed, device type, approximate country) without cookies, through Vercel Web Analytics; and Google Analytics data only if you accept analytics cookies (section 7).

We do not sell personal data, we do not use it for advertising, and we do not use your documents or chats to train AI models.

3. Legal bases and authorisation

We process personal data to perform our contract with you (providing the Service you signed up for), to meet legal obligations (billing and consumer-law records), for our legitimate interests (security, abuse prevention and improving the Service with aggregated data) and, for analytics cookies, with your consent. Under Colombian law, by creating an account after reading the notice next to the sign-up button, you give us your prior, express and informed authorisation to process your personal data for the purposes in section 2.

4. Who processes data for us

We share personal data only with the providers below, only for the stated purpose, under their contractual commitments:

Vercel Inc. (United States): hosts the website and its server functions; cookieless page-view statistics.
Amazon Web Services (United States, Ohio region, us-east-2): our own servers there run the database, the sign-in service, file storage, document indexing and backups.
Anthropic PBC (United States): the AI model that answers chats (including the help assistant on our website), and web search during chats on plans that include it.
OpenRouter, Inc. (United States): a backup route to the same AI model when Anthropic is unavailable, used only by the production service; and AI image generation, which OpenRouter currently sends to a Google Gemini image model.
Resend (United States): sends account and service emails (for example sign-up confirmation, password reset and email change).
Dodo Payments: our Merchant of Record. It sells subscriptions and handles checkout, payment, invoicing, taxes and refunds, as an independent controller under its own privacy policy (https://dodopayments.com/legal/privacy-policy). We receive your subscription status and identifiers from it, never your card details.
Cloudflare, Inc. (United States): DNS for our domains. It resolves our domain names; it does not receive the content you send to the Service.
Cloudinary Ltd.: delivers the images and videos on our documentation pages to your browser.
Google LLC (United States): Google Analytics, only if you accept analytics cookies.

AI providers receive your message, the relevant excerpts from your documents and the assistant's instructions, only to produce the answer, and keep API data under their own terms (for example, limited retention for abuse monitoring). Embeddings of your documents are computed on our own servers; no embedding provider receives your document text.

TalentAssisto's code can also connect to other AI providers (OpenAI, Google Gemini, DeepSeek, Cerebras, Together AI) and to Google Programmable Search. The app does not offer them today, and our servers refuse every request addressed to them, so it does not send your data to them. We will update this policy before we start using any of them.

5. International transfers

Our providers process data mainly in the United States. We transfer data to them under contracts that require them to protect it, relying where applicable on the EU–US Data Privacy Framework or on Standard Contractual Clauses, and on the rules for international transfers of the Superintendencia de Industria y Comercio (SIC) in Colombia. By authorising the processing described here, you also authorise these transfers.

6. How long we keep data

Account, workspace, assistants, chats and files: while your account exists. Deleting your account (Settings → Advanced Settings → Delete account) erases them, including the stored files. Copies in our backups are deleted when those backups expire, within 30 days.
Checkout, cancellation and withdrawal consent records: at least 3 years, also after account deletion, because the law requires proof.
Billing records held by Dodo Payments: under its privacy policy and tax law.
Server and security logs: for no more than 30 days.

7. Cookies and similar technologies

Essential (always on). We use cookies to keep you signed in and to remember your language. The Service cannot work without them, so they do not need your consent.
Analytics (only with your consent). If you choose "Accept analytics" in the banner, we load Google Analytics, which sets cookies (_ga, _ga_<id>) to count visits and see how the site is used. We do not use them for advertising. If you decline or make no choice, Google Analytics is not loaded.
Your choice. We store your choice in your browser. You can change it at any time under "Cookie settings" at the bottom of every page; withdrawing consent stops analytics from that moment and deletes the analytics cookies on our site. You can also block or delete cookies in your browser.
We also measure page views with Vercel Web Analytics, which uses no cookies and does not identify you.

8. Your rights

Under Colombian law (Law 1581 of 2012) you have the right to know, update and correct your personal data; to request proof of the authorisation you gave us; to be told how we use your data; to revoke your authorisation or ask us to delete your data when we have no legal or contractual duty to keep it; to access your data free of charge; and to complain to the Superintendencia de Industria y Comercio (SIC) after you have contacted us. If the GDPR or UK GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent at any time, and the right to complain to your data-protection authority.

You can edit your profile and delete your account in Settings. For anything else, email info@devspeak.dev. We answer queries within 10 business days and complaints within 15 business days, as Law 1581 of 2012 provides (we may extend these once, by 5 and 8 business days respectively, and will tell you why); for GDPR requests we answer within one month.

9. Security

Encrypted connections (HTTPS) everywhere; encryption at rest on our servers; passwords stored only as hashes; database row-level security, so each account reaches only its own data; rate limits on sign-in and password reset; provider keys kept on the server. No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as the law requires.

10. Children

TalentAssisto is a business tool and is not directed at anyone under 18.

11. Changes to this policy

We publish every new version on this page with its effective date. For material changes we email account holders at least 30 days before they take effect.

12. Contact

Devspeak S.A.S. · Bogotá D.C., Colombia · info@devspeak.dev