Privacy
Tarantulah is a permission-broker. We hold as little about you as possible, share nothing without your explicit consent, and let you take or erase your data at any time.
What we store
When you join, the searchable pool holds only a salted, one-way hash of your email (never the email itself), your interest tags (skills, roles, locations, languages), a coarse comp band, and years of experience. Your personal profile — name, email, LinkedIn, CV — lives in a separate, access-gated vault.
Lawful basis
We process your data on the basis of your consent, given when you join. Notifications run on a soft opt-in (ePrivacy Art. 13(2)) that you can withdraw at any time via the unsubscribe link in any email.
How your profile is shared
Recruiters searching the pool see only anonymized signals — never your identity or contact details. A company can view your full profile only after you approve a specific request, and only the fields you approve. Every grant is scoped and expires automatically. You can deny or revoke at any time.
AI & automated decisions
We use AI in three narrow, transparent ways, and always as decision-support with a human in the loop — never to make a hiring or contact decision on its own:
- CV parsing — turning CV text you provide into structured skills and experience.
- Semantic matching — scoring how well a role fits your profile by skill overlap.
- Ranking — ordering candidates for a recruiter to review.
A recruiter always makes the decision to reach out, and nothing is shared with them until you approve a specific request. This aligns with the EU AI Act's transparency and human-oversight expectations. You can see every AI-processing record in your data export.
The consent ledger
Every join, request, grant, denial, and revocation is recorded in an append-only ledger that you can read in your wallet. It exists so you always know who asked for what, and when.
Your rights
- Access & portability: export everything we hold about you as a machine-readable file from your wallet.
- Erasure: delete your profile, pool entry, matches, and ledger permanently, in one click.
- Withdraw consent: leave any company's pool, revoke access, or unsubscribe from emails at any time.
Manage all of this from your data wallet.
Retention & residency
We keep your data only while you have an active profile; delete it and it's gone. Data is stored in the EU by default.
This is a plain-language summary for the MVP and not a substitute for a full legal privacy notice.