Privacy Policy of TalentsLab.ai
Version: 2.4 — Last update: October 6, 2026
Privacy roles: TalentsLab.ai acts as controller or processor depending on the processing activity, as described below.
1. Controller and Processor Roles
The website https://talentslab.ai is published by TalentsLab.ai, a simplified joint-stock company based in France, registered at 60 rue François 1er 75008 Paris.
The GDPR role depends on who determines why personal data is processed and the essential means of that processing. TalentsLab is therefore not the controller for every activity.
- User records provided or generated for a client organization: the client organization normally acts as controller because it decides who participates, which learning activities are assigned, why progress is evaluated, who may view the results, and the applicable retention or professional use. TalentsLab acts as its processor and technically provides the service on the client’s documented instructions: it creates or deletes accounts and assignments, records and displays AI conversations and transcripts, and generates and stores results, rankings, feedback and certificates using the criteria attached to the relevant activity. TalentsLab does not modify those criteria for an individual user.
- Direct individual users and free trials obtained directly from TalentsLab: TalentsLab acts as controller for the account and learning activity because it determines the purpose and essential means of the service.
- Guests using an invitation link: where a client organization creates or requests the invitation and determines its purpose, activity and recipient, that client normally acts as controller and TalentsLab as processor. Where TalentsLab issues the invitation for its own demonstration, prospecting or pre-contractual purposes, TalentsLab acts as controller.
- TalentsLab's own business operations: TalentsLab acts as controller for public website operation, prospect and client-administrator contacts, contractual administration, billing records, newsletters, service security, access and audit logs, fraud prevention, legal compliance and the handling of requests concerning processing for which TalentsLab is controller.
- Technical providers: OVHcloud, OpenAI, HeyGen/LiveAvatar, AssemblyAI and Brevo act as processors or subprocessors for the relevant service, subject to their applicable terms. Payment providers may also act as independent controllers for their own regulatory obligations.
When TalentsLab acts as processor, the client organization remains responsible for its lawful basis, instructions to TalentsLab, information provided to its employees or learners, and decisions made using learning records. TalentsLab does not use those records for its own unrelated purposes.
The controller–processor obligations are set out in the TalentsLab Data Processing Agreement. It becomes binding for a client only when the client agreement or order form expressly incorporates it.
Contact for privacy inquiries: admin@talentslab.ai
2. Personal Data Collected
Unregistered Visitors
- Language preference (functional cookie only)
Guests Using an Invitation Link
- Invitation information: invited name and email where supplied, client organization, invitation language, activity, expiry, status and permitted/used attempts
- Visit information: visit time, IP address, browser/device user agent and referring page
- Activity information: attempt number, session type and status, selected avatar, start and finish times
- Learning content: prompts, conversation messages and transcripts, temporary voice recordings when speech-to-text is used, AI feedback, criteria grades, results and final feedback
- Guest comments: optional satisfaction score and comment submitted after an activity
- Technical usage: provider, model, modality, token usage and related service-cost metadata
Registered Users & Free-Trial Users
- Account and identity: first name, last name, business email, language, company, job family, account role and status, account creation date and email-verification status
- Authentication: password hash or, where SSO is used, identity-provider identifier, provider type and last SSO login time
- Organization and access: company membership, team membership and role (for example member or supervisor), licences, assigned learning streams, journeys and activities
- Learning activity: attempts, submitted text or form responses, conversation messages and transcripts, start and finish times, completion status and percentage, progress, scores, rankings, AI feedback and grades by criterion
- Voice and avatar sessions: temporary voice recordings when speech-to-text is used, resulting transcripts, selected avatar, session type and duration
- Certificates and sharing: learner and course names, certificate date, score, verification code and any public sharing preferences or revocation
- User comments: optional satisfaction score, comments and other feedback submitted about an activity
- Technical, security and usage data: IP address and browser/device user agent recorded for relevant security or administrative events; event time and details; AI provider, model, modality, token or audio usage and associated service-cost metadata
- Communications and privacy requests: language and email-notification preferences, notification history, and information supplied in a request to exercise data-protection rights
- Functional cookies: language preference, session cookie and encrypted "remember me" token where selected
Data is collected when:
- Users fill in forms (signup, contact, newsletter)
- Where an account is created or managed for a client organization, professional identity details, organization, role, team memberships and assignments may be provided by that organization, then imported or entered by one of its authorized administrators or by a TalentsLab administrator acting on its instructions, including through an Excel or other spreadsheet file
- Users browse the site (functional cookies only)
- Users interact with the platform (AI sessions, activities, team management)
- A client organization or TalentsLab creates a guest invitation, and when the guest opens the invitation or completes the activity
3. Purposes and Legal Bases
| Processing activity and purpose | Role | Legal basis |
|---|---|---|
| Provide employee or learner accounts and client-assigned access | Client organization: controller; TalentsLab: processor | Determined and documented by the client organization |
| Deliver assigned learning activities; generate AI dialogue; record transcripts, progress, results, rankings, feedback and certificates | Client organization: controller; TalentsLab: processor | Determined and documented by the client organization |
| Provide a free trial or demonstration requested directly by an individual | TalentsLab: controller | Steps taken at the individual’s request before entering a contract (Article 6(1)(b) GDPR) |
| Create and operate a direct individual account after activation | TalentsLab: controller | Performance of the service contract with the individual (Article 6(1)(b) GDPR) |
| Create and operate guest invitations requested by a client; deliver the selected activity; record attempts, conversations, results and feedback | Client organization: controller; TalentsLab: processor | Determined and documented by the client organization |
| Provide and follow up on a TalentsLab demonstration requested by a prospect | TalentsLab: controller | Steps taken at the prospect’s request before entering a contract (Article 6(1)(b) GDPR) |
| Contact professional prospects about TalentsLab services | TalentsLab: controller | Legitimate interests in developing relevant business-to-business customer relationships (Article 6(1)(f) GDPR), subject to the right to object |
| Operate guest-link controls and, for TalentsLab’s own purposes, record visits and diagnose misuse or technical incidents | TalentsLab: controller for its own security purposes; processor where performed only for a client | For TalentsLab-controlled processing, legitimate interests in protecting invitations, accounts, data and service availability (Article 6(1)(f) GDPR); for client-controlled processing, the basis determined by the client |
| Manage client contacts, administrators, subscriptions and the business relationship | TalentsLab: controller | Legitimate interests in administering and performing the business relationship with the client organization (Article 6(1)(f) GDPR) |
| Issue and retain invoices and mandatory accounting records | TalentsLab: controller | Compliance with French accounting and tax obligations (Article 6(1)(c) GDPR) |
| Provide support for direct individual accounts | TalentsLab: controller | Performance of the service contract with the individual (Article 6(1)(b) GDPR) |
| Answer contact requests from prospects or client representatives | TalentsLab: controller | Legitimate interests in responding to professional inquiries and managing business relationships (Article 6(1)(f) GDPR) |
| Handle requests to exercise GDPR rights for TalentsLab-controlled processing | TalentsLab: controller | Compliance with legal obligations under data-protection law (Article 6(1)(c) GDPR) |
| Send newsletters | TalentsLab: controller | Consent |
| Maintain platform security, access logs and audit trails and prevent fraud | TalentsLab: controller for its own security purposes; processor where a log is maintained solely on a client’s behalf | For TalentsLab-controlled processing, legitimate interests in protecting the service, accounts and data and establishing security events (Article 6(1)(f) GDPR); for client-controlled processing, the basis determined by the client |
| Create minimized aggregate statistics to maintain and improve service reliability and performance | TalentsLab: controller until data is effectively anonymized | Legitimate interests in maintaining and improving the reliability and performance of the service (Article 6(1)(f) GDPR); effectively anonymized information is no longer personal data |
4. Recipients of the Data
- Authorized team members of Talentslab.ai
- Subprocessors subject to GDPR compliance:
- OVH (secure hosting)
- OpenAI (AI processing)
- HeyGen (video avatars)
- AssemblyAI (STT/TTS)
- Payment Service Providers (PSPs):
certain data strictly necessary for processing payments
(such as first name, last name, email address, amount, currency, invoice reference)
may be transmitted to providers such as Stripe, Alma, or any other PSP indicated during the payment process.
PSPs act:- as independent data controllers for their legal obligations (anti-fraud, compliance, financial regulations),
- and, where applicable, as processors for the technical execution of the payment.
- The learner: access to their own activity records and feedback, subject to the activity configuration.
- Authorized supervisors: access to the activity records of members of the teams they supervise, including child teams. Those records may include submitted responses, transcripts, progress, scores, criteria grades and AI feedback.
- Authorized administrators of the Client’s organization: access to the activity records of users in their organization, including submitted responses, transcripts, progress, scores, rankings, criteria grades and AI feedback, for the purposes determined by the client.
- Authorized leaderboard participants: ranking information is visible only where the client enables the relevant leaderboard.
- The organization that issued a guest invitation: guest invitation and activity information may be made available to its authorized contact where required for the purpose it determined and permitted by the applicable service configuration.
No data is sold or transferred to third parties for commercial purposes.
5. AI, Audio and Technical Providers
TalentsLab uses the following processors and technical services. Only data necessary for the selected function is sent. Users should not include special-category data, confidential third-party information, or information unrelated to the learning activity in free-text prompts or audio.
| Provider/service | Purpose | Data that may be processed | Location and retention position |
|---|---|---|---|
| OVHcloud | Primary application, database, file, log and backup hosting. | Account, company, learning activity, conversations, results, certificates, audit logs, IP/technical logs and temporarily stored files. | TalentsLab selects EU hosting. Data follows the retention periods in this policy and the backup lifecycle. OVHcloud acts as an infrastructure processor. |
| OpenAI API and Realtime API | Generate coaching dialogue, feedback, scoring-related structured output, transcription and realtime voice responses. | Activity instructions, prompts, conversation text, transcripts, microphone audio during realtime voice sessions, generated audio, language, model/usage metadata and pseudonymous activity identifiers. A name or email is not intentionally included unless it appears in user-provided content. | Processing may occur in the EEA and in third countries, including the United States. API content may be retained by OpenAI for abuse monitoring for up to 30 days. OpenAI states that API inputs and outputs are not used to train or improve its models unless the customer explicitly opts in. The data remains confidential and protected during retention: it is not sold or shared for advertising or marketing, and access is limited to authorized personnel and service providers where necessary for support, abuse investigation, security or legal compliance. It is deleted after the applicable retention period, except where longer retention is legally required or necessary to protect the service or third parties from harm. TalentsLab stores resulting conversations and feedback under its own retention schedule. |
| HeyGen / LiveAvatar | Provide and animate the live video avatar and synchronize it with the assistant's speech. | Selected avatar identifier, session identifier, OpenAI-generated assistant audio, avatar video stream, and technical connection and diagnostic data. The user's microphone input and conversation transcript are not intentionally sent to HeyGen in avatar-only mode. | HeyGen is established in the United States and may use international infrastructure and subprocessors. TalentsLab uses LiveAvatar's avatar-only mode, closes the provider session after use and does not intentionally retain the avatar video stream as a recording. Provider-side session-event retention and deletion follow the applicable account configuration and agreement; TalentsLab does not represent that zero retention applies unless it is enabled or contracted for the account. |
| AssemblyAI | Convert a submitted voice recording into text. | Temporary audio, selected language, returned transcript, duration, provider transcript identifier and technical usage data. | AssemblyAI is established in the United States and may process data internationally. TalentsLab deletes its temporary audio file immediately after transcription where possible and no later than 24 hours; the resulting transcript is retained as learning activity data. Provider-side retention is governed by the applicable account settings and agreement. |
| Brevo SMTP | Send account, security, licence, privacy-request and other transactional emails; send newsletters only where applicable. | Recipient and sender email addresses, name where included, language, subject, email body, delivery status, timestamps and technical delivery data. | Brevo states that its main database hosting is within the EU. Messages and delivery metadata are retained under the relevant mailbox, campaign/account and contractual settings. Newsletter processing continues until unsubscribe; transactional evidence follows the applicable TalentsLab retention period. |
| Alternative email or infrastructure provider | Business continuity where the configured SMTP, hosting or API service changes. | Only the categories necessary for the same purpose. | TalentsLab will assess the provider, put an Article 28 processor arrangement and transfer safeguards in place where required, and update this policy when a material provider or location changes. |
Audio handling: microphone access is activated only when the user starts a voice-enabled activity and grants browser permission. Pre-recorded speech-to-text audio is written to a randomly named temporary file, submitted to AssemblyAI, and then deleted locally. During realtime avatar sessions, the user's microphone audio is sent to OpenAI; OpenAI-generated assistant audio is sent to HeyGen solely to synchronize and stream the avatar video. TalentsLab retains transcripts, assistant messages, feedback and usage records where required for the learning service, but does not intentionally retain raw realtime microphone audio or the avatar video stream as an activity recording.
AI use: scores, criteria grades and feedback are generated automatically and may be inaccurate. They are advisory indicators intended for learning and coaching, not verified professional qualifications or employment decisions, and TalentsLab does not systematically review them before they are displayed. Depending on the client’s configuration, the learner, authorized supervisors and client administrators may review the records described above. The TalentsLab service does not itself make decisions on recruitment, promotion, pay, discipline, dismissal or other employment matters, and is not designed to be used as the sole basis for a decision producing legal or similarly significant effects. A client deciding to use activity results in a professional context is responsible for the lawfulness and transparency of that use and for compliance with the rules applicable to decisions based on those results.
6. International Data Transfers
OVHcloud hosting selected by TalentsLab and Brevo database hosting are located in the European Economic Area. Some AI and avatar providers—particularly OpenAI, HeyGen and AssemblyAI—are established in the United States or use affiliates and subprocessors in countries outside the EEA.
OpenAI, HeyGen and AssemblyAI publish data processing terms that provide for the EU–US Data Privacy Framework where the relevant recipient is certified and/or incorporate the European Commission Standard Contractual Clauses for transfers outside the EEA. TalentsLab relies on the applicable provider data processing terms and transfer mechanism. OVHcloud and Brevo provide the principal services used by TalentsLab from the EEA; any onward transfer by their subprocessors is governed by the safeguards in their applicable data processing terms.
Providers may use the subprocessors identified in their current subprocessor lists. TalentsLab periodically reviews material changes to provider terms, locations, subprocessors and transfer safeguards. Where Standard Contractual Clauses are relied upon, TalentsLab assesses the transfer and applies appropriate supplementary technical and organizational measures, including data minimization, pseudonymous identifiers where possible, encryption in transit and restricted access. Relevant transfer information may be requested at admin@talentslab.ai, subject to the protection of confidential security and contractual information.
7. Data Retention Period
| Data Type | Retention Period |
|---|---|
| User account & activity | While access remains active, then deletion 2 years after the applicable inactivity trigger: deactivation of the last active licence; the company subscription end date where the user still has an active licence; or account creation where the user has never received a licence. A qualifying renewal or licence reactivation cancels the corresponding scheduled deletion. We notify the user approximately 30 days before deletion. A documented legal hold pauses deletion. |
| Active guest invitations | Until their configured expiry, revocation or permitted attempts are used |
| Guest invitation details, visits, attempts, conversations, results, feedback and usage records | 12 months after expiry, revocation or completion/use of the permitted attempts |
| Contact form | 12 months in the receiving mailbox |
| Newsletter | Until unsubscribe |
| Functional cookies | 13 months |
| Security audit logs | 24 months, unless retained for an active security investigation or legal claim |
| Temporary audio files | Deleted immediately after processing or playback where possible, and no later than 24 hours |
| Certificates issued for a client organization | Until the client instructs TalentsLab to delete or deactivate them, subject to applicable law and Data Subject rights. This default instruction is documented in the incorporated Data Processing Agreement. |
| Certificates issued to direct individual users | While verification remains requested and necessary, subject to applicable law and the user’s rights. |
8. Your GDPR Rights
In accordance with Articles 15 to 22 of the GDPR:
| Right | Description | Article |
|---|---|---|
| Access | Receive a copy of your data | Art. 15 |
| Rectification | Correct inaccurate data | Art. 16 |
| Erasure | Request deletion | Art. 17 |
| Restriction | Temporarily freeze processing | Art. 18 |
| Objection | Object to certain processing | Art. 21 |
| Portability | Receive and reuse your data | Art. 20 |
| Withdraw consent | At any time | Art. 7 §3 |
| Complaint | File with the CNIL | Art. 77 |
Logged-in users can exercise these rights from My profile → Privacy and my data. Guests and former users may email admin@talentslab.ai and should provide enough information to identify the relevant invitation or activity without sending unnecessary data. For employee, learner or guest records controlled by a client organization, TalentsLab records the request, informs or consults the client as appropriate, and assists the client in responding in accordance with its documented instructions. For processing controlled by TalentsLab, TalentsLab handles the request directly. Additional identity information is requested only where there are reasonable doubts about identity. Requests are normally answered within one month; complex requests may be extended by two further months with notice.
9. Use by Minors
The site and platform are not intended for users under 16. No personal data is processed knowingly without parental consent.
11. Data Security
- Secure hosting on OVH
- Encrypted passwords
- Regular backups
- Access logging
- Restricted access to authorized personnel only
12. Governing Law and Jurisdiction
This policy is governed by French law. In case of dispute, the courts within the jurisdiction of TalentsLab France SAS headquarters shall be competent.
13. Updates
This policy may be updated at any time. Users will be informed via the website or by email when appropriate.