Privacy Policy

Talaskill is operated by Omar Alnawasrah ("the Operator"), based in the Hashemite Kingdom of Jordan, who is the data controller for the personal data described in this policy unless stated otherwise for a specific feature.

For any privacy question, request, or complaint, contact: Talaskill1@gmail.com.

This policy covers three groups of people, whose data we handle differently:

We collect only what each feature needs to do its job, and we describe the more sensitive categories separately because they deserve more than a one-line mention.

Account and profile data: your name, email address, password (stored as a salted hash — we never see or store it in readable form), preferred language, and the career details you choose to enter (education, work experience, projects, certificates, achievements).

Skills, assessments and evidence: the skills you claim, your self-reported confidence in them, your assessment attempts and answers, and the resulting evidence record used to resolve whether a claim is supported, disputed, or unsupported.

Assessment integrity signals: while you take a timed assessment, we record response timing and session-behaviour signals (for example, how long each answer took, and whether the pacing is consistent with a person actually working through the questions) specifically to detect automated or dishonest completion. This is a form of behavioural data that some jurisdictions treat with special sensitivity. We use it only for integrity scoring on that specific attempt — never to profile you outside that context — and we do not claim it detects all dishonest behaviour with certainty; a flagged attempt can be reviewed by a person, not decided by the signal alone.

Video evidence: if you choose to upload an introduction or skill-demonstration video, that video may contain your face, voice, and other biometric-adjacent characteristics. This is an entirely optional feature: nothing on the platform requires it, we do not run facial or voice recognition on it ourselves, and you can delete or replace it at any time. Because it is sensitive, uploading it is a separate, explicit action — not bundled into general account consent.

CV and career-history content: whatever you enter into your profile and choose to include when generating a CV or resume export.

Employer and job-application data: if you apply to a role or share a credential with an employer, they receive exactly the skills and evidence you chose to include — never your full profile, and never skills outside what you shared.

Credential and verification data: when you issue a credential, we record how many times its public link was opened and when it was last opened. We deliberately do not record who opened it — no viewer identity, IP address, or device information is stored against a credential view, by design.

AI-feature data: if you opt in to an AI-assisted feature (for example, drafting help for a CV summary), the relevant text is sent to the configured AI provider for that one request. This is off by default and only ever happens after you explicitly enable it.

Technical data: your session is identified by a first-party cookie (not a tracking cookie — see Section 12). We log IP address and basic device/browser information against security-relevant events (login, account changes, credential actions) in an internal audit trail, for fraud prevention and account security, not for profiling or advertising.

Growth attribution data: when you first visit the Service, we may set one additional first-party cookie recording the page you landed on and, if you arrived via a link carrying campaign parameters (for example, a search result or a shared link), which campaign or source it identified. If you later create an account, this is linked to your account once, so we can understand — in aggregate, across all users — which channels actually lead to real signups and hires, rather than guessing. It is never used to build an advertising profile of you individually, never shared with or sold to any third party, and never combined with your activity on other websites. You can see and delete this data via your account's Privacy Dashboard, or prevent it from being set at all by blocking the cookie in your browser (see Section 12).

Community content: the posts, questions, answers, files and links you share in the community, with the country, city, field, skills, dates and organiser details you add. Approved posts are public: anyone can read them, including search engines and AI search services, under your name and a link to your public profile, unless you choose to post anonymously (a post made for an organisation always shows the organisation). Your votes, saves and reports are linked to your account but are not shown to other members, and a member you report is never told who reported them.

Moderation and reports: every post and answer is reviewed automatically when it is shared (for example, for shortened links, chat-group invitations, talk of payments, or links a safety service lists as harmful), and the result and its reasons are stored. Moderators and admins may see a held or reported post together with the reasons, and their decision and any note are kept with the post. When you report a mistake in a test question, we keep the question, your reason and your note, so it can be checked and, where needed, the question corrected and answers re-marked fairly.

Site search words and error logs: we count the words typed into the site's search, with the search box and the language, to see which subjects people look for; and when a page breaks, we record the page pattern (for example, "/community/:id") and the error message. Neither is linked to you: no account, IP address, cookie, form content or query string is stored with them, and email addresses, phone numbers, links and other numbers are removed before anything is saved.

Abuse protection: to slow down password guessing, spam and scraping, we keep short-lived counters keyed to your IP address or account (for example, failed sign-ins in the last hour). They expire on their own, within a day at most.

We do not use third-party advertising networks or analytics trackers on this Service, and we do not sell personal data. The growth attribution data above never leaves our own database — no third party ever receives it.

The QR code on your CV: if you protect the page behind it, we keep your PIN only in scrambled (hashed) form; a record of when the page was opened, unlocked or tried with a wrong PIN (with the company's name when a company you chose opened it, never an address or a device); and the access requests people send you, with their name, email, company and message. Someone who asks for access gives us these details so that we can pass the request to you and email them your answer. Requests are deleted after 90 days and the record after 180 days.

Depending on the data and the purpose, we rely on one or more of the following:

We use personal data to: create and secure your account; let you build a profile, take assessments, and generate CVs; resolve and display the evidence behind a skill claim; issue, verify, and let you revoke credentials; connect candidates and employers around the skills a candidate chooses to share; operate optional AI-assisted features you turn on; detect and prevent fraud, abuse, and assessment cheating; understand, in aggregate, which search terms, pages, and campaigns actually lead to a signup or a hire, so we can improve the Service rather than guess; and comply with legal obligations.

We also use personal data to publish and moderate the community content you share; to tell you when someone answers your question or a moderator decides on your post; to tell search engines when a public post is published (only the page's address is sent, through the IndexNow service used by Bing, Yandex and others); to find and fix errors on the Service; and to learn from site search words which subjects to write about.

We do not use your data to make a final hiring, promotion, or termination decision about you — that decision, if any, is made by an employer, informed by what you chose to share; see Section 13 for more on automated decision-making.

We share personal data only in the following circumstances:

The Service's main database, application servers and abuse-protection counters are in the European Union (Frankfurt, Germany). Some of the providers listed in Section 6 are based in, or may process data in, other countries, including the United States (for example, for email delivery, file storage and AI features). Where data leaves your country, we rely on the providers' data-processing terms, including standard contractual clauses or other safeguards recognised by the applicable law where they are required.

We keep personal data for as long as your account is active, plus a limited period afterward where needed for the purposes described in this policy (for example, security audit logs, or a legal retention requirement). You can request deletion of your account and associated data at any time — see Section 9. Some records, such as evidence needed to prove a still-live credential was validly issued, are retained only until the credential is revoked or expires, or until you request deletion, whichever comes first. Growth attribution data (Section 3) that was never linked to an account is deleted automatically after 90 days; once linked to an account, it is retained and deleted on the same schedule as the rest of your account data.

Community posts, answers and files stay until you delete them or your account; deleting your account deletes them too. Moderation decisions and reports are kept with the post and deleted with it. Site search words are deleted 180 days after they were last searched, error-log entries 30 days after they were last seen, and abuse-protection counters within a day.

Subject to applicable law, you have the right to: access the personal data we hold about you; correct inaccurate data; request erasure of your data; restrict or object to certain processing; receive a copy of your data in a portable format; and withdraw consent at any time for anything based on consent.

Most of these rights are already available to you directly, with no request needed: your account's Privacy Dashboard lets you export your data and delete your account and its associated data yourself, at any time. For anything the dashboard does not cover, contact us using the details in Section 1.

If you are in Jordan, you may also lodge a complaint with the competent authority under the Personal Data Protection Law No. 24 of 2023. If you are in another jurisdiction with its own supervisory authority (for example, a data protection authority in the EU/EEA or the UK), you may have the right to complain to that authority as well.

The Service is intended for people who are at least 16 years old, or the age of majority in your jurisdiction if higher. We do not knowingly collect personal data from anyone younger than that. If you believe a child has provided us with personal data, contact us using the details in Section 1 and we will take appropriate steps to remove it.

Passwords are stored as salted cryptographic hashes, never in readable form. Sessions are identified by a high-entropy token; only a hash of that token is stored, so a database read alone cannot be replayed as a working session, and a session can be revoked instantly. Sensitive actions are rate-limited. Credentials are cryptographically signed and can be revoked at any time, after which they stop asserting anything about you. We do not record who views a public credential — that protection is structural, not a policy choice we could later reverse without changing the product. No method of storage or transmission is perfectly secure, and we cannot guarantee absolute security, but we design for these protections by default rather than as an afterthought.

Our team does not look at your profile, CV, assessment answers, results or credentials in normal work: the admin pages show only totals and the requests people send us (support messages, appeals, payout requests), never anyone's profile data.

In exceptional cases only — for example a payment problem, a technical error, or a support request you sent — a member of our team may open a limited summary of your account. They must write down the reason, the access ends automatically after one hour, you receive an email saying so, and every such access is listed on your Privacy page. When you send a support message you can choose to allow this in advance. This summary never includes your assessment answers, the text of your CV or your uploaded files.

Admin accounts must use two-step verification, and every new sign-in to an admin account is notified by email.

If you set your page to be visible only to companies you choose, we record which of those companies opened it and when, and show that list to you; nobody else sees it.

Files shared in the community are checked by their content, not only by their name; only PDF, image and Office files are accepted, and they are always downloaded, never opened inside the Service. Location data is removed from photos. Links are checked before a post is approved, and shortened or suspicious links are held for a moderator.

If a personal data breach happens — personal data being lost, destroyed, changed, disclosed or accessed without authorisation — we act immediately to contain it and to assess the risk to the people affected. Where the law requires, we notify the competent authority without undue delay and, where feasible, within 72 hours of becoming aware of it. When a breach is likely to put your rights at high risk, we tell you without undue delay what happened, what data was involved, what we have done and what you can do to protect yourself.

We keep a record of every breach, its effects and the action taken, even when no notification is required. Our service providers are bound by contract to keep your data secure and to tell us promptly about any breach that affects it.

You play a part too: keep your password private and use it nowhere else, turn on two-step verification where it is offered, and tell us immediately, using the details in Section 1, if you notice anything suspicious on your account.

We use three cookies, all first-party and all set by us directly, never by a third party: a session cookie ("session_token") that keeps you signed in for up to 30 days, cannot be read by page scripts and, on the live site, is sent only over a secure connection; a language cookie ("NEXT_LOCALE") that remembers the language you are using until you close the browser; and an attribution cookie ("attribution_data") that records the page you first landed on and any campaign details in the link, for up to 90 days (see Section 3, "Growth attribution data"). None of them is a cross-site tracking or advertising cookie, and we use no third-party analytics or advertising cookies or trackers. We also keep a few small settings in your browser's local storage, such as your light or dark theme and the field you picked on the welcome page; they never leave your device. Our Cookie Policy lists each one.

If you install the Service as an app on your device, a small amount of technical data is cached locally on your device so a limited offline view can be shown when you have no connection. This caching happens on your device, under your device's own storage permissions, and is not sent to us.

Assessment scores, evidence-based skill status, and job-match percentages are generated automatically, but we do not use them to make a final hiring, promotion, or termination decision about you — the Service is a source of evidence for a human decision-maker at an employer, not a replacement for one.

If an employer uses these features as part of an automated employment decision covered by a law such as New York City's Local Law 144 or the EU AI Act's high-risk employment-AI provisions, that employer independently bears the compliance obligations those laws place on the party making the hiring decision (for example, bias audits or candidate notice) — our role is to provide the underlying evidence honestly, not to certify an employer's own compliance.

AI-assisted features (for example, drafting help) are opt-in, generate suggestions rather than facts, and are designed with explicit guardrails against inventing employers, dates, or qualifications you did not provide. Review any AI-generated text before relying on it.

If you ask for your CV text to be translated, the translation is made by a translation model that runs on our own servers; the text is not sent to another company. The result is a suggestion: it is saved with your profile only after you review it, and your original text is never changed.

We may update this policy as the Service changes. The "Last updated" date at the top reflects the latest revision. For a material change — one that meaningfully changes what we collect, how we use it, or your rights — we will make reasonable efforts to notify you before it takes effect, and may ask you to re-confirm your acceptance.

Omar Alnawasrah, operator of Talaskill, Hashemite Kingdom of Jordan.

Email: Talaskill1@gmail.com.

This policy is governed by the laws of the Hashemite Kingdom of Jordan, including the Personal Data Protection Law No. 24 of 2023, without prejudice to any additional rights you may have under the mandatory law of your own country of residence. See the Terms of Use for how disputes are resolved.