Privacy Policy

Simonara Talent Solutions will never sell personal information. We collect only the data we need to run the platform, generate matches, and honor your explicit choices about visibility and verification.

We collect information you provide directly and information generated by your use of the platform:

• Account information — name, email, role, company name, password (hashed with bcrypt).
• Talent Passport information — resume text and files, work history, skills, salary expectations, availability, and social links you supply.
• Employer information — company name, hiring briefs, roles, notes, team memberships.
• Usage data — pages visited, features used, and interactions with AI tools (used only to improve the product for you).
• Verification data — when you request a verification via Simonara Verify, we collect the information necessary to run the specific check you authorized. Sensitive PII (SSN, DOB, doc numbers) is encrypted at rest.

• To operate the platform — authentication, session management, notifications.
• To generate AI features — matching, Hiring Briefs, resume review, coaching. These features are advisory only.
• To honor your visibility settings — your Passport is discoverable only when you enable it.
• To improve product quality, aggregated and anonymized where possible.
• To comply with legal obligations and to prevent fraud/abuse.

Simonara uses third-party AI providers (currently OpenAI and Google Gemini models via Emergent's managed infrastructure) to power features like matching, Hiring Briefs, Resume Optimizer, and Career Coach. We send only the fields needed for the specific request (never your entire account), and we do not authorize the AI provider to train foundational models on your data.

Weekly employer pay-transparency reminders use a first-party tracking image to record a unique open, a confirmed unsubscribe, and pay-range changes within seven days. Email privacy settings can affect open measurements. Digest analytics store message identifiers and timestamps, not IP addresses or device details, and expire after 180 days. You can stop these reminders using the unsubscribe link in each email.

We use a small set of first-party cookies to keep you signed in and to remember preferences. We use privacy-respecting analytics (PostHog) to understand product usage. Details in the Cookies Policy.

We share information with third parties only in the following situations:

• With employers that you authorize — via your Talent Passport visibility settings or an explicit reach-out consent flow.
• With verification partners you consent to — solely to complete the specific check you requested.
• With payment processors — for subscription and verification purchases.
• When required by law or valid legal process.

The complete list of every service that touches your data is on our Subprocessors page.

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you the following rights:

• Right to know — request the categories and specific pieces of personal information we have collected about you in the last 12 months.
• Right to delete — request that we delete personal information we hold about you.
• Right to correct — request that we fix inaccurate personal information.
• Right to portability — receive your personal information in a portable, machine-readable format.
• Right to opt out of sale or sharing — Simonara does not sell personal information, and we do not share it with third parties for cross-context behavioral advertising. You can affirmatively confirm this preference below.
• Right to limit sensitive PI — restrict use of sensitive personal information (such as verification data) to only what is strictly necessary to provide the service.
• Right to non-discrimination — we will not deny service, charge a different price, or provide a different quality of service because you exercised a privacy right.

Authorized agents. You may designate an authorized agent to make requests on your behalf. We will verify the agent's authority (e.g., a signed permission letter) before acting.

How to exercise: submit via /data-request or email privacy@simonaratalent.us. We respond within 45 days (extendable to 90 with notice, per CCPA § 1798.130).

If you are in the European Economic Area, United Kingdom, or Switzerland, the General Data Protection Regulation and UK GDPR give you the following rights:

• Right of access to your personal data (Art. 15)
• Right to rectification (Art. 16)
• Right to erasure (“right to be forgotten”, Art. 17)
• Right to restriction of processing (Art. 18)
• Right to data portability (Art. 20)
• Right to object to processing (Art. 21)
• Rights related to automated decision-making, including profiling (Art. 22) — our AI features are advisory; a human always makes the final hiring decision
• Right to withdraw consent at any time, without affecting the lawfulness of prior processing
• Right to lodge a complaint with a supervisory authority

Lawful bases we rely on:

• Contract (Art. 6(1)(b)) — running the platform you signed up for.
• Consent (Art. 6(1)(a)) — marketing emails, optional verifications, marketplace visibility.
• Legitimate interest (Art. 6(1)(f)) — fraud prevention, product analytics, service security.
• Legal obligation (Art. 6(1)(c)) — tax, FCRA-governed background checks, subpoena response.

International transfers. Simonara is based in California, USA. When we transfer personal data from the EEA/UK/Switzerland to the US, we rely on the EU-US Data Privacy Framework and Standard Contractual Clauses (2021 module 2). Our subprocessors have executed matching SCCs — details in the DPA.

Data Protection Contact. We have not appointed a formal DPO (we are not currently required to under Art. 37); privacy questions go to privacy@simonaratalent.us.

We keep data only as long as it's needed to run the platform, meet legal obligations, or defend our interests. Concretely:

When retention expires, records are either hard-deleted or irreversibly anonymised. Legal holds (subpoena, litigation) can extend retention on affected records only.

Our incident response process:

• Detect & contain (T+0 to T+4h) — automated alerts + on-call engineer isolates the affected surface.
• Assess scope (T+4h to T+24h) — identify which data categories and which users were exposed.
• Notify regulators (T+24h to T+72h) — Cal AG or applicable EU/UK supervisory authority; California residents also notified per Civ. Code § 1798.82.
• Notify affected users (T+72h) — by email to the address on file, plus a banner on the affected account surfaces.
• Remediate & post-mortem (T+72h to T+30d) — root-cause analysis and control changes documented in the audit log.

Notifications will include: the nature of the breach, categories and approximate number of records affected, likely consequences, mitigations, and how to contact us for follow-up.

• Passwords are hashed with bcrypt.
• Sensitive verification PII is encrypted at rest using AES/Fernet; every plaintext reveal is audit-logged.
• Admin views expose only masked previews (last-4 SSN, year-only DOB, etc.).
• Any plaintext PII reveal requires elevated admin role and a written business justification.
• We track every sensitive event in a Compliance Console for SOC 2 auditors — full details on the Trust Center.

• Access and download your data at any time from Settings.
• Update or correct information in your Passport or company profile.
• Revoke consent for any verification type from the Simonara Verify page.
• Disable employer discovery from your Passport settings.
• Delete your account at any time — see the retention table for what happens next.
• Submit a formal data request (access · delete · correct · port · opt-out · restrict) via /data-request.

Simonara is an adults-only platform and is not directed to minors. Users must be at least 18 years old to create an account. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided personal information to us, please contact us at privacy@simonaratalent.us and we will delete it.

Simonara is based in California, USA. If you access the platform from outside the United States, you consent to the transfer and processing of your information in the United States, subject to the safeguards described above and in the DPA.

Material changes will be posted on this page and — for existing users — surfaced as an in-app re-consent banner. The version date at the top of this page always reflects the current effective date.

Privacy questions? Email privacy@simonaratalent.us.

Formal data requests are best submitted via /data-request — that gives us the metadata we need to verify your identity and gives you a trackable ticket ID.