Talent-Link Privacy Policy

Last updated: 21 October 2026

This policy explains how TalentLeap AI Ltd (“TalentLeap”, “we”, “us”) collects, handles, stores and shares data through Talent-Link: the TalentLeap Link Chrome extension and the web app at link.talentleap.ai. It sits alongside our general Privacy Policy and, for business customers, our Data Processing Agreement. Where they differ on Talent-Link, this policy applies.

TalentLeap AI Ltd is registered in England and Wales. For anything in this policy, email simon@talentleap.ai.

1. Who is responsible for the data

Your account data (the consultant using Talent-Link): TalentLeap is the data controller.

Data about the people you prospect (LinkedIn profiles, contacts, messages): your recruitment business is the data controller and decides who is captured and contacted. TalentLeap processes that data only to provide Talent-Link, on your instructions and under our Data Processing Agreement.

2. What data we collect

Your consent comes first. The first time you open the TalentLeap Link extension it shows a screen explaining the data below and asks you to press I agree. Until you do, the extension does not sign you in, read any page or cookie, or send anything to our servers.

Account and billing

  • Your name, business email address, company name and role in your team.
  • Sign-in and verification records (one-time codes expire after 5 minutes).
  • Subscription, trial and credit records. Card payments are taken by Stripe; we never see or store your card number.
  • A record, kept in the extension’s storage on your computer, that you agreed to this data use and when.

Your LinkedIn connection (authentication information)

  • When you press Connect, the extension reads the LinkedIn session cookies already in your browser (li_at, and li_a for Recruiter or Sales Navigator), plus your browser’s user agent, time zone and language. These are sent over an encrypted connection straight to our LinkedIn connection provider, Unipile, so your account can run campaigns from the same session you already use.
  • After you have connected, while the extension panel is open it re-reads the same cookies at most once every 30 minutes and sends them the same way, so your connection stays in step with your browser (for example after LinkedIn refreshes your session). If you are signed out of LinkedIn, nothing is sent.
  • We never ask for, collect or store your LinkedIn password, and we do not store or log the session cookies on our servers.
  • We keep the resulting connection details: your Unipile account ID, LinkedIn display name, account type (Basic, Sales Navigator or Recruiter) and connection status.

What the extension reads on LinkedIn

  • The extension works on LinkedIn pages only. When you press Capture, it reads what is on your screen: a person’s name, headline or job title, employer, location, profile URL, time in role, mutual connections and similar profile details; and, for client vacancies, the job title, location, how long it has been live and applicant count. To load those details it may scroll the page you are on.
  • When you press Capture top 400, it sends the address (URL) of the LinkedIn, Sales Navigator or Recruiter search you have open to our server, which fetches those search results through Unipile.
  • While the panel is open, it checks the address of your current tab to see whether it is a LinkedIn search page, so it can switch the capture button on. That address is not stored or sent anywhere unless you press the button.
  • It does not read other websites, your browsing history, your keystrokes, or your LinkedIn messages in the browser. It does not click, post or send anything on LinkedIn from your browser.

Data you create in Talent-Link

  • Capture lists, folders, notes, scores, watchlists of clients and contacts.
  • Your LinkedIn connections list, when you export or import it, so we can show who has changed job.
  • Campaigns: recipients, the message templates you write or approve, invitations and messages sent, and replies received in those LinkedIn conversations.
  • WhatsApp messages you send through Talent-Link from your own number, with the recipient’s name and number.
  • Enrichment results: business email addresses and phone numbers you choose to reveal for a contact, and a record of each lookup and the credits used.
  • The short brief you type when you ask Talent-Link to draft messages.

Technical data

  • Error and service-health logs needed to keep campaigns running safely (for example, a failed send or a LinkedIn connection that needs reconnecting).

We do not collect health, financial, government ID or other special-category data, and we do not knowingly collect data about anyone under 18.

3. How we handle and use the data

We use the data only to provide Talent-Link’s features:

  • Signing you in, verifying your identity and managing your subscription and credits.
  • Keeping your LinkedIn account connected and sending the invitations and messages you set up, paced within conservative daily limits during working hours.
  • Capturing the people, searches and vacancies you choose, scoring them, and showing job movers.
  • Looking up business contact details when you ask, with the credit cost shown first.
  • Drafting suggested messages from your brief, which you edit before anything is sent.
  • Monitoring the service and fixing problems.

What we do not do: we do not sell data; we do not use it for advertising, credit-worthiness or lending; we do not use it to train AI models; we do not let people read it except with your permission, for security, or where the law requires; and we do not use it for anything unrelated to Talent-Link.

Limited Use: the use of information received from the TalentLeap Link Chrome extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Legal bases (UK GDPR): your consent (for the extension reading your LinkedIn session and pages), contract (to provide the service you subscribe to), legitimate interests (keeping the service secure and working, and B2B recruitment prospecting carried out by our customers), and legal obligation (tax and accounting records).

4. How and where we store the data

  • Location: Talent-Link data is stored in a Supabase database hosted in London, United Kingdom (AWS eu-west-2).
  • In the extension: the extension keeps your consent record, your Talent-Link sign-in session and your settings in Chrome’s local extension storage on your computer. It does not keep copies of LinkedIn cookies.
  • Security: all data is sent over HTTPS (TLS) and encrypted at rest. Every table is protected by row-level security so each customer can only reach its own data. Third-party keys are held server-side, never in the extension. Sign-in uses email verification codes.
  • Retention: we keep your data while your Talent-Link account is active. When an account is closed, we delete or anonymise its Talent-Link data within 90 days, except billing records, which we keep for 6 years to meet HMRC requirements. You can ask us to delete individual records, or everything, at any time.

5. Who we share data with

We share data only with the service providers that run Talent-Link, each under contract and only for the purpose listed:

  • Unipile (France): connects your LinkedIn (and WhatsApp, if you use it) account, runs the searches you capture and sends the invitations and messages you set up. Receives your session cookies, browser user agent, language and time zone at connection time and on the 30-minute refresh, search addresses you capture, campaign recipients and message content.
  • Lusha: looks up business email and phone details when you choose to reveal them for a contact. Receives that contact’s name and LinkedIn URL.
  • FullEnrich (France): bulk contact enrichment when you choose it for a list. Receives the contacts’ names, employers and LinkedIn URLs.
  • Anthropic (United States): AI message drafting. Receives the brief you type and the role or sector, not your contact lists. Anthropic does not use this data to train its models.
  • Stripe: payments and subscriptions.
  • Google Workspace: sends sign-in codes and service emails.
  • Supabase: hosting of the database and server functions (London).

Where a provider processes data outside the UK, we rely on UK adequacy regulations or the International Data Transfer Agreement / Standard Contractual Clauses. We may also disclose data if the law requires it, or as part of a merger or sale of the business under the same protections. We never share data with anyone else, and never for their own marketing.

6. Your choices and rights

  • Withdraw consent at any time with the Withdraw consent link at the foot of the extension panel. The extension then stops reading pages and cookies and stops working until you agree again. To also stop campaigns and remove your LinkedIn connection, press Disconnect in Talent-Link first, or email us.
  • You can disconnect your LinkedIn account in Talent-Link at any time, and uninstall the extension from Chrome at any time. Uninstalling removes the data the extension holds on your computer.
  • Under UK GDPR you can ask to access, correct, delete, restrict or export your data, or object to how we use it. Email simon@talentleap.ai; we reply within one month at no cost.
  • If you are someone a Talent-Link customer has contacted, you can ask us to pass your request to that recruitment business, or contact them directly; we will help them respond.
  • You can complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113.

7. Changes to this policy

If we change how Talent-Link handles data, we will update this page and its date, tell current users by email before a material change takes effect, and ask for your agreement again in the extension.

8. Contact

TalentLeap AI Ltd · simon@talentleap.ai · talentleap.ai