Privacy Policy

1.Who we are

TalentOS is operated by El Roi Ventures, Nairobi, Kenya ("El Roi", "we"). El Roi is the data controller for platform accounts, AI features, Talent Radar and the employer marketplace.

Each institution (TVET institute, college or university) is the controller of its trainees' academic records and register, and El Roi processes those records on the institution's behalf under a data processing agreement. Each employer is a controller of the candidate data it receives when you apply or are shortlisted.

You can reach our Data Protection Officer at amitwashington7@gmail.com.

2.What we collect

We collect only what each feature needs:

• Account details: name, email address, mobile number, password (stored only as a secure hash), language and sign-in records.
• Institution records: admission number, programme, intake, classes, attendance, CAT and exam results, and attachment records, provided by your institution.
• Learning and career activity: progress, projects, practice answers, skills, CV text, applications and interview reports.
• AI interactions: your messages to the AI tutor, counsellor, interviewer and coach, transcripts and generated reports, when you have turned AI features on.
• Employer and mentor details: organisation name, KRA PIN, work contacts, job descriptions, mentoring sessions and feedback.
• Payments: invoices and M-Pesa transaction references. We never see your M-Pesa PIN.
• Technical data: IP address, device and browser type, and security logs, used to keep accounts safe.

The Data Collection & Usage Disclosure lists, for each type of user, what we collect, why, on what legal basis, who sees it and how long we keep it.

3.Why we use it, and our legal bases

• Contract: to provide the service you or your institution signed up for, such as accounts, classes, results, attachment, jobs and mentoring.
• Legal obligation: records your institution must keep, tax and payment records, protecting children's data and answering the Data Protection Commissioner.
• Legitimate interests: security, fraud prevention, fixing faults and improving the platform, balanced against your rights.
• Consent: AI features, video avatars, voice practice, being discoverable by employers, a public profile, non-essential SMS and marketing messages. You can withdraw consent at any time in Settings; this does not affect what was done before you withdrew.

4.AI features

When you turn AI features on, your messages and documents are sent to an AI model provider to generate replies, feedback, scores and drafts. Email addresses, phone numbers and admission numbers are removed before the request; only your first name is shared, so the assistant can address you. AI output is advisory: a person makes every decision about grades, admissions, hiring and offers, and we make no decision with legal or similarly significant effect by automated means alone.

Video avatars stream your camera and microphone to our avatar provider, Beyond Presence, only during the session. TalentOS does not store the video. Read How we use AI for details.

5.Who we share it with

• Your institution: its staff see your records for teaching, assessment and attachment, according to their role.
• Employers: only when you choose to be discoverable, apply for a job or are placed on attachment, and only what that step needs.
• Mentors: the details you share when you book a mentoring session.
• Service providers working for us under contract: hosting and backups, SMS (Africa's Talking), email, M-Pesa payments, AI model providers and the video avatar provider.
• Public authorities, when the law requires it.

We do not sell personal data.

6.Transfers outside Kenya

Some providers, including the AI model providers and the video avatar provider, process data outside Kenya. We use them only under contracts with appropriate safeguards, as sections 48 to 50 of the Act require, send them the minimum data, and keep a register of these transfers.

7.How long we keep it

• Accounts: for the life of the account. Closed accounts are anonymised 30 days after closure.
• AI transcripts, chats and reports: up to 365 days, and deleted at once when you withdraw AI consent.
• SMS records: 90 days. Security audit logs: 24 months. Expired sign-in sessions: 30 days.
• Institution academic records: as long as your institution's schedule requires. Official results may be kept after an account is erased.
• Payment and invoice records: as long as tax law requires.
• Backups: up to 35 days, after which erased data is gone from the backups too.

8.Your rights

Under the Kenya Data Protection Act, 2019 you have the right to:

• be told how your personal data is used;
• access your data and receive a copy in a portable format;
• have inaccurate or incomplete data corrected;
• have data deleted, or its processing restricted, where the law allows;
• object to processing, including profiling, and withdraw consent at any time;
• not be subject to a decision based only on automated processing that significantly affects you.

Once signed in, you can ask for a copy of your data or for its deletion under Settings, Privacy & consents. We answer within the time the law sets (usually 7 days for a copy and 14 days for deletion). Corrections to institution records go through your institution.

9.Trainees under 18

TalentOS is meant for people aged 18 and over. Institutions may register trainees under 18. For them, the institution obtains a parent's or guardian's consent (an SMS confirmation or the institution's attestation) before optional features such as AI avatars, voice practice or employer visibility can be switched on.

10.Security

We protect data with encryption in transit, hashed passwords, httpOnly session cookies, protection against forged requests, role-based access, audit logs and encrypted backups. If a breach puts you at risk, we notify the Data Protection Commissioner within 72 hours and tell you without undue delay.

11.Questions and complaints

Contact our Data Protection Officer at amitwashington7@gmail.com. If you are not satisfied with our answer, you may complain to the Office of the Data Protection Commissioner (ODPC) of Kenya at www.odpc.go.ke.

12.Changes to this policy

We publish each new version on this page with its effective date. If a change is significant, we ask you to read and accept it the next time you sign in.