Privacy policy

Who we are

MyTalentPool is recruitment software that helps teams manage roles, candidates, and placements. MyTalentPool is offered by Outboard Support Hub LLC, a company registered in Sheridan, Wyoming, USA (“Outboard Support”, “we”, “us”). Outboard Support is responsible for your personal data as described in this policy.

MyTalentPool is developed, hosted and operated on Outboard Support’s behalf by Nebula Inzhenering DOO (Tetovo, North Macedonia), an affiliated company under common ownership. Nebula processes personal data only on Outboard Support’s instructions and under a data processing agreement between the two companies.

For recruitment data that our customers add to MyTalentPool, such as candidate profiles, CVs and client briefs, the customer (the recruitment agency or employer) is the controller, and we process that data on the customer’s behalf.

Privacy contact: contact@outboardsupport.com

Nebula’s personal data protection officer: Marija Kocevska Cvetanovska, marija.kocevska@nebula.mk

What this policy covers

This policy describes how we handle personal data when you use:

• mytalentpool.ai — our marketing website (including the book-a-demo form).
• app.mytalentpool.ai — the signed-in web application for recruiters and hiring teams.
• Our online services — the platform that powers the web app, integrations, and the browser extension.
• The MyTalentPool browser extension — a side panel that helps signed-in recruiters save people from public professional profile pages they are viewing.
• Inbound email — addresses we provide so applicants can email CVs and applications into a customer workspace.
• Embedded application forms — forms our customers host on their own career sites that submit applications to us.

Data we collect and process

Marketing website

• Demo requests — name, work email, company, and role when you submit the book-a-demo form.
• Bot protection — verification data when human checks are enabled on the form.
• Server logs — standard connection metadata (for example IP address and browser type).

Web app (recruiters)

• Account and organisation data — email address, name, optional phone, preferences, organisation membership, roles, and sign-in session information.
• Client and project data — client records, role briefs, positions, proposals, matching results, tasks, and related recruitment workflow data you enter in the product.
• Candidate and talent-pool data — names, contact details, CVs and extracted profile fields, professional profile links, application sources, notes (including notes added from the extension), consent records where captured, and pipeline status.
• Files — CVs, attachments, images, and other uploads you or applicants provide.
• Product analytics — usage events, identifiers, and error reports to help us operate and improve the service (see Subprocessors).

Browser extension

• What it accesses — the address of the page open in your active browser tab, so it can tell when you are on a supported public professional profile page. The extension does not read page content from those sites and does not run code on them.
• What it sends to us — the profile page address, optional recruiter notes, and role selections when you add or shortlist someone. It uses the same sign-in session as the web app.
• What it does not do — it does not include its own product-analytics SDK; display data comes from MyTalentPool after you are signed in.

Inbound email

• Message details (sender, recipients, subject, body) and attachments sent to a workspace inbound address, used to create or update candidates and store résumés for that customer.

Public application forms

• Applicant-submitted fields (for example name, email, phone, professional profile link, cover letter) and uploaded CV files from our customers’ career sites.
• Consent information where the applicant gives it on the form.

Public profile imports and AI features

• When a recruiter imports someone from a public professional profile link (in the web app or extension), we may collect publicly available profile information through service providers and store it in the customer workspace.
• CV parsing, summaries, matching, and similar features may send relevant text to AI providers to deliver the functionality you request.

How we use personal data

• Provide, secure, and improve the MyTalentPool services.
• Authenticate users and enforce organisation access controls.
• Operate recruitment workflows (talent pool, shortlists, projects, submissions, and communications configured by customers).
• Process applications received by email or embedded forms.
• Run automated CV parsing, matching, and AI-assisted features requested within the product.
• Send transactional email (sign-in links, invitations, verification, and notifications configured in the product).
• Measure product usage and diagnose errors (analytics).
• Respond to demo requests from the marketing site.
• Comply with law and protect our rights, users, and candidates.

Legal bases (EEA/UK GDPR)

Where the GDPR applies, we rely on one or more of the following, depending on context:

• Contract — processing needed to provide the service to our customers and their authorised users.
• Legitimate interests — for example product analytics, security, and improving recruitment workflows, balanced against individuals’ rights.
• Consent — where required (for example certain applicant consents recorded via application forms).
• Legal obligation — where we must retain or disclose data to comply with law.

For customer recruitment data, the customer is the controller as described above. Customers are responsible for lawful grounds to process applicant and employee data in their workspaces.

Sharing and subprocessors

We use service providers that process data on our behalf, including for hosting, email delivery, analytics, AI processing, and collecting public profile information where you use those features.

• Hosting — Railway (EU, Amsterdam) for the application, database, and file storage.
• Cloudflare — marketing site, form protection, inbound email routing, and related edge services.
• PostHog EU Cloud — product analytics (Frankfurt, Germany).
• AI and automation providers — where you use parsing, matching, or public profile import features.
• Email delivery — providers we use to send transactional email.
• Demo notifications — when enabled, demo requests may be forwarded to our internal notification channel.

We do not sell personal data. We may disclose data if required by law or to protect rights and safety.

International transfers

Nebula Inzhenering DOO (Tetovo, North Macedonia) develops, hosts and operates MyTalentPool on Outboard Support's behalf and processes personal data there as Outboard Support's processor. The application, database and file storage are hosted on Railway in the EU (Amsterdam, Netherlands). Analytics run on PostHog EU Cloud (Frankfurt, Germany). Some AI and public-profile collection services we use may process data in the United States. Where personal data leaves the EU/EEA or North Macedonia, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and, where available, the EU-US Data Privacy Framework, under data processing agreements with our providers and between Outboard Support and Nebula.

Retention

We keep account and workspace data for as long as the account is active, and aim to delete it within 30 days after the account is closed or deletion is requested. Candidate CVs and the profiles extracted from them are kept while the workspace that uploaded them is active, or until the workspace or the candidate asks us to delete them (including via the data-removal link we provide). We aim to remove deleted data from our rolling backups within 30 days. Analytics events are kept for the retention period set in our analytics provider. Where the law requires us to keep data longer, we keep it only for that period.

Customers control much of the recruitment data in their organisation. Candidates may request deletion via links we provide (for example in rejection emails), and customers may delete or export data through the product where available.

Security

• Encrypted connections for web and API traffic.
• Access controls scoped to each customer organisation.
• Technical measures to protect inbound integrations and stored credentials.
• Suppressed email addresses are stored only in hashed form.

Your rights

If the GDPR or similar laws apply, you may have rights to access, rectify, erase, restrict, object, and port your personal data, and to withdraw consent where processing is consent-based. You may also lodge a complaint with a supervisory authority.

To exercise rights relating to data for which Outboard Support is the controller, contact contact@outboardsupport.com. For candidate data held on a customer’s behalf, contact that organisation (the controller) in the first instance.

Browser extension transparency

The extension’s purpose is to let signed-in recruiters add people from public professional profile pages to MyTalentPool or shortlist them for open roles. It accesses browsing activity only in the sense of reading the active tab’s address to recognise supported profile pages, and it sends personally identifying information only as described above (profile page address and related recruitment notes).

Changes

We may update this policy. We will post the revised version on this page and update the effective date.