Privacy Policy
Last updated: 9 October 2026
Talent Flow provides a WhatsApp-based intake and messaging automation service for talent agencies. This policy explains what data we collect and how we use it.
Information we collect
When you interact with our service through WhatsApp, we may collect your phone number, your WhatsApp profile name, the content of the messages you send, and any files or media you share with us.
How we use data
We use this data solely to operate and improve the service: to greet and guide contacts, to record candidate and client-request information, to route conversations to a human when needed, and to maintain a history of the interaction for the agency you contacted.
Data sharing
We do not sell your personal data. Your information is made available to the specific agency you contacted so that its team can respond to you. We use WhatsApp (Meta) as the messaging channel, subject to their own terms and privacy policy.
Google user data
An agency can connect one Google account to Talent Flow so interviews appear in its Google Calendar with a Google Meet link. When it does, Talent Flow asks Google for three permissions: to see the list of its calendars (calendar.calendarlist.readonly), to see when it is busy (calendar.freebusy), and to create, change and delete events (calendar.events).
We use this access only to schedule interviews for that agency. We list its calendars so the agency can pick one. We read busy times so we never offer a time that is already taken. We create, update and cancel interview events with a Meet link and invite the people taking part. We read the events of the chosen calendar, and only that calendar, so the agency's team sees them next to its interviews in Talent Flow and so we notice when someone moves or deletes an interview in Google Calendar.
We store the Google refresh token on our servers encrypted with AES-256-GCM (see How we protect data) and the ID of the chosen calendar. For the events of the chosen calendar we keep a copy of the start and end time, the title, and whether the event is marked busy or cancelled; we do not keep descriptions, guests, locations or attachments. The copy only covers events from the last 30 days onwards, events are deleted 60 days after they end, and everything is deleted when the agency disconnects Google, removes our access at Google, or picks another calendar. We do not sell Google user data, use it for advertising, or use it to train AI models. People at Talent Flow do not read it, unless the agency asks us to for support, it is needed for security, or the law requires it. Google user data is never shared with anyone other than the agency that connected the account.
Google user data is never sent to any AI or machine-learning service, ours or a third party's. Calendar data is used only by ordinary code that schedules interviews; it is never part of a prompt, a transcription, or any other AI request, and it is never used to create, train or improve any AI or machine-learning model.
Talent Flow's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
An agency can disconnect at any time in Settings → Google Calendar. This deletes the stored token and revokes our access at Google. Access can also be removed at myaccount.google.com/connections.
How we protect data
We protect personal data, and Google user data in particular, with these measures:
- Encryption in transit. All traffic to and from Talent Flow, and all our calls to Google, WhatsApp and AI providers, goes over HTTPS (TLS). Plain HTTP requests are redirected to HTTPS.
- Encryption of credentials at rest. Google refresh tokens, messaging-channel tokens, API keys and other secrets that agencies connect are encrypted with AES-256-GCM before they are stored, with a key that is kept outside the database. Google access tokens are kept only in memory and never written to disk.
- Separate data per agency. Each agency's data, including its Google Calendar data, is kept in its own database with its own database credentials, so one agency's service cannot read another agency's data.
- Access control. Only signed-in members of the agency can see its data, and what each member can do depends on their role. Passwords are stored only as bcrypt hashes. Uploaded files and media are not public: they are served to signed-in members of the agency, or, when a file is sent to a contact over Messenger or Instagram, through a signed link to that one file that expires within an hour.
- Limited staff access. Only a small number of Talent Flow staff can reach the servers, using SSH keys rather than passwords. They do not look at agency data unless the agency asks for support, it is needed for security, or the law requires it, and admin access to an agency's portal is recorded in an audit log.
- Server hardening. Our servers run behind a firewall that blocks all incoming traffic except what the service needs, and are monitored for errors and unusual activity.
- Data minimisation. We keep only the data the service needs, and delete it on the schedules described in this policy.
- Incident response. If a security incident affects personal data, we will contain it, notify the affected agencies without undue delay, and notify the authorities where the law requires it.
AI services
Some optional features use third-party AI services: answers in the WhatsApp conversation, reading and drafting CVs, matching candidates to jobs, translating texts, and turning voice notes into text. When an agency turns one of these features on, the text or audio needed for that one request is sent to the provider the agency picked. Talent Flow does not route these requests through any aggregator, gateway or model hub; it calls each provider's API directly:
- Anthropic (Claude API,
api.anthropic.com): text features. - OpenAI (OpenAI API,
api.openai.com): text features if the agency picks OpenAI, and speech-to-text. - Groq (GroqCloud API,
api.groq.com): speech-to-text.
We use only these providers' paid business API services, under their commercial terms, never consumer apps such as ChatGPT or Claude.ai. Under those terms the providers do not use data sent through their APIs to train their models. Google user data is never sent to any of them.
Data retention and deletion
We keep your data only as long as needed to provide the service. You can request deletion of your personal data at any time by contacting us at ceo@wolfsteno.com. See our Data Deletion page for details.
Contact
For any privacy question, email us at ceo@wolfsteno.com.