Data Processing Agreement

Last Updated: October 14, 2026

1. Introduction and Parties

This Data Processing Agreement ("DPA") forms part of, and is incorporated into, the Terms of Service between IKP Global LLC, a New Jersey limited liability company that owns and operates the TalentMeta AI product ("Processor", "we", "us"), and the customer entity that has agreed to the Terms of Service ("Controller", "Customer", "you").

This DPA applies where and to the extent that TalentMeta AI processes Personal Data on behalf of the Customer in connection with providing the Service, and where such processing is subject to India's Digital Personal Data Protection Act 2023 (DPDP Act), the California Consumer Privacy Act (CCPA/CPRA), or other applicable data protection laws that impose obligations on data processors or service providers.

By accepting the Terms of Service, the Customer agrees to this DPA. Enterprise customers requiring a countersigned copy may contact us at connect@talentmeta.ai.

2. Definitions

  • "Personal Data" means any information relating to an identified or identifiable natural person ("data subject"), including candidate names, email addresses, resumes, interview recordings, and AI-generated assessments uploaded to or generated within the Service.
  • "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, disclosure, and deletion.
  • "Controller" means the Customer, who determines the purposes and means of processing Personal Data.
  • "Processor" means IKP Global LLC, the operator of TalentMeta AI, which processes Personal Data on behalf of the Controller.
  • "Sub-processor" means any third party engaged by TalentMeta AI to process Personal Data in connection with providing the Service.
  • "Applicable Data Protection Law" means India's DPDP Act, the CCPA/CPRA, and any other applicable privacy legislation that governs the processing of Personal Data covered by this DPA.

3. Roles and Responsibilities

The Customer is the Controller of Personal Data submitted to the Service. TalentMeta AI is the Processor. The Customer is responsible for:

  • Ensuring it has a lawful basis to collect and submit Personal Data to the Service (e.g., consent or legitimate use under the DPDP Act, or a permissible business purpose under the CCPA/CPRA).
  • Providing any required notices to data subjects (including candidates) about the processing of their Personal Data, including the use of AI-assisted tools.
  • Responding to data subject rights requests (access, erasure, portability, objection) and notifying TalentMeta AI where fulfillment requires action by the Processor.
  • Ensuring that its instructions to TalentMeta AI comply with Applicable Data Protection Law.

TalentMeta AI, as Processor, will:

  • Process Personal Data only on the documented instructions of the Customer (as set out in the Terms of Service and this DPA), unless required to do otherwise by applicable law.
  • Ensure that personnel authorized to process Personal Data are bound by appropriate confidentiality obligations.
  • Implement appropriate technical and organizational security measures as described in Section 6.
  • Assist the Customer, where technically feasible, in responding to data subject rights requests.
  • Notify the Customer without undue delay upon becoming aware of a Personal Data breach affecting Customer Data.
  • Delete or return Customer's Personal Data upon termination of the Terms of Service, as described in Section 8.

4. Nature, Purpose, and Duration of Processing

  • Nature: Hosting, storage, retrieval, AI-assisted analysis (resume scoring, interview evaluation, job description generation), and display of Personal Data within the Service.
  • Purpose: To provide the TalentMeta AI recruitment assistance platform to the Customer, including AI scoring, candidate tracking, and interview tools.
  • Categories of data subjects: Job candidates, applicants, and other individuals whose Personal Data the Customer uploads or generates within the Service.
  • Categories of Personal Data: Names, email addresses, phone numbers, resumes and CVs, employment history, educational background, AI-generated scores and assessments, interview responses (text and audio/video where applicable), and other information included in candidate profiles.
  • Duration: For the term of the Terms of Service. Following termination, Personal Data is preserved and can be exported on the Customer's request. It is deleted upon the Customer's written request (as described in Section 8), and may be deleted 24 months after termination on 30 days' written notice. An account with no activity for 12 consecutive months and no active paid subscription may be treated as terminated under the Terms of Service. Interview audio is deleted automatically 30 days after the interview is completed or cancelled.

5. Sub-processors

The Customer grants TalentMeta AI general authorization to engage sub-processors to assist in providing the Service, subject to the conditions in this section.

The current list of sub-processors includes:

  • Vercel, Inc. — Cloud hosting and infrastructure (USA)
  • OpenAI, L.L.C. — AI inference and language model services (USA)
  • Resend, Inc. — Transactional email delivery (USA)
  • Stripe, Inc. — Payment processing (USA) — processes billing data only, not candidate Personal Data
  • Our managed PostgreSQL provider — Database hosting (USA)

TalentMeta AI will inform the Customer of any intended addition or replacement of sub-processors by updating this DPA (with notice via the Service or email) at least 14 days before the change takes effect, giving the Customer an opportunity to object. If the Customer objects on reasonable data protection grounds and the parties cannot resolve the objection within a reasonable period, the Customer may terminate the Terms of Service. Refund eligibility (if any) for any unused prepaid period is governed by Section 8 of the Terms of Service.

TalentMeta AI will impose data protection obligations on each sub-processor equivalent to those set out in this DPA and will remain liable to the Customer for any failure by a sub-processor to fulfill its data protection obligations.

6. Security Measures

TalentMeta AI implements and maintains appropriate technical and organizational measures to protect Personal Data against unauthorized access, disclosure, alteration, or destruction, including:

  • Encryption of data in transit (TLS) and at rest.
  • Access controls and authentication (JWT-based session management, bcrypt password hashing).
  • Tenant isolation — each customer's data is logically separated and inaccessible to other tenants.
  • Regular security reviews and dependency updates.
  • Incident response procedures for Personal Data breaches.

These measures take into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to the rights and freedoms of data subjects.

7. International Data Transfers

TalentMeta AI is based in the United States. Processing of Personal Data of Indian data subjects involves a transfer of Personal Data to the United States.

For transfers subject to India's DPDP Act, TalentMeta AI transfers Personal Data to countries that are permitted under applicable rules issued by the Indian Government. The Customer, as Data Fiduciary under the DPDP Act, is responsible for ensuring that the transfer of Personal Data to TalentMeta AI is made on a lawful basis and with appropriate consent or legitimate use grounds.

8. Data Retention and Deletion

Upon expiry or termination of the Terms of Service, access to the Service ends immediately, but TalentMeta AI does not automatically delete Personal Data (other than interview audio, which is deleted automatically 30 days after the interview is completed or cancelled). The Customer may, at any time:

  • Request an export of Personal Data in a machine-readable format (CSV export); or
  • Request in writing that TalentMeta AI delete all Personal Data, or the Personal Data of specific candidates, which TalentMeta AI will do manually within 30 days of the request, unless applicable law requires retention or TalentMeta AI needs the data to resolve a dispute.

The Customer is responsible for exporting any Personal Data it needs to retain to satisfy its own legal or recordkeeping obligations (for example, employment recordkeeping laws) before requesting deletion.

Until the Customer requests deletion, TalentMeta AI will preserve Personal Data, including after subscription cancellation or account termination. TalentMeta AI may delete Personal Data from a terminated account 24 months after termination, after giving the Customer at least 30 days' written notice, unless applicable law requires a longer retention period or the data is needed for a legal claim or dispute. Personal Data may persist for a limited additional period in our subprocessors' encrypted backup systems before being overwritten in the ordinary course of backup rotation; such backup copies are not accessed except where required to restore the Service.

During the term, the Customer may delete individual candidate records through the Service interface. Deletion requests submitted through the Service are processed from active production systems on a reasonable-efforts basis, typically within 30 days.

9. Data Subject Rights

The Customer is responsible for handling data subject rights requests (access, erasure, rectification, restriction, portability, objection) received directly from data subjects. TalentMeta AI will provide reasonable technical assistance to the Customer to enable fulfillment of such requests where the requested action must be performed at the infrastructure level.

Data subjects wishing to exercise rights directly may also contact TalentMeta AI at connect@talentmeta.ai. TalentMeta AI will forward any such requests to the Customer as the Controller.

10. Personal Data Breach Notification

TalentMeta AI will notify the Customer of a Personal Data breach affecting Customer Data without undue delay after becoming aware of it. The timing of any specific notification will depend on the nature of the breach and the time reasonably needed to confirm scope and impact. Where feasible, notification will include:

  • A description of the nature of the breach, including the categories and approximate number of data subjects affected (to the extent then known);
  • The name and contact details of TalentMeta AI's data protection point of contact;
  • A description of the likely consequences of the breach (to the extent then assessed); and
  • A description of the measures taken or proposed to address the breach.

Information that is not available at the time of initial notification will be provided in phases as it becomes available. The Customer, as Controller, remains responsible for notifying the relevant supervisory authority (e.g., India's Data Protection Board) and affected data subjects within the timelines required by Applicable Data Protection Law.

11. Audit Rights

TalentMeta AI will make available to the Customer all information reasonably necessary to demonstrate compliance with the obligations in this DPA. Upon reasonable written request (with at least 30 days' notice), TalentMeta AI will allow for and contribute to audits conducted by the Customer or an auditor mandated by the Customer, at the Customer's expense, provided that:

  • Audits are conducted during normal business hours and do not unreasonably disrupt TalentMeta AI's operations;
  • The Customer and auditor execute a confidentiality agreement acceptable to TalentMeta AI before receiving any audit-related information;
  • No more than one audit is conducted in any 12-month period unless a breach has occurred.

12. Grievance Officer (India — IT Rules 2011)

In accordance with Rule 5(9) of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, TalentMeta AI designates the following Grievance Officer for customers and data subjects in India:

  • Organization: IKP Global LLC, operator of TalentMeta AI
  • Email: grievance@talentmeta.ai
  • Subject line: "India Grievance — [Your Name]"

Grievances will be acknowledged on a reasonable-efforts basis (generally within a few business days) and we aim to resolve them within 30 days of receipt, subject to the complexity of the matter and any verification reasonably required.

13. Conflict

In the event of any conflict between this DPA and the Terms of Service with respect to the subject matter of this DPA, this DPA will control.

14. Contact

Questions about this DPA or data protection practices: