Privacy Policy

Who we are

UTalento is operated by GradUnlimited AB (org. nr 559555-4949), Ranvägen 1, 187 70 Täby, Sweden. If you use UTalento through your school, the school is the controller of your data and we process it on the school's behalf under contract; direct questions about your data to your school. For personal accounts, GradUnlimited AB is the controller. For anything else, contact us at viktor@utalento.io.

What we collect, and why

• If you use UTalento in a classroom (via a class code): a nickname you choose, your first and last name, and your answers in the activities: your interests and strengths profile (RIASEC), preferred ways of working, what you value in work, school subjects, and suggested study programmes. We collect your name for your school’s sake: it is how your school knows which students are in the class. Only staff at your school (teachers, tutors and counselors) see your name, the same people who already know it. Your classmates only see your nickname, and your name never goes to employers, universities or anyone else outside your school. If you open UTalento Private yourself, the friends you invite there see your first name. If your school uses sign-in accounts, we also store the email and password you register with.
• As you use the activities: we also record how you interact with them: which paths you open, how long you spend, and what you react to. This helps us understand what young people are curious about and make UTalento better.
• In the classmate (sociometric) activity: the classmates you choose for each question. This means we also process information about you that a classmate gave when they chose you. This activity only runs when your teacher switches it on, and its results are visible only to your teacher.
• If you use UTalento on your own (a personal account): the name and email you sign up with. The profile you build as you go (your goals, your interests, how you’re feeling about work, and your test results, including the personality and judgement readings) is saved to your account and stored on our servers at Supabase in the EU, so it follows you from one device to the next. A copy is kept on the device you are using as well, so the app can pick up where you left off. Only you see it. It is never shown to anyone else. If you use the AI guide, the profile context listed in the provider table below is sent with your question.
• As part of signing up: at the end of onboarding we give you a read of what you told us. To produce it, what you wrote about yourself, the goal you gave, how you said you are feeling, and the traits, strengths, motivators and interests in your profile are sent to our AI provider, Microsoft Azure, in Sweden. This happens as part of onboarding, not as a feature you switch on. See “Where it’s processed” below.
• If you’re a teacher: your email and password, your profile name, and the classes and activities you create. You can see the results of students in your own classes only.
• If you join the early-access waitlist: the email address you give us, the language you were browsing in, where you arrived from, the referral code we generate for you, and the code of whoever referred you. We also keep a log of the waitlist gate itself: when the page was seen, when you joined, when you came back to check your place, and whether an invite code was entered. We use this to run the queue, to send your invitation when your place comes up, and to see which channels bring people in.
• Everyone: basic technical data your browser sends (such as IP address and device type) and, if you accept analytics cookies, how the site is used. See our Cookie Policy.

Insights we create (and how UTalento stays free for students)

Running UTalento costs money, and we keep it free for students by creating insight reports for schools and other organisations, for example the kinds of work a year-group is drawn to, or how interest in a field is changing. These reports are always built from many people's answers combined, with a minimum group size, so that no individual can be recognised or singled out. We never share, sell, or show an individual's results, profile, or scores to any third party.

The grounds we rely on

You can withdraw consent at any time. For analytics, use “Cookie settings”, which sits on every page (in the footer where there is one, and in the corner of the screen where there is not): that stops the collection and deletes the analytics cookies and browser-storage entries already on your device. For anything else, email us and we will act on it. Withdrawing does not make what we did while the consent was valid unlawful, it just stops us going further.

We also keep a record of the cookie choice itself: a random consent id, whether you accepted analytics, which version of the banner you were shown, in which language, when it was decided, your browser’s user-agent string, and your account’s random user id if you were signed in. We keep it so we can demonstrate that consent was given or withdrawn, as the law requires. No IP address is stored.

To create a personal account (outside a school) an email address is required: without it the account cannot be created and the signed-in service cannot be used.

Who can see it

• Your teacher and school see the guidance profiles of students in their own classes.
• Third parties only ever receive aggregated reports, never an individual’s results. We don’t sell individual data.
• The service providers below process data on our behalf, under contract. The “Where” column says where each one sits and, for the ones outside the EU/EEA, what the transfer rests on.

Where it's processed

Your account, your profile and everything you build in UTalento are stored in the EU, in Supabase’s Stockholm region.

Our AI features run on Microsoft Azure, in Sweden. When one runs, what you wrote and the profile details it needs are sent there. Microsoft may not train on it, and keeps it for up to 30 days only to detect misuse. Your data at rest stays in the EU (Supabase). The guide and the dream-job match are features you choose to open. The onboarding read and the school lookup are not: they run as part of signing up, so what you write about yourself in onboarding, the goal you give and how you say you are feeling are sent there whether or not you ever use the guide. One more place it runs is not about you at all: staff at a school can upload the school’s own subject sheet to their console so we can read the subject names off it. We extract the text, and for a photo of a printed page we read the letters off the image first. That text goes to the same provider under the same restrictions, it carries no student data, and the file itself is never stored. And on a school counselor’s console, to suggest three conversation questions for a student, we send the provider short codes about that student’s profile (for example that they opened two study paths, or a tag the counselor set) with the list of candidate questions. No name, no notes and nothing the student wrote are sent. And when a counselor searches the console’s job market for a job we do not hold, the job name they typed is sent to the same provider to read it as a job name, and to ESCO, the European Commission’s public job list, to find it. If it is not there either, the counselor can ask the same provider to write a short description of the job from its name. It carries no student data.

Some of the services we use are located outside the EU/EEA. Those transfers are set out below.

• Vercel hosts UTalento. Every request to the site, including your IP address and device type, passes through its infrastructure, and the app runs in an EU region. Vercel Inc. is a US company; email us for the safeguards that apply and a copy of them.
• Google Analytics may transfer data outside the EU, and only if you accept analytics cookies. Google relies on the European Commission’s Standard Contractual Clauses for those transfers.
• Resend processes our transactional email in its EU region (its parent company is American) and receives your email address when we send you an email. Formspree and Cloudflare are US companies. Formspree receives employer contact forms only. Cloudflare receives your IP address, your browser type and the signals from the anti-bot check, on the sign-up screen only. Email us for the transfer safeguards that apply and a copy of them.

How long we keep it

Automated profiling

UTalento turns your answers into a profile and suggestions: study paths, ways of working, fit with a role. It's automated, and it's there to inform you. It never decides anything about you on its own, and it never blocks you from applying anywhere. A suggestion is a starting point for your own choice, not a verdict.

Children

UTalento is used by people under 18. For anyone under 14, the school or a guardian must give consent before the student takes part. That consent is obtained by the school or the guardian, and UTalento does not itself check that it was given. We keep what we collect from younger users to the minimum needed.

For schools and guardians: text a student writes is sent to our AI provider, Microsoft Azure, in Sweden, as described under “Where it’s processed”. Microsoft may not train on the student’s text, and keeps it for up to 30 days only to detect misuse. The AI guide is one place where that happens, and the guide is optional. The read a student gets at the end of onboarding is not optional: as part of signing up, what the student wrote about themselves, the goal they gave and how they said they are feeling are sent to that provider, whether or not the guide is ever used. The same applies when a student types a school name that is not in our list. Separately, and not about any student: when school staff upload the school’s own subject sheet to the console, its text is read the same way, including the letters read off a photo, and the file itself is never stored. Also separately: when a counselor opens a student in the console, short codes about that student’s profile (never a name, a note or anything the student wrote) are sent the same way to suggest conversation questions.

Your rights

You can ask us to show you your data, correct it, delete it, limit how we use it, or give you a copy to take elsewhere, and you can object to certain uses. Email viktor@utalento.io and we will help. You also have the right to lodge a complaint with the supervisory authority in your country. In Sweden that is Integritetsskyddsmyndigheten (IMY); in Spain, the Agencia Española de Protección de Datos (AEPD).