The short version
UTalento helps you explore your strengths, study and work paths, and wellbeing. We collect as little as we can to do that. We never sell anyone's individual results. Within your school, teachers and counselors see results for students in their own classes, the same way grades work today. Insights we share with employers or universities are always built from many people's answers combined, so no single person can be identified. This is also how we keep UTalento free for students.
Who we are
UTalento is operated by Talent Venture Studios AB (org. nr 559549-8329), Box 3053, 103 61 Stockholm, Sweden. We are the controller of the personal data described here. For anything about your data, contact us at viktor@talentventurestudios.com.
What we collect, and why
- If you use UTalento in a classroom (via a class code): a nickname you choose, and your answers in the activities: your interests and strengths profile (RIASEC), preferred ways of working, what you value in work, school subjects, and suggested study programmes. On the standard class-code path we do not ask for your name or email; your class code is the only link between your answers and your class. If your school uses sign-in accounts, we also store the email and password you register with.
- As you use the activities: we also record how you interact with them: which paths you open, how long you spend, and what you react to. This helps us understand what young people are curious about and make UTalento better.
- In the classmate (sociometric) activity: the classmates you choose for each question. This means we also process information about you that a classmate gave when they chose you. This activity only runs when your teacher switches it on, and its results are visible only to your teacher.
- If you use UTalento on your own (a personal account): the name and email you sign up with. The profile you build as you go (your goals, your interests, how you’re feeling about work, and your test results, including the personality and judgement readings) is saved to your account and stored on our servers at Supabase in the EU, so it follows you from one device to the next. A copy is kept on the device you are using as well, so the app can pick up where you left off. Only you see it. It is never shown to a school or an employer. If you use the AI guide, the profile context listed in the provider table below is sent with your question.
- As part of signing up: at the end of onboarding we give you a read of what you told us. To produce it, what you wrote about yourself, the goal you gave, how you said you are feeling, and the traits, strengths, motivators and interests in your profile are sent to our AI provider, OpenRouter, a US company that runs the AI model for us on approved hosting providers in the US. This happens as part of onboarding, not as a feature you switch on. See “Where it’s processed” below.
- If you apply to a job through UTalento: the name, email address, phone number, LinkedIn link, message and CV file you attach to that application are sent to the employer who posted the job. You choose whether to apply, and what to attach.
- If you’re a teacher: your email and password, your profile name, and the classes and activities you create. You can see the results of students in your own classes only.
- If you’re an employer: your company details and the job posts you create. When someone applies to one of your posts, you receive what they chose to send with it: their name, email address, phone number, LinkedIn link and CV file if they added one, their message, and their own stated practical fit (location, availability, languages, and what they wrote about themselves). You never see a person’s test scores, ranking, or match percentage.
- If you join the early-access waitlist: the email address you give us, the language you were browsing in, where you arrived from, the referral code we generate for you, and the code of whoever referred you. We also keep a log of the waitlist gate itself: when the page was seen, when you joined, when you came back to check your place, and whether an invite code was entered. We use this to run the queue, to send your invitation when your place comes up, and to see which channels bring people in.
- Everyone: basic technical data your browser sends (such as IP address and device type) and, if you accept analytics cookies, how the site is used. See our Cookie Policy.
Insights we create (and how UTalento stays free for students)
Running UTalento costs money, and we keep it free for students by creating insight reports for schools, employers, and universities, for example the kinds of work a year-group is drawn to, or how interest in a field is changing. These reports are always built from many people's answers combined, with a minimum group size, so that no individual can be recognised or singled out. We never share, sell, or show an individual's results, profile, or scores to an employer or any other organisation.
The grounds we rely on
| What | Ground (GDPR) |
|---|---|
| Running your account and the service | Contract, Art. 6(1)(b) |
| Your test, profile, and classmate answers (these can be sensitive) | Your explicit consent, Art. 9(2)(a); for classroom use, arranged through your school |
| How you interact with the activities | Your consent, Art. 6(1)(a); for classroom use, arranged through your school |
| Creating aggregated, non-identifying insights | Legitimate interests, Art. 6(1)(f), on data that no longer identifies you |
| Keeping the service secure and working | Legitimate interests, Art. 6(1)(f) |
| Analytics cookies (Google Analytics, PostHog) | Your consent, Art. 6(1)(a) |
| The AI features you choose to open: the guide, reading a CV you upload, grading a skill check, writing the level descriptions for a skill you add, and matching a dream job you type in Paths | Contract, Art. 6(1)(b). We cannot answer without sending your text to our AI provider. See “Where it’s processed” below. |
| The AI features that run as part of signing up: the read at the end of onboarding, and looking up a school name that is not in our list | Contract, Art. 6(1)(b). These are not features you switch on. They run as part of onboarding, and your text is sent to our AI provider when they do. See “Where it’s processed” below. |
| Running the early-access waitlist and sending your invitation | Contract and steps taken at your request, Art. 6(1)(b) |
| The log behind the waitlist gate | Legitimate interests, Art. 6(1)(f), to keep the queue working and to see where sign-ups come from |
You can withdraw consent at any time. For analytics, use “Cookie settings”, which sits on every page (in the footer where there is one, and in the corner of the screen where there is not): that stops the collection and deletes the analytics cookies and browser-storage entries already on your device. For anything else, email us and we will act on it. Withdrawing does not make what we did while the consent was valid unlawful, it just stops us going further.
We also keep a record of the cookie choice itself: a random consent id, whether you accepted analytics, which version of the banner you were shown, in which language, when it was decided, your browser’s user-agent string, and your account’s random user id if you were signed in. We keep it so we can demonstrate that consent was given or withdrawn, as the law requires. No IP address is stored.
Who can see it
- Your teacher and school see the results of students in their own classes.
- Employers, universities, and similar organisations receive aggregated insights, never an individual’s results. The one exception is an application you choose to send an employer, which carries the details you attached to it. We don’t sell individual data.
- The service providers below process data on our behalf, under contract. The “Where” column says where each one sits and, for the ones outside the EU/EEA, what the transfer rests on.
| Provider | What it receives | Where |
|---|---|---|
| Supabase | Database, file storage and sign-in. Your account (email, and a password stored only as a hash), your profile and your answers, including your personal-account profile and test readings, a CV file you upload, and your conversations with the guide. | EU (Stockholm region) |
| Vercel | Hosting. Every request to the site passes through it, including your IP address and device type. | US and EU. Requests are served from Vercel’s edge network, and our app itself runs in its US region. Email us for the transfer safeguards that apply and a copy of them. |
| Cloudflare | The anti-bot check on the sign-up screen. When you create an account, your browser loads Cloudflare’s challenge and we send your IP address to Cloudflare to confirm the check was solved by a real browser. It receives your IP address, your browser type, and the signals from that check. It never receives your answers, your profile or your results. | US. Cloudflare Inc. runs the check. Email us for the transfer safeguards that apply and a copy of them. |
| OpenRouter | The AI service behind every place where UTalento reads or writes text for you: the guide, the CV reading, the skill checks, the level descriptions written for a skill you add (the skill's name is sent), the read at the end of onboarding, matching a dream job you type in Paths, and looking up a school name that is not in our list. It receives what you write, including what you wrote about yourself and how you said you are feeling in onboarding, plus the profile context we attach to your question: the nickname you chose, your archetype and strongest traits, the career paths you saved, your current fit estimates, and readings from any work simulations you played. If you upload a CV, the text of that CV is sent as well. We never send your email address or password. | US. OpenRouter Inc. is a US company, and the transfer rests on the European Commission’s Standard Contractual Clauses. The AI models themselves are open models, including the vision model that judges the visual design of project work you upload, and we technically restrict every request so it runs only on hosting providers in the US that we have approved. Those providers may not train on your text or images, or keep them after answering. Email us for a copy of the safeguards. |
| PostHog | Product analytics, and only if you accept analytics cookies. It runs in the Space and University sections of the site, including the account gate you see before signing in. It receives which features you use, and your account’s random user id once you are signed in, otherwise a random device id. It never receives your name or email address. | EU (PostHog’s EU cloud) |
| Google Analytics | Website analytics, and only if you accept analytics cookies. It receives your IP address, your device and browser type, and which pages you open. Nothing at all is sent to Google before you opt in. | May transfer outside the EU, under Standard Contractual Clauses |
| Resend | Sends our transactional email: the security notice when your password changes, password-reset links, and early-access invitations. It receives your email address and the content of that email. It never receives your answers, profile or results. | US. Email us for the transfer safeguards that apply and a copy of them. |
| Formspree | Used on our employer page only. If an employer submits the hiring-signal form there, Formspree receives the company name, work email, phone number if one is given, and the hiring process they built in the calculator. Students and teachers never touch this form, and no student data goes through it. | US. Email us for the transfer safeguards that apply and a copy of them. |
Where it's processed
Your account, your profile and everything you build in UTalento are stored in the EU, in Supabase’s Stockholm region.
Some of the services we use are located outside the EU/EEA. Those transfers are set out below.
- Vercel hosts UTalento. Every request to the site, including your IP address and device type, passes through its infrastructure, and our app itself runs in a US region. Email us for the transfer safeguards that apply and a copy of them.
- We use an AI provider, OpenRouter, wherever UTalento reads or writes text for you: the guide, reading a CV you upload, the skill checks, writing the level descriptions for a skill you add, the read we give you at the end of onboarding, matching a dream job you type in Paths, looking up a school name that is not in our list, and grading the project work you check in on the university track, including files you upload. OpenRouter Inc. is a US company, and the transfer rests on the European Commission’s Standard Contractual Clauses. When one of these runs, the text you wrote is sent there, together with the profile context listed in the table above, and the full text of a CV if you upload one. When you check in project work, what you upload is read the same way: we extract the file’s text, and for a deck you upload as PDF, or a design image, the pages themselves are sent to a vision model so the visual design can be judged. The file itself is never stored. The AI models themselves are open models, and we technically restrict every request so it runs only on hosting providers in the US that we have approved. Those providers are not allowed to train on your text or keep it after answering, and your data at rest stays in the EU (Supabase). The guide, the CV reading, the skill checks, the skill level descriptions, the dream-job match and project check-ins are features you choose to open. The onboarding read and the school lookup are not: they run as part of signing up, so what you write about yourself in onboarding, the goal you give and how you say you are feeling are sent there whether or not you ever use the guide. Email us for a copy of the safeguards.
- Google Analytics may transfer data outside the EU, and only if you accept analytics cookies. Google relies on the European Commission’s Standard Contractual Clauses for those transfers.
- Resend, Formspree and Cloudflare are US companies. Resend receives your email address when we send you a transactional email. Formspree receives employer contact forms only. Cloudflare receives your IP address, your browser type and the signals from the anti-bot check, on the sign-up screen only. Email us for the transfer safeguards that apply and a copy of them.
How long we keep it
| Data | Kept for |
|---|---|
| Account data | While your account is open; deleted within 90 days of closure. |
| Classroom results | Until your teacher deletes the class. |
| Classmate (sociometric) answers | Deleted when the class is deleted. |
| How you interact with the activities | Kept for as long as we need it for the purposes above. There is no automatic expiry on it today, so email us and we will delete yours. |
| Personal-account profile (goals, interests, test readings) | Kept in your account while the account is open, and deleted when you ask us to delete it. The copy on your device stays until you clear your browser. |
| Early-access waitlist and gate log | Until you are invited and claim your place, or you ask us to take you out of the line. Email us and we delete your row and your entries in the log. |
| Analytics | Google Analytics keeps events for up to 14 months. PostHog keeps them for as long as our PostHog project holds them. Email us for the current setting. |
| Aggregated, non-identifying insights | May be kept indefinitely, as they no longer identify anyone. |
Automated profiling
UTalento turns your answers into a profile and suggestions: study paths, ways of working, fit with a role. It's automated, and it's there to inform you. It never decides anything about you on its own, and it never blocks you from applying anywhere. A suggestion is a starting point for your own choice, not a verdict.
Children
UTalento is used by people under 18. For anyone under 14, or for the parts that involve sensitive answers, the school or a guardian must give consent before the student takes part. That consent is obtained by the school or the guardian, and UTalento does not itself check that it was given. We keep what we collect from younger users to the minimum needed.
For schools and guardians: text a student writes is sent to our AI provider, OpenRouter, in the United States, as described under “Where it’s processed”. The model runs only on approved US hosting providers, which may not train on or keep the student’s text. The AI guide is one place where that happens, and the guide is optional. The read a student gets at the end of onboarding is not optional: as part of signing up, what the student wrote about themselves, the goal they gave and how they said they are feeling are sent to that provider, whether or not the guide is ever used. The same applies when a student types a school name that is not in our list. Project work a student chooses to check in is read the same way, including uploaded files; a deck uploaded as PDF, or a design image, is also read by a vision model to judge the design, and the file itself is never stored.
Your rights
You can ask us to show you your data, correct it, delete it, limit how we use it, or give you a copy to take elsewhere, and you can object to certain uses. Email viktor@talentventurestudios.com and we will help. You also have the right to lodge a complaint with a supervisory authority. In Sweden, the supervisory authority is Integritetsskyddsmyndigheten (IMY).