TalentBoost - Privacy Policy

Who we are

TalentBoost is provided by ReGenerate Trust ("ReGenerate", "we", "us", "our"), a company incorporated in England and Wales under company number 12346123, with its registered office at Fivefields, 8-10 Grosvenor Gardens, London SW1W 0DH. ReGenerate is a charitable organisation committed to creating meaningful employment opportunities for people who face significant barriers to work.

ReGenerate is the Data Controller for personal data processed through TalentBoost. The tool is developed and maintained on our behalf by Torchbox Ltd.

If you have questions about this policy or wish to exercise your data-protection rights, please contact us at info@re-generate.org. Our ICO registration number is CSN4507867.

What this policy covers

This policy explains what personal data ReGenerate collects when you use TalentBoost, why we collect it, who we share it with, how long we keep it, and what rights you have over it.

It applies only to TalentBoost. It does not cover ReGenerate's main website or other services — for those, please see our main privacy policy at www.re-generate.org/privacy-policy.

For information about the cookies TalentBoost uses, see our separate Cookie Policy.

About TalentBoost

TalentBoost is an AI-enabled employer guidance tool that helps organisations identify the next best step towards recruiting people from under-represented groups — specifically care leavers, ex-offenders and young people who are not in education, employment or training (NEET). You interact with the tool through a free-form conversational interface to access tailored, evidence-based guidance drawn from trusted sources, including citations.

TalentBoost is currently in a pilot phase, operating with employers in the West Midlands. Its guidance reflects UK employment law and, where relevant, West Midlands-specific services and support programmes. It is not designed or validated for use outside the UK, and should not be relied upon in other jurisdictions where employment law or available services may differ.

TalentBoost is a decision-support tool, not an automated decision-making system. It surfaces guidance to help employers make better-informed choices — it does not make decisions about individual candidates or on behalf of users. Employers remain responsible for their own recruitment decisions and for compliance with applicable law and their own organisational policies. There are no user accounts, no file upload and no payment.

The personal data we collect

TalentBoost does not ask for your name, email address, employer or any other identifying information. It is designed to function without knowing who you are. Please do not provide any personal information when interacting with TalentBoost. The table below sets out the categories of data the tool does collect.

Category	What is collected and why
Conversation transcripts	Your messages and the tool's responses are stored in our database. Before each new conversation begins, you are asked to confirm via a checkbox that you will not enter personal details — your own or anyone else's — into the chat. If you include personal data contrary to this guidance, it will still be processed as described in this policy.
Derived conversation context	TalentBoost may automatically derive your professional role (for example, HR manager or hiring manager) from the content of your conversation. This is used to maintain useful context throughout your session and to tailor guidance to your situation.
Anonymous session identifier	A randomly generated identifier (UUID) is stored in a cookie in your browser. This allows the tool to retain your conversation if you refresh the page, and lets you return to a previous conversation in your browser history. It is not linked to your name or any real-world identity.
Consent record	When you confirm your agreement before starting a conversation, we record the fact and timestamp of that consent.
AI model query records	Our database stores records of queries made to the AI models that power TalentBoost. These are used for operational monitoring and contain no personal data beyond what may appear in a conversation transcript.
Server access logs	Visitor IP addresses and basic request metadata are recorded in server logs by our hosting provider and security layer. These are used only to operate the service and investigate security and abuse incidents — not for analytics or profiling.
Analytics data (with your consent)	If you opt in to analytics cookies, Google Analytics and Microsoft Clarity collect anonymised data about how the tool is used, to help us understand and improve it. You can opt out at any time — see our Cookie Policy.

A note on data about other people. You may be tempted to refer to a specific individual — a candidate, a colleague, or someone from one of the target groups — in your conversation. Please do not. This is separate from the general guidance not to include your own personal details.

We do not collect payment information or data about children. TalentBoost is intended for professional use by adults.

Lawful basis for processing

The lawful basis on which we process your conversation data is consent (Article 6(1)(a) of UK GDPR). At the start of each new conversation, you are asked to confirm your agreement via a checkbox before the conversation begins.

You can withdraw your consent at any time by contacting us at info@re-generate.org to request deletion of your data — please include your session ID (visible in your browser's address bar or cookies) so we can locate the relevant records. Withdrawing consent does not affect the lawfulness of any processing already carried out.

In some cases, we may need to process your personal information where necessary for our legitimate interests and/or to enable us to comply with a legal obligation.

How we use your data

As a charity, our purpose in operating TalentBoost is to give employers the information and confidence they need to offer meaningful opportunities to people who are too often overlooked. Everything we do with your data is in service of making that tool work well, safely and responsibly.

We use your conversation data to:

• generate the guidance you asked for, by passing your messages to our AI systems and returning a relevant, evidence-based response with source citations
• allow you to return to a previous conversation in your browser history, using the anonymous session identifier stored in your browser
• review response quality — ReGenerate staff can access conversation transcripts to assess whether TalentBoost is providing accurate, useful guidance and to make improvements
• monitor for abuse and misuse — transcripts are reviewed to detect and respond to attempts to use TalentBoost for unintended purposes or to generate inappropriate content
• carry out expert human evaluation — a panel of independent subject-matter experts in employment and rehabilitation reviews sampled transcripts where specialist judgement is required
• run automated quality evaluation — a separate AI model evaluates production transcripts against quality metrics; only derived scores and pseudonymised samples are retained from this process
• investigate and resolve technical errors

We do not use your data to train, fine-tune or improve any AI model — our contracts with AI providers prohibit this. We do not use it for profiling, marketing or advertising, and we do not sell it to third parties. We will only share personal data outside the sub-processors listed below where we are required to do so by law, or where we need to share information with our professional advisers to understand our legal rights and obligations.

Who can see your data

The following people and systems may access your conversation data (but, as noted, the conversation data cannot be tied to you, and we request that you do not provide any identifying information about you or any other people):

• ReGenerate staff with administrator access can view conversations, messages, AI model call records and generated artefacts for quality monitoring, support, debugging and abuse investigation. They cannot edit or delete records through the admin interface.
• Torchbox staff, as the developer and maintainer of TalentBoost, have equivalent administrator access for the same operational purposes during the pilot period.
• A small panel of independent subject-matter experts in employment and rehabilitation may review sampled transcripts as part of structured quality evaluation, under appropriate confidentiality arrangements.
• An automated quality evaluation system — a separate AI model — reviews production transcripts to generate quality metrics. Only metric scores and pseudonymised samples are retained from this process; raw transcripts are not stored for evaluation purposes.
• Our sub-processors (listed below) access data only to the extent necessary to provide their specific services.
• We may disclose data to a court, regulator or law enforcement body where we are legally required to do so.

Sub-processors

To operate TalentBoost, ReGenerate uses the sub-processors listed below. Each works under a Data Processing Agreement, and international transfers are covered by the safeguards indicated.

Provider	Purpose	Data processed	Location	Transfer safeguard
Microsoft Azure (Foundry)	AI inference and text embedding — your messages are processed by AI models to generate responses	Conversation content	EU (Sweden Central)	No international transfer
Firecrawl	Live web search — the AI retrieves up-to-date information from a defined list of permitted websites on your behalf	AI-generated search queries (not your raw messages)	United States	Standard Contractual Clauses
Anthropic, PBC	Provides the model used to score sampled transcripts for quality	Sampled transcript content	United States	Standard Contractual Clauses
Heroku (Salesforce)	Application hosting and primary database	All categories listed in this policy	EU (Ireland); encrypted backups in United States	Standard Contractual Clauses for US backup transfers
Amazon S3	Storage of guidance documents that form the tool's knowledge base	Guidance documents only — not user conversation data	United States	Standard Contractual Clauses
Cloudflare, Inc.	Edge security and content delivery (DDoS protection, firewall, rate limiting)	Visitor IP addresses and request metadata	Global network, including United States	UK Extension to EU-US Data Privacy Framework
Functional Software, Inc. (Sentry)	Error tracking and monitoring	Stack traces from server errors, which may incidentally include user-submitted text	United States	Standard Contractual Clauses
SolarWinds Worldwide, LLC (Papertrail)	Log aggregation for incident investigation	Server access log lines, including IP addresses	United States	Standard Contractual Clauses
Google LLC (Google Analytics)	Usage analytics — only active with your consent	Anonymised usage data	United States	Standard Contractual Clauses
Microsoft Corporation (Microsoft Clarity)	Usage analytics — only active with your consent	Anonymised usage data	United States	Standard Contractual Clauses

Data retention

We hold personal data only for as long as needed for the purposes described in this policy.

Conversation transcripts — messages, responses, inferred role context and generated artefacts are retained for the duration of the TalentBoost pilot and for a defined analysis period afterwards, to allow quality monitoring, expert evaluation and pilot reporting to be completed. Data will then be permanently deleted. A scheduled deletion process will be in place before the pilot concludes.

The anonymous browser ID - expires after 10 days without a visit.

Exported chat transcripts - used for review are held by authorised staff and deleted once the review they were taken for is complete.

Encrypted database backups — backups taken before deletion may continue to hold the same data until they age out of Heroku's backup retention window. We do not access backup contents except to restore from a disaster.

Server access logs — including those aggregated by Papertrail — kept for each provider's standard period and used only for security, abuse investigation and error diagnosis.

Error telemetry — data held by Sentry is retained for a rolling window of 30 to 90 days.

Microsoft - may keep conversation transcripts for abuse monitoring before deleting it, under the terms of our account. It is not used to train models.

Analytics data — data collected by Google Analytics and Microsoft Clarity is subject to those providers' own retention periods.

Keeping your data secure

We apply technical and organisational measures to protect your data against unauthorised access, loss or disclosure. These include access controls limiting who can view conversation data, encrypted data storage and transmission, and secure software development practices throughout the build and operation of the tool.

However, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us using the details set out at the top of this Policy.

Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right to be informed about how your data is processed — this policy fulfils that right
• Right of access — to request a copy of the personal data we hold about you
• Right to rectification — to ask us to correct inaccurate data
• Right to erasure — to request deletion of your data in the circumstances set out in Article 17
• Right to restrict processing — to ask us to limit how we use your data in the circumstances set out in Article 18
• Right to withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal
• Right to data portability — to request that we transfer data you have provided to us, where Article 20 applies
• Right to complain – to make a complaint to us directly about how we handle your personal data.
• Right not to be subject to solely automated decision-making with legal or similarly significant effects — as described above, we do not carry out any such processing through TalentBoost

To exercise any of these rights, contact us at info@re-generate.org. You will not be charged for making a request, unless it is manifestly unfounded or repetitive. Please be aware that we may be unable to provide these rights to you under certain circumstances, for example if we are legally prevented from doing so or can rely on exemptions.

Because TalentBoost has no user accounts and does not collect your name or contact details, we cannot reliably identify your specific conversation from our records alone. To fulfil a rights request we will normally need your session ID or chat ID — visible in your browser's address bar or browser cookies — to locate the relevant data.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/concerns. We would welcome the opportunity to address any concern before you approach the ICO, so please consider contacting us first.

Changes to this policy

We may update this policy from time to time as TalentBoost develops or where required by law. The date at the top of this page shows when it was last changed. Where changes are material, we will communicate them via a notice within the tool.