Privacy Policy

1. Information we collect

We collect information in three ways:

Information you provide

• Name, email, phone number
• LinkedIn URL, resume content, school, graduation year
• Work preferences (role type, company interests, compensation expectations)
• Assessment scores and responses (submitted through partner platforms)
• Company profile information, if you represent a hiring company

Information we receive from third parties

• Identity information from OAuth providers (Google, LinkedIn, GitHub, Clerk) when you sign in
• Assessment results from integrated assessment platforms
• Application tracking stage changes from company Applicant Tracking Systems, when a company has connected their ATS through Merge.dev

Information we collect automatically

• IP address, browser user agent, referrer URL, pages visited
• Timestamps of logins, status changes, and platform activity
• Error telemetry (via Sentry) to diagnose crashes and failures

2. How we use information

• Operate the Service: match candidates with companies, send batch drops, track placements
• Send transactional notifications: application outcome, offer received, next-step reminders
• Enforce slot retention rules and marketplace fairness through company activity review
• Invoice companies for the placement fee upon confirmed hires
• Prevent fraud, spam, and abuse
• Improve the Service — with aggregated, non-identifying analytics
• Comply with legal obligations

3. How we share information

With companies you are introduced to

Candidate profiles (name, LinkedIn, school, graduation year, preferences, assessment scores) are shared with companies during batch drops only when the candidate is eligible for that company's weights and has not opted out. After a candidate accepts a connection, Tapped shares contact information with the company to enable direct communication.

With service providers

Tapped uses vetted third-party processors to operate the Service. Each processes data only as instructed by Tapped:

• Google Cloud / Firebase — data storage, authentication, transactional messaging infrastructure
• Clerk — authentication for companies and administrators
• Resend — transactional email delivery
• Merge.dev — unified Applicant Tracking System integration (when a company connects an ATS)
• Sentry — error tracking and performance monitoring
• Vercel — application hosting

For legal reasons

We may disclose information if required by subpoena, court order, or other legal process, or to protect the rights, property, or safety of Tapped, its users, or the public.

We do not sell your personal information.

Tapped does not sell personal information as that term is defined under the CCPA.

4. Data retention

Tapped retains candidate data for as long as the account is active, and for a reasonable period after (up to 24 months) unless the candidate requests earlier deletion. Placement, invoicing, and engagement logs are retained for 7 years for financial record-keeping. You can request deletion at any time (see Your Rights below).

5. Data security

We use industry-standard security measures: encryption in transit (TLS), encryption at rest (Firestore default), role- based access controls, audit logging, and limited access to production data. No system is perfectly secure — if you become aware of a vulnerability, email security@jointapped.com.

6. International data transfers

Tapped is operated from the United States. If you access the Service from outside the US, your information will be transferred to and processed in the US. By using the Service you consent to this transfer.

7. Your rights

• Access — request a copy of the information Tapped holds about you
• Correction — correct information that is inaccurate
• Deletion — request that Tapped delete your account and associated data
• Opt-out of marketing — transactional emails (offer received, status updates) are operational and cannot be opted out of without deleting your account; any future marketing emails will include an unsubscribe link
• Portability — receive your information in a portable format

To exercise any of these, email privacy@jointapped.com. We will respond within 30 days, or as required by applicable law.

8. California privacy rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following rights in addition to those above:

• Right to know — the categories of personal information we collect, the sources, the business purpose, and the categories of third parties we share it with. All of these are described in this policy.
• Right to delete — subject to exceptions (financial records, fraud prevention, legal obligations).
• Right to correct — inaccurate personal information.
• Right to opt out of sale or sharing — Tapped does not sell personal information, and does not share it for cross-context behavioral advertising. There is no opt-out mechanism to activate because the practice does not occur.
• Right to limit use of sensitive personal information — Tapped does not use sensitive personal information for purposes beyond what is necessary to operate the Service.
• Right to non-discrimination — Tapped will not deny service, charge different prices, or provide a different quality of service because you exercised your CCPA rights.

Categories of personal information collected (per CCPA categories): identifiers; personal information under Cal. Civ. Code § 1798.80(e); characteristics of protected classifications under California or federal law (to the extent volunteered); professional or employment-related information; internet or other network activity; inferences. Sensitive personal information categories are not collected beyond what is necessary to operate the Service.

How to exercise rights: email privacy@jointapped.com with the subject line "CCPA request" and indicate which right you are exercising. Tapped will verify your identity before fulfilling the request. If you use an authorized agent, include written authorization.

9. Children

Tapped is not directed to children under 18 and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided information, contact privacy@jointapped.com.

10. Changes to this policy

Material changes to this policy will be announced by email or in-product notice at least 14 days before taking effect.

11. Contact

Questions about this policy? Email privacy@jointapped.com.