Privacy policy
Last updated: November 4, 2026. Version 1 of this document.
This policy explains which personal data we process when you visit the Talent360Marketing website, sign up or use the application, and what happens to the data each customer account stores in it.
1. Who is the controller
The controller of the data described in this policy is TALENT360HUB LLC, a Bulgarian company operating the Talent360Marketing brand, with registered and tax address at 10 Stefan Verkovich, Plovdiv 4000 (Bulgaria) and EIK/VAT number BG208378160. Its head office is at the European Trade Center, Building D, 1F, 115 M Tsarigradsko Shose Blvd., Sofia 1784 (Bulgaria), and its Western Europe office at Nevelgaarde 8, 3436 ZZ Nieuwegein (Netherlands).
For any privacy question, write to privacy@talent360hub.com. We have not appointed a data protection officer; that address is handled directly by the responsible team.
2. Two different roles: controller and processor
- We are the controller of the data of the people who use Talent360Marketing (each account's users), of the accounts' billing, of visitors to the public website and of people who write to us through the contact form.
- We are a processor of the data each customer account stores or generates in the application: its brands and projects, brand memory, strategies, content, campaigns, calendar, workflows, media library, SEO and GEO audits, keywords, reports and metrics, and the data of the networks and services it connects. That account is the controller and decides which data it stores and why. We process it only on its instructions, under the data processing agreement.
3. If you use Talent360Marketing
When you sign up or your company invites you, we process:
- Account: name, email, password (stored as a bcrypt hash, never in clear text), role, account, status, language, the date and version of these documents you accepted and, if you sign in with Google, your Google profile photo.
- Use of the service: what you do in the application is linked to your user (for example, who created or published a piece of content), activity and security logs, and the use of AI credits.
- Connected accounts: if your account connects social networks or other services, we store their access tokens encrypted together with the data needed to publish and to show metrics (see «Integrations»).
- Account and billing: company name, billing details (name or company name, tax ID, address and country), plan, credits and subscription data. Payment is processed by the payment provider on its secure page: we never see or store your card details.
- System administrators of Talent360Marketing: also their second sign-in factor (an authenticator app or a code by email).
- Support: if you use the chat or the tickets in the help panel, your name, your email and what you write in them, to help you (see «Support chat and tickets»).
4. If you visit the website or write to us
- Browsing: our server receives your IP address and the technical data of each request, which we use to serve the website, protect it from abuse and limit repeated attempts.
- Contact form: name, email, company if you give it, subject and message, to reply to you.
- Cookies: only the necessary ones, unless you accept analytics or marketing cookies (see «Cookies»).
5. If your data is in a customer account
If a company that uses Talent360Marketing includes your data in its content, campaigns, reports or connected networks, that company is the controller of your data and must tell you how it processes it. We only host and process that data on its behalf.
To exercise your rights, contact that company. If you write to us at privacy@talent360hub.com, we will forward your request to it.
6. Why we process data and on which legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Providing the service: accounts, users and roles, brands, content, publishing, workflows, reports and the integrations you enable | Account, use of the service, connected accounts | Performance of the contract (Art. 6(1)(b)) |
| Charging subscriptions, credits and Boost and meeting accounting and tax obligations | Account and billing | Contract (6(1)(b)) and legal obligation (6(1)(c)) |
| Security: authentication, second factor for administrators, abuse prevention, attempt limits, activity and error logs | IP, browser, technical logs | Legitimate interest in protecting the service and its users (6(1)(f)) |
| Giving you support through the chat and the tickets in the help panel | Support | Performance of the contract (6(1)(b)) |
| Replying to people who write to us | Contact form | Legitimate interest (6(1)(f)) and, if you ask for commercial information, pre-contractual steps (6(1)(b)) |
| Service emails: verification, password recovery, security codes, invitations, notices and billing | Name and email | Contract (6(1)(b)) |
| Analytics of the website and the application, and measuring our advertising campaigns | Cookies and identifiers, IP, browsing | Consent (6(1)(a)), which you can withdraw at any time |
| Keeping proof of your consent and of your acceptance of these documents | Choice, version, date, language, IP and browser | Legal obligation to be able to demonstrate it (6(1)(c) and Art. 7(1)) |
We do not sell personal data or use it to send third-party advertising.
7. Artificial intelligence features
The AI features (generating and adapting content and images, strategies, brand memory, SEO and GEO audits, keyword research and reports) send to OpenAI, through its API, the instructions you write and the data of the brand or project needed for each request: for example, the brand description, its audience and tone, the content to adapt or the URL to audit. Each request uses credits from your account.
Under its API terms, OpenAI does not use this data to train its models and keeps abuse-monitoring logs for up to 30 days, unless required by law. Results are generated automatically and may contain errors: review them before publishing them. Avoid including personal data of third parties in your instructions unless necessary.
8. Integrations your account connects
When an account connects an external service, we exchange data with it only for the feature that has been enabled: publishing content, reading metrics or syncing contacts and campaigns. That provider processes the data under the contract the account has with it.
- Social networks: Meta (Facebook and Instagram), LinkedIn, X (Twitter), TikTok and YouTube, to publish the content you schedule and read its metrics.
- Google Ads, Meta Ads, Google Analytics and Search Console: to read metrics of the connected properties and campaigns.
- Mailchimp, HubSpot and Talent360 CRM: to sync the lists, contacts or campaigns the account chooses.
- WordPress, Webflow and Shopify: to publish content on the connected site.
Credentials for these services are stored encrypted. When a connection is removed, its tokens are deleted.
To search images, audit the speed of a page or research keywords we use Unsplash, Pexels, Google PageSpeed Insights and DataForSEO. The request leaves our server with only the search terms, the URL or the keywords: these services do not receive your personal data.
9. How long we keep data
| Data | Period |
|---|---|
| User account and a customer account's data | While the account exists. To close it, write to us and we will delete it |
| Database backups | Up to 90 days |
| Payments and billing | 10 years, under Bulgarian accounting and tax law |
| Proof of acceptance of these documents | While the user exists |
| Record of cookie choices | 24 months; then deleted automatically |
| Contact form | As long as needed to answer you and, if you become a customer, for the duration of the relationship |
| Attempt-limit data (IP or email) | Until its window expires, between 1 minute and 1 hour |
| Data sent to OpenAI | Up to 30 days in its abuse logs |
10. Providers processing data on our behalf
| Provider | Purpose | Where |
|---|---|---|
| Hetzner Online GmbH (Germany) | Application server and database | Finland (EU) |
| DigitalOcean, LLC (USA) | File storage (media library, generated images and logos) and database backups | Amsterdam, Netherlands (EU); as a US entity, it may process data in the USA |
| Mailjet SAS (France) | Sending the service emails: verification, password recovery, security codes, invitations, notices and billing | EU |
| Dinahosting S.L. (Spain) | Our email mailboxes, such as the privacy address, where we receive and answer your messages | Spain (EU) |
| OpenAI Ireland Ltd. (Ireland) | AI features | USA, through its group |
| Stripe Payments Europe, Ltd. (Ireland) | Payment of subscriptions, credits and Boost | Ireland; the group also processes data in the USA |
With all of them, the corresponding regulatory framework under Art. 28 GDPR has been put in place, either by signing a data processing agreement or by accepting the Data Processing Agreements (DPAs) incorporated into their online terms of service.
Support chat and tickets. The chat and the tickets in the help panel are served by Talent360 CRM, another service of the same controller (TALENT360HUB LLC), hosted on the same infrastructure (Hetzner, Finland; files in DigitalOcean Spaces, Amsterdam). It is not a third party. If you use them, it receives your name, your email and what you write in the chat or the tickets, only to give you support.
If we enable PayPro Global, Inc. (Canada) as a payment method, it acts as reseller (merchant of record): it processes the payment and the invoice as an independent controller under its own privacy policy. Google, if you sign in with your Google account, and the analytics and advertising tools (Google and Meta), if you accept their cookies, also act as independent controllers. Providers of the integrations an account connects act under their own contract with it.
11. International transfers
When a provider processes data in the United States (DigitalOcean, OpenAI, Stripe and, if you accept their cookies, Google and Meta), the transfer relies on the EU-US Data Privacy Framework if the provider is certified, or on the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914). PayPro Global processes data in Canada, which has an adequacy decision. You can ask us for a copy of the safeguards at privacy@talent360hub.com.
13. Your rights
You can exercise the rights the GDPR gives you free of charge by writing to privacy@talent360hub.com. We will reply within one month. We may ask for additional information, only to check that you are who you say you are.
- Access: know what data we hold about you and what we do with it.
- Rectification: correct inaccurate data. You can change the language and your password yourself; for the rest, write to us or ask your account administrator.
- Erasure: ask us to delete data that is no longer necessary.
- Restriction: ask us to keep data without using it while a complaint is resolved.
- Portability: receive the data you gave us in a machine-readable format.
- Objection: object to processing based on legitimate interest.
- Withdraw consent when processing is based on it, as easily as you gave it. For cookies, use «Cookie settings» in the website footer.
14. Complaints to the supervisory authority
If you believe we have not handled your request properly, you can complain to the Bulgarian Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, cpdp.bg, or to the authority of the European Economic Area country where you live or work.
15. Automated decisions
We do not take automated decisions that produce legal effects on you or significantly affect you. The AI features generate proposals that each account reviews and decides whether to publish.
16. Minors
Talent360Marketing is a service for businesses and professionals. You must be over 18 to create an account. If you believe a minor has created an account, write to us at privacy@talent360hub.com and we will delete it.
17. Security
- The website is always served encrypted (HTTPS).
- Each account can only access its own data, and within it each user only what their role allows.
- Passwords are stored with bcrypt; sign-ins have attempt limits, changing your password or deactivating a user ends their sessions, and system administrators use a second factor.
- Integration credentials are stored encrypted, and private files are served through signed links that expire.
No system connected to the internet is completely secure. If a security breach put your rights at risk, we would notify the supervisory authority and, where appropriate, you and the affected account.
18. Changes to this policy
If we change anything relevant, we will update the date and version at the top and ask you to accept it again when you enter the application. If the tools that need your permission change, we will ask for your cookie choice again.
19. Other language versions
This document is published in English and Spanish. The translation is provided as a courtesy and, in case of discrepancy between versions, the English version prevails.