Privacy Policy

Last updated: July 2, 2026

This Privacy Policy explains how NodeFlair Pte. Ltd. (UEN 201823536N), a company registered in Singapore, operating the HiddenList product ("HiddenList", "we", "us"), collects, uses, and shares information when you use our website and product at hiddenlist.ai and app.hiddenlist.ai (the "Service").

1. Information we collect

• Account information: name, email address, and company name you provide when you sign up.
• Sign-in information: if you sign in with Google or Microsoft, we receive your name, email address, and profile picture from that provider.
• Connected email account data: if you choose to connect a Gmail or Outlook account to use our outreach features, we access your email address and the metadata and content of messages sent through, or received in reply to, threads created by HiddenList — so we can deliver your outreach messages and detect candidate replies. We do not read or store the rest of your mailbox.
• Candidate data: information about professional candidates, sourced from publicly available sources and licensed data providers, used to power search results for our recruiter customers. This is not information about HiddenList account holders.
• Billing information: if you subscribe to a paid plan, payment is processed by Stripe; we do not store your full card number.
• Usage data: product usage such as searches performed and pages visited, used to operate and improve the Service.

2. How we use information

• To provide and operate the Service, including search, messaging, and outreach sequencing.
• To process billing and manage subscriptions.
• To communicate with you about your account or respond to support requests.
• To detect, investigate, and prevent fraud, abuse, and security issues.

3. Google user data

HiddenList's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only use Gmail data to power the email outreach and reply-tracking features you explicitly connect, and we never use this data for advertising or sell it to third parties. To detect whether an incoming message is a candidate reply, the reply's text may be processed by our AI service provider (OpenAI) solely for that classification — it is never used to train their models, for advertising, or sold.

4. How we share information

We do not sell your personal information. We share information only with:

• Service providers who help us operate the Service, such as our hosting provider, Stripe for payments, and data providers who supply candidate information.
• Google or Microsoft, solely to authenticate you or operate a feature you've explicitly connected.
• Authorities, where required to comply with the law or a valid legal process.

5. Data retention

We retain account data for as long as your account is active. If you disconnect a Gmail or Microsoft account, we revoke and delete the associated access tokens.

6. Your rights and choices

You can disconnect a connected Gmail or Microsoft account at any time from Integrations settings, which revokes our access immediately. To request access to, correction of, or deletion of your personal data, contact us at team@usetalentgpt.com.

7. Security

Data is encrypted in transit (TLS 1.3) and at rest (AES-256).

8. International data transfers

We may process and store information in countries other than your own. Where we do, we take steps to protect it consistent with this Privacy Policy.

9. Children's privacy

The Service is intended for business use and is not directed to children. We do not knowingly collect personal information from children.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above when we do.

11. Contact us

Questions about this policy? Email us at team@usetalentgpt.com, or write to NodeFlair Pte. Ltd. (UEN 201823536N), Singapore.