How your profile is shared

The consent you gave

When you signed up you ticked a box of its own, separate from the Terms of use, authorising Talpass to show your profile to verified work agencies. It is what makes you exist in the talent pool: without it there is nothing to show and no service to provide.

That is why it is a mandatory consent rather than an optional one: withdrawing it amounts to closing the account. It is done by writing to kayaosv@gmail.com.

This permission is for being seen. It is not a permission to open your documents: that one is separate, agency by agency, and is described further down.

What an agency sees about you

• Your first name and the initial of your surname, in the form «Carlos M.».
• Your age, as a calculated number. Never your date of birth.
• Your city and country of residence, and your nationality.
• Your work experience as you wrote it, and the sectors it is in with their months.
• Your English level.
• Whether you are available, and whether you need housing or transport.
• Seals that only say yes or no: identity verified, driving licence verified, tax identifier verified, whether there is a CV and whether there is a recording in English.

There is also an «IBAN on file» seal, which today always says no, because Talpass does not ask anybody for an IBAN yet.

That there is a CV and that there is a recording are announced as a yes or a no. The file itself is not there: the CV only opens with your permission, and the recording depends on a consent of its own that you can withdraw.

What it never sees without your permission

• Your full surname.
• Your email address and your phone number.
• Your postal address, which has its own rule: see below.
• Your exact date of birth.
• Your IBAN, under the same rule as your address.
• Any of your documents: ID card, passport, CV, licence, tax identification.

And it does not see them because it has no door to look through: an agency has no read permission on the tables where that data lives, not even partial, not even through an indirect query. Its only window is the pseudonymised view from the previous section.

That is enforced in the database and not on the screen. It is the difference between a guarantee and a habit: nothing here depends on somebody remembering to filter out a column.

How it asks you for a document

An agency that wants to see documents of yours has to request it, stating which ones it wants, and it can add a message. That request reaches you and you are the one who decides.

You have a deadline to answer. If you do not answer, the request expires by itself: silence grants nothing.

If you grant it, a window of time opens during which that agency — only that one — can open those documents — only those. They are two different clocks: one is your deadline to answer, the other is how long the granted access lasts.

An agency cannot have two live requests with you at the same time, so that nobody can keep pressing you until you give in.

Granting, refusing and revoking are your acts. An agency cannot change the state of its own request, and that is prevented in the database, not just in the interface.

How the file is opened, and what remains

When an agency with permission opens a document of yours, the server first checks that the permission is still alive and only then issues a signed link that expires within minutes. The files sit in private storage: there is no public address that leads to them.

In that same step the access log row is written: which document, who, when, from which IP and with which browser. There is no way to open a document without it being recorded.

The fact that the server checks on every single opening is what makes revoking take effect immediately.

Revoking

You can revoke a granted access before its window ends. From that moment on, the next opening is no longer authorised.

What is not deleted is the record that there was consent and of what was opened while it lasted. That is the point of it.

Your IBAN and address are only seen by the agency that hires you

Before it hires you, no agency sees them, not even with your permission: to decide whether it wants to hire you it does not need your IBAN or your address.

Once an agency hires you, it does need them: the IBAN to pay your wages and the address to register you. From that moment that agency sees them, and only that one. No other, not even one you have allowed to see your documents.

Today, on top of that, Talpass does not even ask you for them. The day it does, this document will say so before you are asked.

Your recording in English is separate

The recording has a consent of its own, optional and withdrawable with a button from your account. It is explained in its own document.