1. Introduction

This Privacy Policy describes how Ascend Global Talent Solutions LLC ("we," "us," "our," or "Company") collects, uses, shares, and protects your personal information when you use our platform, including adjuma.io (collectively, the "Service").

We are committed to protecting your privacy and ensuring transparency about how your data is handled. If you have any questions about this Privacy Policy, please contact us at legal@adjuma.io.

2. Information We Collect

2.1 Personal Information You Provide

We collect information you voluntarily provide when using our Service, including:

• Registration information (name, email address, phone number)
• Profile information (background, skills, location, bio)
• Resume and curriculum vitae (CV)
• Job postings and descriptions you create
• Referral details and nominations
• Stripe Connect onboarding information
• Payment information processed through Stripe
• Information submitted through contact forms

2.2 Account Data

When you create an account, we collect:

• Email address
• OAuth identifiers (Google, LinkedIn)
• Account preferences and settings
• Password hash (never stored in plaintext)

2.3 Resume & Document Information

Resumes and documents you upload may contain:

• Full text and formatting
• Work history and employment records
• Education and certifications
• Contact details

2.4 Payment Information

Payment processing is handled securely through Stripe:

• Credit card information (processed and stored by Stripe, not on our servers)
• Billing address
• Transaction history and payment records
• Confidence Pool records and balances
• Stripe Connect account details for payouts

2.5 Reputation & Trust Score Data

We collect data to calculate and maintain your reputation profile:

• Referral history and outcomes
• Employer feedback and ratings
• Interview rates and conversion metrics
• Hire rates and placement success
• 90-day retention data
• Peer endorsements and recommendations
• Trust Score calculations and components

2.6 Usage Data & Analytics

We automatically collect information about how you interact with our Service:

• Pages visited and time spent
• Clicks and interactions
• Referral submissions and searches
• Search queries and filters applied
• Errors and technical issues encountered

2.7 Device & Browser Information

We collect technical information about the devices and browsers you use:

• Internet Protocol (IP) address
• Browser type and version
• Operating system
• Device type and model
• Cookies and similar tracking technologies

3. How We Collect Information

3.1 Direct Collection

We collect information directly from you when you register, complete your profile, upload documents, make payments, submit referrals, or contact us.

3.2 Automated Collection

We use cookies, web beacons, and similar technologies to automatically collect information about your browsing behavior, device, and interactions with our Service.

3.3 Third-Party Collection

We receive information from third-party service providers:

• Stripe (payment processing and account information)
• Google OAuth (account authentication)
• LinkedIn OAuth (professional profile data)
• Supabase (backend infrastructure)
• Resend (email delivery)

4. How We Use Information

We use the information we collect for the following purposes:

• Platform Functionality: Enabling you to create accounts, build profiles, submit referrals, and access the Service
• Account Management: Managing your account settings, preferences, and authentication
• Service Delivery: Connecting talent with opportunities, processing referrals, and delivering personalized recommendations
• Payment Processing: Processing payments, managing Confidence Pool balances, handling payouts, and administering Stripe Connect accounts
• Reputation System: Calculating and maintaining your Trust Score, collecting employer feedback, and tracking placement outcomes
• Communication: Sending you updates, notifications, and service announcements
• Analytics: Analyzing platform usage, improving the Service, and developing new features
• Rate Limiting: Preventing abuse and ensuring fair platform usage
• Legal Compliance: Complying with applicable laws, regulations, and legal obligations
• Security: Protecting against fraud, security breaches, and unauthorized access
• Marketing: Sending promotional content and offers (only with your consent)

5. How We Share Information

5.1 With Employers

We share talent profiles with employers in a privacy-preserving manner. Initially, employers view blind profiles without identifying information. Once you engage with a specific opportunity, we may share your full profile and contact information with that employer.

5.2 With Referrers

We share relevant information with users who refer talent, including job matches, payout information, and Trust Score metrics to help them track referral outcomes.

5.3 With Payment Processors

We share payment and account information with:

• Stripe (for payment processing and transaction management)
• Stripe Connect (for payout processing and account verification)

5.4 With Service Providers

We share necessary information with service providers who assist in operating our platform:

• Supabase (database and authentication services)
• Google & LinkedIn (for OAuth authentication)
• Resend (for email communication)
• Vercel (for hosting and deployment)
• Upstash (for rate limiting and caching)
• Mercury (for additional infrastructure services)

5.5 Data Sales Prohibition

We do not sell your personal information to third parties. We will not sell your data for monetary compensation or other consideration.

5.6 Legal Requirements

We may disclose your information when required by law, court order, government request, or when necessary to protect our rights, privacy, safety, or property.

5.7 Business Transfers

If Ascend Global Talent Solutions LLC is involved in a merger, acquisition, bankruptcy, or business transfer, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

6. Data Retention

6.1 Active Accounts

We retain your information for as long as your account is active or as needed to provide the Service.

6.2 Account Termination

After account termination, we retain minimal data for 3-7 years to comply with legal obligations and resolve disputes.

6.3 Resumes & Documents

Resumes and documents are retained for 1 year after account termination, then securely deleted.

6.4 Payment Records

Payment records are retained for 7 years to comply with tax and financial regulations.

6.5 Trust Score Data

Aggregated Trust Score data is retained indefinitely to maintain platform integrity and historical reputation metrics.

6.6 User Request

You may request deletion of your data at any time, except where retention is required by law. Contact legal@adjuma.io with deletion requests.

7. Data Security

7.1 Security Measures

We implement comprehensive security measures to protect your information:

• HTTPS/TLS encryption for data in transit
• Bcrypt password hashing for account security
• Role-based access control (RBAC) for staff access
• Row-level security (RLS) in our database
• Upstash Redis for secure caching and rate limiting
• Supabase Storage for encrypted file storage

7.2 No Guarantee

While we implement robust security measures, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your information.

7.3 Breach Notification

In the event of a data breach, we will notify affected users within 72 hours as required by GDPR and applicable privacy laws.

8. Your Rights

8.1 General Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Right to access your personal information
• Right to correct inaccurate information
• Right to delete your information
• Right to opt-out of marketing communications
• Right to download your data

8.2 California Residents (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following rights:

• Right to Know: Request what personal information we collect, use, and share
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt-out of personal information sales and sharing
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights
• Response Time: We will respond within 45 days of receiving your request
• Contact: Submit requests to legal@adjuma.io

8.3 EU Residents (GDPR)

If you are located in the European Union or European Economic Area, the General Data Protection Regulation (GDPR) grants you the following rights:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a portable format
• Right to Object: Object to processing of your data for specific purposes
• Right to Lodge a Complaint: File a complaint with your data protection authority
• Legal Basis: We process your data based on contract, legitimate interests, and consent
• Contact: Submit requests to legal@adjuma.io

8.4 Ghana Data Protection Act 2012 (Act 843)

If you are located in Ghana, the Data Protection Act grants you the following rights:

• Right to be informed about data collection and processing
• Right to access your personal data
• Right to object to processing of your data
• Right to prevent processing for direct marketing
• Contact: Submit requests to legal@adjuma.io

8.5 Exercising Your Rights

To exercise any of your privacy rights, send a request to legal@adjuma.io with "Privacy Request" in the subject line. Include details of your request and any relevant information to help us identify you. We will respond within 30-45 days, or longer if permitted by applicable law.

9. Cookies & Tracking

9.1 Cookie Use

We use cookies and similar technologies to enhance your experience:

• Essential Cookies: Required for platform functionality and security
• Preference Cookies: Remember your settings and preferences
• Analytics Cookies: Help us understand how you use our Service

9.2 Cookie Control

You can control cookies through your browser settings. Most browsers allow you to refuse cookies or alert you when cookies are being sent. However, blocking essential cookies may affect your ability to use the Service.

9.3 Third-Party Tracking

Our service providers may use cookies and tracking technologies to collect information about your browsing behavior and device for analytics and service delivery purposes.

10. International Data Transfers

10.1 Global Operations

We operate across multiple jurisdictions including the United States, Portugal, Ghana, and the United Arab Emirates. Your information may be transferred to and processed in these countries.

10.2 Data Transfers & Safeguards

We implement appropriate safeguards for international data transfers, including Data Processing Agreements (DPAs) with our service providers to ensure adequate protection.

10.3 EU Users

For users in the EU/EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission to ensure lawful data transfers outside the EEA.

10.4 Ghana Users

For users in Ghana, international data transfers comply with the Data Protection Act 2012 (Act 843) requirements for information transfer protection.

11. Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that a minor has provided us with personal information, we will delete such information and terminate the minor's account. If you believe a minor has provided information, contact legal@adjuma.io.

12. Third-Party Services

12.1 External Links

Our Service may contain links to third-party websites and services. We are not responsible for their privacy practices. Review their privacy policies before providing your information.

12.2 Service Providers

We work with the following third-party service providers:

• Stripe: Payment processing and Stripe Connect account management
• Supabase: Database, authentication, and storage services
• Google: OAuth authentication and services
• LinkedIn: OAuth authentication and professional profile integration
• Resend: Email delivery and notifications
• Vercel: Platform hosting and deployment
• Upstash: Rate limiting, caching, and Redis services

12.3 Data Processing Agreements

We have Data Processing Agreements (DPAs) in place with all service providers to ensure your personal information is processed securely and in compliance with applicable privacy laws.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. We will provide at least 30 days' notice before implementing material changes. Your continued use of the Service after updates become effective constitutes your acceptance of the revised Privacy Policy.

14. Contact Information

If you have questions about this Privacy Policy or our privacy practices, please contact us:

Response Times:

• EU/EEA residents: 30 days (extendable to 60 or 90 days as permitted by law)
• CCPA (California): 45 days
• Ghana DPA: 30 days