Privacy Policy

1. Who We Are and How to Contact Us

Instalent is a professional sourcing and outreach platform operated by Sacore AB, a company registered in Sweden (the "Company", "Instalent", "we", "us", or "our").

• Controller: Sacore AB (registered in Sweden)
• Privacy contact: jon@instalent.io

This Privacy Policy explains what personal data we process, why, on what legal basis, who we share it with, how long we keep it, and the rights you have. It is written to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, and applicable US state privacy laws (such as the California Consumer Privacy Act as amended by the CPRA).

2. Our Role and the Scope of This Policy

Instalent serves three groups of people, and our role under data-protection law differs for each. To be transparent, this policy is organised around them:

• Part A — Sourced professionals. If your professional information was surfaced or enriched through Instalent because a recruiter or business searched for candidates or contacts, we act as a controller for that activity. Part A explains how we handle your data and the rights you have.
• Part B — Customers and website visitors. If you hold an Instalent account, contact us, or browse our website, we act as a controller for that data. Part B covers it.
• Part C — Customer-directed processing. When a customer selects contacts and runs outreach campaigns or saves profiles into their own workspace, the customer is the controller and we act as a processor on their documented instructions. That processing is governed by our Data Processing Agreement, not this policy.

Sections 8–13 (security, transfers, sub-processors, children, changes, your supervisory authority, and contact) apply across all parts.

---

Part A — Sourced Professionals

This part is for professionals whose information appears in, or was enriched through, Instalent because one of our customers searched for relevant candidates or business contacts. You do not need an Instalent account for this to apply, and we may not have contacted you directly.

3. What We Process and Where It Comes From

We process professional, business-context information only. This typically includes:

• Identification and professional profile: name, current and former job titles, employer, professional or work history, education, skills, and links to public professional profiles.
• Professional contact details: business email addresses and phone numbers, and professional social or networking profile links.

We obtain this information from:

• Publicly available professional sources on the open web; and
• Third-party professional-data and contact-enrichment providers that supply business-contact information.

We do not seek to process special categories of data (such as health, ethnicity, religion, or political opinions), and we instruct our providers and customers not to introduce such data into the platform.

4. Why We Process It, and Our Legal Basis

We process this information to operate a professional sourcing tool — that is, to help our customers (recruiters and businesses) identify and reach relevant professionals for recruitment and legitimate business-to-business purposes.

Our legal basis is legitimate interests (GDPR Article 6(1)(f)): our legitimate interest, and that of our customers, in operating and using a professional sourcing service. We have weighed this against your interests and rights. Because we process business-context professional information for a purpose you would reasonably expect within a professional setting, do not process special-category data, keep the data only as long as it stays relevant, and give you a clear and easy way to object, we consider this processing proportionate. You can ask for a summary of this balancing assessment using the contact details in Section 13.

5. Automated Processing and AI

To help customers assess relevance, Instalent may rank, score, or summarise profiles against the criteria a customer defines for a search. This supports a human user's own judgement — it does not produce legal effects or similarly significant effects on you by automated means alone, and the decision whether to contact, shortlist, or engage anyone always rests with the human customer. We do not use these features to make solely automated decisions about you, and we do not use sourced professional data to train general-purpose AI models.

6. Who We Share It With

• Our customers, who run the search or use the tool. From that point, the customer is responsible for how they use your information, and acts as a controller for their own activity (see Part C and the Data Processing Agreement).
• Our service providers (sub-processors) that help us operate the platform, as described in Section 10.
• Authorities or advisors, where we are legally required to disclose or need to establish, exercise, or defend legal claims.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

7. How Long We Keep It

We keep sourced professional information only as long as it remains accurate and relevant for sourcing, and we revalidate or delete it on a rolling basis — in practice, typically within three months — unless we have a legal reason to keep it longer. If a customer saves your profile into their own workspace, the customer becomes responsible for it as controller and applies its own retention rules.

Your Rights as a Sourced Professional

You have the right to access the information we hold about you, to have it corrected, to have it erased, to restrict its processing, and — because we rely on legitimate interests — to object to our processing at any time.

To exercise any of these rights, including to be removed from our sourcing data, use our opt-out form or email jon@instalent.io. We will action a valid request, including removal, without undue delay and within one month. You can also lodge a complaint with a supervisory authority (Section 12).

---

Part B — Customers and Website Visitors

8a. What We Collect About You

• Account information: name, email, password, and the organisation you represent.
• Usage data: how you use the platform, such as searches performed and profiles viewed, used to operate the service and manage fair use.
• Billing data: the information needed to take payment, handled by our payment providers — we do not store full card numbers.
• Communications: the content of messages you send us (for example, support or sales enquiries).
• Website and cookie data: as described in our Cookie Policy.

8b. Connected Accounts and Multi-Channel Integration

To provide our multi-channel outreach and unified messaging features, Instalent connects to the third-party accounts you choose to link. These connections are established and operated through Unipile, our multi-channel communication integration partner, with your explicit authorisation.

What we access: we access a connected account only to the extent necessary to provide the features you use — such as sending and receiving messages on your behalf and synchronising your own conversations into the platform.

What we do not do:

• We do not read, scan, index, or analyse the contents of your connected accounts beyond what is necessary to provide the features you actively use.
• We do not sell, rent, or share data from your connected accounts with third parties for their own purposes.
• We do not use data from your connected accounts for advertising, market research, or any purpose unrelated to providing the features you use.
• We do not access your connected accounts outside the scope of your use of the platform.

How connections are secured: account connections and the associated authorisation credentials are established and managed through Unipile. We do not require, store, or handle your account passwords directly. You can review Unipile's practices in the Unipile Privacy Policy. You can disconnect any connected account at any time from your settings, which revokes our access to that account.

Recommended (optional): as an extra precaution after disconnecting, you may also review the active-sessions or connected-applications settings of the underlying platform you linked, and revoke the session there if it is still listed.

8c. Why We Process It, and Our Legal Basis

| Purpose | Legal basis | | --- | --- | | Providing the platform and your account | Performance of a contract | | Billing and collecting payment | Performance of a contract; legal obligation | | Securing the platform and preventing abuse | Legitimate interests | | Improving and developing the service | Legitimate interests | | Sending service and (where permitted) marketing messages | Legitimate interests or consent, as applicable | | Meeting accounting, tax, and other legal duties | Legal obligation |

8d. How Long We Keep It

• Account data: until you delete your account, plus 30 days.
• Usage logs: up to 12 months.
• Billing and accounting records: up to 7 years, as required by law.
• Connected-account data: while the connection is active; on disconnection we revoke access and retain only what is necessary for audit, security, or legal purposes.

Your Rights as a Customer or Visitor

You have the right to access, correct, erase, restrict, and port your data, to object to processing based on legitimate interests, and to withdraw consent where we rely on it. To exercise these rights, email jon@instalent.io.

---

9. Data Security

We protect personal data using appropriate technical and organisational measures, including encryption in transit and at rest, role-based access controls, multi-factor authentication for privileged access, ongoing monitoring, and regular review of our security practices. No system is perfectly secure, but we work to protect your data and to respond promptly to any incident.

10. Sub-Processors and Service Providers

We rely on a small set of trusted providers to operate the platform, including:

• Cloud hosting and infrastructure (e.g., AWS, Google Cloud);
• Multi-channel communication integration (Unipile);
• Payment processing;
• Email delivery;
• Professional-data and contact-enrichment providers;
• Product and website analytics (privacy-friendly, processed in the EU); and
• Customer support tooling.

Each is engaged under terms that require appropriate confidentiality and security. A current list of our named sub-processors is available on request at jon@instalent.io.

11. International Data Transfers

We primarily process data within the European Economic Area. Where data is transferred outside the EEA or UK, we rely on an adequacy decision where one applies, or otherwise on appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with any additional measures required.

12. Children

Instalent is a professional tool intended for business use and is not directed at children. We do not knowingly process the personal data of anyone under 16.

13. Your Supervisory Authority and How to Reach Us

If you have a concern, please contact us first at jon@instalent.io. You also have the right to lodge a complaint with a data-protection supervisory authority — in Sweden, this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) — or with the authority in your country of residence or work.

14. Changes to This Policy

We may update this Privacy Policy as our service or legal obligations change. The "Last updated" date above always reflects the current version, and material changes will be made prominent on this page.