How the TalentVault Candidate Importer Chrome extension collects, transmits, stores and shares candidate information, and how TalentVault handles that data.
Last updated: 15 October 2026
This Privacy Policy describes how TalentVault Technologies ("TalentVault", "we", "us" or "our") handles data in connection with the TalentVault Candidate Importer Chrome extension ("the extension") and the TalentVault recruitment platform available at talent-vault.in.
The extension lets a recruiter import a candidate's public profile into their TalentVault account. It is a recruiter-initiated tool: nothing is collected, extracted or transmitted until the recruiter explicitly triggers an action inside the extension.
The extension is used by recruiters and hiring teams who already have a TalentVault account and are signed in. The candidate whose profile is imported is the data subject; the recruiter performing the import is the data controller of the candidate record they create in their TalentVault workspace.
When a recruiter opens a LinkedIn or Naukri profile page and clicks "Extract Candidate Data", the extension reads the information that is already visible on that page. No background or automatic collection occurs, and the extension does not access data the recruiter cannot already see on the page.
Extraction starts only when the recruiter:
The extracted information is then displayed in the side panel for the recruiter to review and edit. The recruiter can also enter candidate details manually ("Manual Mode") without extracting anything from the page.
Candidate data extracted by the extension is held only in the side panel's in-memory form while the panel is open, so the recruiter can review and edit it. This data is not written to chrome.storage.local, is not persisted to disk by the extension, and is discarded when the panel is closed.
The only value the extension stores in chrome.storage.local is an optional, developer-only API base URL override (apiBaseUrl). The extension ships with no API keys, secrets, or credentials.
Candidate data is transmitted to TalentVault's servers only when the recruiter takes an explicit action, always over HTTPS (TLS):
POST to https://talent-vault.in/api/v1/candidates/import/.POST to https://talent-vault.in/api/v1/enrichment/person/ to look up contact details.These requests include the recruiter's TalentVault session cookies and a fresh CSRF token. The extension authenticates as the signed-in recruiter and does not embed any secret or API key.
When a recruiter saves a candidate, TalentVault creates or updates a candidate record in the recruiter's workspace, including:
parsed_json) for reference.If a candidate already exists (matched by email, phone, or profile URL), the import updates the existing record instead of creating a duplicate.
For enrichment, only validated email/phone values are written to a matching candidate, and existing real contact details are never overwritten.
TalentVault uses imported candidate data to:
TalentVault does not sell candidate data and does not use imported candidate data for advertising.
LinkedIn and Naukri. These are the sources of the visible profile data. The recruiter opens these pages directly in their own browser; TalentVault does not transmit candidate data to LinkedIn or Naukri.
TalentVault's hosting and storage providers. TalentVault runs on its own servers (talent-vault.in, hosted on Render) and stores uploaded files on Amazon Web Services S3. These providers host TalentVault's infrastructure and process data on TalentVault's behalf; they are not the recipients of a separate data transfer from the extension.
Contact enrichment. By default, the "Find Email" / "Find Phone" / "Enrich" feature matches the candidate against TalentVault's own people/contact database — no external enrichment service is involved. TalentVault may configure an external enrichment provider in the future; if it does, only the candidate's name, company, title, location and profile URL would be shared with that provider to look up contact details.
No other third parties. The extension does not transfer candidate data to any other third party. It does not use Google OAuth scopes or Google APIs.
All communication between the extension and TalentVault's servers uses HTTPS (TLS). TalentVault authenticates requests against the signed-in recruiter's session and validates a CSRF token to prevent cross-site request forgery. Contact details are stored only after validation, and profile text is sanitised on the server before it is saved.
No method of transmission or storage is completely secure, and TalentVault cannot guarantee absolute security of candidate data.
Imported candidate records are retained in the recruiter's TalentVault workspace until the recruiter (or a TalentVault administrator) deletes them, or until the account is closed. TalentVault does not currently apply an automatic retention period to imported candidate records.
Deletion requests. Candidates may request access to, correction of, or deletion of their data by contacting TalentVault at Talentvault2020@gmail.com. Recruiters can also delete candidate records from their workspace at any time. We will action verifiable requests in accordance with applicable law.
TalentVault complies with the Chrome Web Store User Data Policy. The extension only collects, transmits and stores candidate data for the purposes described in this policy, and the extension's access is limited to the permissions declared in its manifest (activeTab, scripting, sidePanel, storage) and host permissions for talent-vault.in, linkedin.com and naukri.com.
The extension does not request restricted Google OAuth scopes and does not access, use or transfer Google user data. Because no Google user data is collected, there is no Google user data that could be shared with third parties. If this changes in a future version, this policy will be updated and the relevant disclosures added before the change ships.
If you have questions about this policy, or wish to make a privacy or deletion request, contact us at:
https://talent-vault.in