Talentwise AB Privacy Policy

About this document

This Privacy Policy applies to the collection and processing of personal data through the use of the Refapp website, including our help center and contact forms, owned and maintained by company Talentwise AB ("us", "we", or ”our").

Talentwise AB respects your privacy and the right to control your personal data. This Privacy Policy explains why we collect personal information about you and what we do with it, what personal information we collect, and who we may share it with. We encourage you to read the Privacy Policy carefully, as it also specifies the rights you have regarding your personal data and how you can exercise your rights.

When, how and why we collect personal data

  • We collect, store and process personal information about you for marketing purposes when you explicitly allow this. We use your personal data to market our services and to provide information about new services, newsletters and invitations to our events.
     
  • We collect, store and process your personal information when you contact us, for example, if you make an inquiry on our website, apply for a job, send us an e-mail or phone us. The personal data that you provide us with will be used for responding to your questions or requests and will be stored in our systems for administrative and back-up reasons.

The legal basis for our processing of your personal data is that processing is necessary for the purpose of the legitimate interests of Talentwise to provide its products and services, to provide support to our customers, to market our products and services and to respond to your questions and inquiry. 

What information do we collect from you?

Personal Data

The information we collect includes your name, e-mail, phone number, the content of your message to us and other information you provide us with. 

Usage Data

We might also collect Cookies and Usage Data from your activities on Refapp’s web page such as your computer's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our website that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

Tracking & Cookies Data

We use cookies and similar tracking technologies on our web site to track the activity on our Service and hold certain information. Read our Cookie Policy here. 

Transfer Of Data

Your information, including Personal Data, may be transferred to — and maintained on — computers located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction.

If you are located outside Sweden and choose to provide information to us, please note that we transfer the data, including Personal Data, to Sweden and process it there.

Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

Refapp will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy and no transfer of your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of your data and other personal information. 

What rights do you have to your information?

Our processing of your personal data is carried out in accordance with the European Data Protection legislation, which prevents us from making unlawful use of your personal data. 

At any time, you have the right to:

  • request a copy of the information that we hold about you
  • correct the data that we hold about you
  • ask for the data we hold about you to be erased from our records
  • ask for restriction of our use of your personal data
  • object to certain types of processing, such as direct marketing
  • have your personal data transferred to another organization

To exercise your rights, contact us at info@refapp.com

You also have the right to lodge a complaint regarding our processing of your personal data with the supervisory authority (in Sweden this is Integritetsskyddsmyndigheten).

Service Providers

Talentwise AB employs third party service providers to keep this website and its associated services running. During this process minimal personal information is processed by these parties.

HubSpot

HubSpot provides the hosting of this website as well as of the help centre. For this it processes some information such as IP address to make it possible to serve the website. HubSpot also tracks aggregated usage statistics without personal data and processes information provided by you through forms and other interactive elements.

Google Analytics

Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of our Service. This data is shared with other Google services. Google may use the collected data to contextualize and personalize the ads of its own advertising network.

For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy?hl=en

Others

At times, we might employ platforms to follow-up on ongoing advertising campaigns, such as LinkedIn. When these are active, you will be prompted by CookieBot to give consent about this usage.

Google Calendar integration and use of Google user data

Refapp offers an optional calendar integration that a user may connect to their own Google account. The integration is opt-in: nothing is accessed until the user completes Google's consent screen, and the user can disconnect at any time.

What we access

When the integration is connected, Refapp requests only these Google API scopes:

  • https://www.googleapis.com/auth/calendar.events — lets Refapp create, update and delete calendar events. Needed to place interview bookings on the user's calendar and keep them in sync when an interview is rescheduled, its participants change, or it is cancelled.

  • https://www.googleapis.com/auth/calendar.freebusy — returns busy/free time ranges only, with no event titles, descriptions or attendees. Needed to propose interview times that do not collide with the user's existing commitments.

  • https://www.googleapis.com/auth/userinfo.email — the email address of the connected Google account. Needed to show which account is connected and to associate the connection with the correct Refapp user.

Refapp requests the narrowest scopes that support these features. We do not request full calendar access or read access to the content of your other calendar events.

How we use it

Google user data obtained through the integration is used solely to provide the interview-scheduling features described above, at the user's direction. Refapp creates and modifies only the events it creates for Refapp interviews.

How we store and delete it

We store the OAuth tokens needed to maintain the connection, the connected account's email address, and identifiers for the events Refapp created. Tokens are stored encrypted and are used only to call the Google APIs listed above. When the user disconnects the integration, or revokes access from their Google Account permissions page, or their Refapp account is deleted, the stored tokens and associated integration data are deleted.

How we protect it

Google user data is protected by the same controls as the rest of the Refapp platform:

  • Encryption in transit. All traffic between your browser, Refapp and the Google APIs travels over HTTPS, using TLS 1.2 or TLS 1.3 with modern cipher suites and forward secrecy. Plain-HTTP requests are redirected to HTTPS.

  • Encrypted tokens. The OAuth access and refresh tokens for your Google account are encrypted with AES-256 before they are written to our database, each with its own initialisation vector, and are decrypted only at the moment a call to the Google APIs is made. They are never sent to the browser and are never exposed through the Refapp interface or API.

  • Secrets management. Encryption keys and OAuth client credentials are held in a managed secrets store, separately from the data they protect, and never in our source code.

  • Access control. A signed-in user can reach only their own calendar connection. Administrative access to production systems is limited to a small number of authorised Refapp personnel, requires multi-factor authentication, is granted on a least-privilege basis, and is restricted to approved networks.

  • Monitoring and network protection. Production traffic passes through a web application firewall, and our infrastructure is continuously monitored for threats and anomalous activity.

  • Minimisation and limited logging. We request the narrowest scopes that work (see above) and we do not store the contents of your calendar events. Free/busy availability is used to compute suggested interview times and is not kept as part of your Refapp record; it appears only in our technical request logs, which are encrypted and automatically deleted after 30 days.

What we never do 

Google user data is never sold, never used for advertising or advertising profiles, never used to train generalized or artificial-intelligence models, and never transferred to others except as necessary to provide the feature, to comply with applicable law, or as part of a merger or acquisition after notice to affected users. Humans do not read Google user data except with the user's explicit consent for specific support requests, where necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymized.

Limited Use

Refapp's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Questions about this integration: support@refapp.com.

Links To Other Sites

Our Service may contain links to other sites that are not operated by us. If you click on a third party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Children's Privacy

Our Service does not address anyone under the age of 18 ("Children").

We do not knowingly collect personally identifiable information from anyone under the age of 18. If you are a parent or guardian and you are aware that your Child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from children without verification of parental consent, we take steps to remove that information from our servers.

Changes To This Privacy Policy

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy, please contact us: info@refapp.com

Effective date: 2026-08-12