Legal

Privacy Policy

Last updated 5 November 2026

This policy explains how Turbin AI Inc. ("Turbin", "we", "us") collects, uses, shares, and protects personal data when you visit turbin.ai, sign up for our newsletter or community waitlist, ask us to introduce you to a consultant, or apply to join our consultant network. It also explains your rights under the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR).

Turbin is the data controller for the personal data described here. We are based in Montreal, Quebec, Canada. You can reach us about privacy at admin@turbin.ai.

This policy covers the turbin.ai marketing website. When you create an account and use our product applications, the in-product privacy terms presented at sign-up apply in addition to this policy.

1. Personal data we collect

We only collect what we need for the interactions you choose to have with us:

  • Newsletter and community waitlist. Your email address when you subscribe to our newsletter or join the community waitlist.
  • Introduction requests. Your name and email address, and details of the role or need you describe, when you ask us to introduce you to a consultant.
  • Consultant applications. Your full name, email address, LinkedIn profile URL, the ecosystem you work in, and the resume or CV file you upload, when you apply to join our consultant network.
  • Job matcher. When you set up the job matcher on our job board, the resume or CV you upload and what we read from it (your name, headline, contact details, LinkedIn profile, location, Workday modules, certifications and years of experience), your target salary, relocation preference, how actively you are looking, your email address, and the matches and corrections you confirm. We keep a resume as soon as you upload it, even if you do not finish the setup.
  • Search inputs. The text and criteria you enter into the matching tool on our homepage (such as required skills, modules, budget, and start date). Please do not enter sensitive personal data into this field.
  • Scheduling. If you book a call through the scheduling widget, the name, email, and booking details you provide to our scheduling provider (Cal.com).
  • Analytics and technical data. With your consent, your device and usage data through Google Analytics (see our Cookie Policy), including a truncated IP address, pages viewed, and approximate location. Our hosting provider also processes standard server logs (including IP address) to deliver and secure the site.

2. How we use your data and our legal basis

Under the UK GDPR and EU GDPR we rely on the following lawful bases:

  • To send our newsletter and community updates that you signed up for. Legal basis: your consent. You can withdraw it at any time using the unsubscribe link in any email.
  • To respond to introduction requests and enquiries and connect you with a suitable consultant. Legal basis: our legitimate interest in responding to people who contact us, and taking steps at your request before entering a contract.
  • To assess consultant applications and consider you for our network. Legal basis: taking steps at your request before entering a contract, and our legitimate interest in building our consultant network.
  • To run the job matcher: reading your resume, scoring job board roles against your profile, sending you a daily email of new matches, and introducing you to hiring managers looking for a profile like yours. We ask you before sharing your profile for any specific role. Legal basis: performing the service you agreed to when you set up the matcher. You can pause the matcher, unsubscribe from the emails or ask us to delete your profile at any time.
  • To measure and improve the site through analytics. Legal basis: your consent.
  • To operate, secure, and protect the site against misuse and fraud, and to keep records. Legal basis: our legitimate interest in running a safe service, and compliance with our legal obligations.

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and interests. You can object to this processing as described in section 6.

3. Cookies and analytics

We use a small amount of essential local storage to remember your cookie choice, and, with your consent, Google Analytics to understand how the site is used. We load analytics with consent denied by default, so no analytics cookies are set until you accept. Full detail, and a way to change your choice at any time, is in our Cookie Policy.

4. Who we share your data with

We do not sell your personal data. We share it only with service providers who process it on our behalf, under contract and on our instructions:

  • Google (Google Analytics and Google Fonts), for website analytics and typography.
  • Amazon Web Services, for secure storage of files you upload, such as resumes.
  • Cal.com, for call scheduling when you book a meeting with us.
  • Google (Gemini) and Anthropic (Claude), AI services that read uploaded resumes and job postings for us, so we can match you with roles.
  • Our hosting and email providers, to serve the website and to deliver the newsletter and transactional messages you request.

If you use the job matcher, we may also share your profile with a hiring manager at a company recruiting for a role that fits you, as part of that service. We only do this after you agree to be introduced for that specific role.

We may also disclose personal data where required by law, to enforce our terms, or in connection with a merger, acquisition, or sale of assets, in which case we will notify you of any change in how your data is handled.

5. International transfers

Turbin is based in Canada, and some of our providers are in the United States. When we transfer personal data out of the UK or the European Economic Area, we rely on an appropriate safeguard. Transfers to Canada are covered by the European Commission and UK adequacy findings for Canadian commercial organisations. Transfers to providers in the United States and elsewhere are protected by Standard Contractual Clauses (and the UK Addendum), or by a provider's certification under the EU and UK Data Privacy Framework. You can ask us for a copy of the relevant safeguard using the contact details below.

6. Your rights

Subject to the conditions in the UK GDPR and EU GDPR, you have the right to:

  • access a copy of the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data erased, and ask us to restrict how we use it;
  • receive your data in a portable format, or have it transferred to another provider;
  • object to processing we carry out on the basis of legitimate interests, including any direct marketing; and
  • withdraw consent at any time, without affecting processing already carried out.

To exercise any of these rights, email admin@turbin.ai. We will respond within one month. You will not have to pay a fee in normal circumstances.

If you are unhappy with how we have handled your data, you can complain to your local supervisory authority. In the UK this is the Information Commissioner's Office (ICO) at ico.org.uk. In the EU it is the data protection authority in your country of residence. We would appreciate the chance to address your concerns first.

7. How long we keep your data

We keep personal data only for as long as we need it for the purpose we collected it, and to meet our legal obligations. In practice:

  • Newsletter and waitlist data is kept until you unsubscribe or ask us to remove it.
  • Introduction requests and enquiry data is kept for as long as needed to handle your request and for a reasonable period afterwards.
  • Consultant application data is kept while we consider you and, if you join, for the life of that relationship.
  • Job matcher profiles, including uploaded resumes, are kept until you ask us to delete them.
  • Analytics data is retained by Google Analytics for up to 14 months.

When we no longer need personal data, we delete it or anonymise it.

8. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and reputable infrastructure providers. No method of transmission or storage is completely secure, but we work to protect your data and to address any issues promptly.

9. Children

Our website and services are intended for professionals and are not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you. Please review it periodically.

11. Contact us

For any question about this policy or your personal data, contact Turbin AI Inc. at admin@turbin.ai, or by post at our registered address in Montreal, Quebec, Canada.