Legal Changelog

​

Third-party platform integrations and candidate data sources

• New Terms of Service Section 22 on third-party platform integrations such as LinkedIn: they’re optional and independent of the platform, you’re responsible for making sure your use fits your agreements with that platform, we aren’t liable for actions the platform takes against a connected account unless we caused them, and you indemnify us for claims arising from use that breaches the platform’s terms. Our security and DPA obligations are unchanged
• Privacy Notice Sections 2.1, 3, 4.1, and 5: Talent Search candidate data comes from third-party data providers and publicly available professional sources, not from connected LinkedIn accounts. The hiring organisation is the controller for this data. Section 11 on the browser extension is rewritten in plain terms
• DPA Section 3.5 and Annex I: candidate search, including Talent Search, added to the processing instructions, data subjects, data categories, and data sources
• Sub-processors: Unipile SAS entry now describes the LinkedIn Recruiter integration as independent and notes that Unipile’s network routing providers may operate outside the EEA, with restricted transfers governed by DPA Section 9
• New LinkedIn integration FAQ

• Connecting LinkedIn stays optional. Section 22 also applies to any other third-party platform integration you use
• If you use it, your organisation should confirm that it fits your LinkedIn agreement and internal policies
• If you don’t agree with these changes, tell us and stop using the Services before November 9, 2026. Sections 13 and 18 of the Terms of Service cover termination and refunds of unused prepaid fees

​

TypeSafe AI, Inc. added as sub-processor

• TypeSafe AI, Inc. added to sub-processors list (section 3.1, Primary infrastructure and AI processing)
• Flightcontrol removed from sub-processors list (no longer used)

• Text derived from candidate and job data is processed in the United States under EU Standard Contractual Clauses and the UK Addendum
• TypeSafe does not train models on customer data
• If you have concerns, you may reply to the change notice or email privacy@dweet.com within the notice period set out in DPA Section 8.2

​

Unipile SAS added as sub-processor for outbound messaging and LinkedIn Recruiter

• Unipile SAS added to sub-processors list (section 3.8, Outreach, messaging, and LinkedIn Recruiter integration)
• Used for sending and tracking candidate outreach messages via a unified messaging API
• Used for LinkedIn Recruiter connection, verification, project listing, and shortlist export flows
• Applies only to customers using outbound messaging and/or the LinkedIn Recruiter integration

• Data sent to Unipile’s API: candidate names and profile URLs (outbound messaging), outreach message content, LinkedIn session tokens (access token and premium token), browser user-agent, Recruiter contract identifier, and the IP address Nova’s server derives from the connect request. For shortlist exports, Nova sends the Recruiter project identifier and the LinkedIn profile identifier (public identifier / Recruiter provider id) of each candidate being added. Nova’s own export attempt history (success, partial success, or failure counts, and candidate-level attempt results) stays in Nova and is not sent to Unipile
• Data processed by Nova (not forwarded to Unipile) from the connect flow: extension version, browser family, the paired Recruiter tab URL, Nova’s detected LinkedIn surface and confidence score, cookie-presence flags, a short open-tab summary, and the Recruiter seat identifier used only as a transient safety signal during the connect flow (not persisted for later display), all used for pairing and safety checks before the session is imported
• Data processed exclusively in France (European Union), hosted on Scaleway
• Unipile is SOC 2 Type II certified and GDPR compliant
• No international data transfers required (EEA processing only)
• No impact if you don’t use outbound messaging or LinkedIn Recruiter integration
• If you have concerns, you may reply to the change notice or email privacy@dweet.com within the notice period set out in DPA Section 8.2

​

Mistral AI added as sub-processor (Talent Pool only)

• Mistral AI added to sub-processors list
• Used for OCR-based resume extraction
• Only applies to customers using Talent Pool features

• Resume PDFs are processed by Mistral’s OCR API (Talent Pool only)
• Data processed in the European Union
• Mistral does not use customer data for model training
• No international data transfers required (EEA processing)
• No impact if you do not use Talent Pool

​

Fireworks AI removed for OCR, restored for AI inference

• Fireworks AI removed from resume extraction pipeline
• Fireworks AI re-added for AI inference, embeddings, and fine-tuned model hosting
• Inference data is not stored or logged; content exists only transiently during request processing

​

Baseten Labs, Inc. added as sub-processor

• Baseten added to sub-processors list
• Processing in the United States and European Union
• Inference data is not stored or logged; content exists only transiently during request processing

​

Together AI, Inc. added as sub-processor

• Together AI added to sub-processors list
• Processing in the United States and European Union (Sweden)
• Inference data is not stored or logged; content exists only transiently during request processing

​

OpenRouter, Inc. added as sub-processor

• OpenRouter added to sub-processors list
• Processing in the United States and European Union
• Routes requests to underlying AI providers

​

Modal removed as sub-processor

• Modal removed from sub-processors list (previously section 3.8)
• Document conversion functionality now handled differently

• All new AI inference sub-processors handle data transiently with no persistent storage of customer content
• Standard GDPR transfer safeguards (EU SCCs, UK IDTA) apply for US processing
• No sub-processor uses customer data for model training
• If you have concerns about any new sub-processor, you may reply to the change notice or email privacy@dweet.com within the notice period set out in DPA Section 8.2, including your reasonable data protection grounds

​

Fireworks AI added as sub-processor (Talent Pool only)

• Fireworks AI added to sub-processors list
• Hosts our custom fine-tuned vision-language model for resume extraction
• Only applies to customers using Talent Pool features

• Resume PDFs are processed by our custom model hosted on Fireworks (Talent Pool only)
• Data processed in the United States
• Fireworks does not use customer data for model training
• Standard GDPR transfer safeguards apply
• No impact if you do not use Talent Pool

​

Analytics for authenticated users

• Product analytics (PostHog) enabled for authenticated users
• Privacy Policy Section 10 updated

• We collect usage data (pages viewed, features used)
• Data processed by PostHog in the EU
• No third-party advertising sharing