Privacy notice
Version 1.0 · effective 24 September 2026
Talent Mirror is a research tool built and run by Tonic Agency Limited (“Tonic”, “we”). It reads what employers publish about working for them, and what others say about them in public, and turns it into an analysis of how each employer presents itself. This notice explains what personal data that involves, why, and what you can do about it. It sits alongside Tonic’s privacy policy and Security & Trust Centre.
Who we are
Tonic Agency Limited, registered in England and Wales (company number 08035962), registered office Level 5a Maple House, 149 Tottenham Court Road, London W1T 7NF. We are registered with the Information Commissioner’s Office (reference ZC150873). For anything in this notice, contact our data protection lead at leantonio.nelson@tonic-agency.com.
Tonic is the controller of the personal data described here. Where we process personal data on a client’s instructions as part of an engagement, the contract between Tonic and that client sets out each party’s role.
Two groups of people
This notice covers:
- People who use Talent Mirror — Tonic staff, and people at Tonic’s clients whom Tonic has given a login. Nobody can create their own account.
- People whose public words Talent Mirror reads — for example the author of a public Glassdoor review, a LinkedIn post or a forum comment about an employer, or someone named in a news article about one.
If you use Talent Mirror
What we collect
- Your name, email address and, for Tonic staff signing in with Google, your profile photo.
- Your organisation or client, and what you are allowed to see and do.
- What you create: audit briefs and project descriptions, corrections to sources, decisions in the spot check, and the questions you ask the audit assistant.
- A record of significant actions — who started, approved, shared, exported or erased what, and when — kept for security and accountability.
- Technical error reports, with personal details switched off.
- If you agree to analytics cookies: how you use the site — pages visited and actions such as starting an audit or exporting a report — with pseudonymous identifiers, your device, browser and approximate location. Never your name, email address, audit titles or client names.
Why, and on what basis
- To provide the service to you and to the client you work for — performance of our contract with you or your employer, or our legitimate interest in providing a service our clients have engaged us for.
- To keep it secure, investigate misuse and fix faults — our legitimate interest in running a secure, working service.
- To meet our legal obligations, where they apply.
- To understand how Talent Mirror and its website are used, so we can improve them — your consent, given in the cookie banner and withdrawable at any time from Cookie settings.
If your public words are read by Talent Mirror
What we read, and from where
When Tonic runs an audit, Talent Mirror reads material about named employers that is openly available on the web: their careers sites and job adverts, their LinkedIn pages and posts, public employee reviews on Glassdoor and Indeed, news coverage and public forum discussions. It finds this through web search and by reading public pages. It does not sign in to any site, and it does not read private messages, closed groups or anything behind a login.
What we keep about you — as little as possible
We are interested in what is said about employers, not in who said it. Before anything is stored:
- the names of private individuals are replaced with “[name]” in what search returns to us;
- email addresses, phone numbers, usernames and links to personal profiles are removed;
- a link to a person’s own post or profile is reduced to the website’s address, so it no longer points to you.
What remains is short passages of text about an employer — for example a sentence from a review about pay — which are coded against Tonic’s twelve-factor framework and counted. Names that an employer publishes on its own careers pages are that employer’s publication and are kept as it published them. Senior leaders quoted speaking publicly for their company may be named.
Why, and on what basis
Our legitimate interest, and our clients’, in understanding how employers present themselves and how that compares with how they are seen. We have weighed that interest against yours: we use only material you chose to make public, we remove what identifies you, we never build a profile of any individual, and nothing we do leads to any decision about you. If you would rather your words were not used at all, tell us and we will remove them (see “Your rights”).
Automated processing and AI
Talent Mirror uses AI models to find material, to decide which of the twelve factors a passage speaks to, and to draft the written summary of an audit. It analyses employers, not people. It makes no decision about any individual and has no legal or similarly significant effect on anyone. Tonic staff review every audit before a client sees it. Under their commercial terms, our AI providers do not use the material we send them to train their models.
Who processes it, and where
Talent Mirror runs on Google Cloud in London (database and processing), Turin (exported files) and the Netherlands (the website). AI processing is provided by Anthropic in the United States. Error monitoring is provided by Sentry in the EU, and — only if you agree — usage analytics by Google Analytics. The full list is on the sub-processors page. We do not sell personal data, and we share it with nobody else except where the law requires us to.
International transfers
Sending material to Anthropic, analytics data to Google Analytics, and material to Google if our backup AI provider is used, transfers it outside the UK and EEA. Those transfers are made under the provider’s data processing terms, using the safeguards UK and EU law provide for such transfers — the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.
How long we keep it
| What | How long |
|---|---|
| Passages read and coded for an audit | Deleted 90 days after the audit’s report is complete |
| Passages from audits that were never completed | Deleted after 90 days without activity |
| Remembered classifications | Deleted after 90 days without being reused |
| Exported decks, PDFs and spreadsheets | Deleted after 30 days |
| Conversations with the audit assistant | Deleted after 180 days |
| Usage analytics (only with consent) | No more than 14 months in Google Analytics |
| The record of significant actions | Deleted after 12 months |
| Finished reports (which contain a few short quotes) | Kept as project records under Tonic’s retention schedule: three years after the engagement closes |
| User accounts | For as long as the login is active; removed when Tonic deletes it |
These deletions run automatically every night.
Security
Data is encrypted in transit and at rest. Every audit has its own access list, enforced on our servers as well as in the app, and client logins only ever see their own client’s audits. Our wider controls, and what we do if something goes wrong, are set out in Tonic’s Security & Trust Centre.
Your rights
You can ask us for a copy of the personal data we hold about you, to correct it, to delete it, to restrict how we use it, or to stop using it — and, where it applies, for a copy in a portable format. If your words appear in Talent Mirror and you want them removed, email leantonio.nelson@tonic-agency.com with the text or the name to look for. We can find it across every audit and replace it with “[removed]” wherever it appears. We will reply within one month.
You can also complain to the Information Commissioner’s Office at ico.org.uk, though we would be grateful for the chance to put things right first.
Changes
We will update this notice when what Talent Mirror does changes, and show the new version and date at the top, and tell users about significant changes.