1. Who is responsible (controller / 事業者)
Christopher (Chris) Snow, an individual based in Japan, operates this service personally and is the data controller (GDPR) and personal-information-handling business operator (APPI / 個人情報取扱事業者). “Talentako” and “Skills Observatory” (formerly “SkillsForge”) are brand and product names he uses; Talentako is not an operating legal entity.
Contact for all privacy matters: chris.snow@talentako.com
2. What we collect, and why (purpose of use / 利用目的)
a. Usage analytics — all visitors
- A random identifier generated in your browser (stored in
localStorage), a per-tab session identifier, the pages you view, and which product features you use (e.g. running a JD scorecard, using the role simulator). - Which sections of a page you reach and roughly how long each is on screen; which items you open (for example which role family, employer or skill); and the settings you choose in the interactive tools — a filter, a comparison, or the positions of the role simulator's sliders.
- Where the product could not answer you: an empty result, a comparison we decline to make because the evidence is too thin, or an error.
- Purpose: understanding which parts of the product are useful, which are never found, and which fail people — so that we can improve them or remove them. We use this to decide what to build and what to retire; we do not use it to profile you, target advertising, or make any decision about you.
- The browser identifier is random — it is not your name, email, IP profile, or an advertising ID, and it is never linked across other websites. If you are signed in, these events are also linked to your account, which is how we can tell a returning reader from a new one; while you are signed out they are not. We honour your browser's Do Not Track setting: with DNT enabled, no analytics events are sent at all.
b. Account data — only if you sign in
- Sign-in is offered through LinkedIn or Google. From whichever you choose we receive your name, your email address (if the account provides one), your profile photo, and an app-scoped identifier for that provider. We receive nothing else — no connections, no contacts, no CV, no work history.
- Purpose: operating your session, associating your product usage with your account, and (in future) managing paid subscriptions. Signing in is optional; the product works without it.
c. Content you submit
Two different things happen here, and we set them out separately.
- Job description text — analysed, never stored. Text you paste into an analysis tool (for example a job description in the JD scorecard) is sent to our AI processor and the result is returned to your browser. The text itself exists only for the duration of the request. If you choose to save a result to your account, we store only the derived summary — the tasks, skills and scores we computed — never the original text.
- Chat questions and answers — stored. When you use the “Ask the Observatory” chat, we store the question you typed and the answer you received, together with which internal lookups ran and how long the answer took, linked to your account. Purpose: the chat is new, and reading real questions and real answers is how we find the ones it gets wrong. Please treat the chat as a place to ask about the job-market data, and do not paste confidential or personal information into it.
- Feedback you send — stored. If you use the feedback form we keep what you wrote, any screenshot you attach, and your name and email, so that we can act on it and reply.
d. Technical logs
- Our hosting provider records standard server logs (IP address, request path, timestamp) for security and reliability, retained per its standard schedule.
We do not use advertising trackers or third-party marketing cookies, do not build cross-site profiles, and do not sell or rent personal data to anyone.
3. Legal bases (GDPR Art. 6)
- Legitimate interests — product analytics and security logging — linked to your account while you are signed in, as described in section 2a.
- Contract — operating your account and any subscription you take out.
- Consent — signing in with LinkedIn or Google (you actively choose to connect it); you may withdraw at any time by signing out and requesting deletion.
4. Processors and cross-border transfers (APPI Arts. 27–28 / GDPR Ch. V)
We use a small number of service providers ("processors") to run the product. Some are located outside Japan and the EEA (primarily the United States). We provide this information in line with the APPI's rules on third-party provision in foreign countries; each provider is bound by its own data-processing terms and safeguards (including EU Standard Contractual Clauses where applicable):
| Provider | Role | Location |
|---|---|---|
| Vercel Inc. | Web hosting, database (analytics events, account records) | USA / global edge |
| Third-party text-analysis provider | Automated analysis of the text you submit, and of the questions you ask the chat | USA |
| LinkedIn Corporation | Sign-in (OpenID Connect) | USA |
| Google LLC | Sign-in (OpenID Connect); business email for privacy requests | USA / global |
5. Retention
- Usage analytics events, and the chat questions and answers described in 2c: up to 24 months, then deleted. A weekly scheduled task performs the deletion.
- Account records (LinkedIn or Google sign-in): for as long as you keep the account; deleted on request.
- Job description text: not stored at all. A result you choose to save to your account keeps only the derived summary, until you delete it or ask us to.
- Feedback you send: kept while we act on it, and in any case no longer than 24 months, enforced by the same scheduled job; deleted sooner on request.
6. Your rights
Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests. You may also lodge a complaint with your supervisory authority.
Under the APPI you may request disclosure (開示), correction (訂正), cessation of use (利用停止), and cessation of third-party provision of your retained personal data, and we will respond as the Act requires.
To exercise any right, email chris.snow@talentako.com. We will verify your identity and respond without undue delay (within one month for GDPR requests; without delay under the APPI).
7. Cookies and local storage
We use no advertising cookies. We use: (a) localStorage/sessionStorage
for the anonymous analytics identifiers described above, and (b) strictly-necessary session
cookies if you sign in with LinkedIn or Google (to keep you signed in). Clearing your browser storage
removes the identifiers; a new random one is created on your next visit.
8. Security
All traffic is encrypted in transit (TLS). Analytics data is stored in access-controlled infrastructure; administrative access is limited to the operator and protected by authentication and network controls. No system is perfectly secure — if a breach affecting your personal data occurs, we will notify you and the relevant authorities as required by the GDPR and the APPI.
9. Children
The service is a professional workforce-analytics tool and is not directed at children under 16. We do not knowingly collect their data.
10. Changes
We will post any changes to this policy on this page with a new effective date. Material changes affecting signed-in users will additionally be announced in the product.
3 September 2026. Added the “Ask the Observatory” chat: the questions you ask and the answers you receive are stored for up to 24 months, which the previous version of this page did not say. Added the feedback form. Recorded that sign-in is available through Google as well as LinkedIn. Described the usage analytics more precisely — which sections of a page you reach, which items you open, the settings you choose in the interactive tools, and where the product failed to answer you.