Rights, approvals, data protection and the EU with Talents

• A talent's results only go further after its manager approves them.
• An e-mail draft is never “on its own”. The talent has no mailbox and sends nothing; a person sends it.
• A talent spends no money, orders nothing and concludes no contracts — it has neither a route nor access for that.
• Every action is logged; what a talent writes to third parties is labelled as an AI draft.

A talent has no access to personnel files, salary data or other systems — it only works with what it is given. For Leo in the HR team the blocked areas are additionally in fixed code, independently of the language model: no personnel files, no individual people's salaries or pay, nothing about health or sick notes, no warnings or dismissals, no assessments of people, no private data, no passing applicant data to third parties, no access to other systems.

Talents do not assess real people: no applicants, no CVs, no employees. A request to do so is recognised before the language model and politely declined. Only the talent itself is appraised — by its manager.

• Answers in conversation: a language model of a provider in Paris (EU). It receives the question, the conversation history and the description of the talent — no account data.
• Speech recognition: a service in Paris (EU). Audio only flows after you have pressed the microphone button and the browser has confirmed the permission; we store no recording.
• Speech output: a specialised voice service in the USA. It receives only the text to be spoken, nothing about the person.
• Camera: individual reduced still images to the language model in Paris, to no other provider; images are not stored.
• Tasks in “My team” and in day one: the language model from Paris, with the task and the material you paste for it.
• Storage: a database in Frankfurt — your organisation's hirings, tasks and results, review meetings, appraisals and log, strictly separated per tenant.

• Not stored: the history of a conversation with a talent, audio and camera images.
• Stored for your organisation: which talent is hired for what, with manager, role and approval levels; tasks with input, result and decision; review meetings, appraisals and the log.
• On dismissal: task content is deleted; review meetings, appraisals and log remain as the performance record.
• On the website: against misuse only counts per connection and day with a checksum instead of the IP address; for “Talk Leo into it” only the number of attempts per stage.

Talents are labelled as AI figures: on every page with a line at the edge (“portraits, voices and biographies are AI-generated or invented”), in the conversation window with a small “AI” label that shows the same sentence when you point at it. When asked, every talent says truthfully that it is an AI.

Towards third parties, an approved draft carries the note which AI talent created it and which person approved it. This follows the transparency obligation of the European AI Regulation (Art. 50).

For the data your organisation processes in Talents, Universe is the processor; the details are set out in the data processing agreement, and all service providers are listed in the privacy policy. For pasted content — such as an e-mail with third-party data — your organisation needs its own legal basis.

The AI Regulation requires every organisation that uses AI to ensure its employees have sufficient AI literacy (Art. 4). Talents makes this easier because limits, approvals and labelling are visible — the training itself remains the organisation's task. Whether a specific use is lawful depends on purpose and data; that is for your organisation and your data protection officer to assess.