Privacy policy
Draft revised October 3, 2026. Effective date to be set on publication.
RPM Talent helps auto repair shops hire. That means handling information about job applicants and new hires carefully. This policy explains what we store, what we deliberately do not store, who we share it with and the choices you have.
1Who we are and our role
RPM Talent is a hiring and onboarding service for automotive repair businesses, operated by [RPM legal entity name], [address] (“RPM Talent,” “we,” “us”).
We handle personal information in two different roles:
- On behalf of shops. When you apply for a job at a shop that uses RPM Talent, or go through its hiring and onboarding, the shop is the business responsible for your information. We process it as the shop's service provider under a written agreement, and only to run the shop's hiring for it. Questions or requests about an application should go to the shop first; we will help them respond.
- For ourselves. For shop owners and staff who use RPM Talent, people who contact us, and visitors to this website, we decide how information is used and are responsible for it.
2What we route but never store
RPM Talent is designed to coordinate hiring steps without holding the most sensitive records. These items are entered directly with, or sent directly to, the provider that performs the step. They are never saved in RPM Talent's database or file storage.
| Information | Where it goes | What RPM Talent keeps |
|---|---|---|
| Social Security number, date of birth, driver's license number | Checkr, on Checkr's own secure page | Check status (for example clear or consider), package, cost and a link to the report on Checkr |
| Criminal history and motor vehicle record details | Checkr | Overall result only |
| W-4 withholding, direct deposit and bank account details | ADP or QuickBooks Payroll, in the provider's portal | The new employee ID and whether the handoff succeeded |
| Form I-9 identity documents | The shop's payroll provider or the shop directly | Nothing |
| Signed offer letters and signature records | Dropbox Sign | Offer terms, status and the date and time it was signed |
| Payment card numbers | Stripe | Billing status and the last four digits as shown by Stripe |
3Information we collect and store
Job applicants and new hires (on behalf of the hiring shop):
- Contact details: name, email, mobile number and ZIP code.
- Application details: resume file, years of experience, certifications such as ASE, answers to the shop's screening questions, how you heard about the job, and your text message consent.
- Assessment results, if the shop sends one: your answers to Big Five, DISC and Enneagram questions, the resulting trait scores, and a role-fit score.
- Hiring records: interview times, interviewer scorecards and notes, messages sent to you, offer terms such as title, pay rate and start date, and background check status.
- Onboarding answers: emergency contact, uniform sizes, a list of tools you bring, and typed acknowledgments of the shop's handbook and safety policies with a timestamp.
- After hire: 30, 60 and 90-day check-in survey answers and the shop's new-hire checklist.
Shop users: name, work email, phone, role, assigned location, password (stored only as a one-way hash), sign-in times and IP addresses, and the actions you take in the app.
Shop accounts: business name, locations and addresses, branding, plan, billing contact and integration connection details (access tokens are encrypted).
Website visitors: standard server logs such as IP address, browser type and pages requested. We use strictly necessary cookies to keep you signed in. We do not use advertising cookies or third-party tracking pixels on RPM Talent.
4How we use information
- To run each step of the shop's hiring process: receiving applications, screening, assessments, scheduling, offers, checks, onboarding and payroll handoff.
- To send the texts and emails the shop has set up, such as application confirmations, interview reminders and onboarding links.
- To secure the service: authentication, rate limiting, fraud and abuse prevention, and audit logging.
- To support shops, bill for the service and meet our legal obligations.
- To improve RPM Talent using aggregated or de-identified data that can't reasonably be linked to a person or shop.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use applicant information to market to applicants, and we do not combine one shop's applicant data with another's.
5Screening, assessments and automated scoring
Shops can set screening rules based on job-related answers, experience, certifications and commute distance. RPM Talent applies those rules and gives a score. Depending on the shop's settings, a low score may flag an application for review or close it. The shop chooses and controls these rules.
Assessment results produce a role-fit score that compares your traits to a benchmark for the job. Fit scores never reject an applicant on their own. They are one input shown to the shop alongside your application and interview. If you need an accommodation to complete an assessment, contact the shop; they can move your application forward without it.
6Text messages
If you agree when you apply, the shop will text you about your application through RPM Talent. Message frequency varies with your application. Message and data rates may apply. Reply STOP to any message to opt out, or HELP for help. Consent is not a condition of employment or of applying.
Mobile numbers and text consent are never shared with third parties or affiliates for their marketing.
8How long we keep information
| Record | Retention |
|---|---|
| Applicant and candidate records, including resumes | While the shop's account is active, until the shop deletes them, or until a verified deletion request. Shops are responsible for meeting their own record-keeping duties, which for many employers include keeping applications for at least one year. |
| Employee records, check-ins and checklists | While the shop's account is active or until the shop deletes them. |
| Message logs | Deleted with the candidate record they belong to. |
| Audit logs | Kept for [24 months], then deleted. |
| Shop account data after cancellation | Available for export for 30 days, then permanently deleted. |
| Encrypted backups | Expire on a rolling [35-day] schedule. |
9How we protect information
- All connections use TLS 1.2 or higher. Data is encrypted at rest with AES-256.
- Integration credentials are separately encrypted with AES-256-GCM before they are stored.
- Every database query is scoped to a single shop, so one customer cannot access another's records.
- Role-based access for shop users, password hashing, sign-in rate limiting and automatic sign-out after 30 minutes of inactivity.
- An audit log of sign-ins, record views, exports, deletions and setting changes.
- Resume files are stored privately and served only through short-lived links to signed-in shop users.
- Webhooks from connected services are signature-verified.
10Your privacy rights, including California
Depending on where you live, including California under the California Consumer Privacy Act as amended (CCPA), you may have the right to:
- Know what personal information we hold about you and how it is used and shared.
- Get a copy of it in a portable format.
- Correct information that is inaccurate.
- Delete it, subject to legal exceptions such as an employer's record-keeping duties.
- Opt out of sale or sharing. We do not sell or share personal information, so there is nothing to opt out of.
- Limit the use of sensitive personal information. We use account passwords and similar sensitive information only to provide the service.
- Not be treated differently for exercising these rights.
Applicants and employees: because the shop controls your hiring records, send requests to the shop. Shops can export a candidate's data or permanently delete it from inside RPM Talent. You can also email privacy@rpmtalent.app and we will pass your request to the shop and help it respond.
Shop users and visitors: email privacy@rpmtalent.app. We verify requests by confirming control of the email address on file, respond within 45 days, and may extend once by 45 days with notice. You may use an authorized agent with written permission.
Categories under the CCPA, last 12 months. Identifiers (name, email, phone, IP address); professional and employment information (resume, experience, certifications, offer terms); inferences (assessment trait and fit scores); internet activity (sign-in and audit logs); and account log-in credentials, a type of sensitive personal information. Sources are the person, the shop and connected services. Purposes and recipients are described above.
11Children
RPM Talent is not directed to children under 16, and we do not knowingly collect information from them. Shops are responsible for following child labor rules for any roles open to minors.
12Changes and contact
We will post changes here and update the revision date. For material changes affecting shops, we will also notify account admins by email at least 30 days before they take effect.
Questions or requests: privacy@rpmtalent.app, or [mailing address].