Toptal Privacy Summary

The one thing to know: screening means handing over ID and a biometric check

Toptal's identity checks send a photo and government ID to LexisNexis, which uses Veriff for facial recognition. LexisNexis deletes the biometric data within 24 hours of sending the result, and the policy says Toptal does not receive that data itself. Biometric data is kept no longer than its purpose or three years after your last interaction with Toptal, whichever is earlier. The policy also says Toptal may record and transcribe audio and video calls, and that background checks can be part of screening. ^{[1] [2]}

Before you start a screening, check which calls are recorded and which background checks you have agreed to. The sign-up page says meetings made through Toptal's systems may be recorded or monitored, so assume a screening call is on the record. ^[2]

Identity checks: what talent hand over

Talent give Toptal a name, contact details, address, work and education history, references, a photo, a government ID, social network information and billing details. Those details are kept as long as Toptal reasonably needs them. Signing up also means accepting a 'Sourced Talent Matching Agreement', which sets the fee and contract terms for talent. Ask Toptal for its text before you sign. ^{[1] [2]}

Clients: payment data and a possible credit check

Clients give Toptal names, job titles, payment and company details. Toptal may run a credit check before services begin. Payment data goes to service providers, including Stripe, which handles payments. ^[1]

Where your data goes

Toptal is based in the United States and sends data to US servers as needed to provide its services. The policy says US data protection law may be less strict than, or different from, the law where you live. It shares data with service providers for analytics, digital advertising, hosting, CRM, billing and payments, and background checks, and in a business sale, merger or similar event. It says it does not sell personal information, and the California section says it has not sold personal data in the last twelve months. ^[1]

AI and your data

Toptal's policy does not mention AI or machine-learning training on your profile or work. It does say the identity-check vendor, LexisNexis, uses verification data to improve its identity-verification technology. Toptal's ExpertCrowd is a separate AI training-data product, sold to companies rather than to talent. Ask Toptal in writing before you share a portfolio you cannot reuse. ^{[1] [4]}

How to delete your data

1. Finish or cancel any engagement that is still active, because cancellation of the client subscription counts only when none is.
2. Give written notice at least three business days before the next billing date, under the platform terms.
3. Email the privacy address in Toptal's policy to ask for deletion of your personal data.
4. Expect marketing preferences to stay until you opt out, and some basic data to be kept after deletion to prevent fraud. ^{[3] [1]}

The verdict

Sign up if you accept a LexisNexis and Veriff face check, recorded screening calls and a three-year cap on biometric retention. Limit what you give at sign-up, because a deletion request still leaves basic data behind to prevent fraud, and the policy gives no AI-training opt-out. ^{[1] [2]}