Your Privacy Matters

Jobily Technologies Inc. is a corporation incorporated under the laws of Ontario with its principal office at 320 Bay Street, Suite 800, Toronto, ON M5H 4A6. We operate an AI-powered job search and recruitment platform for Canadian employers and job seekers.

Our designated Privacy Officer can be contacted at:

We collect personal information that you provide directly and information generated through your use of the Service:

Account information: Full name, email address, password (hashed), province of residence, and account type (job seeker or employer).

Job seeker profile data: Resume content, work history, education, skills, certifications, languages, salary expectations, work preferences, profile photo (optional), and LinkedIn profile (optional).

Employer data: Company name, business registration number (BN), address, industry, company description, and contact information for the account administrator.

Application data: Cover letters, responses to screening questions, and any attachments you submit when applying to jobs.

Usage data: Pages viewed, search queries, job listings clicked, features used, session duration, IP address, browser type, and device identifiers.

Payment data: Billing name, billing address, and partial payment card information (last 4 digits, expiry). Full card numbers are processed and stored by Stripe – we do not have access to them.

Communications: Support tickets, email correspondence, and any content you submit through our contact forms.

We use personal information to:

• Create and manage your account;
• Match job seekers with relevant job opportunities using AI;
• Display your profile to employers when you have enabled "Open to Opportunities";
• Send job alerts, application status updates, and platform notifications;
• Process payments and generate invoices;
• Provide customer support;
• Detect and prevent fraud, abuse, and unauthorized access;
• Comply with legal obligations;
• Improve our platform and develop new features using aggregated, de-identified analytics.

We do not use your personal data for targeted advertising. We do not sell your data.

Under PIPEDA, we collect, use, and disclose personal information based on your knowledge and consent, with the following considerations:

• Express consent: Obtained when you create an account and accept this Privacy Policy for all primary uses of your data;
• Implied consent: For incidental uses reasonably within the scope of why you provided your data (e.g., using your email to send application confirmations);
• Legal obligation: Where required by law, court order, or regulatory authority;
• Legitimate business purpose: For fraud detection and security measures where obtaining consent is not reasonably practical.

You may withdraw consent at any time, subject to legal or contractual restrictions, by contacting our Privacy Officer. Withdrawal may affect your ability to use certain features.

We do not sell, rent, or trade your personal information. We share data only in the following circumstances:

With employers: When you apply to a job, your application, profile, and relevant data are shared with the hiring employer. You control what is visible on your public profile.

Service providers: We share data with trusted third-party service providers who assist us in operating the platform, including:

• Stripe Payments Canada, Ltd. – payment processing
• Amazon Web Services Canada, Inc. – cloud infrastructure (data remains in Canada)
• SendGrid (Twilio Canada Inc.) – transactional email delivery
• Anthropic, PBC – AI language model processing (see Section 6)

All service providers are bound by data processing agreements requiring them to protect your information and use it only for the services they provide to us.

Legal requirements: We may disclose personal information if required by law, subpoena, court order, or to protect our rights, property, or safety.

Business transfers: In the event of a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will notify you via email and provide an opportunity to opt out before your data is transferred to a new privacy policy.

Jobily uses Claude, an AI assistant developed by Anthropic, PBC, to power features including resume analysis, job matching, and natural language search. When you use these features, relevant portions of your data (such as your resume or job search query) are transmitted to Anthropic's API for processing.

Important commitments:

• Your data is never used to train Anthropic's AI models;
• Data transmitted to the API is processed in-context only and not retained by Anthropic beyond the minimum necessary to complete the request;
• Our use of the Anthropic API is governed by a Data Processing Agreement that includes these protections;
• You can opt out of AI features at any time in your Privacy Settings. Opting out means you will receive unranked search results.

All AI-generated outputs (match scores, resume suggestions) are recommendations only. Hiring decisions remain solely with employers.

We retain personal information for as long as your account is active or as needed to provide services and comply with legal obligations:

• Active accounts: Data is retained while your account is open;
• Deleted accounts: Personal data is deleted within 30 days of account deletion, except where retention is required by law;
• Financial records: Billing and transaction records are retained for 7 years as required by the Income Tax Act (Canada);
• Application data: Applications are retained for 2 years after the position closes to allow for reference checks and legal compliance;
• Audit logs: Security and access logs are retained for 90 days.

Under PIPEDA, you have the right to:

• Access: Request a copy of the personal information we hold about you;
• Correction: Request that we correct inaccurate or incomplete personal information;
• Withdrawal of consent: Withdraw consent for certain uses of your data at any time;
• Deletion: Request deletion of your account and associated personal data (subject to legal retention requirements);
• Complaint: File a complaint with our Privacy Officer or directly with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.

To exercise any of these rights, contact us at privacy@jobily.ca. We will respond to verified requests within 30 days.

We use cookies and similar tracking technologies for the following purposes:

• Essential cookies: Required for authentication, session management, and security. Cannot be disabled.
• Functional cookies: Remember your preferences (language, theme, saved searches). Can be disabled with reduced functionality.
• Analytics cookies: Collect aggregated, anonymized data on how users interact with the Service using a self-hosted analytics solution. No third-party tracking pixels are used.

We do not use third-party advertising cookies or social media tracking pixels. You can manage your cookie preferences in your account settings or through your browser settings.

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a user under 18, we will delete it promptly. If you believe we have collected data from a minor, contact us at privacy@jobily.ca.

Jobily stores all primary personal data on servers in Canada (AWS ca-central-1, Montréal). However, some service providers operate or have infrastructure outside Canada. When personal information is transferred outside Canada, we ensure it is protected by:

• Contractual safeguards (data processing agreements) requiring equivalent protection to that provided under PIPEDA;
• Using providers whose jurisdictions offer adequate protection standards.

By using the Service, you acknowledge and consent to this cross-border processing as described. Details of transfers and the countries involved are available upon request from our Privacy Officer.

Jobily implements industry-standard technical and organizational measures to protect your personal information against unauthorized access, loss, alteration, or disclosure:

• AES-256 encryption at rest for all stored personal data;
• TLS 1.3 for all data in transit;
• Multi-factor authentication available for all accounts, required for employer admin accounts;
• Regular penetration testing by independent security firms (quarterly);
• Bug bounty program at jobily.ca/security;
• Employee access controlled by role-based permissions with audit logging;
• SOC 2 Type II compliance in progress (expected Q3 2026).

In the event of a data breach affecting your personal information, we will notify you and the Office of the Privacy Commissioner of Canada within 72 hours of becoming aware of the breach, in accordance with the Breach of Security Safeguards Regulations under PIPEDA.

We may update this Privacy Policy periodically. We will notify you of material changes by:

• Email notification to your registered email address, at least 30 days before the change takes effect;
• A prominent notice on our platform.

Your continued use of the Service after the effective date of any change constitutes your acceptance of the updated Policy. If you do not agree to the updated Policy, you may close your account before the effective date.

The date of the last update is shown at the top of this page. Previous versions of this Policy are available upon request.