1Data Controller
Déto Jean-Luc Gouaho
RecruitEasy.ca
Address
100 Leroux, Granby, Quebec J2J 1S1, Canada
2Collected Data
Account Data
- •Email, first name, last name, phone
- •Password (hashed with bcrypt - never stored in plain text) or authentication via social provider (Google, Microsoft, LinkedIn)
- •Organization, role
- •Profile photo (optional, automatically retrieved from your social provider if you use social login)
- •Language preference (French/English)
- •Social authentication provider identifier (if logging in via Google, Microsoft or LinkedIn)
Candidate Data (if recruiter)
- •Uploaded CVs (PDF/Word files)
- •Extracted professional experiences
- •Detected technical skills
- •Education and certifications
- •Candidate contact info (email, phone, LinkedIn, GitHub, Portfolio)
- •Notes and tags added by recruiters
- •Application history
Billing Data
- •Stripe Customer ID (StripeCustomerId)
- •Subscription and module history
- •Payment information (processed by Stripe only : we NEVER store your credit cards)
Technical Data
- •IP Address (temporary logs)
- •Browser and operating system
- •Session cookies (authentication)
- •Activity logs (ActivityLog)
- •Product usage data (pages viewed, actions performed, session recordings) via PostHog, to improve the service
3Purposes of Processing
We use your data ONLY to:
Provide the RecruitEasy service
Applicant Tracking System (ATS)
AI Recommendations
Matching between candidates and job offers via OpenAI
Transactional Communications
Application notifications, reminders via Resend
Billing
Subscription management via Stripe
Customer Support
Responding to your support requests
Security
Prevent fraud and protect your account
Product improvement
Usage statistics and session recordings (PostHog) to diagnose issues and improve the experience
We NEVER use your data for:
- •Resale to third parties
- •Targeted advertising or remarketing
- •Profiling outside the service
- •Training AI models (RecruitEasy trains no model on your data)
4Legal Basis (PIPEDA / Quebec Bill 25)
Consent
You accept this policy upon registration
Contract Execution
Necessary to provide the ATS service
Legal Obligation
Retention of invoices for 7 years (Canadian tax law)
5Sharing with Third Parties (Processors)
We share your data ONLY with the following processors, all bound by their data processing terms.
| Processor | Purpose | Location | Guarantees |
|---|---|---|---|
| Microsoft Azure | Application server (API) | USA (Central US) | Data processing terms, TLS encryption in transit |
| Vercel | Frontend hosting | USA | Data processing terms, SOC 2 Type II |
| Neon.tech | PostgreSQL database | USA (AWS us-east-2, Ohio) | Data processing terms, AES-256 encryption at rest |
| Cloudflare R2 | File storage (CVs, documents) | USA | Data processing terms, encryption at rest |
| Upstash | Search index and cache | USA | Data processing terms, TLS encryption in transit |
| OpenAI | CV parsing and AI recommendations (CVs are sent as-is, not anonymized) | USA | Data processing terms, standard API data terms: no training on API data by default |
| Stripe | Payment processing | USA | PCI-DSS Level 1 certified |
| Resend | Transactional emails | USA | Data processing terms, TLS encryption |
| Apideck | Third-party ATS integrations | USA | Data processing terms, secure OAuth |
| Auth0 (Okta) | Social authentication (Google, Microsoft, LinkedIn) | USA | SOC 2 Type II, ISO 27001, data processing terms |
| PostHog | Usage statistics and session recordings | USA (US instance) | Data processing terms, SOC 2 Type II |
We NEVER sell your data to third parties.
6International Transfers
RecruitEasy is a Canadian company, but our processors host your data in the United States. Applicable safeguards:
Data processing terms
Each processor's standard data processing terms, accepted with its service
United States hosting
API on Microsoft Azure (Central US), database on Neon (AWS us-east-2, Ohio), files on Cloudflare R2, search index and cache on Upstash, AI through the OpenAI API
Encryption
In transit (TLS) and at rest by our providers (AES-256 for the Neon database)
No model training on your data
RecruitEasy trains no model on client data. The OpenAI API does not use API data to train its models by default.
7Your Rights (PIPEDA + Quebec Bill 25)
You have the following rights, which you can exercise at any time:
Right of Access
Request a copy of all your personal data
- Email: jean-luc@recruiteasy.ca
- Response within 30 days
Right to Rectification
Correct inaccurate or incomplete data
- From your account (Settings → Profile)
- Or by email: jean-luc@recruiteasy.ca
Right to Erasure ("Right to be Forgotten")
Delete your account and all your personal data
- Email: jean-luc@recruiteasy.ca
- Immediate deletion with 30-day grace period
Right to Object
Refuse marketing emails (you will still receive transactional emails)
- "Unsubscribe" link in every email
- Or Settings → Notifications
Right to Portability
Export all your data in a machine-readable format (JSON)
- Email: jean-luc@recruiteasy.ca
To exercise your rights:
Send an email to jean-luc@recruiteasy.ca with your request.
We will respond within 30 days maximum.
8Data Retention
| Data Type | Retention Period |
|---|---|
| Active Account | As long as the account exists |
| Deleted Account | 30 days (grace period) then permanent deletion |
| Candidate CVs | 2 years or manual deletion by recruiter |
| Stripe Invoices | 7 years (Canada tax obligation) |
| Security Logs (ActivityLog) | 1 year |
| Database Backups | 30 days (then automatically overwritten) |
9Security Measures
Technical Measures
Encryption in Transit
HTTPS/TLS mandatory
Encryption at Rest
Handled by our providers, AES-256 for the database (Neon.tech)
Secure Authentication
Signed JWT tokens, two-factor authentication (2FA) available for every account
Password Hashing
PBKDF2 via ASP.NET Core Identity
Backups
Point-in-time recovery over 24 hours, snapshot before every release
Organizational Measures
- •Data access limited to necessary employees (principle of least privilege)
- •Two-factor authentication (2FA) available for every account
- •Production access limited to the founder
- •Audit log of two-factor authentication events and AI decisions
11Modifications
We may modify this policy. In case of major changes, we will notify you by email 30 days before effectiveness.
12Contact & Complaints
For any questions regarding your data or to file a complaint:
Email : jean-luc@recruiteasy.ca
Adresse : RecruitEasy, 100 Leroux, Granby, Quebec J2J 1S1, Canada
If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.