1Data Controller
2Collected Data
Account Data
- •Email, first name, last name, phone
- •Password (hashed with bcrypt - never stored in plain text) or authentication via social provider (Google, Microsoft, LinkedIn)
- •Organization, role
- •Profile photo (optional, automatically retrieved from your social provider if you use social login)
- •Language preference (French/English)
- •Social authentication provider identifier (if logging in via Google, Microsoft or LinkedIn)
Candidate Data (if recruiter)
- •Uploaded CVs (PDF/Word files)
- •Extracted professional experiences
- •Detected technical skills
- •Education and certifications
- •Candidate contact info (email, phone, LinkedIn, GitHub, Portfolio)
- •Notes and tags added by recruiters
- •Application history
Billing Data
- •Stripe Customer ID (StripeCustomerId)
- •Subscription and module history
- •Payment information (processed by Stripe only : we NEVER store your credit cards)
Technical Data
- •IP Address (temporary logs)
- •Browser and operating system
- •Session cookies (authentication)
- •Activity logs (ActivityLog)
- •Product usage data (pages viewed, actions performed, session recordings) via PostHog, to improve the service
3Purposes of Processing
We use your data ONLY to:
Provide the RecruiEasy service
Applicant Tracking System (ATS)
AI Recommendations
Matching between candidates and job offers via OpenAI
Transactional Communications
Application notifications, reminders via Resend
Billing
Subscription management via Stripe
Customer Support
Responding to your support requests
Security
Prevent fraud and protect your account
Product improvement
Usage statistics and session recordings (PostHog) to diagnose issues and improve the experience
We NEVER use your data for:
- •Resale to third parties
- •Targeted advertising or remarketing
- •Profiling outside the service
- •Training AI models without anonymization
4Legal Basis (PIPEDA / Quebec Bill 25)
Consent
You accept this policy upon registration
Contract Execution
Necessary to provide the ATS service
Legal Obligation
Retention of invoices for 7 years (Canadian tax law)
5Sharing with Third Parties (Processors)
We share your data ONLY with the following processors, all subject to Data Processing Agreements (DPA).
| Processor | Purpose | Location | Guarantees |
|---|---|---|---|
| Vercel | Frontend hosting | USA | Signed DPA, SOC 2 Type II |
| Neon.tech | PostgreSQL Database | USA/EU | Signed DPA, AES-256 encryption |
| OpenAI | CV Parsing and AI Recommendations | USA | Signed DPA, anonymized data |
| Stripe | Payment Processing | USA | PCI-DSS Level 1 certified |
| Resend | Transactional Emails | USA | Signed DPA, TLS encryption |
| Apideck | Third-party ATS Integrations | USA | Signed DPA, secure OAuth |
| Auth0 (Okta) | Social authentication (Google, Microsoft, LinkedIn) | USA/EU | SOC 2 Type II, ISO 27001, Signed DPA |
| PostHog | Usage statistics and session recordings | USA | Signed DPA, SOC 2 Type II |
We NEVER sell your data to third parties.
6International Transfers
Some processors are located in the United States. Applicable guarantees:
Standard Contractual Clauses (SCC)
Approved by the European Commission
Data Processing Agreements (DPA)
Signed with each processor
Encryption
In transit (TLS 1.3) and at rest (AES-256)
SOC 2 Type II Compliance
For Vercel and Neon.tech
7Your Rights (PIPEDA + Quebec Bill 25)
You have the following rights, which you can exercise at any time:
Right of Access
Request a copy of all your personal data
- Email: jlgouaho@recruiteasy.ca
- Response within 30 days
Right to Rectification
Correct inaccurate or incomplete data
- From your account (Settings → Profile)
- Or by email: jlgouaho@recruiteasy.ca
Right to Erasure ("Right to be Forgotten")
Delete your account and all your personal data
- Email: jlgouaho@recruiteasy.ca
- Immediate deletion with 30-day grace period
Right to Object
Refuse marketing emails (you will still receive transactional emails)
- "Unsubscribe" link in every email
- Or Settings → Notifications
Right to Portability
Export all your data in a machine-readable format (JSON)
- Email: jlgouaho@recruiteasy.ca
To exercise your rights:
Send an email to jlgouaho@recruiteasy.ca with your request.
We will respond within 30 days maximum.
8Data Retention
| Data Type | Retention Period |
|---|---|
| Active Account | As long as the account exists |
| Deleted Account | 30 days (grace period) then permanent deletion |
| Candidate CVs | 2 years or manual deletion by recruiter |
| Stripe Invoices | 7 years (Canada tax obligation) |
| Security Logs (ActivityLog) | 1 year |
| Database Backups | 30 days (then automatically overwritten) |
9Security Measures
Technical Measures
Encryption in Transit
HTTPS/TLS 1.3 mandatory
Encryption at Rest
AES-256 for database (Neon.tech)
Secure Authentication
JWT + httpOnly cookies via NextAuth.js
Password Hashing
Bcrypt via ASP.NET Identity
Daily Backups
Encrypted (30-day retention)
Organizational Measures
- •Data access limited to necessary employees (principle of least privilege)
- •Two-factor authentication (2FA) for administrative access
- •Regular security training for the team
- •Code reviews and periodic security audits
11Modifications
We may modify this policy. In case of major changes, we will notify you by email 30 days before effectiveness.
12Contact & Complaints
For any questions regarding your data or to file a complaint:
Email : jlgouaho@recruiteasy.ca
Adresse : Quebec, Canada
If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.