Privacy Policy

1. Our Role

1.1 Platform Data (Recruitment Data)

When customers upload CVs, candidate notes, or related information into NordiQ Intelligence:

• The customer (e.g., recruitment agency, executive search firm, or employer) acts as the data controller.
• Wisteria Inc. acts as a data processor/service provider.
• We process personal information solely on behalf of our customers and in accordance with their instructions and our Terms of Service.
• We do not determine hiring decisions or independently control recruitment purposes.

1.2 Website Visitors

When you visit our website, we may collect limited technical and usage information as described in Section 10. For website-related data, Wisteria Inc. acts as the data controller.

2. Information We Process

Through the Services, we may process:

• Names
• Contact information (email, phone)
• Employment history
• Education history
• Professional qualifications
• Recruiter notes
• Interview summaries
• Uploaded CVs and documents
• Communication records sent via the platform

Because CVs may contain additional information, we may also process sensitive personal information, including:

• Gender
• Date of birth
• National origin
• Photographs
• Information voluntarily disclosed in resumes

We process such data only as instructed by our customers.

3. Browser Extensions

We offer two optional Chrome extensions. Sections 3.1 to 3.4 cover Nordiq LinkedIn Capture. Section 3.5 covers Mini NordiQ App.

Nordiq LinkedIn Capture which lets a signed-in recruiter save a LinkedIn profile into their own NordiQ workspace instead of retyping it. The extension is not usable without a NordiQ account.

3.1 What it reads, and when

• Only the LinkedIn profile page the recruiter has open, and only when the recruiter starts a capture. It does not run on its own.
• From that page it reads the profile as displayed: name, headline, location, work experience, education, skills, and any contact details LinkedIn shows to the recruiter.
• It does not read other tabs, browsing history, or any site other than the LinkedIn profile being captured and the recruiter's own NordiQ workspace. On LinkedIn it runs only on profile pages, and reads one only when the recruiter starts a capture.

3.2 Where the data goes

A captured profile is sent directly to the customer's own NordiQ workspace at their own subdomain, where it becomes recruitment data governed by Section 1.1: the customer is the controller and Wisteria is the processor. Wisteria does not receive captured profiles at any separate destination, and the extension contains no advertising or analytics trackers.

3.3 What is stored on the device

While a capture is in progress the extension keeps its working state in the browser's local extension storage, so that closing the popup does not discard the recruiter's work. This is local to the device and is cleared when the capture finishes.

3.4 Permissions

The extension requests only the permissions it uses: access to the LinkedIn profile page being captured, access to the customer's NordiQ workspace to save the result, the ability to identify the tab the recruiter is capturing from, the ability to place the reader into that tab when it was already open before the extension was installed or updated, and local storage for the state above.

3.5 Mini NordiQ App

Mini NordiQ App is a side panel that lets a signed-in recruiter search their own NordiQ workspace from any browser tab, read a candidate summary and add the candidate to a target list. It is not usable without a NordiQ account.

• It does not read, change or run on any web page. It has no access to other tabs or to browsing history.
• It sends only what the recruiter types or pastes into it, such as keywords, a job title or a postal code, and only to the customer's own NordiQ workspace at their own subdomain. Results are governed by Section 1.1.
• When a recruiter adds a candidate to a target list linked to the customer's own applicant tracking system, NordiQ updates that list in the customer's system, as the customer's integration already does.
• On the device it keeps only the workspace name, the recruiter's name and language, and the last search mode. It stores no candidate data and no searches.
• It requests only access to the customer's NordiQ workspace, the browser side panel, and local storage for the settings above. It contains no advertising or analytics trackers.

4. Outreach Communications

The platform may allow customers to send outreach emails to candidates.

Important clarifications:

• Outreach content is created and reviewed by the customer.
• Emails cannot be sent without human review.
• We do not autonomously generate or send outreach messages.
• Customers are responsible for ensuring lawful communication (e.g., consent, anti-spam compliance).
• We act solely as a service provider transmitting communications on behalf of the customer.

5. How We Use Personal Information

We process personal information to:

• Structure and analyze candidate data
• Provide AI-assisted summaries
• Enable search, ranking, and rediscovery
• Store and retrieve documents securely
• Facilitate recruiter communications
• Maintain system security and performance

We do not:

• Sell personal information
• Rent candidate data
• Share data for advertising
• Use customer data to train public AI models

Customer data remains under the control of the customer.

6. AI Processing

Certain features rely on APIs provided by OpenAI.

• Full candidate notes and documents may be transmitted for processing.
• Candidate addresses are sent to OpenAI to be normalised before they are geocoded.
• Search embeddings are normally generated on our own servers in Quebec. If that service is unavailable, embedding generation falls back to OpenAI.
• Processing may occur in the United States.
• API agreements prohibit the use of customer data for model training.
• AI features are designed as decision-support tools only.

NordiQ Intelligence does not:

• Make automated hiring decisions
• Replace human review
• Guarantee outcomes

Customers must apply independent professional judgment.

7. Infrastructure and Subprocessors

We rely on the following service providers:

• Amazon Web Services - hosting, file storage and outbound email (Montreal, Canada)
• OpenAI - AI processing (United States)
• Google - address geocoding (United States), and optical character recognition where a customer chooses to enable it. Customers who do not enable it have documents processed locally on our own infrastructure.
• Cloudflare - network protection and content delivery
• Meilisearch - search indexing
• Twilio - SMS delivery, including verification codes
• Stripe - payment processing
• Datadog - system monitoring and logging

Primary databases and backups are hosted in Montreal, Quebec.

We maintain contractual safeguards with each subprocessor.

8. International Data Transfers

Quebec law regulates the communication of personal information outside Quebec. Our databases, file storage and backups are located in Montreal, Quebec. The following processing takes place outside Quebec:

• OpenAI (United States) - candidate notes, documents and addresses sent for AI processing, and embedding generation when our own service is unavailable.
• Google (United States) - candidate addresses, for geocoding. Google is our only geocoding provider, so every address we geocode is sent to it. Optical character recognition, where a customer has enabled it.

9. Data Retention

We retain personal information:

• For as long as the customer maintains an active account, and
• In accordance with the customer's retention decisions.

Upon account termination:

• Data may be retained for up to 30 days to allow export.
• After that period, data is deleted from active systems.
• Backups are purged in accordance with standard technical cycles.

We do not retain recruitment data for independent purposes.

10. Website Data and Cookies

Our website may collect:

• IP address
• Browser type
• Device information
• Usage data

We may use cookies or analytics tools in the future to improve website performance and marketing effectiveness.

Where required by law, we will provide appropriate notice and consent mechanisms.

We do not use recruitment platform data for marketing tracking.

11. Security Measures

We implement commercially reasonable administrative, technical, and physical safeguards, including:

• Encryption in transit and at rest
• Access controls
• Account isolation
• Monitoring systems

No system can be guaranteed fully secure.

12. Individual Rights

Because our customers act as data controllers:

If a candidate wishes to:

• Access their data
• Correct information
• Request deletion
• Exercise privacy rights

They should contact the recruiting organization directly.

If we receive a request directly, we will redirect it to the relevant customer unless legally required otherwise.

13. Privacy Officer (Quebec Law 25)

In accordance with applicable Quebec privacy law, responsibility for personal information at Wisteria Inc. rests with:

14. Data Breach Notification

Where we have cause to believe a confidentiality incident involving personal information has occurred, we take reasonable measures to reduce the risk of injury and to prevent further incidents of the same kind, and we record the incident in our confidentiality incident register. We will:

• Notify affected customers without undue delay, and in any case within 72 hours
• Provide sufficient information to allow customers to meet their legal obligations
• Promptly notify the Commission d'accès à l'information, and the individuals concerned, where the incident presents a risk of serious injury

Customers remain responsible for regulatory notifications to candidates unless otherwise required by law.

15. Governance, Roles and Complaints

15.1 Keeping and Destruction of Information

Customers decide what candidate information they hold and for how long. We keep personal information for as long as the customer maintains an active account and in accordance with the retention settings they configure. When the purpose for which information was collected has been achieved, or when a customer instructs us to remove it, the information is destroyed. Section 9 sets out the periods that apply after an account ends.

15.2 Roles and Responsibilities of Our Personnel

Our Privacy Officer is accountable for the protection of personal information across its whole life cycle, from collection through to destruction, and approves our internal governance policies and practices.

Access to customer data by our personnel is limited to those who need it to perform their duties, and only for support, maintenance and security purposes. Engineering staff who require access to production systems do so through individually identified accounts. Personnel are bound by confidentiality obligations. Any personnel who become aware of a possible confidentiality incident are required to report it to the Privacy Officer without delay.

15.3 Complaints

If you believe we have not met our obligations in respect of personal information, you may complain to our Privacy Officer at the address in Section 13. Please describe the issue and the outcome you are seeking. We will acknowledge your complaint, investigate it, and respond in writing with our findings and any corrective measures, normally within 30 days.

If you are not satisfied with our response, you may bring the matter to the Commission d'accès à l'information du Québec.

16. Changes to This Policy

We may update this Privacy Policy from time to time.

Material changes will be communicated through the platform or by email.

17. Contact Us

For privacy-related inquiries: