Privacy Policy

1. Our Role

1.1 Platform Data (Recruitment Data)

When customers upload CVs, candidate notes, or related information into NordiQ Intelligence:

• The customer (e.g., recruitment agency, executive search firm, or employer) acts as the data controller.
• Wisteria Inc. acts as a data processor/service provider.
• We process personal information solely on behalf of our customers and in accordance with their instructions and our Terms of Service.
• We do not determine hiring decisions or independently control recruitment purposes.

1.2 Website Visitors

When you visit our website, we may collect limited technical and usage information as described in Section 10. For website-related data, Wisteria Inc. acts as the data controller.

1.3 Users of the Platform

For the accounts of our customers' staff, Wisteria is responsible for the information we use to secure and operate the Services. When you sign in, we record your IP address and a device identifier calculated from your browser's characteristics (such as browser and screen settings and rendering features), to recognise trusted devices and detect suspicious sign-ins. We keep sign-in records for 12 months, and delete trusted devices 30 days after they expire. We also record a user identifier and role in PostHog for product analytics (Section 8).

2. Information We Process

Through the Services, we may process:

• Names
• Contact information (email, phone)
• Employment history
• Education history
• Professional qualifications
• Recruiter notes
• Interview summaries and meeting transcripts
• Uploaded CVs and documents
• Communication records sent and received via the platform

Because CVs may contain additional information, we may also process sensitive personal information, including:

• Gender
• Date of birth
• National origin
• Photographs
• Information voluntarily disclosed in resumes

We process such data only as instructed by our customers.

3. Browser Extensions

We offer two optional Chrome extensions. Sections 3.1 to 3.4 cover Nordiq LinkedIn Capture. Section 3.5 covers Mini NordiQ App.

Nordiq LinkedIn Capture which lets a signed-in recruiter save a LinkedIn profile into their own NordiQ workspace instead of retyping it. The extension is not usable without a NordiQ account.

3.1 What it reads, and when

• Only the LinkedIn profile page the recruiter has open, and only when the recruiter starts a capture. It does not run on its own.
• From that page it reads the profile as displayed: name, headline, location, work experience, education, skills, and any contact details LinkedIn shows to the recruiter.
• It does not read other tabs, browsing history, or any site other than the LinkedIn profile being captured and the recruiter's own NordiQ workspace. On LinkedIn it runs only on profile pages, and reads one only when the recruiter starts a capture.

3.2 Where the data goes

A captured profile is sent directly to the customer's own NordiQ workspace at their own subdomain, where it becomes recruitment data governed by Section 1.1: the customer is the controller and Wisteria is the processor. Wisteria does not receive captured profiles at any separate destination, and the extension contains no advertising or analytics trackers.

3.3 What is stored on the device

While a capture is in progress the extension keeps its working state in the browser's local extension storage, so that closing the popup does not discard the recruiter's work. This is local to the device and is cleared when the capture finishes.

3.4 Permissions

The extension requests only the permissions it uses: access to the LinkedIn profile page being captured, access to the customer's NordiQ workspace to save the result, the ability to identify the tab the recruiter is capturing from, the ability to place the reader into that tab when it was already open before the extension was installed or updated, and local storage for the state above.

3.5 Mini NordiQ App

Mini NordiQ App is a side panel that lets a signed-in recruiter search their own NordiQ workspace from any browser tab, read a candidate summary and add the candidate to a target list. It is not usable without a NordiQ account.

• It does not read, change or run on any web page. It has no access to other tabs or to browsing history.
• It sends only what the recruiter types or pastes into it, such as keywords, a job title or a postal code, and only to the customer's own NordiQ workspace at their own subdomain. Results are governed by Section 1.1.
• When a recruiter adds a candidate to a target list linked to the customer's own applicant tracking system, NordiQ updates that list in the customer's system, as the customer's integration already does.
• On the device it keeps only the workspace name, the recruiter's name and language, and the last search mode. It stores no candidate data and no searches.
• It requests only access to the customer's NordiQ workspace, the browser side panel, and local storage for the settings above. It contains no advertising or analytics trackers.

4. Outreach Communications

The platform may allow customers to send outreach emails to candidates.

Important clarifications:

• Outreach content is created and reviewed by the customer.
• Emails cannot be sent without human review.
• AI features may draft or rewrite a message; a person must review and send it. We do not send outreach messages on our own.
• Customers are responsible for ensuring lawful communication (e.g., consent, anti-spam compliance).
• We act solely as a service provider transmitting communications on behalf of the customer.

5. How We Use Personal Information

We process personal information to:

• Structure and analyze candidate data
• Provide AI-assisted summaries
• Enable search, ranking, and rediscovery
• Store and retrieve documents securely
• Facilitate recruiter communications
• Maintain system security and performance

We do not:

• Sell personal information
• Rent candidate data
• Share data for advertising
• Use customer data to train public AI models

Customer data remains under the control of the customer.

6. AI Processing

Certain features rely on APIs provided by OpenAI.

• Candidate notes, CVs and documents, meeting transcripts, inbox messages and search queries may be transmitted to OpenAI for processing.
• CVs and documents are sent in full, including any address they contain. Separately, when an address is cleaned up before geocoding, it is sent without the house or unit number.
• OpenAI does not keep application state for our requests and keeps abuse-monitoring logs for up to 30 days.
• Search embeddings are normally generated on our own servers in Quebec. If that service is unavailable, embedding generation falls back to OpenAI.
• Processing may occur in the United States.
• API agreements prohibit the use of customer data for model training.
• AI features are designed as decision-support tools only.

NordiQ Intelligence does not:

• Make automated hiring decisions
• Replace human review
• Guarantee outcomes

Customers must apply independent professional judgment.

7. Infrastructure and Subprocessors

We rely on the following service providers:

• Amazon Web Services - hosting, file storage, backups and outbound email (Montreal, Quebec, with disaster-recovery copies in Calgary, Alberta)
• OpenAI - AI processing (United States)
• Google Cloud - optical character recognition (Montreal, Canada)
• Cloudflare - network protection and content delivery (global network)
• Twilio - SMS delivery, including verification codes (United States)
• Datadog - system monitoring and logging (United States)
• PostHog - product usage analytics (United States)
• Pusher - real-time updates (United States)

Google Maps (geocoding and address suggestions) is used under Google's terms as an independent controller, not as our subprocessor.

Search indexing runs on our own infrastructure in Montreal.

Primary databases, file storage and backups are hosted in Canada, in Montreal, Quebec, with disaster-recovery copies in Calgary, Alberta.

Each subprocessor is subject to a written agreement with us. Google's mapping services operate under Google's own controller terms, as described in Section 8.

8. International Data Transfers

Quebec law regulates the communication of personal information outside Quebec. Our databases, file storage and backups are located in Canada, in Montreal, Quebec, with disaster-recovery copies in Calgary, Alberta. The following service providers receive personal information outside Quebec:

• OpenAI (United States) - candidate notes, CVs and documents, meeting transcripts, inbox messages and search queries, for AI processing, and embedding generation when our own service is unavailable. CVs and documents are sent in full, including any address they contain. Separately, when an address is cleaned up before geocoding, it is sent without the house or unit number.
• Google (United States) - addresses for geocoding, sent by our servers without the house or unit number. When a user types an address into an address field in the platform, Google's address suggestions receive the text as typed, which may include the house number, together with the user's IP address. Google acts as an independent controller for these Maps services.
• Twilio (United States) - phone numbers and message content, to deliver SMS, including verification codes.
• Datadog (United States) - system logs, which contain record identifiers but not names, contact details or document content.
• PostHog (United States) - product usage analytics, limited to a user identifier and role for our customers' staff, and the IP address and browser of the request.
• Pusher (United States) - record identifiers, to update screens in real time.
• Cloudflare (global network) - all traffic to and from the Services passes through it. Cloudflare decrypts and re-encrypts it at the nearest point of its network, which may be outside Canada, to protect the Services. It does not store the content.
• Vercel (Canada) - website hosting, including the demonstration request form (Section 10).
• Google Workspace (may store data outside Quebec) - for our website and business email only, including the demonstration requests we receive (Section 10).

9. Data Retention

We retain personal information:

• For as long as the customer maintains an active account, and
• In accordance with the customer's retention decisions.

Upon account termination:

• Data may be retained for up to 30 days to allow export.
• After that period, data is deleted from active systems.
• Backup copies, including disaster-recovery copies in Calgary, Alberta, are deleted within 30 days after the data is deleted from active systems.

We do not retain recruitment data for independent purposes.

For information we hold as controller (Sections 1.2 and 1.3), we keep:

• Demonstration requests: 24 months after our last exchange, then deleted
• Sign-in records: 12 months
• Trusted devices: deleted 30 days after they expire
• System logs in Datadog: 15 days
• Other server logs: 7 days
• Records of requests blocked by our web firewall, including the IP address: 30 days
• Product usage analytics in PostHog: 1 year

10. Website Data and Cookies

Our website uses one cookie, to remember your language. We do not use analytics or advertising cookies, and we do not run analytics on our website. When you close the cookie notice, your browser keeps a note of it on your device so the notice is not shown again.

Our website host, Vercel, receives your IP address and browser information with each request in order to deliver the pages.

When you request a demonstration, we collect the details you submit (name, business email, company, company size, area of interest and message) and your IP address. We use the details to respond to your request. The IP address is used only to block automated submissions and is not kept. The form is processed by our website host, Vercel, in Canada (Montreal), and the request is delivered to our mailbox hosted by Google Workspace, which may store it outside Quebec. We keep demonstration requests for 24 months after our last exchange, then delete them. We do not look up your location from your IP address. You may ask our Privacy Officer (Section 13) to access or correct this information, or withdraw your consent to its use.

If we add analytics or advertising cookies, we will ask for your consent first.

We do not use recruitment platform data for marketing tracking.

11. Security Measures

We implement commercially reasonable administrative, technical, and physical safeguards, including:

• Encryption in transit and at rest
• Access controls
• Account isolation
• Monitoring systems
• Application logs that exclude personal data
• Encryption of the credentials we hold for third-party integrations

No system can be guaranteed fully secure.

12. Individual Rights

Because our customers act as data controllers:

If a candidate wishes to:

• Access their data
• Correct information
• Request deletion
• Exercise privacy rights

They should contact the recruiting organization directly.

A candidate may request a copy of their data from the recruiting organization, which can export it from the platform, or download it through the candidate portal where the organization provides one.

If we receive a request directly, we will redirect it to the relevant customer unless legally required otherwise.

For information we hold as controller (Sections 1.2 and 1.3), write to our Privacy Officer (Section 13). We respond within 30 days.

13. Privacy Officer (Quebec Law 25)

In accordance with applicable Quebec privacy law, responsibility for personal information at Wisteria Inc. rests with:

14. Data Breach Notification

Where we have cause to believe a confidentiality incident involving personal information has occurred, we take reasonable measures to reduce the risk of injury and to prevent further incidents of the same kind, and we record the incident in our confidentiality incident register. We will:

• Notify affected customers without undue delay, and in any case within 72 hours
• Provide sufficient information to allow customers to meet their legal obligations

For recruitment data, we notify the customer as above, and the customer notifies the Commission and the persons concerned. For information we hold as controller (Sections 1.2 and 1.3), we notify the Commission d'accès à l'information and the persons concerned promptly where an incident presents a risk of serious injury.

15. Governance, Roles and Complaints

15.1 Keeping and Destruction of Information

Customers decide what candidate information they hold and for how long. We keep personal information for as long as the customer maintains an active account and in accordance with the retention settings they configure. When the purpose for which information was collected has been achieved, or when a customer instructs us to remove it, the information is destroyed. Section 9 sets out the periods that apply after an account ends.

15.2 Roles and Responsibilities of Our Personnel

Our Privacy Officer is accountable for the protection of personal information across its whole life cycle, from collection through to destruction, and approves our internal governance policies and practices.

Access to customer data by our personnel is limited to those who need it to perform their duties, and only for support, maintenance and security purposes. Engineering staff who require access to production systems do so through individually identified accounts. Personnel are bound by confidentiality obligations. Any personnel who become aware of a possible confidentiality incident are required to report it to the Privacy Officer without delay.

15.3 Complaints

If you believe we have not met our obligations in respect of personal information, you may complain to our Privacy Officer at the address in Section 13. Please describe the issue and the outcome you are seeking. We will acknowledge your complaint, investigate it, and respond in writing with our findings and any corrective measures, normally within 30 days.

If you are not satisfied with our response, you may bring the matter to the Commission d'accès à l'information du Québec.

16. Changes to This Policy

We may update this Privacy Policy from time to time.

Material changes will be communicated through the platform or by email.

17. Contact Us

For privacy-related inquiries: