Terms of Service

The Services may include:

• Structured candidate data extraction and normalization
• Historical note analysis and intent classification
• Candidate momentum scoring
• Mandate-aware ranking and shortlist acceleration tools
• Cross-source candidate rediscovery workflows
• AI-assisted summarization and decision support
• Secure storage of candidate files and notes
• Integrations with ATS platforms and external systems
• OCR and document parsing services

You are responsible for:

• Maintaining credential confidentiality
• All activity under your account
• Promptly notifying us of unauthorized access

You may not:

• Upload unlawful, harmful, or infringing content
• Violate employment, discrimination, or privacy laws
• Attempt unauthorized system access
• Interfere with service operations
• Use the Services for spam or deceptive practices
• Reverse engineer or copy the platform

5.1 Ownership

5.2 Purpose of Processing

We process Customer Data solely to:

• Structure and analyze candidate information
• Provide ranking, summarization, and rediscovery features
• Deliver secure storage and retrieval functionality
• Improve system performance and reliability

5.3 AI Processing and Third-Party Providers

Certain AI-powered features rely on third-party AI infrastructure, including APIs provided by OpenAI.

• Candidate notes, CVs and documents, meeting transcripts, inbox messages and search queries may be transmitted to OpenAI for processing.
• CVs and documents are sent in full, including any address they contain. Separately, when an address is cleaned up before geocoding, it is sent without the house or unit number.
• OpenAI does not keep application state for our requests and keeps abuse-monitoring logs for up to 30 days.
• Search embeddings are normally generated on our own servers in Quebec. If that service is unavailable, embedding generation falls back to OpenAI.
• Processing may occur in the United States.
• OpenAI API services are used under contractual terms prohibiting model training on Customer Data.
• Each subprocessor is subject to a written agreement with us.

5.4 Infrastructure and Subprocessors

We rely on the following service providers:

• Amazon Web Services - hosting, file storage, backups and outbound email (Montreal, Quebec, with disaster-recovery copies in Calgary, Alberta)
• OpenAI - AI processing (United States)
• Google Cloud - optical character recognition (Montreal, Canada)
• Cloudflare - network protection and content delivery (global network)
• Twilio - SMS delivery, including verification codes (United States)
• Datadog - system monitoring and logging (United States)
• PostHog - product usage analytics (United States)
• Pusher - real-time updates (United States)

5.5 Data Security

We implement commercially reasonable safeguards, including:

• Encryption in transit and at rest
• Access controls
• Logical separation between customer accounts
• Regular system monitoring
• Application logs that exclude personal data
• Encryption of the credentials we hold for third-party integrations

5.6 Our Commitments as Your Service Provider

This Section 5.6, together with our Data Processing Addendum, is the written mandate under which you entrust Customer Data to us. Where they differ, the Data Processing Addendum prevails with respect to personal information. We undertake that:

• We will use Customer Data only to carry out the Services described in these Terms, and for no other purpose.
• We will take the measures set out in Section 5.5 to protect the confidentiality of Customer Data, and will require comparable commitments from each subprocessor we engage. We remain responsible to you for the performance of each subprocessor's obligations.
• We will not retain Customer Data after these Terms end, beyond the periods stated in our Privacy Policy for export and for the expiry of backups.
• We will communicate Customer Data outside Quebec only to the providers listed in Section 5.4, after a privacy impact assessment and under a written agreement with each.
• We will notify your designated privacy officer without delay of any breach, or attempted breach, by any person of the confidentiality obligations that apply to Customer Data.
• We will allow your privacy officer to conduct any verification relating to the confidentiality requirements of these Terms and the Data Processing Addendum, on reasonable notice, by questionnaire, by review of our documentation, including the parts of our privacy impact assessment that concern your data, or, where those are not sufficient, by an audit at your expense.

We:

• Do not make hiring decisions
• Do not guarantee candidate suitability
• Do not guarantee hiring outcomes
• Do not ensure compliance with employment laws

Customers remain solely responsible for:

• Candidate evaluation
• Interview processes
• Equal opportunity compliance
• Bias mitigation
• Final hiring decisions

We target 99.5% monthly uptime, excluding:

• Scheduled maintenance
• Force majeure events
• Third-party service failures

Upon termination:

• Access to the Services ends immediately.
• We will retain Customer Data for up to 30 days to allow export.
• After that period, Customer Data will be permanently deleted from active systems.
• Backup copies, including disaster-recovery copies in Calgary, Alberta, are deleted within 30 days after the data is deleted from active systems.

You may not:

• Reverse engineer
• Copy or resell
• Create derivative works

We will treat Customer Data as confidential and will not disclose it except:

• As required to provide the Services
• As required by law
• With your consent

You agree to indemnify Wisteria Inc. against claims arising from:

• Your misuse of the Services
• Your violation of employment or privacy laws
• Candidate disputes related to hiring decisions
• Content you upload