Privacy Policy

1. Our Role

1.1 Platform Data (Recruitment Data)

When customers upload CVs, candidate notes, or related information into NordiQ Intelligence:

• The customer (e.g., recruitment agency, executive search firm, or employer) acts as the data controller.
• Wisteria Inc. acts as a data processor/service provider.
• We process personal information solely on behalf of our customers and in accordance with their instructions and our Terms of Service.
• We do not determine hiring decisions or independently control recruitment purposes.

1.2 Website Visitors

When you visit our website, we may collect limited technical and usage information as described in Section 10. For website-related data, Wisteria Inc. acts as the data controller.

2. Information We Process

Through the Services, we may process:

• Names
• Contact information (email, phone)
• Employment history
• Education history
• Professional qualifications
• Recruiter notes
• Interview summaries
• Uploaded CVs and documents
• Communication records sent via the platform

Because CVs may contain additional information, we may also process sensitive personal information, including:

• Gender
• Date of birth
• National origin
• Photographs
• Information voluntarily disclosed in resumes

We process such data only as instructed by our customers.

3. Browser Extension

We offer an optional Chrome extension, Nordiq LinkedIn Capture, which lets a signed-in recruiter save a LinkedIn profile into their own NordiQ workspace instead of retyping it. The extension is not usable without a NordiQ account.

3.1 What it reads, and when

• Only the LinkedIn profile page the recruiter has open, and only when the recruiter starts a capture. It does not run on its own.
• From that page it reads the profile as displayed: name, headline, location, work experience, education, skills, and any contact details LinkedIn shows to the recruiter.
• It does not read other tabs, browsing history, or any site other than the LinkedIn profile being captured and the recruiter's own NordiQ workspace. On LinkedIn it runs only on profile pages, and reads one only when the recruiter starts a capture.

3.2 Where the data goes

A captured profile is sent directly to the customer's own NordiQ workspace at their own subdomain, where it becomes recruitment data governed by Section 1.1: the customer is the controller and Wisteria is the processor. Wisteria does not receive captured profiles at any separate destination, and the extension contains no advertising or analytics trackers.

3.3 What is stored on the device

While a capture is in progress the extension keeps its working state in the browser's local extension storage, so that closing the popup does not discard the recruiter's work. This is local to the device and is cleared when the capture finishes.

3.4 Permissions

The extension requests only the permissions it uses: access to the LinkedIn profile page being captured, access to the customer's NordiQ workspace to save the result, the ability to identify the tab the recruiter is capturing from, the ability to place the reader into that tab when it was already open before the extension was installed or updated, and local storage for the state above.

4. Outreach Communications

The platform may allow customers to send outreach emails to candidates.

Important clarifications:

• Outreach content is created and reviewed by the customer.
• Emails cannot be sent without human review.
• We do not autonomously generate or send outreach messages.
• Customers are responsible for ensuring lawful communication (e.g., consent, anti-spam compliance).
• We act solely as a service provider transmitting communications on behalf of the customer.

5. How We Use Personal Information

We process personal information to:

• Structure and analyze candidate data
• Provide AI-assisted summaries
• Enable search, ranking, and rediscovery
• Store and retrieve documents securely
• Facilitate recruiter communications
• Maintain system security and performance

We do not:

• Sell personal information
• Rent candidate data
• Share data for advertising
• Use customer data to train public AI models

Customer data remains under the control of the customer.

6. AI Processing

Certain features rely on APIs provided by OpenAI.

• Full candidate notes and documents may be transmitted for processing.
• Processing may occur in the United States.
• API agreements prohibit the use of customer data for model training.
• AI features are designed as decision-support tools only.

NordiQ Intelligence does not:

• Make automated hiring decisions
• Replace human review
• Guarantee outcomes

Customers must apply independent professional judgment.

7. Infrastructure and Subprocessors

We rely on trusted service providers, including:

• Amazon Web Services (primary hosting - Montreal, Canada)
• Google Cloud (OCR processing)
• OpenAI (AI processing - United States)

Primary databases and backups are hosted in Montreal, Canada.

Some processing activities occur outside Canada where necessary to provide AI functionality.

We maintain contractual safeguards with subprocessors.

8. International Data Transfers

Because certain AI services operate in the United States, personal information may be transferred outside Canada.

We implement appropriate contractual and technical safeguards to protect transferred data.

9. Data Retention

We retain personal information:

• For as long as the customer maintains an active account, and
• In accordance with the customer's retention decisions.

Upon account termination:

• Data may be retained for up to 30 days to allow export.
• After that period, data is deleted from active systems.
• Backups are purged in accordance with standard technical cycles.

We do not retain recruitment data for independent purposes.

10. Website Data and Cookies

Our website may collect:

• IP address
• Browser type
• Device information
• Usage data

We may use cookies or analytics tools in the future to improve website performance and marketing effectiveness.

Where required by law, we will provide appropriate notice and consent mechanisms.

We do not use recruitment platform data for marketing tracking.

11. Security Measures

We implement commercially reasonable administrative, technical, and physical safeguards, including:

• Encryption in transit and at rest
• Access controls
• Account isolation
• Monitoring systems

No system can be guaranteed fully secure.

12. Individual Rights

Because our customers act as data controllers:

If a candidate wishes to:

• Access their data
• Correct information
• Request deletion
• Exercise privacy rights

They should contact the recruiting organization directly.

If we receive a request directly, we will redirect it to the relevant customer unless legally required otherwise.

13. Privacy Officer (Quebec Law 25)

In accordance with applicable Quebec privacy law, responsibility for personal information at Wisteria Inc. rests with:

14. Data Breach Notification

In the event of a confirmed security incident affecting personal information, we will:

• Notify affected customers without undue delay
• Provide sufficient information to allow customers to meet legal obligations

Customers remain responsible for regulatory notifications to candidates unless otherwise required by law.

15. Changes to This Policy

We may update this Privacy Policy from time to time.

Material changes will be communicated through the platform or by email.

16. Contact Us

For privacy-related inquiries: