Privacy

Privacy officer

Privacy officer

Contact the officer

Data processed

• Account: sign-in email, non-public account identifier, and secure session.
• Profile and work: name, contact details, resume, criteria, job postings, letters, comments, and files provided or requested.
• Payment: amounts, currency, purchased lot, usage, refund, and transaction identifier; the card number remains with Stripe.
• Duplicate-prevention list: approved or drafted applications, expiring after 7 days.
• Private mode: profile, criteria, resume, searches, job postings, letters, and application files are not exported as account history.

Use

Data is used to search for job postings based on candidate criteria, display amounts due, lock paid results until payment, and avoid suggesting an already approved application again. In private mode, durable account data remains limited to payment tracking and duplicate prevention. Sensitive internal service information remains protected.

Privacy-preserving service improvement

Both improvement permissions are disabled by default. Refusing them does not change the service. A public-knowledge suggestion first requires account permission, then separate confirmation when suggested.

• The improvement channel accepts only structured region, capability, language, and outcome codes.
• It receives no raw resume, address, exact location, or free-form text and trains no model from customer files.
• Consented temporary signals are retained for at most 30 days; withdrawing permission purges them.
• An aggregate measure requires at least 20 distinct contributors; smaller groups remain blocked.
• Actual aggregate learning remains pending until the privacy assessment is complete.

Sharing and providers

WHC remains the source of truth for the account, profile, resumes, letters, application files, and backups. Stripe receives only the data required for payment, receipts, and refunds. The transactional email provider receives the email address and minimum content required for verification, contracts, or support. Sign-in providers receive only the data needed for the selected protocol.

Some features use the DeepSeek API. ReisMaker sends only the content required after removing or replacing direct identifiers, including names, addresses, email addresses, phone numbers, and account identifiers. The reinsertion map remains temporarily in memory at WHC. Pseudonymized information remains personal information when it can be linked to the account. No financial information, secret, or payment-card number is sent to DeepSeek. Under DeepSeek’s published terms, Inputs and Outputs may be used to a minimal extent to provide, maintain, operate, develop, or improve its services only after encryption, strict de-identification, and irreversibility of identification; those terms also announce a way to opt out of that improvement.

Retention

• Temporary drafts: 24 hours after the last change.
• Application duplicate-prevention list: 7 days.
• Application security logs: 90 days.
• Consented improvement signals: no more than 30 days.
• Support tickets: 24 months after closure.
• Contracts, receipts, payments, refunds, and consent evidence: up to 7 years when required.
• Encrypted backups: planned maximum rotation of 35 days, to be confirmed by operational evidence.

The profile, resumes, letters, searches, and application files are retained until deletion when history is requested; they do not become account history when the no-history option is selected. A legal obligation or dispute may temporarily suspend deletion of a targeted category without authorizing indefinite general retention.

Processing outside Quebec

Some providers, including Stripe, selected identity providers, and DeepSeek, may process data outside Quebec and Canada. Pseudonymized content required for a DeepSeek feature may be processed in the People’s Republic of China. ReisMaker limits every transfer to its stated purpose and assesses the location, written terms, security, retention, and rights. The standard Open Platform Terms, the incorporated Terms of Use, and ReisMaker’s safeguards are evaluated in the privacy impact assessment. A material change to the texts, categories, or purpose closes the workflow until a new assessment is completed. No job-site sign-in secret is requested or transmitted.

Export, deletion, and limits

Account export removes internal retention details. Deletion erases account-linked data and account-owned files, but remains blocked while an amount payable is open to preserve billing records. Processing remains limited to functions required for service delivery, payment, account security, and applicable tracking obligations.

To act, sign in and open the account: export prepares a local copy, and deletion requires re-entering the account email before ending the session.

• Export my data

  Open the signed-in account to generate a local copy. No private data is displayed on this public page.

  Open account to export
• Delete account

  Deletion remains within the signed-in account and requires re-entering the exact email before the session closes.

  Open account to delete
• Privacy question

  If the matter involves payment, a locked deliverable, or a technical error, first review support guidance and keep the available receipt or context.

  Read support guidance

Your requests and complaints

You may request access, correction, export, or deletion from the account, or contact the officer published above. The response explains the verified identity, scope handled, data retained for a specific obligation, and applicable recourse. Never send a password, sign-in code, or card number in a support request.