JobACE Privacy Policy

1. Scope and accountability

This Privacy Policy explains how JobACE ("JobACE", "we", "us" or "our") collects, uses, discloses and protects personal information through jobace.ca and the related applications, APIs, interview exercises, reports, job-listing, referral, redemption, support and enterprise features (collectively, the "Services").

JobACE is responsible for personal information under its control and has designated a Privacy Officer. Depending on where you live and how the information is handled, Canadian federal or provincial private-sector privacy laws may apply, including PIPEDA and substantially similar laws in Alberta, British Columbia and Quebec.

This Policy does not govern a third-party website, employer, job board or service that you visit through a link in the Services.

2. Personal information we collect

Information you provide

• Account and profile information: name or display name, email address, password hash, profile details, communication preferences and account-verification records.
• Interview-practice content: microphone recordings, spoken answers, transcripts, chat messages, selected practice mode, timing data, feedback, scores, assessments, improvement plans and reports.
• Career context: resumes, resume filenames, extracted resume text, job descriptions, target role or company, and other material you submit for tailored questions or assessments. JobACE attempts to redact some common contact details from extracted resume text, but you should still remove information that is unnecessary.
• Transactions and programs: plan, credit balance, subscription status, trial use, transaction history, redemption activity, referral code, invitee email, reward status and anti-fraud information. Card details are collected by Stripe, not stored by JobACE as complete card numbers.
• Communications: support requests, feedback, survey responses, newsletter sign-up and other messages you send us.

Information collected automatically

• IP address, browser and device characteristics, operating system, language, platform, screen characteristics, time zone, user agent, referring pages, approximate location derived from IP address, page interactions, login and activity timestamps, session status, error and security logs.
• A device or browser identifier derived from limited technical characteristics and stored locally for analytics, security, concurrent-account controls and fraud prevention.
• A persistent or pseudonymous identifier, landing page, referring URL, referral code and campaign parameters such as UTM source, medium and campaign for attribution and service analytics.
• Cookies, browser storage and similar technologies used for sign-in, preferences, attribution, security and analytics. Google Analytics may receive device, browser and usage information when its tag is enabled.

Information from other sources

If you use Google Sign-In, we receive the account information Google makes available based on the permissions shown to you, typically your name, email address and profile information. We also receive payment status and transaction metadata from Stripe and referral information from the person or link that referred you.

3. How we use personal information

We use personal information to:

• create, verify, secure and administer accounts;
• record and transcribe answers; generate interview questions, spoken prompts, coaching, assessments, AIMS™ scores, reports and improvement drills; and preserve practice history;
• tailor practice to a resume, job description, role, company lens and previous performance;
• process purchases and subscriptions, provide credits and trials, issue receipts, handle cancellations and maintain financial records;
• operate referrals and redemption programs and detect duplicate, fraudulent or abusive activity;
• provide support and service notices, respond to requests and send marketing only where permitted by law and your choices;
• understand acquisition and use of the Services, troubleshoot, improve performance and develop features using aggregated or de-identified information where appropriate;
• enforce our Terms of Use, protect users and the Services, investigate incidents, and comply with legal, tax, accounting and regulatory obligations.

We will not use personal information for a new incompatible purpose without obtaining any consent required by law.

4. AI processing, scoring and profiling

When you use voice-enabled or AI-assisted features, JobACE may transmit audio and relevant content to third-party service providers, including OpenAI, for speech-to-text transcription, AI-assisted analysis, generated questions, feedback, assessments and synthesized speech. Inputs may include your recording, transcript, conversation history, resume excerpts, job description, target role or company and prior performance. Outputs may be inaccurate, incomplete or biased and should be reviewed critically.

AIMS™ scores and related feedback use automated processing to evaluate practice performance. They are educational estimates, not verified facts, professional advice, employment decisions or an employer's official hiring criteria. JobACE does not provide your practice profile to an employer unless you direct us to share it or separately authorize disclosure for a clearly identified organization-sponsored program. Before information is shared for such a program, we will identify the receiving organization, purpose and data categories involved. Private practice sessions, raw audio and full transcripts are not shared unless they are specifically identified in that notice and authorization. Where applicable law gives you rights concerning an exclusively automated decision, you may contact the Privacy Officer for information about the principal factors and to submit observations or request human review.

5. Consent and your choices

We obtain consent in a form appropriate to the sensitivity of the information and the context. Some processing is necessary to provide a feature you request. For example, microphone audio must be processed to provide voice-based coaching. Consent to marketing is optional, is not a condition of creating an account and should be requested separately from acceptance of these legal terms. Optional analytics and other non-essential activities are presented separately where required.

• You control microphone permission in your browser or device and may stop a recording before submitting it.
• You may unsubscribe from commercial email using the link in the message. We may still send non-commercial account, transaction, security and service messages.
• You may limit cookies or browser storage through your browser settings or any consent controls we make available, although essential features may not work correctly.
• You may withdraw consent to optional processing by contacting us. Withdrawal does not affect prior lawful processing and may prevent us from providing a feature that depends on the information.

6. When we disclose personal information

We may disclose only the information reasonably needed to:

• AI and speech providers: OpenAI processes prompts, transcripts and audio for transcription, language-model analysis and text-to-speech. This processing is subject to applicable contractual terms, safeguards and data-processing arrangements. Provider retention and abuse-monitoring rules may apply.
• Payment providers: Stripe processes checkout, payment methods, subscriptions, refunds and fraud prevention and returns transaction and status information to JobACE.
• Authentication and analytics providers: Google supports optional Google Sign-In and Google Analytics.
• Infrastructure and communications providers: hosting, database, storage, caching, security, email delivery and support providers help operate the Services.
• Professional advisers and legal requirements: lawyers, accountants, courts, regulators, law enforcement or other parties where disclosure is reasonably necessary for professional advice, compliance with law, or protection of rights, safety, users or the Services.
• Business transactions: we may provide limited information to prospective investors, purchasers, lenders or transaction counterparties where reasonably necessary for financing, due diligence, restructuring or a proposed transaction. Where practicable, information will be aggregated or de-identified, and any personal-information disclosure will be limited and subject to appropriate confidentiality or other protective measures.

We do not sell or rent personal information. We do not disclose a user's recordings, transcripts, resume or assessment to other users or employers for their independent use unless the user directs or authorizes the disclosure, or law permits or requires it.

7. Processing outside your province or Canada

Personal information may be processed in Canada, the United States and other jurisdictions in which our service providers operate. When information is processed outside your province or Canada, it may be subject to the laws and lawful-access requirements of that jurisdiction.

JobACE remains responsible for personal information transferred to a service provider for processing and uses contractual or other appropriate measures to protect it. Alberta residents and others may contact the Privacy Officer to request written information about our policies and practices for service providers outside Canada, including applicable countries and purposes.

8. Retention and deletion

We retain personal information for as long as reasonably necessary to provide the Services, maintain account and practice history, fulfil the purposes described in this Policy, and meet applicable legal, accounting, security and dispute-resolution requirements. Retention depends on the type of record and the purpose for which it is held:

• submitted recordings, transcripts, messages, resume context, assessments and reports are generally retained with the practice session until you delete the audio or session, or until they are otherwise handled under our retention practices;
• some generated speech and processing files are temporary and may be deleted after retrieval or a short technical expiry;
• identifiable attribution events are currently scheduled to be aggregated and pruned after approximately 180 days; aggregated or de-identified statistics may be kept longer;
• billing, transaction, consent, fraud-prevention, security and legal records may be kept for the period reasonably necessary or required or permitted by law.

Closing an account does not necessarily result in the immediate deletion of all associated records. When you close your account, we deactivate it and delete, de-identify or restrict access to certain account information. Some practice records may remain associated with a de-identified or pseudonymous account identifier. We may retain other records in identifiable form where reasonably necessary for accounting, fraud prevention, security, dispute resolution, legal compliance or another purpose described in this Policy.

When information is no longer required for an identified purpose, we delete, anonymize or otherwise securely dispose of it under our retention practices. Copies in backups and logs are removed or de-identified through ordinary retention cycles unless preservation is legally required.

9. Security

We maintain reasonable administrative, technical and organizational safeguards appropriate to the nature and sensitivity of the information we process. These safeguards include measures such as access restrictions, authentication controls and encryption in transit where supported by the relevant systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Keep your credentials confidential and contact us promptly if you suspect unauthorized account use.

If a privacy breach creates a real risk of significant harm or another statutory reporting threshold is met, we will notify affected individuals and regulators as required by applicable law.

10. Access, downloads, correction and complaints

The Services may allow you to download certain materials, such as available audio files or assessment reports. These downloads do not constitute a complete export of all information associated with your account, and JobACE does not currently provide a self-service export of all account data.

Subject to applicable law, you may ask us to:

• confirm whether we hold personal information about you;
• provide access to it and an account of its use or disclosure;
• correct inaccurate or incomplete information;
• delete eligible information or close your account;
• provide eligible computerized information in a structured, commonly used technological format, where a portability right applies; or
• review a privacy concern or challenge our compliance.

We may need to verify your identity. Legal exceptions may limit access, correction, portability or deletion, and we will explain a refusal where required. You may also complain to the Office of the Privacy Commissioner of Canada or the privacy regulator in your province. We encourage you to contact us first so we can investigate.

11. Children and young people

The Services are intended for users aged 16 and older. We do not ordinarily request a date of birth during registration and do not independently verify every user's age. If we learn that a person under 16 has provided personal information in connection with an account, we may suspend or close the account and delete or otherwise appropriately handle the information. Parents or guardians may contact us if they believe a person under 16 has used the Services. Users who have not reached the age of majority where they live should use the Services only with the involvement and permission of a parent or legal guardian.

12. Changes to this Policy

We may post non-material updates by revising this Policy and its effective date. We will provide reasonable advance notice of material changes by email, through the Services or by another prominent method. Where a change requires new consent under applicable law, the relevant processing will not begin until that consent has been obtained. We encourage you to review this page periodically.

13. Contact the Privacy Officer

Privacy Officer, JobACE
Ontario, Canada
Email: jobace.ca@gmail.com

Please write "Privacy Request" in the subject line and describe your request. Do not email passwords, full payment-card details, government identifiers or unnecessary sensitive information.