Privacy Policy

DRAFT FOR LEGAL REVIEW. Not yet in force. Items in [brackets] must be completed.

Last updated: [date]

This policy explains how Offerloom, a sole proprietorship of [owner's full legal name] in Ontario ("Offerloom", "we", "us"), collects, uses, discloses and protects your personal information when you use the Offerloom website (www.useofferloom.com) and services. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, for residents of Quebec, the Act respecting the protection of personal information in the private sector (Law 25).

1. Who is responsible

Offerloom ([owner's full legal name], sole proprietor), 1802-9560 Markham Road, Markham, Ontario L6E 0T9, Canada.

Privacy Officer: [name], [privacy email address]. Contact the Privacy Officer with any question, request or complaint about your personal information.

2. What we collect

• Account information: your email address and sign-in records.
• Resume information: the resume file you upload and the text and structure we extract from it, such as your work history, education, skills and certifications, plus any additional resumes you add for other target roles.
• Application profile: your name, phone number, city, LinkedIn and website links, work authorization status, whether you need visa sponsorship, minimum salary, notice period, willingness to relocate, saved answers to common application questions, and writing preferences.
• Job search settings: the country you are looking for work in, how recent jobs should be, job titles, locations, work arrangements, companies and keywords you include or exclude.
• Generated content: tailored resumes, cover letters and recruiter outreach drafts we create for you, and any edits you make.
• Application records: which jobs you applied to, when, the method used, the status, your notes, screenshots of application forms taken during automated submission, and questions we could not answer.
• Consent records: when you approved resumes and authorized submissions.
• Usage and technical data: feature usage counts, AI processing costs, error logs, and basic device and browser information needed to keep the service secure.
• Application inbox: mail that arrives at your personal Offerloom application address (for example application confirmations, verification codes and employer replies, including mail you forward there). It may contain information about recruiters and other people who wrote to you. If you choose, this address is the email employers receive on your applications, resumes and cover letters. We create a short summary of each message and, according to your notification settings, email it to the address you sign in with, and, when you ask, an AI draft of a reply that you can edit and send yourself, from your own email or from your application address. Replies you send from your application address are stored with the conversation. If you choose, we email you a full plain-text copy of new messages instead of a summary.
• Employer-site accounts, only if you allow it in Settings: the login and a randomly generated password for employer career sites where our apply assistant creates an account for you, stored encrypted.
• Browser extension: when you press Fill in the Offerloom Copilot extension on a job board form, the extension fetches your application profile, saved answers and the matching tailored resume to fill that form. It does not collect your job-board password or session cookies.
• Billing information: your plan, credit balance and unit usage. Card details are handled by Stripe; we do not see or store full card numbers.

We do not ask for and do not want: government identification numbers or health information. Demographic information (for example gender, race or ethnicity, disability or veteran status) is collected only if you choose to self-identify in your profile. It is off by default. If you switch it on, with your express consent, we store your answers encrypted and use them only to select the matching option when an employer form asks a voluntary demographic or equal-opportunity question; we never infer these answers and never type them into free-text fields. You can change or delete them at any time, which also withdraws your consent. If you do not self-identify, we only ever select "decline to self-identify" where that option exists, and otherwise leave the question for you. [Lawyer to review: sensitive information consent wording, Quebec Law 25.]

3. Why we use it

We use your personal information only to:

1. Find job postings that match your search settings.
2. Score how well each posting fits your resume.
3. Write tailored resumes, cover letters and outreach drafts for jobs you select.
4. Fill in and, only after your explicit approval, submit job applications on your behalf.
5. Show you your application history and status.
6. Operate, secure, troubleshoot and improve the service, and enforce plan limits.
7. Communicate with you about your account and, with your separate consent, about product news.
8. Meet legal obligations.

We do not sell your personal information. We do not use your resume or application content to train AI models, and our AI provider does not use it to train its models under our commercial agreement with them [confirm against current provider terms].

4. Automated processing

Offerloom uses artificial intelligence to score job fit, to draft documents and, on some employer sites, to help an automated assistant find its way through the application form. For that assistant, the AI provider receives the form's field labels, button names and page text, never your answers, which are filled in from your profile by fixed rules. These scores and drafts are suggestions. You choose which jobs to pursue, you review and approve every resume, and nothing is submitted to an employer until you give explicit consent. You may ask us to explain how a score was produced and which information was used.

5. Who we share it with

• Employers you choose to apply to, through their application systems (for example Greenhouse, Lever or Ashby). Once submitted, the employer's own privacy policy applies to that information.
• Service providers that process data for us under contract:

• Authorities, where required by law.
• A buyer or successor if our business is sold, subject to this policy.

6. Storage outside Canada

Some of our service providers process information outside Canada, mainly in the United States. Information processed in another country is subject to that country's laws and may be accessible to its courts, law enforcement and national security authorities. For Quebec residents, we assess the protection offered before transferring information outside Quebec, as Law 25 requires.

7. How long we keep it

• Account, profile and resume data: while your account is active.
• Generated resumes, cover letters, screenshots and application records: while your account is active, or until you delete them.
• Shared job posting data (not personal information): up to [12] months.
• Consent and audit records: [up to 2 years after account deletion] to demonstrate consent.
• Backups: deleted data may remain in encrypted backups for up to [7] days.

When you delete your account, we delete your personal information within [30] days, except where the law requires us to keep it.

8. Your rights

You can:

• Access and download your information (Settings, Download your data).
• Correct your information (Profile).
• Withdraw consent, which may mean we can no longer provide the service.
• Delete your account and data (Settings, Delete your account).
• For Quebec residents: request information about automated decisions, data portability in a structured format, and de-indexing where applicable.
• Complain to us, and to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

We respond to requests within 30 days.

9. Security

We protect your information with encryption in transit and at rest, database row-level security so each user can only reach their own records, private file storage with short-lived links, least-privilege access for staff, audit logging and regular security testing. A small number of our staff can see your email address, plan, usage and application statuses to provide support, using multi-factor sign-in; they cannot see your resumes, saved answers, inbox mail, employer-site passwords or self-identification answers, and every such access is logged. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the Privacy Commissioner as PIPEDA requires, and keep a record of all breaches.

10. Children

Offerloom is not intended for anyone under 16 [confirm age]. We do not knowingly collect information from children.

11. Changes

We will notify you by email or in the app before material changes take effect.

12. Contact

[Privacy Officer name], [privacy email address], 1802-9560 Markham Road, Markham, Ontario L6E 0T9, Canada.