Privacy Policy

For account, billing, and usage information — Sam7 is the enterprise that collects and holds this information and is accountable for it.

For application data (resumes, contact details, interview notes) — it is the Client Organization running the recruitment that collects this information and is accountable to you for it. We act on its behalf, on its instructions, as a service provider, under a written agreement compliant with section 18.3 of the Act. If you are a Candidate and wish to exercise a right, contact the organization you applied to first; we remain reachable if it no longer is.

Person in charge of the protection of personal information (s. 3.1 of the Act) — Serge Dogbo, Privacy Officer (Person in charge of the protection of personal information). Email: contact@chasseurdetalents.com. Address: 123, rue Serge, Québec (Canada).

Account information — name, email address, password (stored as an irreversible cryptographic hash), role within the organization, language and theme preference.

Application data — resume content (education, experience, skills), cover letters, answers to interview questions, recruiter notes, status history, AI analysis results (summary, relevance score).

Billing information — organization name, billing address, payment history. No credit card number passes through our servers, and none is stored there. When card payment is offered, it will be entrusted to a specialized PCI-DSS compliant provider, with card details entered directly on their systems.

Technical information — IP address, device and browser type, pages visited, connection timestamps, audit log of sensitive actions, for security, troubleshooting, and traceability purposes.

Communication information — content of messages exchanged with support or the built-in conversational assistant.

Sensitive information. A resume may contain information of a sensitive nature (origin, health, union membership, beliefs). We never solicit it and draw no inference from it; it is processed solely because it appears in a document you or the Client Organization submitted, and receives the highest level of protection provided for in this Policy.

The marketing website collects only a minimum of technical information, described in the Cookie Policy. It processes no application data.

Québec law requires us to determine the purposes of collection before collecting any information, and to limit collection to what is necessary for those purposes. Our purposes are:

Providing the Service — creating and managing your account, hosting your recruiting campaigns, analyzing applications, powering the candidate portal, handling billing.

Securing the Service — detecting and preventing unauthorized access and fraud, logging sensitive actions, diagnosing incidents.

Supporting you — responding to your support requests and questions.

Complying with the law — retaining accounting and tax records for the required period, responding to a legitimate request from a competent authority.

Improving the Service — from aggregated, irreversibly anonymized statistics only.

Consent. In accordance with section 14 of the Act, your consent is requested in a manner that is manifest, free, and enlightened, and given for each specific purpose, in simple terms and separately from any other information. Consent for purposes not necessary to the Service (for example receiving our newsletter) is always optional and may be withdrawn at any time without affecting your access to the Service.

We never sell your personal information, nor exchange it for consideration, and we never use it for behavioural advertising.

Resumes may be analyzed by an artificial intelligence system operated on enterprise cloud infrastructure, for the sole purpose of producing a structured summary, a relevance score, and suggested interview questions for the recruiter.

No decision based exclusively on automated processing is rendered. The results produced are recommendations subject to the judgment of a human recruiter. Should this change, we would inform you at the time of or before the decision and allow you to submit observations and request a review of the decision, in accordance with section 12.1 of the Act.

Processing is partitioned by organization: one Client Organization’s data is never used to answer another’s request. Photographs are never sent to the analysis system. Your data is never used to train any model.

Full details — nature of the processing, known limits, measures against bias, Candidate rights — appear in our AI Transparency Notice.

We disclose your personal information only to the following categories of recipients, each bound by a written agreement imposing confidentiality, security, and a prohibition on use for other purposes:

Cloud hosting — the Service’s servers, databases, and files (facilities located in Canada (Google Cloud Platform infrastructure)).

Artificial intelligence infrastructure — application analysis, on our exclusive instructions.

Payment provider — secure card payment processing, PCI-DSS compliant. This provider is not yet in service: no card payment is processed at this time.

Transactional email service — confirmations, invitations, password resets, billing notices.

Authorized members of your own organization, according to the roles and permissions assigned to them.

Competent authorities, only where the law requires it of us or to assert our rights in court. We require a valid, documented request, and we inform you where the law permits.

A successor in a reorganization (merger, acquisition, asset sale) — you would be informed before any transfer and before your information becomes subject to a different policy.

Each organization is strictly partitioned: no organization’s data is visible to another.

Our primary servers are located in Canada (Google Cloud Platform infrastructure). Some providers may nevertheless process information outside Québec, including in another Canadian province or abroad.

In accordance with section 17 of the Act, we carry out a privacy impact assessment before any communication of personal information outside Québec, and before entrusting a provider located outside Québec with the collection, use, communication, or retention of such information. That assessment takes into account the sensitivity of the information, the purposes of use, the protection measures, and the legal regime applicable in the destination territory.

Communication takes place only if the assessment demonstrates that the information will receive adequate protection, having regard in particular to generally recognized principles for the protection of personal information, and it is governed by a written agreement.

The register of our assessments is kept up to date and may be consulted on reasoned request to the person in charge of the protection of personal information.

Sensitive fields receive additional layers of protection, on top of robust encryption applied across the entire Service, both in transit and at rest. Access is strictly limited by organization and by role, verified securely on every request.

Temporary links to sensitive files automatically expire shortly after creation. A separate audit log records sensitive actions for traceability.

Confidentiality incidents. We maintain a register of every confidentiality incident, in accordance with section 3.8 of the Act. Where an incident presents a risk of serious injury, we promptly notify the Commission d’accès à l’information du Québec and the persons concerned, and we take reasonable measures without delay to reduce the risk and prevent recurrence.

No system being infallible, we do not guarantee absolute security; we maintain measures consistent with recognized practice and evolve them according to risk.

Québec law requires us to destroy or anonymize personal information once the purpose for which it was collected has been achieved. We apply the following schedule:

Account and platform data — for the life of the account, then deleted within thirty (30) days of closure, unless you request extended retention or a legal obligation applies.

Application data — retained in the Client Organization’s talent pool until deleted at the request of the Candidate or the organization, or until that organization’s account is closed. The Client Organization may set a shorter period.

Billing and accounting — six (6) years from the end of the relevant fiscal year, as required by applicable tax regulation.

Security and audit logs — twelve (12) months, a period proportionate to incident-detection needs.

Confidentiality incident register — five (5) years from the date the incident became known, in accordance with the applicable regulation.

Free-trial anti-abuse registry — a cryptographic fingerprint of the email address, retained indefinitely, including after the account is deleted. The fingerprint cannot be used to reconstruct the address; it serves only to prevent the same email from opening several successive free trials. No other data is held.

Unsubscribe registry — a cryptographic fingerprint of the email address, retained indefinitely: without it, an unsubscribe request would be lost and commercial emails would resume.

Backup copies — purged on a rotation cycle not exceeding thirty-five (35) days after deletion in production.

Under Québec and Canadian law, you have the following rights:

Access — obtain confirmation that we hold information about you and receive communication of it.

Rectification — have inaccurate, incomplete, or equivocal information corrected.

Deletion — have information deleted where its collection is not authorized by law.

Withdrawal of consent — withdraw a consent given at any time, going forward.

Portability — receive, in a structured, commonly used technological format, the computerized information you provided to us, or request its communication to a third party.

De-indexing and cessation of dissemination — have the dissemination of information stopped or a hyperlink giving access to it de-indexed, on the conditions set out in the Act.

Information about an automated decision — be informed and submit observations where a decision is based exclusively on automated processing.

Response time. We respond within thirty (30) days of receiving your request. Processing is free of charge; reasonable fees may be charged only for transcription, reproduction, or transmission, and you are informed of them beforehand.

Recourse. In the event of refusal or no response, you may first request an internal review (see the Your Privacy Choices page), then apply to the Commission d’accès à l’information du Québec, or to the Office of the Privacy Commissioner of Canada depending on the law applicable to you.

The website and the platform use only cookies and local storage technologies that are strictly necessary to their operation: keeping the session active, remembering language and theme. No advertising or third-party analytics cookie is placed, which is why no consent banner is shown.

We use no technology capable of identifying, locating, or profiling you. Should we introduce one, we would inform you beforehand and provide the means to deactivate it, in accordance with section 8.1 of the Act.

The full inventory appears in the Cookie Policy, incorporated by reference into this Policy.

The platform, as a work tool, is reserved for persons who have reached the age of majority.

Submitting an application, however, is open to any person of legal working age. Where the Candidate is under 14 years of age, consent to the collection of their personal information must be given by the person having parental authority, in accordance with section 4.1 of the Act. Above 14, the minor consents personally.

If you believe information about a minor was collected without the required consent, write to contact@chasseurdetalents.com: we will delete it.

We may update this Policy. Any material change is communicated to you at least thirty (30) days before it takes effect, by in-platform notification or by email. The date of last update appears at the top of the page, and previous versions are retained and available on request.

If you reside in one of these territories, the General Data Protection Regulation (GDPR) or its local equivalent may apply. The following rights then supplement those described in section 9:

Legal bases. Our processing relies on performance of the contract (providing the Service), legitimate interest (security, fraud prevention, improvement through anonymized statistics), legal obligation (accounting), or your consent (optional communications).

Additional rights — restriction of processing, objection to processing based on legitimate interest, and the right not to be subject to a fully automated decision.

Transfers outside the territory. Transfers to Canada benefit from the European Commission’s adequacy decision regarding Canada for organizations subject to PIPEDA. For transfers not covered, we rely on standard contractual clauses.

Complaint. You may lodge a complaint with the supervisory authority of your place of residence, place of work, or the place of the alleged infringement.

If you reside in California, Colorado, Connecticut, Texas, Virginia, or another state with a consumer privacy law, the following applies.

Categories collected in the past twelve months — identifiers (name, email, IP address); commercial information (subscription history); internet activity (pages visited); professional or employment information (resume content); limited inferences (relevance score). Sources: you, your Client Organization, your browser. Purposes: those stated in section 3. Recipients: the categories stated in section 5.

Sensitive personal information. A resume may contain some. We use it only for purposes permitted by law — providing the requested Service — and never to infer characteristics about you. The right to limit its use is therefore satisfied by default; you may nonetheless formally exercise it by writing to us.

No sale, no sharing. We do not sell and do not share your personal information within the meaning of these laws, including for cross-context behavioural advertising, and have not done so in the past twelve months. No “Do Not Sell or Share” link is therefore required.

Your rights — to know, access, correct, delete, obtain a portable copy, and not be subject to discriminatory treatment for exercising a right. We do not deny or degrade the Service, and apply no different price, because you exercised a right.

Timing. We acknowledge receipt within ten (10) business days and respond within forty-five (45) days, extendable once by forty-five (45) days with a reasoned notice.

Authorized agent. You may appoint a third party to exercise your rights; we will verify their mandate and your identity.

Appeal. If refused, you have a right of appeal described on the Your Privacy Choices page, and may then contact your state attorney general.

Global preference signals. We honour recognized preference signals, such as Global Privacy Control. In practice, since no affected tracker is placed, the signal has no effect to neutralize.

Privacy Officer (Person in charge of the protection of personal information) — Serge Dogbo

Sam7, 123, rue Serge, Québec (Canada)

Email: contact@chasseurdetalents.com

Commission d’accès à l’information du Québec — www.cai.gouv.qc.ca

Office of the Privacy Commissioner of Canada — www.priv.gc.ca