Pholeo Privacy Policy

Introduction

Pholeo Technologies Inc. ("Pholeo," "we," "us," or "our") operates the Pholeo marketing portfolio platform (the "Service"), including portfolio creation and publishing, first-party templates, free and paid subscription plans, and job listings. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the Service.

Please read this Privacy Policy together with our Terms of Service. Where we rely on consent for a particular use (for example, promotional emails), we will ask for that consent separately where required by law. Using the Service means you acknowledge this Privacy Policy; it does not waive rights you have under PIPEDA or other applicable law.

1. Definitions

• Personal Information means information about an identifiable individual, as defined under the Personal Information Protection and Electronic Documents Act (PIPEDA).
• User Content means any content uploaded or created by users on the Service.
• Billing Information means payment-related data such as credit or debit card details, billing address, and transaction history.

2. Information Collection

We collect the following categories of information:

• Registration Information: When creating an account, we collect your name, email address, and authentication credentials (password is stored in hashed form).
• Billing Information: When you subscribe to a paid plan or make a purchase, our third-party payment processor collects your payment details (e.g., credit or debit card number, expiration date, and billing address). Pholeo does not directly store full payment card numbers. We receive and retain limited transaction data, such as the last four digits of your card, transaction amounts, and billing dates, for record-keeping and support purposes.
• User Content: We store content you upload or create on the platform, including marketing materials and portfolio information.
• Resume-Guided Setup (Job Search Pass): If you choose to use resume-guided setup, we process the resume file you upload (PDF or Word .docx, up to 4 MB) or the text you paste in, as described in Section 5A. We read the file in memory to extract the text and show it to you to review and edit. We do not store the file or the text. We store only the suggestions you choose to apply.
• Contact Form Submissions: If you add a contact form to a published portfolio, we collect the name, email address, and message a visitor submits so we can deliver that message to you.
• Usage Data: We collect data on how you use the platform, including page views, feature interactions, clicks, and errors.
• Device Information: We collect device type, operating system, browser type, browser language, and IP address.
• Employer Account Information: If you create an employer account, we collect information needed to operate that account (such as name, email, company or organization details you provide, and authentication credentials).
• Job Application Information: If you apply to a role through the Service, we process information related to that application, including your identity as associated with your account or application, your published portfolio content made available to the employer for that application, any optional message you include, and application status updates within the platform.

3. Use of Information

We use collected information for the following purposes:

• To provide, maintain, and improve the Service
• To provide resume-guided setup when you ask for it: we send only the resume or work-history text you review and approve to our AI service provider to generate suggested profile details and projects, which you can edit or discard before anything is saved to your account (see Section 5A)
• To authenticate users and manage accounts
• To process payments, manage subscriptions, and send billing-related communications (e.g., receipts, renewal reminders, and failed payment notices)
• To communicate with you about your account, including service announcements, security alerts, and customer support messages
• To deliver contact form submissions from visitors to the portfolio owner who enabled the form
• To operate job listings, including enabling employers to post roles, enabling candidates to apply with portfolio-based applications, showing employers the candidate information described in Section 6, and providing application-status visibility where available
• To enforce our Terms of Service, including employer-use restrictions related to candidate data
• To send product research and feedback requests related to improving the Service (for example, short surveys or interview invites). These messages are not promotional offers. Each such message will include a way to opt out of future product-research emails (such as an unsubscribe link or an equivalent opt-out instruction), and you may also opt out through your account settings or by contacting [email protected]. Opting out of product-research emails does not affect transactional or account messages (such as billing, security, or support)
• To send promotional communications, such as information about new features, offers, or content relevant to you (you may opt out of promotional emails at any time using the unsubscribe link in any such email or through your account settings)
• For analytics purposes, to understand how users interact with the Service and to improve our offerings
• To detect, prevent, and address fraud, abuse, or security issues

4. Data Storage and Security

We primarily store user data in secure cloud infrastructure located in Canada, but some of our service providers may process data in other jurisdictions. We implement industry-standard security measures, including encryption of data in transit and at rest, access controls, regular security reviews, and secure authentication protocols. While we take reasonable steps to protect your information, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.

5. Sharing Information

We may share your information with the following categories of third parties:

• Payment Processors: We share billing information with third-party payment processors (e.g., Stripe) to process subscription payments and transactions. These processors handle your payment data in accordance with their own privacy policies and applicable payment card industry (PCI) standards.
• Infrastructure and Service Providers: We use third-party providers for cloud hosting, email delivery, product analytics, AI processing, and customer support tools. These providers access your data only as necessary to perform services on our behalf and are contractually obligated to protect your information. Key categories include payment processing (e.g., Stripe), product analytics (currently Mixpanel and Google Analytics 4), hosting/infrastructure, email delivery, and AI processing for resume-guided setup (currently Google LLC, through the Gemini API). A current list of key subprocessors is available upon request at [email protected], and we intend to publish it on this page or a linked page as we expand the list.
• AI Service Provider (Resume-Guided Setup): If you use resume-guided setup, the text you review and approve is sent to Google LLC (Gemini API) to generate suggestions, and Google returns the results to us. Under Google's terms for the paid Gemini API, Google acts as our data processor, does not use this content to improve its products, and may keep it for a limited period (currently up to 55 days) only to detect and prevent abuse and to meet legal requirements. Authorized Google personnel may review content flagged by Google's automated abuse systems. See Section 5A.
• Portfolio Owners: If you submit a contact form on a published portfolio, we share your submission with the portfolio owner so they can respond to you.
• Employers: If you apply to a role through the Service, we share application and published portfolio information with the employer who posted that role, as described in Section 6.
• Legal Obligations: We may disclose your information if required to do so by law, regulation, legal process, or enforceable governmental request.
• Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

We do not sell your personal information to third parties. We do not currently run third-party advertising or ad-targeting / remarketing tags on the Service. We use Google Analytics 4 for measurement and product analytics as described in Section 7. If we later use personal information for third-party advertising or ad targeting, we will update this Privacy Policy before doing so.

5A. Resume-Guided Setup (Job Search Pass)

Resume-guided setup is available to accounts created on or after October 20, 2026. For accounts created before then, it becomes available on November 21, 2026, 12:00 a.m. Calgary time (UTC−6), when this version of the Privacy Policy applies to them. If you have an active Job Search Pass, you can choose to use resume-guided setup to draft portfolio content from your resume. This feature is optional. You can skip it at any time and enter your details manually.

• What you provide: You can upload a resume file (PDF or Word .docx, up to 4 MB) or paste text, such as your resume, LinkedIn profile text, or notes about your work (up to 30,000 characters). This may include your name, contact details, work history, employers or clients, and results you describe. Before you continue, please remove anything you don't want to share, such as your home address, phone number, date of birth, government ID numbers, health information, references' contact details, or confidential client information. If your resume includes information about other people, remove it unless you are permitted to share it.
• How we read your file: If you upload a file, our servers read it in memory to extract the text, and we show you that text so you can review and edit it. We do not save the file or the extracted text, and we do not record either in our logs. Our logs contain only technical details, such as error codes and file size.
• What we send to our AI provider: Only the text that is in the review box when you click "Draft my case studies" is sent to Google LLC through the Gemini API. Google uses it to generate suggested profile details (such as a display name and a short bio) and up to five suggested projects. We use Google's paid Gemini API. Under Google's terms for that service, Google processes this text on our behalf as a data processor, does not use your text or the suggestions to improve its products, and keeps them for a limited period (currently up to 55 days) only to detect and prevent abuse and to meet legal or regulatory requirements. If Google's automated systems flag content as potentially abusive, authorized Google personnel may review it.
• What we save: Nothing from resume-guided setup is saved to your account until you review the suggestions and choose to apply them. Suggestions you apply, for example a portfolio display name or draft case studies, become part of your User Content and are kept and deleted like other User Content (see Section 9). We do not keep the suggestions you don't apply.
• Accuracy: Suggestions are generated automatically and may be inaccurate or incomplete. Please review and edit them before you apply or publish them.
• What we don't do: We do not use your resume text to train AI models, for advertising, or to make decisions about you. Our analytics and error-monitoring tools are configured not to record the contents of your resume file, the review box, or the suggestions.
• Where it is processed: The servers that read your file are operated by our hosting provider and are currently located in the United States. Google may process your text, and store it temporarily, in the United States or other countries where Google or its agents maintain facilities. See Section 12.

If you have questions about resume-guided setup, or about how we use service providers outside Canada, contact us at [email protected].

6. Employer Access to Candidate Information

When a candidate submits a job application through the Service, the following information becomes visible to the employer who posted the role:

• The candidate's name and any information included in their published portfolio, including case studies, project descriptions, stated outcomes, and skills.
• An application snapshot of published portfolio information, which may include the portfolio title, headline, thumbnail, specialisation or skill tags, and the contact email shown on the published portfolio, if the candidate has provided one.
• Any optional message the candidate includes with their application.
• The candidate's application status as updated within the platform.

The following information is not visible to employers through the Service:

• The candidate's account email address, unless the candidate has also included that address (or another contact email) in their published portfolio.
• Any portfolio content the candidate has not published (drafts, unpublished work).
• Any information from other applications the candidate has submitted on the platform.
• Private hiring notes an employer records about an application. Those notes are visible only to that employer.

Pholeo tracks employer interactions with applications, including when an application is viewed or a status is changed, for platform analytics and to provide candidates with application status visibility. This activity data is not shared with third parties. Employers are prohibited from using candidate data outside of the permitted uses described in Section 3A of the Terms of Service. Pholeo may investigate reports of misuse and suspend or terminate accounts as described in the Terms.

7. Cookies and Tracking Technologies

We and our partners may use cookies and similar tracking technologies:

• Essential Cookies: Required for the Service to function, including authentication and session management.
• Analytics Cookies: Used to understand how users interact with the Service (including marketing pages), measure performance, and identify areas for improvement. We use product analytics tools, currently Mixpanel and Google Analytics 4 (measurement ID configured in our site), that may set their own cookies or similar identifiers and may process usage data (such as page views, device/browser information, approximate location derived from IP, and referral information) in other jurisdictions, including the United States, as described in Sections 4 and 12. More detail is in our Cookie Policy.
• Preference Cookies: Used to remember your settings and preferences across sessions.

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Service.

8. User Rights

Under applicable privacy laws, including PIPEDA, you have the following rights regarding your personal information:

• Access: You may request access to the personal information we hold about you.
• Correction: You may request correction of inaccurate or incomplete personal information.
• Deletion: You can delete your account yourself in Settings → Delete account if you created your account on or after October 20, 2026; for an older account, from November 21, 2026, 12:00 a.m. Calgary time (UTC−6). Until then, or if you can't sign in, email [email protected] from your account email and we'll verify your identity and delete it for you. When you delete your account, your portfolios and Pholeo link go offline and any custom domain is removed right away, and you have 14 days to restore your account from the link we email you. After that, we delete your account and associated personal data as described in Section 9, except what we must or may keep as described there.
• Withdrawal of Consent: You may withdraw your consent for data processing at any time, subject to legal or contractual restrictions. Withdrawal of consent may affect your ability to use certain features of the Service.
• Resume-Guided Setup: Using resume-guided setup is optional. You can create your profile and case studies manually without it, and you can edit or delete any suggestions you applied at any time.
• Export / copy of your information: Where available in product settings, or upon request where required by applicable law, you may obtain a copy of certain personal information we hold about you in a commonly used, machine-readable format, where technically feasible.
• Opt Out of Marketing and Product Research: You may opt out of promotional communications and/or product-research and feedback emails at any time (see Section 3).

To exercise any of these rights, contact us at [email protected] or use the relevant options in your account settings. We will respond to your request within 30 days.

9. Data Retention

We retain your personal information for as long as necessary to provide the Service, fulfill the purposes described in this Privacy Policy, or as required by applicable laws. Specifically:

• Account Data: Retained for as long as your account is active. When you delete your account:
  • Days 0–14 (restore period): your public content goes offline right away, and you can restore your account from the link we email you.
  • After 14 days: we permanently delete or anonymize your account, portfolios, uploads and other personal data in our primary systems.
  • Service providers that process data for us (for example, product analytics and email delivery) may take up to 30 more days to complete deletion.
  • Backups expire on their own schedule, within 14 weeks. Server logs expire on their own schedule.
  • The records described under "Kept after account deletion" below are kept as described there.
• Billing and Transaction Records: Kept generally for six years after the end of the applicable tax year, or longer where required by law, to meet tax, audit and financial record-keeping requirements. These records include invoices, payments, refunds, tax amounts, and the purchase disclosures and terms that applied to a purchase. They are kept even if you delete your account, and are not used for other purposes.
• Usage and Analytics Data: Retained in aggregated or anonymized form and may be kept indefinitely for analytical purposes.
• Resume-Guided Setup: We do not store the resume file you upload, the text extracted from it, the text you submit, or the suggestions you don't apply. Our operational logs for this feature record only technical details (such as error codes and file size), not resume content. Suggestions you choose to apply become part of your User Content and are kept and deleted as described above for Account Data. Our AI service provider, Google, may keep the submitted text and the suggestions for a limited period (currently up to 55 days) to detect abuse and meet legal requirements, as described in Section 5A.
• Kept after account deletion: After you delete your account, we keep only:
  • billing and transaction records, as described above;
  • if you bought a Job Search Pass in the previous 12 months, a one-way coded (hashed) version of your email address, so the one-pass-per-12-months limit still applies. We keep it for no more than 12 months and destroy it automatically on the date you could buy another pass;
  • if you unsubscribed from our marketing emails, a one-way coded (keyed-hash) version of your email address on our do-not-email list, so we never send you marketing again. We keep it for 3 years after the last marketing email we sent you; this is our own choice, so we can show we respected your request;
  • job applications you already sent: deleting your account does not recall them. They remain visible to the employer you sent them to until the role is closed or 12 months after you applied, whichever is first (without your portfolio link or thumbnail). We tell you this when you apply;
  • a record that your account was deleted, without your name or email address;
  • information we must keep because of a legal obligation, a legal claim or investigation, or a pending access request, for as long as that requires.

After the applicable retention period, we will securely delete or anonymize your personal data in accordance with our data management practices and legal obligations.

10. Data Breach Notification

In the event of a data breach that creates a real risk of significant harm to individuals, Pholeo will notify affected users and the Office of the Privacy Commissioner of Canada as required under PIPEDA. We will provide notification as soon as feasible after becoming aware of the breach, including a description of the breach, the types of information involved, and the steps we are taking in response.

11. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly. If you believe a child under 18 has provided us with personal information, please contact us at [email protected].

12. International Data Transfers

Pholeo is based in Canada, and your personal information is primarily stored and processed in Canada, but some service providers may process data in other jurisdictions (including, where applicable, the United States). If you access the Service from outside Canada, your information may be transferred to, stored in, and processed in Canada or other countries. Privacy laws in those countries may differ from those in your jurisdiction. We take reasonable steps to protect personal information when it is processed by service providers, including contractual obligations to safeguard the information, consistent with this Privacy Policy and applicable Canadian privacy law. If we rely on consent for a particular transfer or use, we will obtain it as required.

Service providers outside Canada. We use these service providers outside Canada:

While your information is outside Canada, it may be accessible to courts, law enforcement and national security authorities there. To get our written policies on service providers outside Canada, or to ask questions about how they collect, use, disclose or store your information, contact our Privacy Officer, Pholeo Technologies Inc., [email protected].

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify users of any material changes at least 30 days in advance through email or in-app notifications. The "Effective Date" at the top of this page indicates when this Privacy Policy was last revised. Your continued use of the Service after the updated Privacy Policy takes effect constitutes your acceptance of the changes.

14. Contact

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us at:
Privacy Officer, Pholeo Technologies Inc., [email protected]

If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

15. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of Canada, including PIPEDA and applicable provincial privacy legislation.