Privacy policy
Written to be read. Canadian personal information law (PIPEDA, and provincial equivalents in Quebec, Alberta and British Columbia) governs what we do here.
Last updated
What we collect
If you create a job seeker account: your email, the password you choose (stored only as a salted hash — we cannot read it), and whatever you put in your profile: name, headline, location, skills, links, work authorisation, and a resume if you upload one.
If you create an employer account: your email, password hash, and your company details.
If you apply to a job: the application is stored with a copy of your resume as it was at the time, plus any message you wrote. The employer whose job you applied to can see it.
If you create a job alert: your email address and the search you saved.
Everyone: standard web request data — IP address, user agent, and the page requested — handled by Cloudflare as our infrastructure provider. We use this for rate limiting and abuse prevention.
What we do not do
We do not sell personal information. We do not share it with advertisers or data brokers. We do not run third-party analytics or advertising trackers. We self-host our fonts specifically so that loading a page does not hand your IP address to another company.
Who can see your profile
By default, only employers whose jobs you actually apply to.
There is an opt-in setting that lets verified employers find your profile in a search. It is off unless you turn it on, and you can turn it off at any time.
How long we keep things
Job postings and applicant correspondence: 3 years. This is not our choice. Ontario's Employment Standards Act requires employers to retain copies of public job postings, application forms, and the outcome information given to interviewed applicants, for three years. We hold those records so employers using this board can meet that obligation.
Your account: until you delete it.
Rate limiting data: hours, then discarded.
Email logs: the record of transactional email we sent you is kept alongside the application it relates to, for the same three-year period.
Your rights
Under PIPEDA you can ask what personal information we hold about you, ask for it to be corrected, and withdraw consent for its use.
You can edit or delete your profile and resume yourself at any time from your account. To request deletion of an account and everything attached to it, email hello@hirea.ca from the address on the account.
One limit worth stating plainly: applications you have already submitted are records the receiving employer holds as well, and the three-year retention above applies to them. Deleting your account removes your profile and your resume from our storage; it does not retroactively unsend an application.
Where the data lives
On Cloudflare's infrastructure. Our primary database is provisioned in the Eastern North America region. Requests are served from Cloudflare's global network, which means data may transit through, and be temporarily processed in, jurisdictions outside Canada.
Security
Passwords are hashed with PBKDF2-SHA256 at 600,000 iterations. Sessions are signed HTTP-only cookies. Everything is served over HTTPS. Uploaded files are checked against their declared type and served as downloads, never rendered inline.
We are a small operation and we do not claim to be unbreakable. We do claim to have made the obvious choices correctly.
Changes
If this policy changes materially we will note the date above and, for changes that affect how we use information you have already given us, tell account holders by email.
Contact
hello@hirea.ca