Asperadi Privacy Policy

Effective date: October 21, 2026

1. Who we are and who this policy is for

Asperadi is a resume-screening service for recruiting teams, operated by Asperadi Solutions Inc., a Saskatchewan corporation in Saskatoon, Saskatchewan, Canada ("Asperadi", "we").

This policy is for two groups:

• Account users: recruiters, managers, administrators and owners at a customer organization who sign in to Asperadi. Sections 5 and 13 are mainly for you.
• Candidates: people whose resume an organization has given to Asperadi. Sections 6, 14 and 15 are mainly for you.

If you are a candidate, start here. The organization that received your resume is responsible for your personal information under Canadian privacy law. It collected your resume, it is responsible for any decision on your application, and it is your first point of contact. We process your resume only on the organization's instructions. Section 14 explains what we do if you contact us directly.

This policy is a notice, not a consent form. The organization is responsible for any notice and consent the law requires.

2. Summary

• The tool does not decide. An AI tool assesses your resume against the job's requirements. It does not decline or advance anyone on its assessment. The organization decides (section 15). An apply page can refuse a send before anything is stored, for the reasons in sections 6.1 and 16.
• Your name and contact details are removed before assessment, by our own code. An AI step first reads your resume, including your name, to extract details. Our code flags a resume where it cannot confirm the removal (section 6.3).
• We do not use your information to train AI models, and our model host may not use it to train models (sections 7 and 9).
• We store candidate data in Canada. The AI steps may run in the United States. Our providers process some data in Canada, the United States, Switzerland, Germany, Norway and the European Economic Area, and requests may pass through our host's region nearest you (sections 9 and 10). While your information is in the United States, it may be accessible to the courts, law enforcement and national security authorities of that country (section 9).
• We keep resumes 365 days from upload or the last decision, up to two years, unless the organization deletes them sooner or a legal hold applies (section 11).
• You can reach a person. Section 19 has our Privacy Officer's details.

3. Words we use

• Organization or customer: the business that holds an Asperadi account and gives us resumes, such as an employer's hiring team or a recruiting agency. For a candidate, it is the organization that received your resume.
• Account user: a person with a seat on an organization's account: Owner, Administrator, Manager or Recruiter.
• Candidate: a person whose resume an organization has uploaded, received through email intake, or received through an apply page.
• Assessment: the AI-generated evaluation of a resume's redacted text against a job posting's requirements.
• Legal hold: a hold we place on a record when an access request, a complaint, an erasure request under review, or a lawyer's instruction requires us to keep it. Except for original emailed applications (section 11), a record under a legal hold is not deleted until the hold is released.
• Stage: a hiring-process label, such as contacted, interviewed or hired. Every candidate shows "Pending Review" until the organization records another.
• Personal information: information about an identifiable individual, as the Personal Information Protection and Electronic Documents Act (PIPEDA) defines it. A resume with the name removed is still personal information.

4. Who is responsible

Our Privacy Officer is responsible for our compliance with this policy and with PIPEDA, and can be reached at legal@asperadi.com.

Our service providers stay our responsibility. Written contracts limit our providers' use of candidate resumes and assessments to our purposes and require security and confidentiality. Some providers also use technical or billing data, such as IP addresses, for their own purposes, as section 10 lists.

The organization's responsibilities are its own. Our customer terms require the organization to tell candidates that an AI-assisted tool is used in screening, and to give any other notice the law requires. We do not review each organization's notice.

5. Information about account users

5.1 What we collect

5.2 What we generate about you

• An audit trail of account events, such as sign-ins, security and role changes, uploads and exports. It holds codes and identifiers, not free text. Owners and administrators see all of it. Others see their own entries.
• Sessions. By default you have one session at a time, and a new sign-in ends the others. If your organization allows several, you can see and end them in account settings.
• Sign-in recognition. A keyed one-way hash of each network address you sign in from, so we can warn you about a sign-in from a new place.
• Notifications, email delivery status and rate-limit counters.
• Terms records. When you accept our terms and this policy, or dismiss a notice that they changed, we record your user ID, the document, its version and the time.

5.3 What we do not collect

In the signed-in app, we run no analytics or tracking scripts and collect no device identifiers, advertising identifiers or location data. Apart from session records, we keep your IP address only as the hash in 5.2. Our hosting, bot-check, email and payment providers also see it when they handle your request (section 10).

5.4 Emails we send you

Invitations, sign-in and confirmation codes, security and billing notices, export-ready notices, seat-removal notices, checkout emails, and an optional weekly intake summary.

5.5 When you leave an organization

Your sign-in identity is deleted. Your work stays with the organization, under the seat you held. If your organization reduces its seats below the people holding them, you may be removed at its renewal, and we email you that your access has ended.

5.6 Account restrictions

We may pause a seat to prevent abuse, stop processing when credits run out, or suspend an account under the customer terms. To appeal or get your data, write to support@asperadi.com from your sign-in address.

6. Information about candidates

6.1 What the organization gives us

Your resume (PDF, Word .docx or plain text) and the job's requirements. Each file can be up to 2.5 MB.

An organization may have applications emailed to an address we run for it. We process one resume from each email. Mail to an address that is not active is refused and bounced to the sender, and nothing is stored. We keep the original email, including your address and message, for 30 days.

An organization may also publish an apply page for a posting, which we host for it at apply.asperadi.com. What you submit there goes to that organization, under its privacy notice, the same as an emailed application. You attach your resume (PDF, Word .docx or plain text) or type it in. The page refuses any other type of file, and nothing is stored. You may also give your name, email and phone. The organization sees your typed email and phone in place of those in your resume, and your typed name only if your resume has none. We keep the name, email and phone you type with your application and do not send them to the AI model. Your resume itself is processed like any other application (sections 6.2 to 6.4). If the organization already has the same file for that posting, we delete your new copy and the details you typed, and keep the earlier one. You see a confirmation on screen; we send you no email. The page is deleted with its posting (section 11). If the posting is full, the organization's account cannot take your resume, or your IP address or browser has already sent that posting an application in the last minute, 3 in the last hour or 5 in the last day, the page says your application was not submitted, and nothing is stored. The same happens when the page has received 50 applications in the last hour or 500 in the last day, or your IP address has sent 30 in the last hour or 100 in the last day across all apply pages. We count those by a keyed hash of your IP address and of a random device id kept in a cookie (section 16), not the address or id itself. The hashes are personal information and are kept with your application (section 11). An application the page accepted that the organization's account cannot yet process is deleted after 30 days if it is still waiting. An application whose posting closes before it is processed is not processed, and is deleted 30 days after it arrived.

The organization chooses which of its postings your resume is assessed against. That can include other roles, if you agreed to be considered for them. Assessing a resume against several postings is something the organization sets up, not us. A recruiter can also see the organization's other open postings ranked by how well they match your resume. Our own code works this out, without an AI model, by comparing the words in your redacted resume with each posting's title and requirements. It assesses nothing. It is worked out each time the page opens, and the list and its order are not saved.

We do not ask candidates to create an account. To reach us, see section 14.

6.2 What we extract

From the resume text we record:

• your name, email address and phone number, so the organization can reach you;
• the city, region or country you give, because a job may require working in a particular place;
• your skills and years of experience.

We read the first 20,000 characters of your resume's text. Text after that is not extracted or assessed. We also store the resume text, up to 100,000 characters. Our tools have no field for, and do not extract, your street address, postal code, date of birth, graduation year, or any protected characteristic or demographic field. They stay in the stored resume text if your resume contains them. The model is instructed not to infer any protected characteristic. Your recorded location is not used in the assessment, but a place named in the resume may remain in the text the model reads. We do not extract other people named in a resume, such as references. Their names stay in the resume text the model reads; email addresses and phone numbers are removed whoever they belong to. We remove their details from any copy we send you in an access response.

6.3 Removing your identity before assessment

An AI step first reads the resume, including your name, to find your name and contact details. Our own code, not an AI, then removes your name using what that step found, and removes the email addresses, phone numbers and postal addresses it finds in the text. The assessment runs separately, on the redacted text and the job's requirements only.

Redaction can miss an identifier in a format our code does not recognize. If our checks cannot confirm the removal, the resume is still assessed and flagged for the organization to check.

This is a fairness measure, not anonymization. The redacted text is still personal information.

6.4 The assessment and the score

An AI model rates the redacted text against each requirement with a band and a short reason, and suggests follow-up questions a recruiter may ask you. The service turns the bands, and any weights the organization set, into a score shown to the reviewer, and may order lists best to worst. Ordering removes no one. A resume with no evidence for any requirement is listed in its own section. A resume that cannot be ranked, because every requirement was withheld as naming a protected characteristic or the AI model refused, timed out or gave an answer our code could not validate, is listed on the posting's flagged list. The assessment is not a decision (section 15).

6.5 The decision

The organization, not the tool, decides what happens to your application. Its people record decisions, notes and any stage other than the default "Pending Review".

6.6 What we store

Your resume file and text, the redacted text, your contact details, location, skills and experience, every assessment, decisions, notes and stages, and a one-way fingerprint of each file, to recognize the same file sent again to a posting. A newer resume for the same posting may be linked to your earlier one. We hold it for the organization in our database and file storage in Canada, for the period in section 11.

7. Why we use personal information

For candidates. We use candidate information only to provide the service to the organization: receiving and storing resumes; extracting fields and removing identifiers; producing assessments for the organization's reviewers; recording decisions and stages; helping recruiters draft follow-up emails they send themselves; exports; the audit trail; and preventing abuse, including the limits across all apply pages (section 6.1).

For account users and visitors. We also use personal information for our own purposes: signing users in and keeping accounts secure, including new-sign-in warnings; billing, and tax records for 6 years; replying to people who use our public forms (section 16); keeping records for disputes and audits (section 11); and publishing aggregate figures about the service that identify no one.

We do not use it to train AI models, we do not sell it, and we do not share one organization's candidates with another. Our error logs hold counts, not resume content.

8. Consent

The organization collects your resume, so under PIPEDA it identifies the purposes and obtains consent. We process your resume on its behalf, for that purpose, so we do not ask for a separate consent. To withdraw, tell the organization. There is no Canada-only version of the service (section 9).

9. Where personal information is processed

At rest: Canada. Our database, file storage and sign-in service are in Canada.

During assessment: Canada or the United States. Our AI model host reads your resume text to extract its details, including your name and contact details, and again on the one automatic retry. Each assessment against a posting then reads only the redacted text. The file itself is not sent. The model host may use the text only to provide its service to us, or as the law requires, and not to train models. Under our model host's terms, the model's developer does not receive the text we send. We keep no copy in model-call logs.

While your information is in the United States, it may be accessible to the courts, law enforcement and national security authorities of that country. We bind our providers by contract. Our customer terms require the organization to give the notice the law requires.

Mail you send us: Switzerland, Germany and Norway. Our mailboxes (support@, sales@ and legal@asperadi.com) are hosted by a Swiss provider that stores mail in Switzerland, Germany and Norway, with message bodies under zero-access encryption. Authorities in those countries can order it to disclose who wrote to us, subject lines, and mail that arrives later.

Requests from public authorities. If an authority demands candidate information from us, we tell the organization unless the law forbids it, refer the authority to the organization, and disclose only what we must.

10. Companies that process information for us

These are the categories we use. Customers can ask us for the named list.

11. How long we keep personal information

A process that runs at least daily deletes records when their time is up. Deleting a record from Asperadi does not delete the organization's own copies.

Some provider copies outlast our deletion for a short time: database backups for normally about 7 days, and copies of sent account emails for normally about 30 days at our email provider, plus about 7 days in its backups.

12. Safeguards, accuracy and incidents

We protect personal information to match its sensitivity, and treat resumes and assessments as sensitive:

• each organization's data is isolated in the database. Within an organization, every account user can see candidate records, stages and notes, and access to postings and assessments follows roles and workspaces;
• information is encrypted in transit and at rest;
• two-factor sign-in is available, and an organization can require it;
• our logs hold counts and field names, not resume content;
• our staff open a candidate record only to answer a request, for support or for a legal hold, and our support tool records each such access in the organization's audit trail.

Accuracy. Assessments are not overwritten: a new one is added. If you tell us something is wrong, we pass it to the organization, which decides and records any correction.

Incidents. If we become aware of a security incident affecting an organization's candidate information, we notify the organization without undue delay. If an incident affects information we control, such as account users' information, and creates a real risk of significant harm, we report it to the Privacy Commissioner of Canada and notify the people affected. We keep a record of every breach of security safeguards for at least 24 months.

13. Your choices: account users

• See and correct your information in account settings, or ask the Privacy Officer.
• Ask what we hold about you. Write to the Privacy Officer from your sign-in address. We answer within 30 days, or tell you within that time if we need up to 30 more days, as the law allows.
• Leave. Ask your administrator to remove your seat.
• Your organization's data. The Owner can export it from the product, even during a restriction, or by writing to support@asperadi.com.
• Close the account. Owners only, under the customer terms.

14. Your choices: candidates

Start with the organization that received your resume. It is responsible for your information. Ask it what it holds about you, including the assessment and the decision, to correct something, or to stop considering you.

If you write to us, contact our Privacy Officer (section 19) with your full name, the email address on your resume and, if you know it, the organization. We use what you send only to verify you, find your record and answer you.

• We forward your request to the organization, normally within 5 business days.
• If the organization has not answered within the time the law gives it, we may answer you ourselves, after verifying your identity. We give you your resume and the fields taken from it, every assessment with its bands and reasons, the decision and note, the stages, and what the bands mean. Access is free. If a legal exception applies, we explain it in writing.
• Corrections and complaints go to the organization, which decides them. Assessments are not rewritten.
• Deletion requests go to the organization, which can delete your record at once unless it is under a legal hold or its account is suspended or frozen. Deleting a record also deletes the decision on it. If the organization does not act in time, or its account is suspended or closed, we may delete your record ourselves after verifying your identity. Where a decision was recorded on it in the last year, we delete it a year after that decision instead.
• You can ask the organization how your application was reviewed.

What we cannot do. We cannot delete the organization's own copies of your resume, keep processing entirely in Canada, or answer for the organization's hiring decision.

15. Automated tools and human decisions

What the tool does. An AI model assesses the redacted resume against a job's requirements (section 6.4), possibly in the United States (section 9).

Who decides. The organization, not the tool. The tool does not decline or advance anyone on its assessment, and ordering removes no one from a list. Our customer terms forbid customers from building an automatic cut-off around the service.

Limits. The tool can be wrong, and a resume with little detail can understate a candidate. We do not describe the tool as bias-free.

The law.

• Canada. PIPEDA has no specific rule on automated decisions.
• Ontario. An employer with 25 or more employees that uses AI to screen, assess or select applicants must say so in a publicly advertised posting for work in Ontario.

16. Cookies, bot protection and our website

Cookies. We use only the cookies the site needs: to keep you signed in, remember choices such as your currency, hold a candidate search for 30 minutes, give you demo access, remember a passed bot check for 30 minutes, protect sign-in, forms and payments, and, on apply pages, keep a random device id for 1 year to apply their limits and show the submitted notice for 24 hours. We set no analytics, advertising or tracking cookies.

Currency. Our host works out your country from your IP address to set the currency for prices, checkout and billing. We do not save it.

Bot protection. A bot check runs when you submit our sign-in, account-recovery, demo, pricing, careers, contact or waiting-list forms. After a bot check passes on our demo, pricing, careers, contact or waiting-list form, a cookie lets the same browser submit that form again for 30 minutes (15 minutes for a checkout code) without another check. An invisible bot check also runs on apply pages. If it fails, a visible check appears; if that fails too, your resume is not sent or stored, and the page says how else to apply. When you send an application, apply pages set two cookies: a random device id, kept for a year, which we store only as a hash for the limits in section 6.1; and a marker that shows a posting's submitted notice for 24 hours after you send it an application. The bot check does not run in the signed-in app. If it blocks you, write to support@asperadi.com.

Public forms. If you join the waiting list, open the demo or claim a pricing offer, we use your email address only to answer that request, such as telling you when the site launches (section 11). Careers form messages come to our inbox.

17. Children, and where you live

Accounts are for organizations and their staff. We do not knowingly give a seat to anyone under 18. Candidates may be under 18, and the organization is responsible for any consent the law requires for them. Apply pages set the device cookie (section 16) for every applicant, whatever their age.

PIPEDA applies to Asperadi across Canada. Provincial law may add to it:

• Alberta. PIPA requires the countries and purposes of processing outside Canada and a contact for questions. See sections 9, 10 and 19.
• British Columbia. PIPA requires the organization to keep information it used to decide about you for at least one year. Our schedule keeps a record at least 365 days after the last decision on it, up to two years from upload, unless the organization deletes it sooner.

The service is offered to organizations in Canada, outside Québec, for roles in Canada. Customers agree not to open an account from Québec, or to publish or screen a posting for a position located there.

18. Changes to this policy

We may change this policy at any time.

• Material changes are those that change where candidate information is processed (other than a provider change the Terms of Service allow) or reduce its protection. We notify customers in writing at least 15 days before they take effect, by email or an in-app notice that says what changed.
• Other changes take effect 15 days after we post them.
• Changes required by law or for security may take effect sooner, with notice within 7 days after.
• Providers that handle candidate information. We give customers 7 or 14 days' notice before adding or replacing one (Terms of Service, section 8.6). If a provider fails or cuts off our access, we may replace it first and tell customers within 7 days (Terms of Service, section 10.4).

19. Questions and complaints

First, us. Privacy Officer, Asperadi Solutions Inc., Saskatoon, Saskatchewan. Email: legal@asperadi.com. Account users, please write from your sign-in address. Candidates, please include your full name and the email address on your resume. We answer within 30 days, or within the extension section 13 describes.

Then, the regulator. You may complain to the Office of the Privacy Commissioner of Canada: 30 Victoria Street, Gatineau, Québec K1A 1H3, 1-800-282-1376, www.priv.gc.ca. Residents of Alberta and British Columbia may also complain to their provincial commissioner. Candidates may also complain to the organization.

Accessibility. If you need this policy, or help with a request, in an accessible format, write to legal@asperadi.com.