Policy draft · updated November 4, 2026

Privacy Notice

Draft for review · not yet in force. JPOS.ca is the selected public brand and domain. The legal operator, hosting and data vendors, support contact, and production storage choices still need confirmation. Complete a privacy review for the final operating regions before publication.

This draft explains the information the JPOS.ca platform is designed to handle and the intended reasons for handling it. The final notice must identify the legal operator and all production service providers.

Information handled

Account and contact details, account role, company details, and employer review records.
Job seeker profile information, resume details, and PDF resume files uploaded to the preview service.
Job postings, applications, application status, and messages linked to an application.
Support requests, safety reports, staff notes, moderation decisions, and audit/security events.
Technical and session information needed to secure and operate the service.

How information is used

Information is used to operate accounts, show public profiles or postings according to user settings, deliver applications and messages to the intended participants, provide support, investigate reports, prevent misuse, maintain security, and meet legal or business record obligations.

Resume privacy

In the current preview, resume PDFs are held in the service database and served through account-authorized routes. A job seeker can access their own file. An employer can access a resume only when the applicant has applied to that employer’s posting and the application remains within its retention period. Public search must not expose resume files. This preview setup is not production-approved file hosting; private storage, backup and restore, and access controls still need production configuration and verification.

Sharing

Application information is shared with the employer selected by the job seeker. External application links send the user to an employer-controlled site. Authorized support staff, moderators, and admins may access reports and related records needed for support, moderation, investigations, and operations. Safety reports are kept separate from ordinary support cases and are visible to staff roles. Production vendors that host or process data must be named in the final notice.

Retention and deletion

Current policy direction is to retain active accounts while active; mark accounts inactive after 365 days without login without deleting them solely for inactivity; and remove public presence when a user deletes an account while retaining internal records for 24 months, subject to legal, security, audit, billing, or regulatory needs. Audit logs are intended to be retained for seven years. Billing records and receipts have separate retention periods.

For Gen 1, ended free postings and linked application/resume access are configured for a 28-day retention window. Account deletion and 24-month record purging still require a production-ready workflow and verification; these policy targets must not be represented as fully automated until that work is confirmed.

Your choices and requests

Users should be able to request access, correction, or deletion through the support channel. The final operator must provide a working contact and explain any applicable regional rights, response times, and exceptions.

Security and changes

The service uses role checks and application relationships to limit access. No online system can promise absolute security. Before publication, identify the legal operator and production providers, confirm applicable privacy rights and contact procedures, and update this notice to match the live hosting, database, file storage, and email services.