CareerGraph is operated by Jegsplus Solutions LTD, a company incorporated in the Province of Saskatchewan, Canada ("we", "our", or "us"). We operate the www.careergraph.co website (hereinafter referred to as the "Service"). This Privacy Policy explains how we collect, use, disclose, and otherwise handle your information when you visit our website and use our services.

1. Information We Collect

Personal Information

When you create an account or use CareerGraph, we collect personal information you voluntarily provide, including:

Name, email address, and contact information
Professional background, work experience, and education history
Skills, certifications, and resume content
Payment information (processed securely through Stripe)
Profile information and preferences

Automatically Collected Information

When you access our Service, we automatically collect certain information about your device and usage, including:

IP address and browser type
Pages visited and time spent on each page
Referring website and clickstream data
Device information and operating system
Cookies and similar tracking technologies

Interview Platform Data (Candidates)

When you participate in a scheduled video interview through CareerGraph, we collect additional data as part of the interview session, including:

Video and audio recordings of your interview session via your device camera and microphone
Written responses to interview questions submitted during the session
AI-generated scores and feedback on each of your answers, produced by OpenAI
Integrity monitoring data, including timestamps and counts of browser tab switches, window changes, fullscreen exits, paste attempts, right-click attempts, and developer tool usage
Face detection data, including whether multiple faces are detected in your camera feed during the interview
Violation snapshots: if certain integrity violations are detected (such as multiple faces visible on camera), a still image captured from your camera feed may be saved and transmitted to the hiring organization as part of the integrity report
An integrity score (0 to 100) calculated from the above monitoring data
Session metadata, including start time, completion time, question count, and retake count

Before the interview begins, you are presented with a rules screen disclosing all active monitoring features. Proceeding past that screen constitutes your consent to this data collection for that session.

2. How We Use Information

We use the information we collect to:

Provide, maintain, and improve our Service
Create and manage your account
Process payments and send related information
Send administrative emails and service updates
Respond to your inquiries and customer support requests
Monitor and analyze trends, usage, and activities
Detect, prevent, and address fraud and security issues
Personalize and improve user experience
Send promotional communications (with your consent)
Comply with legal obligations
Score and evaluate interview answers using AI (for scheduled interview participants)
Calculate integrity scores and compile proctoring reports for hiring organizations
Generate a final interview performance report and deliver it to both the candidate and the hiring organization

3. Data Sharing and Processors

We do not sell, trade, or rent your personal information to third parties. We may share your information only in these circumstances:

Supabase: Our database and authentication provider stores your account data and resume content on servers in the United States
OpenAI: Resume content, cover letter text, elevator pitch data, and interview answers submitted through AI features are processed by OpenAI, L.L.C. to generate responses and scores. OpenAI does not use this data to train their models under our API agreement
Stripe: Payment processing information is shared with Stripe, Inc. to process transactions securely
Google AdSense: If you consent to cookies, advertising data may be shared with Google LLC for ad personalization
Hiring Organizations (Interview Candidates): If you participate in a scheduled interview arranged by an employer or organization using CareerGraph, the following information about your session is shared with that organization: your interview answers, your AI-generated scores and feedback, your overall score and grade, your integrity score, any detected violations, violation snapshots (still images from your camera captured at the moment a violation occurred), and a link to your interview video recording. This data is delivered by email to the organization's administrator upon completion of your interview. You are informed of this sharing before the interview begins.
Resend: We use Resend to deliver transactional emails. Email content including interview reports may pass through Resend's infrastructure
Google Analytics: If you enable the Analytics cookie category, Google LLC processes usage data (pages visited, approximate location, device information) to provide aggregate usage statistics. Analytics is not loaded until you opt in
Anam: During AI video interviews, your audio and the interviewer's responses are processed by Anam Ltd to render the interactive AI interviewer avatar
Twilio: If you use SMS features, your phone number and message content are processed by Twilio Inc. to deliver text messages
Sentry: Error reports (which can include your IP address, browser details, and the page where an error occurred) are processed by Functional Software, Inc. (Sentry) so we can diagnose and fix failures
Cloudflare Turnstile: Sign-up, sign-in, and password reset forms use Cloudflare's Turnstile to block bots; Cloudflare processes your IP address and browser signals to make that determination
Upstash: Rate limiting uses Upstash Redis, which briefly processes request identifiers (such as hashed IP addresses) to prevent abuse
Google Fonts: Public portfolio pages load their chosen typefaces from Google Fonts, which means Google receives the page visitor's IP address as part of serving the font files
Legal Requirements: When required by law, court order, or government request
Business Transfer: In the event of merger, acquisition, or asset sale, your information may be transferred
With Your Consent: When you explicitly consent to share information

4. Cookies and Consent

We use a cookie consent banner on your first visit that lets you choose exactly which categories of cookies you allow. Non-essential cookies are off by default and are only loaded after you explicitly turn on their category. Essential cookies (for login sessions and security) are always active because the Service cannot function without them.

We use the following cookie categories:

Essential cookies: Required for authentication, session management, and security. These are always active and do not require consent.
Analytics cookies: Help us understand how you use our Service so we can improve it. Loaded only if you enable the Analytics category.
Marketing and advertising cookies: Used by Google AdSense to show relevant ads. Loaded only if you enable the Marketing and Advertising category.

You can change or withdraw your consent at any time using the "Cookie Settings" link in the footer of every page, which reopens the consent banner with your current choices. Withdrawing consent stops new optional cookies from being set; you can also clear existing cookies through your browser settings. Your choices are stored on your device and are not linked to your account.

5. Data Security

We implement robust security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. These include:

SSL/TLS encryption for data in transit
Secure password hashing and authentication
Regular security audits and updates
Access controls and role-based permissions
Compliance with industry security standards

However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal information:

Access: Request access to your personal data
Correction: Request correction of inaccurate information
Deletion: Request deletion of your data (right to be forgotten)
Portability: Request your data in a portable format
Withdrawal: Withdraw consent for data processing
Opt-out: Opt-out of marketing communications

You can download a complete copy of your personal data at any time using the "Download My Data" button in your account Settings, and you can delete your account (including all associated data) from the same page. To exercise any other right, please contact us. Your privacy rights are protected under Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

6a. For Users in the European Economic Area and the United Kingdom (GDPR and UK GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to our processing of your personal data, and this section provides the additional information those laws require.

Lawful Basis for Processing

We process your personal data on the following legal bases:

Performance of a contract (Article 6(1)(b)): Creating and managing your account, storing your resumes and cover letters, processing payments, and providing the features you use
Consent (Article 6(1)(a)): Marketing emails, analytics and advertising cookies, and interview session monitoring. You can withdraw consent at any time
Legitimate interests (Article 6(1)(f)): Securing our Service, preventing fraud and abuse, and improving our features. We balance these interests against your rights and freedoms
Legal obligation (Article 6(1)(c)): Retaining payment records for tax purposes and responding to lawful requests from authorities

International Data Transfers

Your data is stored on Supabase infrastructure located in the United States, and our processors (OpenAI, Stripe, Google, Resend) also process data in the United States. Where data is transferred out of the EEA or UK, we rely on our processors' compliance mechanisms, including Standard Contractual Clauses and, where applicable, certification under the EU-U.S. Data Privacy Framework and the UK Extension to it. You may contact us for more information about the safeguards applied to a specific transfer.

Your Rights Under GDPR and UK GDPR

In addition to the rights described in Section 6, you have the right to:

Access (Article 15): Obtain confirmation of what personal data we hold about you and a copy of it
Rectification (Article 16): Have inaccurate personal data corrected
Erasure (Article 17): Have your personal data deleted where there is no lawful reason to keep it
Restriction (Article 18): Restrict processing in certain circumstances
Portability (Article 20): Receive your data in a structured, commonly used, machine-readable format. The "Download My Data" button in Settings provides this as a JSON export
Objection (Article 21): Object to processing based on legitimate interests and to direct marketing at any time
Automated decision-making (Article 22): Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. AI interview scores generated by CareerGraph are provided to hiring organizations as a supplementary tool only, and hiring organizations are contractually required not to use them as the sole basis for hiring decisions

Complaints to a Supervisory Authority

If you believe our processing of your personal data infringes data protection law, you have the right to lodge a complaint with a supervisory authority. In the United Kingdom, this is the Information Commissioner's Office (ICO), reachable at ico.org.uk. In the EEA, you may complain to the data protection authority in your country of residence or place of work. We would appreciate the chance to address your concerns first, so please consider contacting us before contacting a regulator.

6b. Data Protection Contacts, Retention and Human Review

Data Protection Officer and EU Representative

Our Data Protection Officer can be reached at dpo@careergraph.co. You may write to the DPO about anything in this policy, including a request to exercise any of the rights in Section 6a.

For the purposes of Article 27 of the GDPR, our representative in the European Union can be reached at eu-rep@careergraph.co. Data subjects in the EEA may contact the representative on any matter relating to the processing of their personal data.

How Long We Keep Your Data

We keep personal data only as long as we need it for the purpose it was collected for:

Active accounts: your account data, resumes, cover letters and application history are kept for as long as the account is in use, and reviewed every 12 months.
Inactive accounts: an account with no sign-in for 6 months is flagged as inactive. We contact you before any deletion so that you can keep the account by signing in.
After deletion: data is erased within 30 days of an account being deleted, except where we are legally required to keep it.
Interview recordings: deleted within 5 days of the interview being scored.
Payment records: kept for 7 years, as tax law requires.

Human Review of Automated Decisions

Where AI has scored, ranked or filtered anything relating to your employment, you can ask for a person to review it. Write to privacy@careergraph.co and a person, not a system, will answer. You can also turn AI Auto Apply off at any time from its settings screen, which stops automated matching for your account entirely.

What our AI does, what it assesses and what it never looks at is set out in full on our Automated Decision-Making page.

6c. For Residents of California (CCPA and CPRA)

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you the rights set out below. We have not sold personal information in the preceding 12 months, and we do not share it for cross-context behavioural advertising.

Categories of Personal Information We Collect

Identifiers: name, email address, phone number, account identifier. Collected to create and run your account.
Customer records: employment history, education and skills from the resumes you build or upload. Collected to provide the resume, matching and application features.
Commercial information: subscription plan and payment records. Collected to take payment and meet tax obligations.
Internet activity: pages viewed and features used. Collected to keep the service secure and to improve it.
Geolocation: approximate location from your IP address. Collected to show relevant jobs and to detect unusual sign-ins.
Audio and visual information: interview recordings, where you take an interview. Collected to score the interview and share the result with the hiring organization.
Professional information: job applications and their outcomes. Collected to run the application tracker.
Inferences: AI-generated match scores and interview scores. Generated to rank jobs for you and to give hiring organizations a supplementary signal.

We collect this information from you directly, from your use of the service, and from hiring organizations that invite you to an interview. We keep each category for the periods set out in Section 6b.

Your California Rights

Right to know: request the categories and specific pieces of personal information we have collected about you, where it came from, why we collected it, and who we disclosed it to.
Right to delete: request deletion of the personal information we hold about you, subject to the exceptions the law allows.
Right to correct: request that we correct inaccurate personal information.
Right to opt out of sale or sharing: we do not sell or share personal information, so there is nothing to opt out of. If that ever changes, we will say so here first and provide a mechanism.
Right to limit use of sensitive personal information: interview recordings are the only sensitive category we handle, and they are used solely to score the interview you chose to take.
Right to opt out of automated decision-making: you can ask that AI not be used to score, rank or filter anything relating to your employment, and that a person handle it instead. Write to privacy@careergraph.co, or turn AI Auto Apply off in its settings.
Right to non-discrimination: we will not deny you service, charge you a different price, or give you a lower quality of service because you exercised any of these rights.

Do Not Sell or Share My Personal Information

CareerGraph does not sell or share personal information as those terms are defined by the CCPA and CPRA. To make any other request under this section, including a request to opt out of automated decision-making, write to privacy@careergraph.co, or use the contact form. You may also use an authorised agent. We verify requests against the email address on the account, and answer within 45 days.

7. Age Requirement

Our Service is intended for users who are at least 14 years of age. We do not knowingly collect personal information from anyone under 14. If we become aware that we have collected personal information from a person under 14, we will take steps to delete such information and terminate the account promptly.

8. Data Retention

We retain your personal information for as long as your account is active and as needed to provide our Service. Specifically:

Account data (name, email, resume content) is retained while your account remains active
Upon account deletion, your personal data is deleted within 30 days, except where retention is required by law
Payment records are retained for 7 years as required by tax and financial regulations
Anonymized usage data may be retained indefinitely for analytics purposes
Interview video recordings are automatically and permanently deleted from our storage 5 days after the interview is completed
Interview answers, scores, feedback, integrity scores, and violation data (including any violation snapshots) are retained for as long as the hiring organization's account remains active, and deleted within 30 days of account closure
If you are a candidate and the hiring organization deletes your interview data, it will be removed from our systems within 30 days

You can delete your account yourself at any time from Settings under Danger Zone, or contact us and we will do it for you.

8a. Interview Platform and Proctoring

CareerGraph provides a video interview platform used by employers and organizations ("hiring organizations") to conduct remote interviews with candidates. This section describes how that platform works and what it means for your privacy.

How Candidates Are Invited

Hiring organizations using CareerGraph may invite candidates to complete a video interview by sharing a unique interview link. If you receive such a link, CareerGraph acts as a data processor on behalf of the hiring organization, which is the data controller for the interview session.

What Is Collected During an Interview

During a scheduled video interview, the following data is collected and transmitted to CareerGraph servers:

A continuous video and audio recording of your session
Your written or spoken answers to each interview question
Real-time integrity monitoring events, including browser tab switches, window changes, fullscreen exits, paste attempts, right-click attempts, and developer tool detections
Camera-based face detection results, including whether multiple faces are visible during the session
Still image snapshots captured from your camera at the moment of certain integrity violations

Consent Before the Interview

Before the interview begins, you are shown a rules and disclosure screen listing all active monitoring features for that session. The monitoring features active for any given interview are configured by the hiring organization. By clicking "Start Interview," you acknowledge that you have read and agree to the monitoring terms for that session.

AI Scoring

Your interview answers are transmitted to OpenAI, L.L.C. for automated scoring. OpenAI returns a score (0 to 100) and written feedback for each answer. These scores and feedback are stored on our servers and shared with the hiring organization. AI-generated scores are not a guarantee of any hiring outcome and should not be treated as the sole or definitive assessment of a candidate.

Sharing with Hiring Organizations

Upon completion of your interview, a report is automatically sent by email to the hiring organization's administrator. This report includes: your answers, scores, feedback, overall grade, integrity score, detected violations, violation snapshots, and a time-limited link to view your video recording. You are made aware of this sharing in the disclosure screen before the interview starts.

Video Recording Deletion

Video recordings are automatically deleted from CareerGraph storage 5 days after the interview is completed. Violation snapshots are embedded in the email report delivered to the hiring organization and are not stored separately on our servers beyond that point.

Biometric and Facial Data

CareerGraph uses browser-based face detection during interviews solely to determine whether more than one face is visible in the camera frame. We do not build facial recognition profiles, identify individuals by biometric characteristics, or store facial geometry data. Still image snapshots taken at the moment of a multi-face violation may capture an image of your face and are shared with the hiring organization as described above. If your jurisdiction has laws governing biometric information (such as BIPA in Illinois or PIPEDA in Canada), you should review the hiring organization's own privacy disclosures, as they are the data controller for your interview data.

9. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the applicable regulatory authority as required under PIPEDA and applicable provincial privacy laws. Notification will be provided without undue delay, and in any case within 72 hours of becoming aware of the breach where feasible. Notification will include a description of the breach, the data involved, and steps we are taking to address it.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, and other factors. We will notify you of any material changes by posting the updated policy on our website with an updated "Last updated" date. Your continued use of our Service constitutes your acceptance of the updated Privacy Policy.

11. Contact and Privacy Officer

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

Jegsplus Solutions LTD

Operating as CareerGraph

Location: Saskatchewan, Canada

We'll respond to your inquiry within 72 hours.