Privacy Policy

1. Introduction

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Payment Information

We use Stripe to process payments. We do not store your credit card number, CVV, or full payment card details. Stripe collects and processes payment information in accordance with their Privacy Policy.

3. How We Collect Information

3.1 Direct Collection

We collect information directly when you:

• Create an account
• Submit job postings for analysis
• Contact us for support
• Subscribe to a paid tier

3.2 Automatic Collection

We automatically collect technical and usage data through:

• Server logs
• Cookies and similar technologies (see Section 9)
• Analytics tools (when implemented)

3.3 Third-Party Sources

We may receive information from:

• Authentication providers (when you sign in with third-party accounts)
• Payment processors (transaction confirmations only)

4. How We Use Your Information

We use your information for the following purposes:

5. AI and Machine Learning

5.1 How AI Processes Your Data

ZipCheck uses artificial intelligence (AI) and large language models (LLMs) to analyze job postings. When you submit a job posting:

1. Rule-Based Analysis: Your text is first analyzed using automated pattern matching (no AI involved)
2. Low-Confidence Flagging: If the rule-based system has low confidence, your text proceeds to AI analysis
3. AI Analysis: Your job posting text is sent to third-party AI providers (via OpenRouter) for deeper analysis
4. Results Generation: AI-generated compliance suggestions are returned to you
5. Report Display: The compliance report is presented in your dashboard

5.2 What AI Providers Receive

When processing your job posting, our AI providers receive:

• The job posting text you submitted
• A unique session identifier (not linked to your identity)

AI providers do not receive:

• Your name or email address
• Your organization name
• Your payment information
• Your account details

5.3 Contractual Protections

We have contractual agreements with AI providers that:

• Prohibit them from using your data to train their models
• Require them to delete your data after processing
• Limit data retention to the minimum necessary for processing
• Require industry-standard security measures

However, you should review the privacy policies of third-party AI providers for their specific data handling practices.

5.4 AI Providers

We currently use:

• OpenRouter: Routes requests to various LLM providers (including Anthropic, OpenAI, and others) for text analysis

For details on how these providers handle data, see their respective privacy policies.

5.5 Aggregated Data

We may use anonymized, aggregated patterns (e.g., “60% of postings lack salary disclosure”) to improve the Service. This aggregated data:

• Cannot be linked back to you or your specific job postings
• Does not contain personally identifiable information
• Helps us understand common compliance issues

6. Information Sharing and Disclosure

6.1 Third-Party Service Providers

We share information with service providers who help us operate the Service:

These providers are contractually required to:

• Protect your information with appropriate security measures
• Use your data only for the services they provide to us
• Not use your data for their own business purposes (except as necessary for providing the service)
• Comply with applicable privacy laws

6.2 Legal Requirements

We may disclose your information if required by law, including:

• Court orders or subpoenas
• Government or regulatory requests
• To protect our legal rights or safety
• To investigate potential violations of our Terms of Use
• To comply with tax or financial reporting obligations

6.3 Business Transfers

If ZipCheck is acquired, merges with another company, or sells assets, your information may be transferred as part of that transaction. We will notify you by email and/or prominent notice on our website before your information becomes subject to a different privacy policy.

6.4 With Your Consent

We may share information for other purposes with your explicit consent.

7. Data Retention

7.1 Retention Periods

7.2 Automatic Deletion

• Free Tier: Scan history and job posting text are automatically deleted after 7 days
• All Tiers: Shareable report links expire and are permanently deleted after 30 days

7.3 After Account Closure

When you close your account:

• Personal information is deleted within 30 days
• Anonymized usage data may be retained for analytics
• Backup copies may persist for up to 90 days before permanent deletion
• Legal/tax records (e.g., payment history) are retained for 7 years as required by law

7.4 Deletion Requests

You can request deletion of your data at any time by contacting privacy@zipcheck.ca. We will process deletion requests within 30 days, except where retention is required by law.

8. Your Privacy Rights

Under PIPEDA, you have the following rights:

8.1 Right to Access

You can request a copy of the personal information we hold about you. We will respond within 30 days. There is no fee for reasonable requests.

8.2 Right to Correction

If your information is inaccurate or incomplete, you can request corrections. We will update our records promptly and notify any third parties who received the incorrect information (where appropriate).

8.3 Right to Withdraw Consent

You can withdraw consent for data collection at any time. Note that withdrawing consent may limit your ability to use the Service (e.g., we cannot provide compliance analysis without processing your job posting text).

8.4 Right to Deletion

You can request deletion of your personal information. We will delete your data within 30 days, except where retention is required by law (e.g., payment records for tax purposes).

8.5 How to Exercise Your Rights

To exercise any of these rights:

• Email: privacy@zipcheck.ca
• Subject line: Include “Privacy Request” and the specific right you're exercising

We may need to verify your identity before processing your request. We will respond to privacy inquiries within 5 business days and complete requests within 30 days.

8.6 Complaints

If you believe we have not handled your information properly, you may file a complaint with:

9. Cookies and Tracking Technologies

9.1 What We Use

9.2 What We Don't Use

We do not use:

• Advertising or marketing cookies
• Third-party tracking for ad targeting
• Social media tracking pixels
• Cross-site tracking

9.3 Cookie Consent

When you first visit ZipCheck, we will display a cookie consent banner allowing you to accept or decline non-essential cookies. Essential cookies required for the Service to function are not subject to consent requirements.

9.4 Managing Cookies

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using certain features of the Service (e.g., staying logged in).

10. Data Security

10.1 Security Measures

We protect your information using:

10.2 No Guarantee

While we implement reasonable security measures, no system is 100% secure. We cannot guarantee absolute security of your information. Internet transmission and electronic storage always carry some risk.

10.3 Breach Notification

If a data breach occurs that poses a real risk of significant harm to individuals, we will:

• Notify affected individuals as soon as feasible (without undue delay)
• Report to the Privacy Commissioner of Canada as required by PIPEDA
• Take steps to mitigate harm and prevent future breaches
• Provide information about what happened and what you can do to protect yourself

11. International Data Transfers

11.1 Where Data Is Processed

Your information may be processed in:

• Canada: Primary data storage (PostgreSQL)
• United States: Some service providers (Stripe, Vercel, OpenRouter)

11.2 Safeguards

When transferring data outside Canada, we ensure protection through:

• Contractual agreements with service providers requiring PIPEDA-equivalent protection
• Selection of providers with strong privacy practices and certifications
• Compliance with PIPEDA requirements for cross-border transfers
• Data processing agreements that meet Canadian standards

11.3 Foreign Legal Access

12. Children's Privacy

12.1 Age Restrictions

ZipCheck is intended for users who are at least 18 years of age (the legal age of majority in most Canadian provinces). We do not knowingly collect personal information from children under 18.

12.2 Parental Consent

In exceptional circumstances where a user between ages 13-17 wishes to use the Service (e.g., a high school student learning about HR compliance), we require verifiable parental or guardian consent before creating an account.

12.3 Reporting Child Accounts

If you believe a child under 18 has provided us with personal information without parental consent, please contact us at privacy@zipcheck.ca, and we will:

• Investigate the matter promptly
• Delete the information if consent was not obtained
• Close the account

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes:

Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

14. Contact Us