Privacy Policy

1. Our Privacy Officer

We have designated a Privacy Officer who is accountable for our compliance with this policy and applicable privacy laws. You can reach our Privacy Officer for any privacy-related question, access request, or complaint at support@sparklane.ai.

2. Information we collect

We collect the following categories of personal information:

• Account information. Your name, email address, password (stored as a salted hash by our authentication provider), the role and industries you select during signup, and your communication preferences.
• Career context. Resumes you upload, the parsed text and structured fields extracted from them, and stories you save. Resumes may contain sensitive information you choose to include (for example, education history, employment history, certifications, or contact details).
• Opportunities and practice content. Job descriptions you create or paste, generated practice questions, guidance, and your written notes.
• Session content. Audio recordings of your practice answers, the resulting transcripts, and the AI feedback we generate from them. Your voice recordings are biometric in nature; we do not use them to identify you and we do not generate voiceprints.
• Usage and device data. Pages and features you use, timestamps, browser and device type, IP address, and similar diagnostic information needed to operate the Service.
• Communications. Messages you send to our support team and your responses to product notifications.
• Information a partner organization provides. If you were invited to Sparklane by an organization we work with (for example, an employment or settlement services agency), that organization gave us your first name, last name, and email address. The organization is responsible for having your consent to share them with us. We use them only to send your invitation, to recognize the invitation when you accept it, and to link your account to that organization’s program. The invitation email says which organization shared your details.

Apart from information a partner organization provides as described above, we collect this information directly from you when you create an account, upload content, or use Service features. We do not buy personal information from data brokers. We ask you not to include special categories of personal data (such as data revealing health, racial or ethnic origin, religious beliefs, or sexual orientation) in your resume, stories, or session answers unless strictly necessary; if you do, you consent to our processing of that information for the purposes described in this policy.

3. How we use your information and our legal bases

We use your information for the purposes below. Where the GDPR applies, we identify the legal basis we rely on for each purpose.

• To provide the Service — including generating practice questions, transcribing your answers, producing feedback and reports, and storing your content. Legal basis: performance of a contract with you.
• To authenticate and secure your account — including password handling, session management, fraud prevention, and abuse detection. Legal basis: performance of a contract and our legitimate interest in keeping the Service secure.
• To send service communications — email verification, password resets, security alerts, and notifications that your analysis or report is ready. Legal basis: performance of a contract; legal obligation where applicable.
• To improve the Service — diagnosing issues, measuring feature usage in aggregate, and tuning prompts and models using your content where you have not opted out. Legal basis: our legitimate interest in improving the Service (balanced against your privacy interests); consent where required.
• To send optional product communications — product updates, tips, and marketing where permitted by law. Legal basis: your consent, which you may withdraw at any time.
• To comply with legal obligations and enforce our Terms — responding to lawful requests, defending legal claims, and enforcing our agreements. Legal basis: legal obligation; legitimate interest.

We do not sell your personal information, we do not rent it, and we do not use your content to train third-party foundation models.

4. AI and automated processing

The Service uses large language models and speech-to-text providers to analyze your resume and job descriptions, generate practice questions and guidance, and produce feedback on your recorded answers. These outputs are intended as practice material — they are not used to make decisions that produce legal or similarly significant effects about you (for example, hiring, credit, or insurance decisions), and we do not share AI outputs with employers or third parties for those purposes.

If we ever introduce features that involve solely automated decision-making with legal or similarly significant effects, we will notify you and provide the rights required by applicable law, including the right to obtain human review.

5. How we share your information

We share information with a limited set of service providers (“subprocessors”) that help us operate the Service. Subprocessors are bound by written agreements that require them to protect your information, use it only for the purposes we direct, and apply appropriate security safeguards.

• Cloud infrastructure — application hosting, database, file storage, queue and cron processing, and content delivery.
• Authentication— to create and manage your account and sessions.
• AI inference— to analyze your resume and job descriptions and generate practice questions, feedback, and reports.
• Speech-to-text transcription — to turn your audio answers into transcripts.
• Email delivery— to send you transactional and notification emails.
• Product analytics, observability, and error monitoring — to understand feature usage in aggregate and to detect and fix issues.

A current list of subprocessors is available on request from our Privacy Officer.

Partner organizations.If your account is linked to a partner organization’s program, we share aggregate information with that organization to help it assess the program’s success — for example, how many invitations were sent and accepted, how many members are practicing, and how much of the program’s practice allowance has been used. This information is reported as totals and does not identify you. We do not share your resume, stories, opportunities, recordings, transcripts, feedback, or scores with a partner organization without your consent.

We may also disclose personal information:

• when required by law, court order, or other valid legal process;
• to protect the rights, property, or safety of Sparklane, our users, or the public;
• as part of a corporate transaction such as a merger, acquisition, financing, or sale of assets — in which case we will require the recipient to honor this Privacy Policy and will notify affected users where required by law.

6. Where your information is stored and processed

Sparklane operates from Canada. Your account information, resumes, stories, opportunities, audio recordings, transcripts, feedback, and reports are stored in Canada.

Some parts of the Service process your information outside Canada:

• AI inference. When we analyze your resume, a job description, or your answers, that content is sent to our AI providers to produce a result. Depending on available capacity at the time of the request, it may be processed anywhere across the globe. It is processed to return the result and is not stored there.
• Speech-to-text transcription. Your audio answers are sent to our transcription provider, which may process them outside Canada.
• Monitoring and diagnostics. Records of AI requests, which can include the content sent in them, are kept by our AI monitoring provider in the European Union so we can investigate and fix problems. Usage analytics and diagnostic logs are processed outside Canada.

Privacy laws in these jurisdictions may differ from those in your country.

When we transfer personal information across borders, we rely on appropriate legal mechanisms and safeguards, including:

• the European Commission’s adequacy decision recognizing Canada’s commercial privacy regime, for transfers between the EU and Canada;
• Standard Contractual Clauses with subprocessors located in countries without an adequacy decision;
• contractual commitments under PIPEDA that require subprocessors to provide a comparable level of protection while personal information is in their custody;
• technical and organizational measures such as encryption in transit and at rest, and access controls.

You may contact our Privacy Officer for more information about the safeguards we use for international transfers.

7. Data retention

We retain personal information only as long as necessary for the purposes described in this policy. In practice this means:

• Account information — for as long as your account is active.
• Career context, opportunities, stories, sessions, and reports — until you delete them or close your account. You can delete individual items from the dashboard at any time.
• Audio recordings — retained alongside the related session; deleting the session deletes the associated audio and transcript.
• Partner invitations — if you are invited by a partner organization and do not accept, we keep the invitation record (your name, email address, and the invitation’s status) so we do not invite you twice. You can ask our Privacy Officer to delete it at any time.
• Usage and diagnostic logs — typically retained for up to 13 months, then aggregated or deleted.
• Support communications — up to 24 months after the conversation ends.

When you delete your account, we delete or anonymize your personal information within a reasonable period (typically 30 days), except where we are required or permitted to retain it for legal, accounting, tax, security, or fraud-prevention purposes, in which case it is segregated and protected until the retention period expires.

8. Your rights

Subject to applicable law, you have the following rights with respect to your personal information:

• Access— obtain confirmation of whether we process your personal information and request a copy of it.
• Rectification— ask us to correct inaccurate or incomplete information.
• Erasure / deletion — ask us to delete your personal information.
• Restriction— ask us to limit our processing in certain circumstances.
• Portability— receive a copy of certain information in a structured, commonly used, machine-readable format and ask us to transmit it to another controller where technically feasible.
• Objection— object to processing that we base on legitimate interests, including any profiling.
• Withdraw consent — withdraw consent at any time where we rely on it (withdrawal does not affect the lawfulness of prior processing).
• Information about disclosures — under PIPEDA and Quebec Law 25, ask about the third parties to which we have disclosed your personal information.
• Not be subject to solely automated decisions with legal or similarly significant effects (see Section 4).

You can exercise most of these rights directly from your account. You can also submit a request by emailing our Privacy Officer at support@sparklane.ai. We may need to verify your identity before acting on a request. We will respond within the timelines required by applicable law (generally within 30 days under PIPEDA and Quebec Law 25, and without undue delay and within one month under the GDPR).

You will not be discriminated against for exercising any of these rights.

9. How to make a complaint

If you believe we have not handled your personal information in accordance with this policy or applicable law, please contact our Privacy Officer first — we will work with you in good faith to resolve your concerns.

You also have the right to lodge a complaint with:

• the Office of the Privacy Commissioner of Canada (priv.gc.ca);
• the Commission d’accès à l’information du Québec, if you are a resident of Quebec (cai.gouv.qc.ca);
• your local supervisory authority in the European Economic Area, if you are located there; or
• another data protection authority that has jurisdiction over your personal information.

10. Security

We use technical and organizational measures designed to protect your information, including encryption in transit and at rest, least-privilege access controls, row-level security on user-owned data, audit logging, hardened authentication, and ongoing monitoring. No system is perfectly secure; if you believe your account has been compromised, please contact us right away. We will notify you and the appropriate regulators of any personal information breach where required by applicable law (including PIPEDA’s breach-of-security-safeguards reporting obligations and the GDPR’s 72-hour notification requirement).

11. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember your preferences, and measure how the Service is used in aggregate. We do not use cookies for cross-site advertising. You can control cookies through your browser settings; disabling cookies may affect parts of the Service that depend on them (for example, staying signed in).

12. Children

The Service is not directed to children under 18, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

13. Changes to this policy

We may update this Privacy Policy as our practices evolve. When we make material changes, we will update the “Last updated” date above and, where appropriate, give you additional notice (for example, by email or an in-app message). For changes that require your consent under applicable law, we will obtain that consent before the change takes effect for you.

14. Contact

If you have any questions about this Privacy Policy or how we handle your information, please contact our Privacy Officer at:

Spark Labz Inc. operating as Sparklane
support@sparklane.ai