Pholeo Privacy Policy

Introduction

Pholeo Technologies Inc. ("Pholeo," "we," "us," or "our") operates the Pholeo marketing portfolio platform (the "Service"), including portfolio creation and publishing, first-party templates, free and paid subscription plans, and job listings. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the Service.

Please read this Privacy Policy together with our Terms of Service. Where we rely on consent for a particular use (for example, promotional emails), we will ask for that consent separately where required by law. Using the Service means you acknowledge this Privacy Policy; it does not waive rights you have under PIPEDA or other applicable law.

1. Definitions

• Personal Information means information about an identifiable individual, as defined under the Personal Information Protection and Electronic Documents Act (PIPEDA).
• User Content means any content uploaded or created by users on the Service.
• Billing Information means payment-related data such as credit or debit card details, billing address, and transaction history.

2. Information Collection

We collect the following categories of information:

• Registration Information: When creating an account, we collect your name, email address, and authentication credentials (password is stored in hashed form).
• Billing Information: When you subscribe to a paid plan or make a purchase, our third-party payment processor collects your payment details (e.g., credit or debit card number, expiration date, and billing address). Pholeo does not directly store full payment card numbers. We receive and retain limited transaction data, such as the last four digits of your card, transaction amounts, and billing dates, for record-keeping and support purposes.
• User Content: We store content you upload or create on the platform, including marketing materials and portfolio information.
• Contact Form Submissions: If you add a contact form to a published portfolio, we collect the name, email address, and message a visitor submits so we can deliver that message to you.
• Usage Data: We collect data on how you use the platform, including page views, feature interactions, clicks, and errors.
• Device Information: We collect device type, operating system, browser type, browser language, and IP address.
• Employer Account Information: If you create an employer account, we collect information needed to operate that account (such as name, email, company or organization details you provide, and authentication credentials).
• Job Application Information: If you apply to a role through the Service, we process information related to that application, including your identity as associated with your account or application, your published portfolio content made available to the employer for that application, any optional message you include, and application status updates within the platform.

3. Use of Information

We use collected information for the following purposes:

• To provide, maintain, and improve the Service
• To authenticate users and manage accounts
• To process payments, manage subscriptions, and send billing-related communications (e.g., receipts, renewal reminders, and failed payment notices)
• To communicate with you about your account, including service announcements, security alerts, and customer support messages
• To deliver contact form submissions from visitors to the portfolio owner who enabled the form
• To operate job listings, including enabling employers to post roles, enabling candidates to apply with portfolio-based applications, showing employers the candidate information described in Section 6, and providing application-status visibility where available
• To enforce our Terms of Service, including employer-use restrictions related to candidate data
• To send product research and feedback requests related to improving the Service (for example, short surveys or interview invites). These messages are not promotional offers. Each such message will include a way to opt out of future product-research emails (such as an unsubscribe link or an equivalent opt-out instruction), and you may also opt out through your account settings or by contacting [email protected]. Opting out of product-research emails does not affect transactional or account messages (such as billing, security, or support)
• To send promotional communications, such as information about new features, offers, or content relevant to you (you may opt out of promotional emails at any time using the unsubscribe link in any such email or through your account settings)
• For analytics purposes, to understand how users interact with the Service and to improve our offerings
• To detect, prevent, and address fraud, abuse, or security issues

4. Data Storage and Security

We primarily store user data in secure cloud infrastructure located in Canada, but some of our service providers may process data in other jurisdictions. We implement industry-standard security measures, including encryption of data in transit and at rest, access controls, regular security reviews, and secure authentication protocols. While we take reasonable steps to protect your information, no method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.

5. Sharing Information

We may share your information with the following categories of third parties:

• Payment Processors: We share billing information with third-party payment processors (e.g., Stripe) to process subscription payments and transactions. These processors handle your payment data in accordance with their own privacy policies and applicable payment card industry (PCI) standards.
• Infrastructure and Service Providers: We use third-party providers for cloud hosting, email delivery, product analytics, and customer support tools. These providers access your data only as necessary to perform services on our behalf and are contractually obligated to protect your information. Key categories include payment processing (e.g., Stripe), product analytics (currently Mixpanel and Google Analytics 4), hosting/infrastructure, and email delivery. A current list of key subprocessors is available upon request at [email protected], and we intend to publish it on this page or a linked page as we expand the list.
• Portfolio Owners: If you submit a contact form on a published portfolio, we share your submission with the portfolio owner so they can respond to you.
• Employers: If you apply to a role through the Service, we share application and published portfolio information with the employer who posted that role, as described in Section 6.
• Legal Obligations: We may disclose your information if required to do so by law, regulation, legal process, or enforceable governmental request.
• Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

We do not sell your personal information to third parties. We do not currently run third-party advertising or ad-targeting / remarketing tags on the Service. We use Google Analytics 4 for measurement and product analytics as described in Section 7. If we later use personal information for third-party advertising or ad targeting, we will update this Privacy Policy before doing so.

6. Employer Access to Candidate Information

When a candidate submits a job application through the Service, the following information becomes visible to the employer who posted the role:

• The candidate's name and any information included in their published portfolio, including case studies, project descriptions, stated outcomes, and skills.
• An application snapshot of published portfolio information, which may include the portfolio title, headline, thumbnail, specialisation or skill tags, and the contact email shown on the published portfolio, if the candidate has provided one.
• Any optional message the candidate includes with their application.
• The candidate's application status as updated within the platform.

The following information is not visible to employers through the Service:

• The candidate's account email address, unless the candidate has also included that address (or another contact email) in their published portfolio.
• Any portfolio content the candidate has not published (drafts, unpublished work).
• Any information from other applications the candidate has submitted on the platform.
• Private hiring notes an employer records about an application. Those notes are visible only to that employer.

Pholeo tracks employer interactions with applications, including when an application is viewed or a status is changed, for platform analytics and to provide candidates with application status visibility. This activity data is not shared with third parties. Employers are prohibited from using candidate data outside of the permitted uses described in Section 3A of the Terms of Service. Pholeo may investigate reports of misuse and suspend or terminate accounts as described in the Terms.

7. Cookies and Tracking Technologies

We and our partners may use cookies and similar tracking technologies:

• Essential Cookies: Required for the Service to function, including authentication and session management.
• Analytics Cookies: Used to understand how users interact with the Service (including marketing pages), measure performance, and identify areas for improvement. We use product analytics tools, currently Mixpanel and Google Analytics 4 (measurement ID configured in our site), that may set their own cookies or similar identifiers and may process usage data (such as page views, device/browser information, approximate location derived from IP, and referral information) in other jurisdictions, including the United States, as described in Sections 4 and 12. More detail is in our Cookie Policy.
• Preference Cookies: Used to remember your settings and preferences across sessions.

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Service.

8. User Rights

Under applicable privacy laws, including PIPEDA, you have the following rights regarding your personal information:

• Access: You may request access to the personal information we hold about you.
• Correction: You may request correction of inaccurate or incomplete personal information.
• Deletion: You may request deletion of your account and associated personal data, subject to our legal retention obligations (see Section 9).
• Withdrawal of Consent: You may withdraw your consent for data processing at any time, subject to legal or contractual restrictions. Withdrawal of consent may affect your ability to use certain features of the Service.
• Export / copy of your information: Where available in product settings, or upon request where required by applicable law, you may obtain a copy of certain personal information we hold about you in a commonly used, machine-readable format, where technically feasible.
• Opt Out of Marketing and Product Research: You may opt out of promotional communications and/or product-research and feedback emails at any time (see Section 3).

To exercise any of these rights, contact us at [email protected] or use the relevant options in your account settings. We will respond to your request within 30 days.

9. Data Retention

We retain your personal information for as long as necessary to provide the Service, fulfill the purposes described in this Privacy Policy, or as required by applicable laws. Specifically:

• Account Data: Retained for as long as your account is active. Upon account deletion, we will delete or anonymize your personal data within 30 days where feasible, except for residual copies in backups or logs and where required for legal, security, or compliance purposes.
• Billing and Transaction Records: Retained for a period of up to 7 years after the date of the transaction to meet tax, audit, and financial record-keeping requirements.
• Usage and Analytics Data: Retained in aggregated or anonymized form and may be kept indefinitely for analytical purposes.

After the applicable retention period, we will securely delete or anonymize your personal data in accordance with our data management practices and legal obligations.

10. Data Breach Notification

In the event of a data breach that creates a real risk of significant harm to individuals, Pholeo will notify affected users and the Office of the Privacy Commissioner of Canada as required under PIPEDA. We will provide notification as soon as feasible after becoming aware of the breach, including a description of the breach, the types of information involved, and the steps we are taking in response.

11. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly. If you believe a child under 18 has provided us with personal information, please contact us at [email protected].

12. International Data Transfers

Pholeo is based in Canada, and your personal information is primarily stored and processed in Canada, but some service providers may process data in other jurisdictions (including, where applicable, the United States). If you access the Service from outside Canada, your information may be transferred to, stored in, and processed in Canada or other countries. Privacy laws in those countries may differ from those in your jurisdiction. We take reasonable steps to protect personal information when it is processed by service providers, including contractual obligations to safeguard the information, consistent with this Privacy Policy and applicable Canadian privacy law. If we rely on consent for a particular transfer or use, we will obtain it as required.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify users of any material changes at least 30 days in advance through email or in-app notifications. The "Effective Date" at the top of this page indicates when this Privacy Policy was last revised. Your continued use of the Service after the updated Privacy Policy takes effect constitutes your acceptance of the changes.

14. Contact

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us at:
[email protected]

If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

15. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of Canada, including PIPEDA and applicable provincial privacy legislation.