Privacy Policy

Last updated: November 2, 2026

Postulio is a product of Nokaris Lab (opens in a new tab), whose head office is in Quebec. Nokaris Lab ("we") operates Postulio and is responsible for the personal information collected through the website and the Service.

This policy explains what information we collect, why, with whom we share it, how long we keep it and how to exercise your rights. It is based on:

• Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25;
• the federal Personal Information Protection and Electronic Documents Act (PIPEDA), where it applies.

1. Person in charge of the protection of personal information

The person in charge of the protection of personal information is Idriss Sergio Talom Nokam, for Nokaris Lab (opens in a new tab).

• Email: privacy@postulio.ca

This person ensures compliance with this policy and handles access requests, correction requests and complaints.

2. Information we collect

2.1 Information you provide

Account:

• email address;
• first and last name;
• password (stored only in hashed form, never in plain text).

Profile and documents:

• optional contact details (phone, city and province, LinkedIn profile URL);
• resumes you import or create, cover letters and other documents;
• work experience (including, if you provide them, the tools you used, the main product or engagement, the work arrangement and a key achievement), education, skills, volunteering, projects, professional summary;
• availability (immediately, after a notice period or from a given date), if you provide it;
• work authorization status in Canada, only if you choose to provide it (see section 3.5);
• the grammatical agreement to use in your French documents (feminine, masculine or neutral), only if you provide it: it is used solely to make the sentences of your resumes and cover letters agree, is never inferred from your first name, is never read by the site assistant and is shared with no one other than through the documents you download;
• job search criteria (positions, locations);
• occupations you are aiming for, if you choose any (title you entered and occupation of the National Occupational Classification);
• applications you record in your tracking board.

Communications:

• messages sent to support;
• conversations with the site assistant and requests you ask it to pass on to our team.

Subscription:

• chosen plan and subscription status. Payment details are entered directly with Stripe: we neither receive nor store your card number.

2.2 Information collected automatically

• Technical data: IP address, browser and device type, language, server logs, needed to run and secure the Service.
• Audience measurement: pages viewed and visit sources, through the PostHog tool, only if you consent (see section 6).
• Error reports: when an error occurs, a technical report is sent to our error monitoring tool (Sentry), without personal data by default.
• Sign-up source: if you create your account from the free ATS scanner, we note on your account that it came from the scanner (and nothing else), to know how many sign-ups our free tools bring in. This note is erased with your account.

2.3 Information from third parties

Signing in with Google or LinkedIn (optional). If you choose to sign up or sign in with Google or LinkedIn, that provider sends us, with the consent you give on its side: your first name, last name, email address, confirmation that this address is verified, and an identifier specific to your account with that provider. We receive neither your password nor access to your contacts or posts, and we keep no provider access token. We keep the identifier and address of the linked account, with the date it was linked and last used, to recognize you at your next sign-in. You can remove this sign-in method in Settings, Security; it is deleted with your account. This information is included in the export of your data.

The job postings displayed are read from employer career pages and job sites, in accordance with their terms of use and their robots.txt file, or posted on Postulio by employers after review by our team. These are public postings: these sources send us no personal information about you.

3. Why we use your information

We use your information only to:

• create and manage your account, and authenticate you;
• suggest job postings and calculate how well they match your profile;
• produce the documents you request (tailored resume, cover letter, posting analysis, content from the tools) and calculate your scores;
• track the applications you record and send you the email reminders and digests you have turned on;
• manage your subscription and billing;
• respond to your requests;
• secure the Service, detect abuse and fix errors;
• measure site audience to improve it;
• meet our legal obligations.

Postulio never submits an application on your behalf: you send each application to the employer yourself.

3.1 Artificial intelligence

Your documents and profile are sent to our artificial intelligence provider only to:

• produce the content you request;
• calculate your scores (ATS score, match with a posting);
• extract information from a resume you import;
• answer your questions in the site assistant;
• review the profile photo you submit to it, if you ask (Pro plan).

Your resumes, documents and profile data are never used to train an artificial intelligence model. Our AI provider processes them through its API only to produce the requested result and does not use them to train its models.

AI scores and suggestions are decision aids: they do not produce any decision about you based exclusively on automated processing. You alone decide what you send to an employer.

What the assistant reads from your account. If you are signed in, the assistant reads, during the exchange only and to guide you better in Postulio, statuses and counts: your plan, the current step of your path and its progress, your profile completion rate and the number of skills and experiences, the number of job analyses done and the date of the latest one, the number of active job alerts and your plan’s limit, the number of applications by status, the number of target occupations tracked and analyzed and the number of improvements left, and the page you are on. It never reads the content of your resume, employer names or your notes, and never receives your name, first name or email: your first name is only used for the welcome message, shown by the assistant window without going through our AI provider. Of this information, only your plan is stored with the conversation. This is used only to steer its answers and leads to no automated decision about you.

Profile photo and banner. The profile photo and LinkedIn banner tools work in your browser: the images you load there are not sent to our servers. The one exception is the AI review of your profile photo, if you request it after being informed: the cropped photo is then sent to our AI provider for that review only, and is kept neither by Postulio nor in your account. The review covers how the photo is presented (framing, lighting, background, sharpness, gaze, attire, composition); it does not identify you, creates no biometric characteristic or measurement, and makes no judgment about any personal trait.

3.2 Emails

We send you two kinds of emails.

Service emails. Account confirmation, security (sign-in, password, address change), billing and subscription, replies to your requests and reminders about the applications you track. Security and billing emails are always sent; reminders can be adjusted in Settings > Notifications.

Information emails. Job alerts, your weekly application summary and Postulio news. Under Canada’s Anti-Spam Legislation, these are commercial electronic messages. We send them only on one of these grounds:

• your express consent: an optional box, unchecked by default, at sign-up, or turning them on in Settings > Notifications;
• your request: emails from a job alert you created with email delivery turned on;
• your implied consent: if you bought a paid plan (Pro or Premium), the weekly summary and news for 2 years from the start of your last paid period.

We check this ground right before each send. Each of these emails identifies the sender, Nokaris Lab, with its mailing address, and contains an unsubscribe link that works without signing in: you choose this type of email or all information emails, and it takes effect immediately. You can also turn them off at any time in Settings > Notifications.

As proof, we keep the date of each consent and each unsubscribe, its source (sign-up, settings or an email link), and for a consent, the exact text shown to you, its version and its language. This data is kept as long as your account exists and deleted with it.

3.3 My profile against an occupation

If you enter a target occupation (in your profile or from a path of your career assessment), we compare your profile (skills, experience, education, certifications and orders, languages) with the official requirements published for this occupation (National Occupational Classification, OaSIS) and with our reference data. This comparison is made by rules, without artificial intelligence, and its result is saved with the target occupation, so it is not redone while your profile does not change.

• Optional rephrasing: if you ask the AI to rephrase an experience to better reflect a requirement, the text of that experience, its position, its employer and the names of the requirements are sent to our AI provider, as for any AI field assistance (section 3.1). The suggestion replaces your text only if you apply it.
• Optional personalized plan (Pro plans and up): if you ask the AI for a plan to reach an improvement, we send our AI provider the target occupation, the nature of the improvement (kind, levels, name of the requirement) and the relevant parts of your background (title, experience, education, skills, languages, certifications), without your identity or contact details, as for any AI field assistance (section 3.1). The plan is only displayed: it is not saved.
• Sharing with a human advisor (Premium and Organization plans): your target occupations and their analyses are visible only if you give consent by ticking a box. The advisor of your human sessions sees them while a session with them is requested or scheduled; Postulio’s administration may also view them to organize your sessions. Neither support nor moderation has access. They are viewed without the profile text quoted in the improvements, and each view is logged. We keep the date of each consent and each withdrawal. You can withdraw consent at any time: no one then has access. Nothing else from your profile is shared through this consent.
• Retention: target occupations and their analyses remain as long as you keep them; they are erased if you remove them or delete your account, and they are included in the export of your data.

3.4 Public portfolio

The public portfolio is optional. You choose its content (sections, projects, contact details) and publish it yourself by checking a consent box, the date of which we keep. Once published, it can be seen by anyone who knows its address and may be indexed by search engines. Your email, phone number, city and photo only appear if you check each of them. You can unpublish it at any time; if it is no longer covered by your plan, it is taken down after a 14-day period, of which you are notified by email.

Contact form. When someone writes to you through your portfolio’s contact form, their name, email and message are forwarded to you by email, with their address as the reply-to address. Postulio does not keep these messages: they are stored neither in your account nor in our databases. To limit abuse, we temporarily count submissions per IP address and per portfolio, without keeping their content.

3.5 Work authorization

You can indicate your work authorization status in Canada (citizenship, permanent residence, open work permit, employer-specific work permit, study permit or other). This information is optional: you never have to provide it, and Postulio never infers it from a resume you import.

• Why: some employers in Canada check work authorization first; stating it on a resume can keep an application from being set aside for lack of that information.
• Where it appears: on your generated resumes only if you check "Show on my resumes". This box is unchecked by default.
• Who does not receive it: it is never read by the site assistant and is not shared with employers or third parties other than through the resume you choose to download and send yourself. It is sent to our AI provider, to write a resume, only if you have checked that box.
• Your choices: you can change or erase it at any time in My profile. It is included in your data export and erased with your account.

4. Service providers and communication of information outside Quebec

We do not sell your personal information, rent it out or share it for advertising purposes.

We entrust certain tasks to providers that process information on our behalf, only to the extent needed for their role:

Job posting sites. To display postings, and to read a full posting when you analyze it, our servers fetch the public page of the posting on the employer’s or job site’s website. This request comes from our servers: it sends neither your name, nor your email, nor your resume, nor any other information about you.

Communication outside Quebec and Canada. Our data is hosted in Canada, in Montréal (Quebec). However, some of these providers, including Anthropic, Stripe, Resend, PostHog and Sentry, process information outside Quebec and Canada, notably in the United States. That information may then be subject to the laws of those countries. Each communication is governed by these providers’ contractual data processing commitments, which limit the use of the information to the services provided and require security measures.

Legal obligations. We may disclose information when the law requires or permits it, for example under a court order.

Business transaction. If the business is sold or merged, information may be communicated under the conditions provided by law; you will be informed.

5. Retention and deletion

• While your account exists: we keep your information as long as your account exists, to provide the Service.
• Account deletion: you can delete your account at any time in Settings > Privacy > Delete my account. Deletion is immediate and permanent: your account and its related data (profile, resumes, documents, applications, searches, career assessment, target occupations and sharing consents) are erased from our database as soon as you confirm, with no grace period. Any paid subscription is cancelled first. Only an anonymized record remains, showing that a deletion request was honoured, without any information that could identify you.
• Records of important actions (role changes in the Postulio team or in an organization, invitations, plan and subscription changes, team actions on an account): kept for 3 years, even after the account is deleted, to prove who did what and when in case of a dispute, an incident or an appeal. They contain no password, no email address and no content from your documents; when the account is deleted, your identifier is removed from them and replaced with a non-reversible fingerprint. They cannot be altered. Those about you (roles and subscription) are included in your data export.
• Billing: when you delete your account, we also delete your customer record at Stripe (email, billing address, saved payment methods). Past invoices and payments are kept by Stripe in accordance with applicable legal, tax and accounting obligations.
• Sign-in sessions: each session keeps the device (browser) and IP address that opened it, so you can recognize your sign-ins and so a suspicious sign-in can be investigated. It is deleted 30 days after it ends (sign-out, expiry or closure). You can see your open sessions, with a truncated IP address, and close them in Settings > Security; they are included in your data export.
• Links sent by email (address confirmation, password reset, sign-in email change): the requested new address is erased as soon as the link is used, cancelled or replaced; the link itself is deleted 30 days after it expires.
• Data no longer tied to an account, destroyed automatically when its period ends:
  • security log (sign-ins and sensitive actions): 3 years; the IP address and browser it contains are erased after 12 months;
  • anonymized record of an account deletion: 3 years;
  • payment notifications received from Stripe: 90 days;
  • Organization information requests: 3 years after they become a client, 1 year after the last activity otherwise;
  • resume uploaded for extraction: deleted from our servers within 24 hours;
  • profile photo submitted for AI review: processed in memory for the review only, never stored;
  • server technical logs (without email or phone, masked when written): 30 days.
• Conversations with the site assistant: we keep the text of the messages (yours and the assistant’s), the language, the page where the conversation started, your plan if you are signed in, and technical counts (number of messages, volume processed). Email addresses, phone numbers and long digit sequences are masked before they are stored; neither your IP address nor your browser is kept, and a visitor is recognized only by a random identifier drawn by their browser. Why: to link the messages of a conversation together, to let authorized members of our team review the answers to correct the assistant (access is logged), and to let you export or delete your conversations. How long: 90 days after the last message, then deleted automatically each day. If you are signed in, they are included in your data export and deleted with your account.

You can also delete a document, resume or application from your account at any time.

6. Cookies and local storage

Postulio uses a small number of cookies:

• cookies needed for sign-in (postulio_refresh, postulio_session_present) and for the site language;
• PostHog audience measurement cookies, off by default and set only if you click "Accept" in the consent banner. You can withdraw this consent at any time through the "Manage cookies" link in the footer.

Postulio uses no advertising cookies. Details are in the Cookie Policy.

The site does not respond to browser "Do Not Track" signals. You can block or delete cookies in your browser settings.

Free ATS scanner. The resume and posting you submit are analyzed in memory, then forgotten: neither the text, the file nor the result is stored on our servers. We only count the number of analyses per day (text or file, with or without a posting), with no information about you. If you check the box provided under the result (it is unchecked by default), the analyzed posting and, for a sign-up, your resume file are kept in your browser tab only (session storage) so you can pick them up after signing up: for 2 hours at most, erased as soon as they are reused, when the tab closes and on sign-out. They only reach our servers if you start the resume import or the posting analysis yourself.

7. Security

We protect your information with measures suited to its sensitivity, including:

• encryption of all communications in transit (HTTPS);
• passwords hashed with argon2id, never stored in plain text;
• two-factor authentication (TOTP) available in Settings > Security;
• two-factor authentication secret encrypted in the database (AES-256-GCM);
• session cookie inaccessible to page JavaScript (HttpOnly) and restricted to the site (SameSite=Strict);
• sessions closed automatically after 30 minutes of inactivity and no later than 12 hours after sign-in (30 days if you choose “Stay signed in” on a personal device); password asked again for sensitive actions (changing your password or sign-in email, account deletion, data export, billing, two-factor authentication);
• notice by email for every password change or sign-in email change request, and your other sessions closed once the change is made;
• payments processed by Stripe, with no card numbers stored on our side;
• data access limited to the people who need it.

No measure offers absolute security. Protect your password, turn on two-factor authentication and report any suspicious activity to privacy@postulio.ca.

Confidentiality incidents. If an incident presents a risk of serious injury, we promptly notify the Commission d’accès à l’information du Québec and the people concerned, as required by law, and we keep a register of incidents.

8. Your rights

You have the right:

• of access: to know what information we hold about you and obtain a copy;
• of correction: to have inaccurate, incomplete or equivocal information corrected;
• to portability: to obtain your information in a structured, commonly used technological format;
• of deletion: to have your information erased;
• to withdraw consent: to withdraw your consent to a use, subject to legal obligations;
• to be informed of the information used to make a decision based exclusively on automated processing, if applicable;
• to file a complaint with a supervisory authority.

How to exercise them

• In your account: edit your profile, download your data (Settings > Privacy > Download my data) and delete your account (Settings > Privacy > Delete my account).
• By email: write to privacy@postulio.ca from your account’s email address. We may ask you to confirm your identity.

We respond to any access or correction request within 30 days of receiving it, as required by law.

Complaints

First write to our person in charge of the protection of personal information at privacy@postulio.ca. You may also contact:

• the Commission d’accès à l’information du Québec: cai.gouv.qc.ca (opens in a new tab);
• the Office of the Privacy Commissioner of Canada: priv.gc.ca (opens in a new tab), 1-800-282-1376.

People located in the European Union

If the General Data Protection Regulation (GDPR) applies to you, you have the rights it provides, including the right to lodge a complaint with your country’s data protection authority. Write to us at privacy@postulio.ca to exercise them.

9. Minimum age

Postulio is for people 16 and older. We do not knowingly collect information about younger people. If you believe a minor under 16 has sent us information, write to privacy@postulio.ca: we will delete it.

10. Changes to this policy

We may change this policy. Any significant change will be communicated to you by email or in the app before it takes effect. The date of the last update appears at the top of the page.

11. Contact us

Nokaris Lab (opens in a new tab), publisher of Postulio (Quebec, Canada)

• Protection of personal information: privacy@postulio.ca
• Legal questions: legal@postulio.ca
• Publisher website: nokaris.ca (opens in a new tab)

Last updated: November 2, 2026