Privacy Policy

Canada and United States

1. Introduction, scope, and roles

This Privacy Policy (the "Policy") explains how HyreMynd AI Inc. ("HyreMynd", "we", "us", or "our"), an Ontario corporation, collects, uses, discloses, retains, and protects personal information. It covers the HyreMynd platform, the Workplace Fit Assessment, the candidate and team portals, the HyreMynd browser extension, our websites, and related services (together, the "Platform").

This Policy applies to individuals in Canada and the United States whose personal information we process: candidates invited to complete an Assessment, employees and managers of Employer clients who complete an Assessment for internal team purposes, authorized users within Employer client organizations, prospective clients, and website visitors. This Policy is incorporated by reference into the HyreMynd Master Service Agreement, the Candidate Terms of Use, and the Internal Team Terms of Use.

1.1 The Workplace Fit Assessment

The "Workplace Fit Assessment" (the "Assessment") is HyreMynd's proprietary structured assessment. It measures how well an individual aligns with a role, with a manager's way of working, and with a team. A proprietary artificial intelligence model assists in scoring responses. The model reports separate fit signals rather than a single composite score, and its output is a conservative summary designed for review by a human decision maker. The model supports decisions. It does not make them, and it is not permitted to be the sole or final basis for any employment decision. All employment decisions are made by the Employer client through its own people.

1.2 Our role

Where HyreMynd processes personal information at the direction of an Employer client, HyreMynd is a service provider, processor, or contracted third party, as those roles are defined under applicable law. In that capacity, the Employer client is responsible for its own legal obligations to the individuals it invites, including candidate notices, consents, bias audit procurement and publication, job posting disclosures, alternative selection procedures, and accommodation decisions, as set out in Section 3.4. HyreMynd acts as an independent business only for the limited purposes of its own described in this Policy.

2. Applicable law

2.1 Canada

HyreMynd designs its practices to comply, where applicable, with the Personal Information Protection and Electronic Documents Act (PIPEDA), the Consumer Privacy Protection Act under Bill C-27 once in force, the Quebec Act respecting the protection of personal information in the private sector as amended by Law 25, the Personal Information Protection Act (Alberta), the Personal Information Protection Act (British Columbia), section 8.4 of the Ontario Employment Standards Act, 2000, which requires employers to disclose artificial intelligence use in publicly advertised job postings effective January 1, 2026, and the French language requirements of the Charter of the French Language as they apply to communications with Quebec residents.

2.2 United States

For U.S. residents, HyreMynd designs its practices to comply, where applicable, with section 5 of the Federal Trade Commission Act, Title VII of the Civil Rights Act as applied by the Equal Employment Opportunity Commission to automated hiring tools, the California Consumer Privacy Act as amended by the California Privacy Rights Act, including its regulations on automated decision-making technology and risk assessments, the Illinois Biometric Information Privacy Act, the Illinois Human Rights Act as amended effective January 1, 2026, New York City Local Law 144 governing automated employment decision tools, the Colorado Privacy Act and Colorado artificial intelligence legislation as in force, the Connecticut Data Privacy Act and the Connecticut Artificial Intelligence Responsibility and Transparency Act as its provisions phase in, the Texas Data Privacy and Security Act and the Texas Responsible Artificial Intelligence Governance Act, the Virginia Consumer Data Protection Act, and the comprehensive consumer privacy statutes of other U.S. states as enacted.

2.3 Classification of Assessment data

Assessment responses and derived fit scores may qualify as sensitive personal information or profiling data in certain U.S. states. HyreMynd applies the safeguards required for sensitive personal information to all Assessment data, and has obtained or will obtain written confirmation from qualified U.S. counsel on classification before processing the personal information of residents of any applicable state.

3. Personal information we collect

3.1 Information you provide

We collect your name, email address, account credentials, and your Assessment responses.

3.2 Information the Platform generates

The Platform generates derived Assessment data: fit scores across HyreMynd's separate scoring signals, response timing, and session integrity data. Derived data is personal information and this Policy treats it as such.

3.3 Information collected through the HyreMynd browser extension

Authorized users at an Employer client may use the HyreMynd browser extension to collect publicly available professional profile information about a candidate, including from professional networking sites, to open or inform a hiring engagement. The Employer client initiates and directs this collection. Before the Assessment begins, HyreMynd delivers a disclosure notice to the candidate in the onboarding flow. The notice identifies what was collected, from where, for what purposes, and the candidate's rights, including withdrawal. It is designed to satisfy the knowledge and consent requirements of PIPEDA Principle 3, the Law 25 disclosure requirement for technology that collects personal information without the knowledge of the person concerned, and applicable U.S. state disclosure obligations.

3.4 Allocation of employment law compliance

As between HyreMynd and the Employer client, and as reflected in the Master Service Agreement, the Employer client alone is responsible for: candidate and employee notices required of employers or employment agencies, including advance notice and publication duties for automated employment decision tools under New York City Local Law 144 and similar laws; disclosure of artificial intelligence use in job postings, including under section 8.4 of the Ontario Employment Standards Act; procuring any independent bias audit required of a deployer and publishing its summary; any adverse impact analysis expected under Title VII as applied by the EEOC; any legally required alternative selection procedure; any consent required of an employer; making and documenting employment decisions through human decision makers; and reasonable accommodations under applicable human rights and disability law. HyreMynd provides Employer clients with documentation and reasonable cooperation in support of these obligations. Assisting compliance is not a substitute for the Employer client's own audits and counsel.

3.5 Information collected automatically

We automatically collect device and usage information: IP address, browser type, operating system, pages viewed, session duration, and log data. We use cookies and similar technologies for authentication, security, and Platform functionality.

3.6 Connected calendar and meeting accounts

An authorized user at an Employer client may connect a Google or Microsoft account so that HyreMynd can schedule interviews on their behalf. When they do, we store the email address of the connected account, the access and refresh credentials the provider issues to us, the identifier of the encryption key that protects them, the scopes the provider reports as granted, and the state of the connection, including the error code of a failed credential refresh. The credentials are encrypted at rest, are never displayed or exported, and are sent to no one other than the provider that issued them. A connection belongs to the individual who created it rather than to the Employer client, and no colleague can read it. The user may disconnect it at any time in the Platform. The key that encrypts a stored credential can be rotated, and a retired key version withdrawn from use, without the user having to authorize the connection again.

3.7 Calendar availability and interview meetings

Where an account is connected, HyreMynd reads availability from the calendars the grant covers, in order to propose interview times and detect conflicts. The only calendar information the Platform receives is a list of busy intervals, each one a start time and an end time. It receives no event title, description, location, organizer, attendee list, or event identifier, so the content of a user's or a colleague's calendar is never read. HyreMynd also creates the interview event and its Google Meet or Microsoft Teams meeting on the connected user's own calendar; that event carries the interview's subject, which includes the candidate's name, and its join link and provider event identifier are stored so the meeting can later be rescheduled or cancelled. HyreMynd transmits no attendee list to Google or to Microsoft. The provider event names the organizer alone, and candidates and panel members are invited by HyreMynd's own email with a calendar attachment, so their email addresses never reach the meeting provider through us.

3.8 Interview transcripts

A Google Meet or Microsoft Teams interview produces a transcript only where a participant turned transcription on inside the meeting. HyreMynd never starts a recording or a transcription: the Platform has no ability to do so, and no part of it asks a provider to begin one. Where a transcript already exists, HyreMynd retrieves it once for that meeting, within a bounded window of 48 hours after the interview ends, and stores its text on the application record together with the provider it came from. Most interviews produce no transcript at all, and that is the ordinary outcome rather than a fault. Whether transcription is enabled, and any notice or consent that enabling it requires, is a matter for the Employer client and the meeting participants, not for HyreMynd.

4. Why we collect and use personal information

We use personal information to deliver the Assessment and provide fit scores and related decision support to the Employer client, to give each individual portal access to their own scores, to schedule interviews by proposing times, detecting conflicts against a connected calendar, and creating the interview meeting on the organizer's calendar, to maintain the record of an interview including any transcript the meeting produced, to run and secure the Platform, to verify Assessment integrity and protect the validity of results, to communicate about the engagement and support matters, to meet legal and contractual obligations, and to improve the Platform using anonymized data as described below.

4.1 De-identified and anonymized data

HyreMynd may create de-identified, anonymized, and aggregated data from personal information and may use it for any lawful business purpose, including model validation, calibration, benchmarking, research, and product improvement. We keep this data in a form that cannot reasonably identify anyone, we commit publicly not to attempt re-identification except to test whether our de-identification works, and we require the same commitment from recipients, consistent with U.S. state law and Canadian anonymization standards. Once anonymized under applicable law, this data is no longer personal information. We do not use identifiable Assessment data for model training.

5. AI processing and decision support

A proprietary artificial intelligence model assists in scoring Assessment responses. Its output is decision support only. The output reports separate fit signals for the role, the manager's work style, and the team, rather than one opaque composite score, and it presents a conservative summary written for a human reviewer. The Employer client makes every employment decision, and HyreMynd contractually requires Employer clients to keep documented human review over any decision informed by Assessment output.

Where Law 25 applies, individuals are told when a decision rests exclusively on automated processing, can learn the personal information and principal factors behind the decision, and can submit observations to someone at the Employer client positioned to review it. On request, the principal factors behind a result can be explained in plain language, in English or in French for Quebec residents. Where U.S. state law applies, individuals receive pre-use notice of automated decision-making technology and may exercise applicable opt-out or appeal rights through the Employer client as deployer, or through HyreMynd where a statute makes HyreMynd the responsible party.

Where an interview transcript has been ingested, HyreMynd may generate a draft set of suggested answers to the interview validation questions, each with the passage of the transcript it rests on. The draft is advisory pre-fill and nothing more: it is not a finding, it carries no weight in any score, and it becomes part of the candidate's record only when a human reviewer confirms it. Generating the draft again replaces the previous one in full rather than accumulating alongside it, so what is shown is always the most recent run. A reviewer may accept, change, or disregard any suggestion, and the recorded conclusion carries the provenance of how it was reached.

6. Google user data and Limited Use

This Section describes how HyreMynd uses data obtained through Google APIs when an authorized user connects a Google account, and it applies in addition to the rest of this Policy. A Google account is connected by an individual user, is used only for that user's own interview scheduling, and can be disconnected at any time.

6.1 Why HyreMynd requests each Google scope

HyreMynd requests the narrowest scopes that support the feature. Each scope it requests, and the feature that requires it, is listed below. No other Google scope is requested, and reading the transcript of a Google Meet meeting requires no additional scope.

• https://www.googleapis.com/auth/calendar.events Creates, reschedules, and cancels the interview event on the connected user's own calendar. HyreMynd requests this scope rather than full calendar access because it is the narrowest grant that supports the feature.
• https://www.googleapis.com/auth/calendar.freebusy Reads free and busy intervals so the Platform can propose interview times and flag conflicts. It returns start and end times only, and no event title, description, location, organizer, attendee, or identifier.
• https://www.googleapis.com/auth/meetings.space.created Creates the Google Meet space attached to the interview event, which is what lets an invited candidate join without waiting to be admitted individually, and reads the transcript of a meeting held in a space created this way where a participant enabled transcription. It reaches only the meeting spaces this application itself created.
• openid Identifies the Google account being connected, so the connection is attached to the right user.
• email Returns the email address of the connected account, which the Platform displays so the user can see which account is connected. It is not used to send email and is added to no marketing list.

6.2 Limited Use

HyreMynd's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Data obtained through Google APIs is never used for advertising, and is never used to serve, target, or measure advertisements.
• Data obtained through Google APIs is never sold, and is never shared for cross-context behavioral advertising.
• Data obtained through Google APIs is never used to develop, improve, or train generalized artificial intelligence or machine learning models. Where an interview transcript is processed by an artificial intelligence provider through our API gateway, it is processed solely to produce the advisory draft for that one application.

6.3 Removing HyreMynd's access to your Google account

A user can disconnect a Google account at any time in the Platform. Disconnecting deletes the stored credential from our systems and asks Google to revoke the grant. A user can also remove HyreMynd's access directly from their Google Account, on the page listing third-party apps with account access. Where the account is erased, HyreMynd asks Google to revoke the grant while the credential still works and then permanently deletes it.

7. Disclosure of personal information

We disclose personal information only in these situations: to Employer clients on the Platform, as decision support delivered into their workflow when they consider a candidate for a role — including when a candidate's prior self-serve Working Style completion is reused for a later engagement; to service providers working for us under written contracts with confidentiality, security, and use limits, covering cloud application hosting, database and storage infrastructure, caching infrastructure, artificial intelligence model providers accessed through an API gateway, communications services, and calendaring and online-meeting providers acting on the authorization a user has given them; to professional advisors bound by confidentiality; to public authorities when the law, a court order, or legal process requires it, in which case we disclose only what is legally required; and in a merger, acquisition, financing, or asset sale, with confidentiality protections and this Policy continuing to apply.

HyreMynd publishes a current list of the sub-processors it engages, naming each one's legal entity, purpose, categories of personal information, and processing location, rather than furnishing that list on request. View the HyreMynd sub-processor list.

7.1 No sale or sharing

HyreMynd does not sell personal information and does not share it for cross-context behavioral advertising, as the CCPA and similar state laws define those terms, and has not done so in the preceding twelve months.

7.2 Not a consumer reporting agency

HyreMynd is not a consumer reporting agency and Assessment output is not a consumer report under the U.S. Fair Credit Reporting Act. Employer clients are contractually prohibited from using Assessment output as a consumer report.

8. Where your information is processed

The Platform is hosted on infrastructure located in the United States. Personal information of Canadian residents is therefore transferred to, stored in, and processed in the United States, where it is subject to U.S. law and lawful access by U.S. authorities.

For communications of personal information outside Quebec, HyreMynd conducts the assessment Law 25 requires to confirm the information will receive adequate protection, and puts contractual safeguards in place with each receiving party. Employer clients carry their own cross-border duties to the individuals they invite, including any privacy impact assessment required under section 17 of the Quebec Act before personal information leaves Quebec, and transparency under PIPEDA about U.S. processing. HyreMynd supports those duties with clear subprocessor and transfer documentation. HyreMynd does not claim Canadian data residency.

9. Retention

We keep personal information only as long as the purposes in this Policy and our legal and contractual obligations require. After that, we destroy it securely or anonymize it under applicable law, including the destruction and anonymization requirements of Law 25.

Assessment data: 24 months after the engagement completes or terminates, unless a longer period is required by law or by the Employer's documented instructions under the DPA.

Portal accounts: Retained while the account is active and as long as necessary to fulfil the stated purposes; no fixed post-termination deletion date; deletion on request within 30 days, subject to legal obligations.

Anonymized data: Kept without time limit once anonymization is complete under applicable law.

Audit and security logs: 12 months.

Connected account credentials: Deleted when the user disconnects the account and when the account is erased. Disconnecting removes the stored credential from our systems and, where the provider offers a revocation endpoint, HyreMynd also asks it to revoke the grant; where the provider offers none, the user is shown where to remove HyreMynd's access from their own provider account. On erasure, HyreMynd asks the provider to revoke the grant while the credential still works and then permanently deletes it. No copy is archived and no retention period applies.

Interview transcripts and the drafts derived from them: Kept on the same clock as Assessment data above, unless a longer period is required by law or by the Employer's documented instructions under the DPA. They are deleted rather than anonymized in place, because a transcript is the candidate's own words.

10. Your rights

Subject to applicable law and identity verification, you may exercise these rights by contacting the Privacy Officer in Section 14:

• Access and knowledge. Confirm whether we process personal information about you and receive access to it, including categories collected, sources, purposes, and categories of recipients.
• Correction. Correct inaccurate or incomplete personal information.
• Deletion. Request deletion, subject to statutory exceptions and Section 10.1. Where you have connected a Google or Microsoft account, erasure first cancels your future interview meetings at the provider and asks the provider to revoke HyreMynd's access, while the credential still works, and then permanently deletes the encrypted credential from our systems. Interview transcripts and the drafts derived from them are deleted outright.
• Withdrawal of consent. Withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice. Withdrawing during an active Assessment ends your participation in that engagement.
• Portability. Where the law provides, receive computerized personal information you gave us in a structured, commonly used format.
• Automated decision rights. The rights in Section 5, including observations and, where applicable, opt-out or appeal rights for automated decision-making technology.
• U.S. state rights. Know, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, and appeal a refusal, as the privacy statute of your state provides.
• Non-discrimination. We will not treat you differently for exercising your rights.

10.1 Requests about delivered results

Where a request concerns Assessment output already delivered into an Employer client's workflow, our service provider role may require us to direct the request to that Employer client, or coordinate with it, because the Employer client is the business or controller responsible for that data. Deletion by HyreMynd does not recall output already delivered.

10.2 Timelines and appeals

We respond within the timelines applicable law requires, generally 30 days, with extensions where permitted. If we refuse a request, we tell you why and, where the law gives you an appeal right, how to appeal. You may also contact the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, your provincial commissioner, your state Attorney General, or the California Privacy Protection Agency.

11. Security

HyreMynd maintains administrative, technical, and physical safeguards that match the sensitivity of the information it holds: encryption in transit and at rest, role-based access controls, multi-factor authentication for administrative access, least-privilege access, audit logging, segregation of production data, and vendor security review. No system is perfectly secure, and HyreMynd does not promise absolute security. HyreMynd maintains a documented incident response plan and a confidentiality incident register. Where a confidentiality incident presents a risk of serious injury, we notify the Commission d'accès à l'information and the affected individuals. Where the real risk of significant harm threshold under PIPEDA is met, we notify the Office of the Privacy Commissioner of Canada. We also provide the breach notifications U.S. state law requires.

12. Consent

We collect, use, and disclose personal information with knowledge and consent, except where the law permits or requires otherwise. Consent is collected during onboarding, before the Assessment begins, through clear and plainly worded statements, one for each purpose, including the anonymized data purpose in Section 4.1. This follows the Law 25 requirement that consent be requested for each purpose in clear and simple language.

13. Children

The Platform is built for professional workplace use and is not directed to minors. We do not knowingly collect personal information from anyone under the age of majority in their jurisdiction, and we delete any such information when we become aware of it.

14. Privacy Officer and contact

HyreMynd has designated a Privacy Officer, who is also the person in charge of the protection of personal information under Law 25.

Privacy Officer: Marleigh Robertson

Organization: HyreMynd AI Inc.

Mailing Address: Toronto, Ontario, Canada

Email: privacy@hyremynd.com

15. Changes to this Policy

We may amend this Policy at our discretion. We will communicate material changes through the Platform or by email before they take effect and update the Effective Date. Continued use after the effective date is acceptance, except where the law requires fresh consent.

16. Governing law

This Policy is governed by the laws of Ontario and the federal laws of Canada that apply there. This does not limit mandatory rights you hold under the privacy laws of where you live, including Law 25 for Quebec residents and state law for U.S. residents.

Privacy Policy | Confidential and Proprietary