Privacy Policy

Koali has designated a Privacy Officer who is responsible for our compliance with privacy law and for handling your privacy requests and questions.

Privacy Officer, Koali Inc. - privacy@koali.ca

You can reach the Privacy Officer in English or French. We respond to requests within 30 days and may ask you to verify your identity before we act on a request.

We collect information in three ways:

Information you provide directly:

• Account data: name, email address, password (hashed, never stored in plain text), role (candidate or recruiter)
• Candidate profile: headline, résumé (PDF), skills, seniority level, work experience, education, certifications, languages, location and work preferences, phone number, LinkedIn/portfolio URLs, bio
• Application content: cover notes, application status, recruiter notes, messages exchanged with recruiters
• Recruiter profile: company name, job title, bio, website, verification status, subscription plan
• Listing content: role descriptions, salary ranges, location, tags
• Payment metadata: Stripe customer ID, subscription ID, credit purchase history (we do not store full card numbers)
• Other information you choose to add: a free-text “other information” field on your candidate profile (up to 2,000 characters). Please do not include sensitive information you are not comfortable sharing - for example, health, ethnic origin, or other special-category details - as recruiters who receive your application can see what you enter here.
• Structured application data: the structured answers and custom responses you submit with an application (“application data”), including any questions a recruiter has added to a listing. Some recruiter questions may ask for diversity- or equity-related information; answering those questions is optional, and we treat such answers as sensitive.
• Recruiter onboarding details: for recruiters, your specialty, years recruiting, and company size.

Information generated automatically:

• Login timestamps, session tokens, IP addresses (for security and fraud prevention), browser/device type (via standard HTTP headers)
• Platform usage logs: listing views, application submissions, message activity
• Aggregate, cookieless analytics via Vercel Web Analytics (page views and performance only - no cookies, no personal identifiers, no cross-site tracking)
• Product-analytics events (an “analytics events” record of in-product actions - for example which pages or listings you view and which features you use), used to operate, measure, and improve the Platform.
• Records that flow from using the Platform: your credit ledger (credit purchases, deductions, and refunds), placement records (when a recruiter records that you were placed), service-level (SLA) tracking, and candidate quality flags - including whether a profile has earned “Koali Recognised” status.

Information from third parties:

• Payment and subscription status from Stripe
• Email delivery confirmations from our transactional email provider

We collect, use, and disclose personal information only for the purposes below, and we ask for your consent at or before the time of collection. Under Law 25, consent for a purpose is sought specifically and separately where required.

• Operate the platform: accounts, applications, messaging, listings, credits
• Enforce SLA windows and issue automatic credit refunds on SLA breaches
• Send transactional emails (application received, new message, SLA reminder, credit refund, billing, account security)
• Process payments and manage subscriptions via Stripe
• Detect and prevent fraud, abuse, and policy violations
• Operate, measure, analyse, maintain, and improve the Platform's reliability, performance, security, and features, and develop new features - including by producing internal analytics, usage statistics, and operational benchmarks. We identify this purpose to you here, at the time of collection, so it is part of why we collect your information - not a later, separate use.
• Produce statistics and study how the Platform and the labour market it serves are used. Where we use your personal information to produce statistics, we de-identify it first, as Canadian privacy law permits.
• Comply with legal obligations (financial records, tax, legal process)

We do not sell your personal information. We do not disclose your personal information to data brokers, and we do not use it for third-party advertising or behavioural profiling.

No automated decision-making. Koali uses zero automated tools to screen, rank, or reject applications. All application decisions are made by human recruiters.

De-identification. We may de-identify your personal information so that it no longer directly identifies you, and we use de-identified information internally - for example, to produce statistics and to study, measure, and improve the Platform. De-identified information can still, in theory, be linked back to a person, so we continue to treat it as personal information and protect it accordingly.

Anonymisation. We may also anonymise personal information, using generally accepted best practices and the criteria set by applicable Quebec regulation, so that it is no longer reasonably foreseeable - alone or in combination with other information - that the information could be used to identify you, directly or indirectly. Information anonymised in this way is no longer personal information, and we may keep and use it for legitimate purposes permitted by law.

No re-identification. We do not attempt to re-identify de-identified or anonymised information, and where we share such information we contractually require the recipient not to attempt re-identification either. Attempting to identify a person from de-identified or anonymised information without authorisation is an offence under Quebec law.

Aggregate statistics. Some of the insights we produce - for example, salary ranges, application volumes, time-to-response, and skills or demand trends by sector, seniority, and region - are genuine aggregate statistics: counts, medians, and distributions that describe groups, not individuals. We suppress small groups so that no individual can be singled out. Aggregate statistics of this kind are not information about an identifiable person.

Aggregated insights you can opt into. With your opt-in consent - off by default, changeable anytime in your profile, and never a condition of applying or of the human review we guarantee - your information may be included in aggregated, non-identifying labour-market statistics (such as salary and response-time trends by role, sector, and region). These are produced with the small-group suppression described above, contain no personal information about you, and may be published or licensed to organisations under our Data & Insights Licence. We never sell your personal information or any individual record, and any licensee is contractually barred from attempting to re-identify anyone. If you have not opted in, your personal information is not used to build these statistics; you can withdraw your consent at any time.

We share personal information only as described below. We do not sell personal information to brokers, advertisers, or any third parties.

With recruiters (candidates only):

When you apply to a role, your candidate profile (name, résumé, skills, cover note, headline) is shared with the recruiter managing that role. Recruiters are contractually required to use your data only to evaluate you for the specific role you applied to and to comply with applicable privacy and employment law.

With candidates (recruiters only):

Recruiter name, company, and response rate are shown to candidates as part of listing information to enable informed decision-making.

With service providers:

We share data with the following providers solely to operate the platform, under data processing agreements and appropriate safeguards:

Cross-border transfers: Our infrastructure providers are based in the United States, so your personal information is transferred to, stored in, and processed in the United States, subject to US law. Before transferring personal information outside Quebec, we conduct a privacy impact / transfer assessment as required by Law 25, confirm each provider offers adequate protection, and bind each provider by written agreement. By using Koali, you are informed of and consent to these transfers.

Legal disclosure:

We may disclose personal information if required by law, court order, or lawful government request, or where necessary to protect the safety of users or prevent fraud or illegal activity. If Koali is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.

We retain personal information for as long as necessary to fulfil the purposes set out in this Policy, subject to the following minimums:

• Account data (candidates and recruiters): retained for 3 years after account closure, then deleted or anonymised
• Application records and messages: retained for 3 years after the application is closed, then deleted or anonymised
• Financial records (credits, subscriptions, refunds): retained for 7 years to meet tax and accounting obligations
• Security and access logs: retained for 90 days, then deleted

If you delete your account, your profile is removed from the platform within 30 days. Financial records and de-identified aggregate data may be retained longer as required by law or for fraud prevention purposes.

Under PIPEDA, Law 25, and applicable provincial law, you have the right to:

• Access: request a copy of the personal information we hold about you
• Correction: ask us to correct inaccurate or incomplete information
• Withdraw consent: withdraw consent to certain uses of your data (note: this may prevent you from using parts of the platform that depend on that use)
• Deletion: request deletion of your account and personal data, subject to our legal retention obligations
• Portability (Law 25): request that the computerised personal information you provided be communicated to you, or to another organisation you designate, in a structured, commonly used technological format, where technically feasible
• De-indexing / cessation of dissemination (Law 25): in certain circumstances, ask us to stop disseminating personal information or to de-index it
• Complaint: to our Privacy Officer, and to a regulator (see Section 14) if you are not satisfied with our response

To exercise any of these rights, email privacy@koali.ca. We respond within 30 days and may verify your identity first.

Koali uses industry-standard security measures including:

• TLS encryption for all data in transit; encryption at rest via our infrastructure providers
• Row-level security (RLS) on all database tables: each user can access only their own data and the data explicitly shared with them
• Résumés and uploaded documents are kept in a private storage bucket that is not publicly accessible. When a résumé needs to be shown - for example, to a recruiter you have applied to - it is served through a temporary, signed link that expires after a few minutes, so documents cannot be reached through a guessable or shareable public URL.
• Passwords are hashed and never stored in plain text
• Payment card details are never stored on Koali servers - all card processing is handled by Stripe, which is PCI-DSS Level 1 certified
• Admin access is restricted and audited

No system is perfectly secure. If you believe your account has been compromised, contact security@koali.ca immediately.

If a confidentiality incident creates a risk of serious injury (a “real risk of significant harm”), we will, as required by law, notify the affected individuals and the relevant regulator(s) - including the Commission d'accès à l'information du Québec (CAI) for Quebec residents, the Office of the Privacy Commissioner of Canada under PIPEDA, and the Office of the Information and Privacy Commissioner of Alberta where Alberta's mandatory-reporting law applies. We keep a register of confidentiality incidents. (British Columbia does not currently require private organisations to report breaches; we will still notify B.C. residents voluntarily where there is a real risk of significant harm.)

Koali uses only essential cookies required to operate authentication sessions. We do not use advertising cookies or cross-site tracking pixels. For analytics we use Vercel Web Analytics, which is cookieless and privacy-friendly: it measures aggregate usage (page views and performance) using a temporary daily request hash, sets no cookies, collects no personal identifiers, and cannot track you across other websites. See our Cookie Policy for details.

Account, transactional, and service messages - for example, application updates, new-message alerts, SLA reminders, credit refunds, billing, account-security notices, and any digest of activity on your account - are part of operating your account and are not marketing. These are not optional, and you cannot unsubscribe from them while you have an active account; we keep them on a separate channel from any marketing email.

We will send you promotional electronic messages (for example, newsletters or feature announcements) only if you have given express, opt-in consent - and we do not currently run a marketing-email program. If and when we do, we will ask for that consent separately (for example, by an unchecked box you must tick), every promotional message will identify Koali Inc. and include our mailing address and a working one-click unsubscribe link, and we will honour unsubscribe requests promptly, all in accordance with Canada's Anti-Spam Legislation (CASL). You can withdraw marketing consent at any time without affecting your account.

The Koali platform is intended for users 18 years of age or older. We do not knowingly collect personal information from minors. If you believe a minor has submitted information, contact privacy@koali.ca and we will delete it promptly.

We may update this Policy from time to time. Material changes will be communicated via email or in-platform notice at least 14 days before taking effect. Continued use of the platform after that date constitutes acceptance of the updated Policy.

Privacy Officer, Koali Inc. - privacy@koali.ca

If you are not satisfied with our response, you may contact:

• Office of the Privacy Commissioner of Canada (OPC)
• Commission d'accès à l'information du Québec (CAI) (Quebec residents)
• the privacy regulator in your province, where applicable