Privacy policy

Who we are

Hire a Canadian — a service of 2592903 Ontario Ltd, at 270 Presqui'le Parkway, Brighton, Ontario K0K 1H0, Canada. This policy explains what we collect about you, why, how long we keep it, and how to have it corrected or removed.

Who to contact

Questions about this policy, or about the personal information we hold about you: email our Privacy Officer at hello@hirea.ca. That is a title, not a named individual — whoever holds it is responsible for our compliance with PIPEDA and, for people in Quebec, that province's private-sector privacy law.

What we collect

If you create a job seeker account: your email, the password you choose (stored only as a salted hash — we cannot read it), and whatever you put in your profile: name, headline, location, skills, links and work authorisation. We no longer accept resumes: applications are made on the employer's own site, so there is nothing here for us to hold.

If you create an employer account: your email, password hash, and your company details.

If you apply to a job: nothing is stored here. Every posting sends you to the employer's own careers page, and what happens there is between you and them — we do not see it, and we never receive a resume on an employer's behalf.

If you create a job alert: your email address and the search you saved.

Everyone: standard web request data — IP address, user agent, and the page requested — handled by Cloudflare as our infrastructure provider. We use this for rate limiting and abuse prevention.

What we do not check

Worth stating before the rest, because a check with an unstated boundary invites more trust than it has earned.

These checks are assessed under Ontario's Employment Standards Act, which governs work performed in Ontario by provincially regulated employers. They do not reach federally regulated employers — banks, telecommunications, air and rail, inter-provincial trucking, broadcasting, Canada Post, the federal public service — and they do not reach roles performed entirely outside Ontario.

Other provinces have their own rules and we do not yet assess them. British Columbia has its own pay transparency legislation. Quebec has French-language obligations under the Charter of the French Language that reach job advertising and employment documents, and nothing on this board evaluates them. A posting for a Quebec role that passes our checks has not been checked against Quebec's requirements, and should not be read as if it had.

We also check what a posting states, not whether the statement is true. We do not verify that a disclosed salary is the salary paid, that a stated vacancy exists, or that an employer's reported size and industry are accurate. Where we cannot establish that a duty applies to an employer at all — which is the case for listings collected from an employer's own careers page — we describe what the posting says and assert nothing about what anyone owed.

What we do not do

We do not sell personal information. We do not share it with advertisers or data brokers, and we do not run advertising trackers.

If job posting payments or the Early Access subscription are switched on, purchasing goes through Stripe. We never see or store your card number — Stripe collects it directly.

Who processes your information, and where

We do not run all of this ourselves. Four outside companies handle parts of it on our behalf, and all four are based in the United States — so your information is processed outside Canada whenever it passes through one of them:

• Cloudflare hosts the site, runs our database and file storage, and its network sees the IP address and request details of every visit, which it uses for security and rate limiting.
• Resend sends every email we send: account mail, application notices, job alerts, the newsletter, Early Access.
• Stripe processes payments, once posting fees or the Early Access subscription are switched on. It collects card details directly; we never hold them.
• Google Analytics is in use on the site today — see Analytics, below — to count visits.

Using a processor does not change what we have promised above about not selling your information; each of them handles it only to provide their service to us.

Analytics

We use Google Analytics 4 to see how people find and move through the site, not just that a page loaded. What it records is a fixed list of actions: a search on the jobs board, a job page opened, an application started, a role saved, an account created or signed into, a job alert or newsletter subscription created, and whether you have Early Access. It sets cookies whose names begin with _ga to tell repeat visits apart, and it sends Google your IP address, page URL, referrer, and coarse device and browser details.

If you are signed in, we also send an anonymous internal account id and your account role (job seeker, employer or admin), and whether you are an Early Access member — never your name or email address, and this is never sent for a page we serve to a signed-out visitor.

We have turned off the parts of it that exist to serve advertising: no Google Signals, no ad-personalisation signals, and IP anonymisation on. We do not use the data for advertising, and we do not build profiles from it beyond what is described here.

You can turn this off. Visit /privacy/analytics to switch analytics off in your browser, or back on — no account needed, and it takes effect immediately. We also honour Global Privacy Control (the Sec-GPC signal some browsers and extensions send): if yours sends it, analytics is off for you automatically, whatever the setting on that page says. Either way, nothing on this site stops working when analytics is off, and any content blocker will also stop it.

We self-host our fonts, so loading a page does not hand your IP address to a font provider on top of that.

One more thing worth stating precisely rather than glossing: Cloudflare, our infrastructure provider, adds its own cookieless analytics script to pages it serves. Our Content Security Policy blocks that script from running, so it does not execute in your browser and no measurement is collected from it. We would rather tell you it is in the page and blocked than claim there is nothing there.

Early Access emails contain a tracking image and links that record when the email is opened and which role is clicked. We use this only to measure and improve what we send — no third-party tracker is involved, and nothing here is shared with advertisers. To switch it off, turn off the daily email from your account page at /me, or use the unsubscribe link in any Early Access email — either one stops the email, and with it the tracking.

Who can see your profile

By default, only employers whose jobs you actually apply to.

There is an opt-in setting that lets verified employers find your profile in a search. It is off unless you turn it on, and you can turn it off at any time.

How long we keep things

Derived from what the code actually does, store by store — not a schedule we invented after the fact:

• Job postings: 3 years. Ontario's Employment Standards Act requires an employer to keep a copy of each public job posting for three years, so we keep the postings themselves. We no longer hold application forms or applicant correspondence of any kind — applications are made on the employer's own site.
• Your account and profile: kept until you ask us to remove it. There is no self-service "delete my account" button yet; email hello@hirea.ca from the address on the account and we will remove your profile and account within 30 days.
• Resumes: none are held. Resume storage was removed on 2026-09-22 and every stored file was deleted.
• Job alerts: deleted immediately when you unsubscribe.
• Newsletter and Early Access subscriptions: unsubscribing stops the mail immediately. We keep the record that you unsubscribed, so we never re-mail you by mistake, rather than deleting the row outright.
• Email logs and open/click tracking: kept as our sending record and the ESA correspondence record described above; nothing purges it on a timer.
• Rate-limiting data: minutes to hours, then it expires on its own.
• Aggregate traffic counts (page views by route and referrer): kept in aggregate, with no IP address stored. The per-network abuse counters used to catch scrapers are deleted after 7 days.
• Payment and subscription records, once billing is switched on: kept indefinitely, as accounting and tax record-keeping require. Card numbers are never in our database — Stripe holds those.

Your rights

Under PIPEDA you can ask what personal information we hold about you, ask for it to be corrected, and withdraw consent for its use. We will respond to a request within 30 days.

You can edit or delete your profile yourself at any time from your account. To request deletion of an account and everything attached to it, correction of anything we hold, or an export of your data in a portable file, email hello@hirea.ca from the address on the account.

One limit worth stating plainly: an application you made on an employer's own site is a record that employer holds, and deleting your account here has no effect on it. You would have to ask them.

If something goes wrong

We keep a record of every security incident that could involve personal information, whether or not it turns out to matter. Where a breach creates a real risk of significant harm to someone, we tell the people affected directly and report it to the Office of the Privacy Commissioner of Canada, as the law requires.

Quebec

If you are in Quebec, that province's private-sector privacy law gives you rights worth naming directly rather than folding into the general text above:

• Who is responsible. Our Privacy Officer — a title, not a named individual, reachable at hello@hirea.ca — is in charge of our compliance with Quebec's law, the same as with PIPEDA.
• Profiling technology. Google Analytics and the tracking image and links in Early Access email are the two technologies on this site that identify or profile a specific visitor across visits. Both are described above under Analytics, both are optional, and both can be switched off: turn analytics off at /privacy/analytics (or send Global Privacy Control, which we honour automatically) for analytics, and the daily-email toggle at /me or the unsubscribe link for Early Access tracking.
• Portability. You can ask for the personal information we hold about you in a portable, commonly used format — a JSON export. Email hello@hirea.ca.

Security

Passwords are hashed with PBKDF2-SHA256 at 600,000 iterations. Sessions are signed HTTP-only cookies. Everything is served over HTTPS. Uploaded files are checked against their declared type and served as downloads, never rendered inline.

We are a small operation and we do not claim to be unbreakable. We do claim to have made the obvious choices correctly.

Changes

If this policy changes materially we will note the date above and, for changes that affect how we use information you have already given us, tell account holders by email.

Related pages

Terms of use · Accessibility · Refunds and cancellation

Contact

Our Privacy Officer: hello@hirea.ca