Upfinity Inc. Last updated: July 27, 2026 · Effective: July 27, 2026
Upfinity Inc. ("Upfinity", "we", "us") is a company incorporated in Ontario, Canada, with its registered office at 140 Carlton Street, Toronto, ON, M5A 3W7, Canada. We operate Upfinity Talent (the "Platform"), a recruitment and candidate assessment service provided to employer organisations ("Clients").
Our role depends on whose information is involved:
Contact for privacy matters: privacy@upfinity.ca EU/UK representative (required under GDPR Art. 27 if we have no EU establishment): Upfinity Inc., 140 Carlton Street, Toronto, ON, M5A 3W7, Canada Privacy Officer (required under PIPEDA): Upfinity Inc.
Collected either from the Client, from your application (including via email or job boards such as Indeed), or generated by your use of the Platform:
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, email address | Client, your application |
| Application materials | Résumé/CV file and its extracted text, stated experience, skills | Your application |
| Role and process data | Role applied for, application date, stage, attempt number | Client, Platform |
| Assessment data | Answers submitted, per-question timing, completion timestamps, score, pass/borderline/fail band | Platform |
| Assessment integrity data | Tab-switch counts, session/device changes, automatic lock events | Platform |
| Technical data | IP address, browser/device user agent, approximate location derived from IP (city/region/country) | Platform |
| Assessment analysis | AI-generated summary, skill and experience assessment, written-answer scoring, recommendation | Platform (see Section 4) |
| Interview and outcome data | Interview status, scheduling, decisions recorded by the Client, notes entered by the Client | Client |
We do not intentionally collect special category data (racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, sex life or sexual orientation). Please do not include such information in your résumé or free-text answers. If it appears incidentally, we process it only as an unavoidable consequence of processing the document as a whole and apply the same protections described here.
We do not knowingly collect information from anyone under 16.
Name, work email address, password (stored only as a salted cryptographic hash — never in readable form), role within the account, authentication session data, and records of actions taken in the Platform.
We do not use advertising cookies, third-party marketing trackers, or behavioural advertising. We do not sell personal information, and we do not "share" it for cross-context behavioural advertising as those terms are defined under US state privacy laws.
| Purpose | Legal basis (GDPR) | Basis (PIPEDA / Canada) |
|---|---|---|
| Delivering the assessment you were invited to complete | Contract / steps prior to contract (Art. 6(1)(b)); legitimate interests of the Client in evaluating applicants (Art. 6(1)(f)) | Implied consent through voluntary participation; reasonable purposes for employment consideration |
| Scoring assessments and generating candidate analysis | Legitimate interests (Art. 6(1)(f)) — evaluating suitability for a role, balanced against candidate rights as described in Section 4 | Reasonable purposes |
| Protecting assessment integrity (tab-switch and session monitoring) | Legitimate interests (Art. 6(1)(f)) — fairness to all candidates; disclosed to you before the assessment begins | Reasonable purposes; disclosed in advance |
| Retaining records to defend against or establish legal claims (e.g. discrimination complaints) | Legal claims (Art. 9(2)(f) where relevant); legitimate interests (Art. 6(1)(f)) | Legal requirement / legitimate business purpose |
| Retaining candidates in a talent pool for future roles | Consent (Art. 6(1)(a)) — you may withdraw at any time | Express consent |
| Platform security, abuse prevention, rate limiting | Legitimate interests (Art. 6(1)(f)) | Reasonable purposes |
| Client account administration and billing | Contract (Art. 6(1)(b)); legal obligation for financial records (Art. 6(1)(c)) | Contract; legal requirement |
Where we rely on legitimate interests, you have the right to object (Section 8). We have documented a balancing assessment for each such purpose and will provide a summary on request.
The Platform uses artificial intelligence to evaluate candidates. We want you to understand exactly what this means.
What the AI does. After you submit an assessment, objective questions are scored automatically against a predetermined answer key. Written answers and, where applicable, résumés are analysed by a large language model to produce a numeric score, a summary of strengths and concerns, and a recommendation. This analysis is provided to the Client as decision-support information.
What the AI does not do. The AI does not make hiring decisions. It does not reject candidates. A human representative of the Client reviews candidate information before any advancement, rejection, or offer decision is made or communicated. Where a Client has enabled automatic advancement based on a score threshold, this only adds a candidate to a list requiring human review before any contact occurs — it does not itself produce a decision or communication.
Your rights regarding automated processing. You have the right to:
To exercise any of these, contact privacy@upfinity.ca or the Client directly.
Accuracy and limitations. AI-generated scores and summaries are probabilistic and can be wrong. They may reflect biases present in underlying models or in the question set. They should never be treated as a definitive measure of ability. We are implementing periodic reviews of assessment outcomes for disparate impact across protected characteristics.
Regulatory notices. Where required by applicable law, including New York City Local Law 144 and comparable statutes, the Client is responsible for providing candidate notice and for obtaining and publishing an independent bias audit before using automated employment decision tools in the relevant jurisdiction. Upfinity provides supporting information to enable this. Under the EU AI Act, recruitment AI systems are classified as high-risk and subject to additional obligations; Upfinity maintains supporting technical documentation, logging, and human-oversight measures in support of compliance, and is expanding this documentation on an ongoing basis.
We share personal information only as follows:
| Sub-processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting | United States |
| Neon Inc. | Database hosting | United States |
| Google LLC | Email intake (Gmail API) and résumé file storage (Drive), where a Client enables this | United States |
| Resend / Brevo / Google (SMTP) | Transactional email delivery | US / EU |
| OpenRouter, OpenAI, Anthropic, Google LLC (Gemini), NVIDIA, and DeepSeek | Assessment and résumé analysis. Clients may bring their own API key for any provider; OpenRouter is the platform default. DeepSeek is excluded from the AI provider chain for any tenant serving EU/UK candidates — those tenants route only through the remaining providers. | United States (OpenRouter, OpenAI, Anthropic, Google, NVIDIA); DeepSeek: People's Republic of China, not used for EU/UK data |
A current list of sub-processors is maintained at /subprocessors. We provide Clients advance notice of changes.
We do not sell personal information.
Note on AI sub-processors: where a third-party AI provider processes résumé or assessment content, we contract to prohibit use of that content for model training. Clients and candidates should be aware that content is transmitted to these providers for analysis.
Personal information is stored and processed in the United States, and may be transferred to and processed in other countries where our service providers operate.
For transfers of EU/UK personal data outside the EEA/UK, we rely on:
For candidates in Canada: personal information may be stored or accessed outside Canada, including in the United States, and is therefore subject to the laws of those jurisdictions, including lawful access by their courts and authorities.
Retention is set by the Client as controller, within the limits below.
Candidate information — default schedule
| Data | Retention |
|---|---|
| Candidate records, assessment results, résumés and derived analysis (Canada and US) | 24 months from your last interaction (assessment submission, or last stage update) |
| Candidate records (EU/UK) | [6–12 MONTHS — SEE NOTE] from the conclusion of the recruitment process, unless you consent to longer talent-pool retention |
| Assessment link tokens and in-progress session data | Deleted or invalidated shortly after expiry or completion |
| Email delivery logs | Retained indefinitely, to support regulatory and legal compliance requests |
| Security and authentication logs | Retained indefinitely, to support regulatory and legal compliance requests |
| Client account and billing records | Duration of the agreement plus the period required by tax and corporate law (typically 6–7 years in Canada) |
Note on EU retention: EU data protection authorities generally expect recruitment data to be deleted within 6–12 months of a hiring decision absent consent, tied to the limitation period for discrimination claims in the relevant member state — the exact figure above is pending confirmation.
Reminder before deletion. Where we hold a valid email address, we will send a reminder before the end of the retention period, giving you the option to consent to remain in the Client's talent pool for future opportunities. If you do not respond, deletion proceeds.
What we retain after deletion. After the retention period, we permanently delete direct identifiers — name, email address, telephone number, résumé file and résumé text, free-text answers, IP address, device identifiers, and any account or record identifier linking back to you.
We retain a statistical record containing only: the role applied for, the score band, the assessment date to the level of month and year, the coarse experience bracket, and the outcome stage reached. These records are retained indefinitely for aggregate reporting, fairness monitoring, and assessment quality analysis.
We design these records so that they cannot reasonably be used to re-identify any individual, and we do not attempt re-identification. Where a residual re-identification risk exists in a particular dataset, we continue to treat that data as personal information and honour deletion requests against it.
Earlier deletion. You may request deletion before the end of the retention period (Section 8). We will comply unless we are required or permitted to retain specific information to establish, exercise or defend legal claims, or to meet a legal obligation — in which case we will tell you what we are retaining and why.
Depending on where you live, you may have the right to:
How to exercise them. Contact privacy@upfinity.ca. We will respond within 30 days (PIPEDA) or one month (GDPR, extendable by two further months for complex requests, with notice). We do not charge a fee unless a request is manifestly unfounded or excessive. We may need to verify your identity before acting.
If your information is held on behalf of a Client, we will forward your request to that Client and support them in responding.
Complaints.
Measures include: encryption in transit (TLS) and at rest; passwords stored only as salted hashes; encrypted storage of third-party access credentials; strict logical separation of each Client's data; role-based access control with individual administrator accounts; session authentication with CSRF protection; rate limiting and abuse detection; time-limited, single-use assessment links; and audit logging of significant actions.
No system is perfectly secure. Where a breach creates a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours (GDPR) and affected individuals without undue delay, and will report to the Office of the Privacy Commissioner of Canada where the breach poses a real risk of significant harm (PIPEDA).
We use only strictly necessary cookies and browser storage: an authentication session cookie for administrators, a CSRF protection token, and local storage on the candidate assessment page to preserve answers if a connection drops. We do not use analytics, advertising, or tracking cookies. Strictly necessary cookies do not require consent, but we describe them here for transparency.
We will post any changes here with an updated effective date. For material changes affecting how we use your information, we will provide advance notice to Clients and, where practicable and required, to affected candidates.
Upfinity Inc. 140 Carlton Street, Toronto, ON, M5A 3W7, Canada Privacy enquiries: privacy@upfinity.ca Privacy Officer: Upfinity Inc. EU/UK Representative: Upfinity Inc., 140 Carlton Street, Toronto, ON, M5A 3W7, Canada