Privacy notice

Effective date: [[PLACEHOLDER: effective date]]

Who we are

Reply is run by [[PLACEHOLDER: legal entity name]]. Our mailing address is [[PLACEHOLDER: mailing address]]. To ask a privacy question, write to [[PLACEHOLDER: contact email]].

Law that applies: [[PLACEHOLDER: jurisdiction]]. check: we assume the federal Canadian law PIPEDA and the law of Ontario. A lawyer must confirm this.

What we keep about you

This is the personal information that the service stores.

All accounts

Your name and email address. Whether you have verified the email address.
Your password, stored as a one-way hash. We cannot read it.
Your sessions: a secret session token, the expiry time, the IP address and the browser description (user agent) from when you signed in.
Your notifications in the service, and the emails we send you, with their delivery state.
An audit record of important actions in the service: who did what, and when.

Candidates

Your profile: time zone, country and region (we use them to count business days), and the profile fields you save.
Each application: a copy of your profile at the time, the questions, your answers, the time you confirmed, the stage, and the history of actions on it.
Interview dates and states for your applications.

Employers and recruiters

Your company name, the members of your company and their roles, and invitations (the invited email address).
Your company time zone and region, and the company email address and website that you give to verify the company.
Your job listings, their changes, and the person responsible for each listing.
Your decisions on applications, and the deadlines, extensions, blocks and strikes that follow from the response rules.

Reports, moderation and appeals

Reports that you send about a listing or an application, with your details text and your account.
Moderation cases, the evidence on them, the decision, the reason, and appeals.
Human-check records: that a check was needed, and whether it passed or failed.

Security log

To protect accounts, we write a security event when someone signs in, fails to sign in, signs up, is locked out, hits a rate limit, asks for a password reset, completes a reset, or changes a password. Each event holds the time, your account id (if known), a hash of your email address (not the address itself), and your IP address. It never holds a password, a token or a reset link. We keep each security event, with its IP address, for 90 days. Then the service deletes it.

Rate limits and lockouts

To stop abuse, we count requests in the database. These rows are deleted 60 minutes after they expire. After repeated failed sign-ins, we lock the account for a short time. The lockout row uses a hash of the email address, not the address. We delete it 24 hours after its last activity.

Password reset

A reset link works once and ends after 30 minutes. We store only a hashed form of the token. When you reset your password, your other sessions end.

Cloudflare Turnstile (human check)

When we need to know that a person is acting, we show a check from Cloudflare Turnstile. The check runs a script from Cloudflare in your browser. Cloudflare receives your IP address, and signals from your browser and device (such as browser type and how the page behaves), to decide if you are a person. We send the result to Cloudflare to confirm it, and we keep only whether the check passed or failed. If the check is not available or fails, a moderator reviews the case instead. Cloudflare’s own privacy policy applies to what Cloudflare does with this data: https://www.cloudflare.com/privacypolicy/. check: confirm the current Turnstile data description in Cloudflare’s documentation before launch.

Resend (email delivery)

We send email (for example a password reset link or a company verification link) through Resend. Resend receives the recipient address, the message content and the sender. Resend’s privacy policy applies to what it does with this data.

Other services that see your visit

Cloudflare also carries the traffic to our server (DNS and tunnel). It sees your IP address and the pages you ask for.
The pages load the fonts DM Sans and Manrope from Google Fonts. Google receives your IP address and browser details when your browser loads them. check: we may host the fonts ourselves later.

Cookies

We set one kind of cookie: the sign-in session cookie from Better Auth (better-auth.session_token, with the prefix __Secure- on the live site). It keeps you signed in. It is HttpOnly, SameSite=Lax and Secure. If you do not choose “remember me”, Better Auth may also set a small cookie (better-auth.dont_remember) to end the session when you close the browser. We set no advertising or analytics cookies. Cloudflare Turnstile may set its own storage in your browser while the check runs. check: look at the cookies on the live site before launch.

Where the data is kept

The database runs on a server that we host ourselves in Canada. check: confirm the country and the place of the server. Cloudflare and Resend are service providers that may process data outside Canada. check: confirm where Resend and Cloudflare process data.

How long we keep it

Security events and their IP addresses: 90 days.
Rate-limit rows: deleted 60 minutes after they expire.
Lockout rows: deleted 24 hours after last activity.
Password reset tokens: 30 minutes.
Sessions: until they expire or you sign out.
Account, application, listing, moderation and audit data: [[PLACEHOLDER: retention period for account and application data]]. check: no deletion time is set in the service yet. The audit record and moderation decisions cannot be edited after they are written.

Why we use your information

We use it to run your account, to hold both sides of a hiring process to their response deadlines, to review reports, to keep the service secure, and to send the emails that the service needs. We do not sell personal information. We do not use it for advertising.

Your rights

You may ask to see the personal information we hold about you, to correct it, to delete it, or to withdraw your consent. You may also ask a question or make a complaint. Write to [[PLACEHOLDER: contact email]]. We will answer within [[PLACEHOLDER: response time for privacy requests]]. check: PIPEDA gives a right of access and correction, and you may complain to the Office of the Privacy Commissioner of Canada. A lawyer must confirm the exact wording and the legal limits (for example, we may keep data that the law requires, or that protects other people).

Changes to this notice

When we change this notice, we will change the effective date at the top.