Privacy Policy

Who we are

100089160 Ontario Inc. ("we", "us", "our"), operating as WhoDooUNode, operates the WhoDooUNode platform at whodoounode.com. We are incorporated in Ontario, Canada and comply with the Personal Information Protection and Electronic Documents Act (PIPEDA).

Questions about this policy? Email us at support@whodoounode.com

What we collect

• Account information: Your name, email address, and password when you sign up.
• Resume files: When you upload a resume for job matching. See the 24-hour deletion policy below.
• Resume data: Skills, experience, and role preferences extracted from your resume. This stays in our system to power your matches.
• Usage data: Pages visited, searches run, and matches viewed — used to improve the platform.
• Payment information: Processed entirely by Stripe. We never see or store your card details.
• Communications: Messages you send to our support team.

Where your data is stored

100089160 Ontario Inc. (operating as WhoDooUNode) is incorporated in Ontario, Canada. The infrastructure that runs the platform is currently hosted in the United States. This means your personal information — including your account data, resume content, matching activity, and commission records — is stored on and processed by servers located in the U.S.

U.S.-based service providers may be subject to U.S. laws, including the CLOUD Act, which can compel a U.S. provider to disclose data in response to lawful U.S. legal process regardless of where the data is physically located. Under PIPEDA, you have the right to know this.

We have a documented plan to migrate primary data hosting to Canadian-sovereign infrastructure when business conditions warrant it (for example, a federal procurement requirement, an enterprise client requesting Canadian residency, or sustained revenue thresholds). Until that migration executes, we describe the current state honestly here rather than claiming Canadian residency we have not yet delivered.

How we use your information

• Match you to relevant job listings
• Send you job match alerts and platform notifications
• Process payments and calculate referral commissions
• Prevent fraud and abuse on the platform
• Improve our matching algorithm
• Respond to your support requests

Service providers we use

We do not sell your personal information. We share it only with trusted third-party service providers, each acting on our behalf to operate the platform and each bound by its own contractual and privacy commitments. The categories below describe what they do and where they operate.

• Database hosting (U.S.-based): Stores your account, resume, matching, and commission data. U.S.-based.
• Application hosting (U.S.-based): Runs the platform and handles page and API requests, including standard request metadata such as IP address, browser headers, and session cookies. U.S.-based.
• File storage (U.S.-resident): Stores uploaded resume files (subject to the 24-hour deletion policy above) and avatar / video assets. U.S.-resident.
• Payment processing (Stripe): Processes payments, subscriptions, and scout payouts. Card details never reach our servers. U.S. infrastructure; a Canadian Stripe entity is used for CAD billing.
• Email delivery (U.S.-based): Delivers account, alert, payout, and support emails. U.S.-based.
• AI processing (U.S.-based): Processes your resume content to help power your matches. Your resume text is not used to train any provider's general AI models. U.S.-based.
• Search & matching infrastructure (U.S.-based): Supports the systems that surface and order the roles you see. U.S.-based.
• External job applications: When you apply to a job hosted on an external site via our platform, we append a source tag to the apply link so the destination employer can see the application came from WhoDooUNode. No additional personal information is sent beyond the application you submit on the employer's own site.

Information you choose to make public

Parts of the platform are designed to be public so that hiring teams, search engines, and AI assistants can discover scouts and candidates who choose to be discoverable:

• Scout pages: If you sign up as a scout, your public scout page (name, photo, bio, expertise, references, and shared roles) is visible to anyone with the link and indexable by search engines and AI assistants.
• Open to Work pages: If you publish an Open to Work page, the information you choose to include (industry focus, role goals, references, video intro) is public and indexable.
• Structured data: We publish structured metadata (JSON-LD) on public profile pages so search engines and AI assistants can describe scouts and candidates accurately. It contains only what is already visible on the page itself.

You can take any public surface private (or remove it entirely) from your dashboard settings at any time.

Information others provide about you

Two flows involve a third party providing personal information about you:

• References: Past employers or colleagues can submit references about a candidate using a reference link the candidate shares with them. The candidate reviews each reference before it appears publicly and can redact or remove any reference at any time.
• Scout referrals: When a scout refers you, that scout sees they referred you and may be paid commission on related platform revenue events. Scouts do not see your private profile, resume content, or contact information unless you choose to share it directly with them.

Your rights under PIPEDA

You have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Request deletion of your account and associated data
• Withdraw consent to data collection (which means closing your account)
• File a complaint with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, email support@whodoounode.com. We respond within 30 days.

Data retention

• Resume files: Deleted within 24 hours of upload
• Account data: Retained while your account is active, deleted within 30 days of account closure
• Payment records: Retained for 7 years (Canadian tax law requirement)
• Commission records: Retained for 7 years (T4A reporting requirement)

Security and breach notification

We use encryption in transit (HTTPS), encrypted storage for sensitive fields, and access controls to protect your data. No system is 100% secure — if you believe your account has been compromised, contact us immediately.

We comply with PIPEDA's mandatory breach reporting rule. If a security incident creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada without unreasonable delay, and keep an internal record of the incident as required by law.

Changes to this policy

We may update this policy as the platform evolves. We will notify you by email of any material changes. Continued use of the platform after changes means you accept the updated policy.