Privacy Policy

Introduction

JobCannon LTD (company number 15090881), registered at 18 Fir Tree Road, Banstead, Surrey, SM7 1NG ("we", "us", "our") operates the jobcannon.io website. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services.

Information We Collect

We collect information that you provide directly to us:

• Name and email address when you create an account
• Payment information processed securely through Stripe (we do not store card details)
• Assessment and test results
• Course progress and completion data
• Communications you send to us

We automatically collect (only with your consent):

• Browser type, IP address, and device information
• Pages visited and time spent on our platform
• Cookies and similar tracking technologies
• Behavioral signals during assessments: per-question response times, tab/window focus changes, mouse movement idle periods, paste events, and navigation through questions. Used for response-quality analysis (integrity flags shown to recruiters in B2B settings) and product improvement (drop-off and friction detection). Never used to identify you outside the test session.
• Interaction data across the site: where you click, how far you scroll, and cursor movement, stored against an anonymous id. Used only to find broken or confusing parts of the interface. We never record what you type — the contents of form fields are not read.

How We Use Your Information

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send you technical notices, updates, and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze trends, usage, and activities (with your consent)
• Personalize and improve your experience

Information Sharing

We do not sell your personal information. We share your information with the following third-party service providers:

• Stripe (stripe.com), payment processing. Stripe processes your payment data under their own privacy policy.
• Supabase (supabase.com), database and authentication hosting, located in the EU.
• Google Analytics 4 (analytics.google.com), website usage analytics. Only activated with your cookie consent.
• Microsoft Clarity (clarity.microsoft.com), heatmaps and session replay, used to find broken and confusing UI. Only activated with your cookie consent.
• Vercel (vercel.com), website hosting.
• Resend (resend.com), transactional email delivery.
• Law enforcement when required by law.

Cookies and Tracking

We use essential cookies required for authentication and site functionality. Analytics cookies (Google Analytics, Microsoft Clarity) are only loaded after you give explicit consent via our cookie banner. You can reject analytics cookies at any time.

See our Cookie Policy for full details.

Your Rights (GDPR)

If you are in the European Economic Area (EEA) or the United Kingdom, you have the following rights under GDPR/UK GDPR:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to withdraw consent for analytics cookies at any time

To exercise any of these rights, including account deletion, go to your Profile settings or contact us at support@jobcannon.io. We will respond within 14 days.

Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know what personal information we collect, use, and disclose
• Right to request deletion of your personal information
• Right to opt out of the sale or sharing of your personal information
• Right to non-discrimination for exercising your privacy rights
• Right to correct inaccurate personal information

JobCannon does not sell your personal information. We do not share personal information for cross-context behavioral advertising.

Categories of personal information we collect: identifiers (name, email), internet activity (assessment responses, browsing), professional information (career preferences), and payment data (processed by Stripe, we do not store card numbers).

To exercise your CCPA rights, contact us at support@jobcannon.io or use the account deletion feature in your Profile settings . We will respond within 45 days.

Brazil Privacy Rights (LGPD)

If you are located in Brazil, you have additional rights under the Lei Geral de Proteção de Dados (LGPD):

• Right to confirmation of the existence of processing
• Right to access your data
• Right to correction of incomplete, inaccurate, or outdated data
• Right to anonymization, blocking, or deletion of unnecessary data
• Right to data portability
• Right to deletion of personal data processed with your consent
• Right to information about third parties with whom your data is shared
• Right to revoke consent at any time

Legal basis for processing: consent (for analytics cookies and optional features) and legitimate interest (for service delivery and security).

To exercise your LGPD rights, contact our Data Protection Officer at support@jobcannon.io. You may also file a complaint with the ANPD (Autoridade Nacional de Proteção de Dados) at gov.br/anpd.

Data Retention

We retain your personal data for as long as your account is active. Specifically:

• Account data (name, email): until you delete your account
• Assessment results: until you delete your account
• Course progress: until you delete your account
• Payment records: 7 years after the transaction (legal requirement)
• Analytics data: 26 months (Google Analytics default), 12 months (Microsoft Clarity), 14 days (our own interaction data)

When you delete your account, all personal data is permanently removed from our systems within 14 days, except where retention is required by law (e.g. financial records).

Data Security

We implement industry-standard security measures including encrypted data transmission (TLS/HTTPS), hashed passwords, role-based access controls, and row-level database security policies. However, no method of transmission over the Internet is 100% secure.

Lawful Basis for Processing

Under GDPR Article 6, we process your personal data on the following bases:

• Contract: account management, service delivery, payment processing, necessary to fulfil our contract with you.
• Consent: analytics cookies, marketing emails, advertising pixels, only with your explicit opt-in. You may withdraw consent at any time.
• Legitimate interest: security monitoring, fraud prevention, service improvement, balanced against your rights.
• Legal obligation: financial records retention (7 years) as required by UK law.

International Data Transfers

Some of our service providers process data outside the UK/EEA. Where this occurs, we ensure appropriate safeguards are in place:

• Stripe (USA), certified under the EU-US Data Privacy Framework.
• Vercel (USA), Standard Contractual Clauses (SCCs) in place.
• Google Analytics (USA), operates under the EU-US Data Privacy Framework.
• Microsoft Clarity (USA), operates under the EU-US Data Privacy Framework.
• Supabase (EU), data hosted in the European Union.
• Resend (USA), Standard Contractual Clauses (SCCs) in place.

Children's Privacy

JobCannon is not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16 without parental consent, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at support@jobcannon.io.

Automated Decision-Making & Profiling

Our assessment tests analyse your responses to generate personality profiles and career recommendations. These are informational tools only and do not produce legal effects or similarly significantly affect you. You are free to disregard any results. No automated decisions are made about your access to services or pricing based on test outcomes.

Data Protection

As a small business, we are not required to appoint a Data Protection Officer. For all data protection queries, contact us at support@jobcannon.io. We will respond within 14 days.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, as required by GDPR Article 33. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, as required by GDPR Article 34.

Candidates Routed Through ATS Partners (B2B)

Some candidates reach JobCannon through their employer's Applicant Tracking System (ATS), for example Greenhouse, Ashby, Lever, or Workable, when the hiring team has selected JobCannon as their assessment provider. This section explains how we handle data in that flow.

When you take a JobCannon assessment as part of an application via an ATS partner, the hiring organisation is the data controller for that assessment. JobCannon acts as their data processor, we run the test, store the results, and return them to the ATS so the hiring team can review them. The hiring organisation's own privacy policy governs how they then use those results.

Data we receive from the ATS partner

• Your name and email address (passed to us so we can send the assessment invite)
• An application identifier so the result lands on the right candidate profile inside the ATS
• An assessment identifier indicating which test the hiring team has selected

We do not receive the ATS account credentials of any other candidate. Each request is authenticated and scoped to a single hiring organisation.

Data we return to the ATS partner

• Your test scores and standardised result envelope (the same data shown to you on your result page)
• A link back to your result page on JobCannon, which the hiring team can open to read the full report
• Status updates (sent → started → complete) so the hiring team can see whether the assessment is finished

Retention

ATS-routed candidate data (session metadata, candidate email, completion timestamps) is retained for 90 days after assessment completion, then deleted unless we are instructed otherwise by the hiring organisation under their lawful basis. Your underlying assessment_results record is governed by the standard retention rules in this policy.

Your rights

You retain the same rights described above (access, rectification, erasure, restriction, portability, objection). Because the hiring organisation is the controller for the assessment data they receive, requests relating to data they hold should be addressed to them in the first instance. We will help you identify the correct contact and will action any request that falls within our role as processor, usually deletion of the JobCannon-side session record.

If you ask us to delete your JobCannon account, the ATS-side copy of your result already shared with the hiring organisation may persist according to their retention rules; we will inform them of your deletion request and ask them to honour it.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or a prominent notice on the website at least 14 days before the changes take effect. The "Last updated" date at the top of this page indicates when the policy was last revised. We encourage you to review this policy periodically.

Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at: support@jobcannon.io

Data controller: JobCannon LTD, registered with the UK Information Commissioner's Office under reference ZC128224.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.