Privacy Policy

Beyz Inc. ("Bluelet", "we", "our" or "us") is an Ontario‑incorporated company that operates an AI‑powered talent‑discovery platform available at https://bluelet.ai (the "Site") and through related web‑based services, plug‑ins and application‑programming interfaces (together, the "Services").

Bluelet is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Ontario private‑sector privacy requirements. We follow the ten fair‑information‑practice principles set out in PIPEDA: accountability, identifying purposes, consent, limitation of collection, limitation of use/disclosure/retention, accuracy, safeguards, openness, individual access and compliance.

We collect personal information in the following categories:

• Publicly‑available candidate data – names, titles, education, skills and contact details from public websites.
• Customer Workspace Data – search keywords, job‑description drafts, outreach templates, candidate notes and analytics created in your workspace.
• Account & billing data – name, business email, company, passwords, subscription tier, payment method.
• Communications & marketing preferences – support tickets, chat transcripts, survey responses, newsletter opt‑in status.
• Device & usage data – IP address, browser type, device identifiers, pages visited, log‑in timestamps.
• Social‑media interactions – public profile information and engagement metrics when you interact with Bluelet pages on LinkedIn, X (Twitter) or similar platforms.

We do not intentionally collect sensitive information such as health data, union membership or political opinions.

Purposes and PIPEDA bases:

• Deliver & administer the Services (contractual necessity; implied consent).
• Improve & secure our platform (legitimate business interests).
• Market our products (express or implied consent under CASL).
• Comply with law & enforce rights (legal obligation; legitimate interests).

We share personal information only with:

• Your organisation's Bluelet users – Customer Workspace Data is visible only within your workspace.
• Bluelet customers – publicly‑available candidate data returned in search results; never Customer Workspace Data.
• Service providers – hosting, payment processing, support, analytics, email delivery, security.
• External AI/LLM vendors – under strict contractual controls.
• Professional advisers – legal counsel, auditors, insurers (as needed).
• Authorities & courts – where required to comply with law or protect rights.
• Successor entities – in connection with a merger or asset sale (subject to this Policy).

Bluelet is headquartered in Ontario, Canada, but many cloud providers operate in the United States or other jurisdictions. Personal information stored or processed outside Canada may be subject to foreign laws. We apply contractual and technical measures (encryption, role‑based access, sub‑processor DPAs) to protect it regardless of location.

We keep personal information only as long as necessary to fulfil the purposes described here, to meet legal and accounting obligations, or until you withdraw consent. Afterwards it is securely deleted or irreversibly de‑identified.

We employ administrative, technical and physical safeguards—TLS encryption, tenant isolation, role‑based access controls, SOC‑2‑aligned policies and penetration testing—to protect personal information against loss, theft or unauthorised access.

Under PIPEDA you may:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Withdraw consent to non‑essential uses.
• Challenge our compliance by contacting our Privacy Officer.
• Complain to the Office of the Privacy Commissioner of Canada or the Information and Privacy Commissioner of Ontario if unresolved.

To exercise any right, email contact@bluelet.ai. We may request proof of identity.

We use cookies, pixels, and local-storage objects to remember preferences, analyze traffic, and serve ads. You can manage your cookie preferences at any time through your browser settings or the cookie-preferences link in our Site footer. We provide an option to refuse all non-essential cookies with a single click. Third-party services (such as analytics and advertising partners) may collect device, usage, and engagement data via cookies or similar technologies; these partners process data according to their own privacy policies.

We may update this Policy to reflect legal or operational changes. Material updates will be announced by email or banner notice and the "Last updated" date will change. Continuing to use the Services after the update means you accept the revised Policy.

The Services are intended for business users and not directed to children under 16. We do not knowingly collect personal information from minors. If we become aware that a child under 16 has provided personal information, we will promptly delete that information and take steps to prevent further collection.

We retain personal information only as long as necessary to fulfill the purposes described here, to meet legal and accounting obligations, or until you withdraw consent. Account and billing data are retained for the duration of your account plus seven years for legal compliance; logs and analytics data are retained for up to two years; backup data is deleted or irreversibly de-identified within 90 days of account closure. Upon expiry of the retention period, data is securely deleted or anonymized. You may request deletion of your personal information at any time, and we will comply unless legal obligations require otherwise.

In addition to rights under PIPEDA, you may have the right to data portability, to request erasure ("right to be forgotten"), and to object to or restrict processing. We respond to privacy requests within 30 days. If your request is denied, we will provide the reason and information on how to appeal or file a complaint with the relevant authority.

We maintain administrative, technical, and physical safeguards—TLS encryption, tenant isolation, role-based access controls, SOC-2-aligned policies, and penetration testing—to protect personal information against loss, theft, or unauthorized access. If a data breach occurs that may affect your information, we will notify you and relevant regulatory authorities as required by law, providing details of the breach, what data was involved, and guidance on protective steps you can take.