Privacy Policy

This Privacy Policy explains how InPlaay Inc. (“InPlaay”, “we”, “us”) collects, uses, shares and protects personal information when you use the InPlaay website, apps and the InPlaay Chrome extension (together, the “Services”). It applies to everyone whose information we handle: candidates who use InPlaay, recruiters and employers who use InPlaay, hiring managers who open a link someone shares with them, and professionals who appear in recruiters’ search results without having signed up.

1. Information we collect

Everyone with an account

• Account details: name, email address, sign-in details, and for recruiters the workspace (company) you belong to.
• Payments: your plan and payment history. Card details are handled by our payment processor; we don’t store card numbers.
• Usage and device information: pages and features used, sign-in times, IP address, browser and device type, kept in server logs for security and to fix problems. We use only essential cookies (to keep you signed in and secure). We don’t use advertising or third-party tracking cookies.

Candidates

• Resumes you upload (including versions you upload for a specific job), and what we read from them: work history, titles, skills, education, location.
• Job preferences: roles, industries, locations, distance, company size.
• Jobs we find for you or you add (by link, pasted text or file), and the fit assessments we write for them.
• Interviews you add, your private interview notes, and interview requests sent to you.
• Calendar information, if you connect a calendar (see section 4).
• Outreach: the hiring contacts we find for you, what you tell us about who you met or would report to, and the messages you send through the Chrome extension, and your LinkedIn account type (free or Premium) so messages fit LinkedIn’s limits.

Recruiters and employers

• Jobs and searches: job titles, employers, locations, job descriptions, interview steps and search settings.
• Your work on candidates: notes, feedback, priorities, which candidates you contacted, invited or interviewed, and their stage in each job.
• Calendar information, if you connect a calendar (see section 4), and your interview settings.

Professionals in search results who haven’t signed up

To help recruiters find people for jobs, we process professional information about people who may not use InPlaay: name, current and past job titles and employers, location, skills, education and public professional profile links. It comes from publicly available sources and licensed professional data providers. So that a recruiter can reach someone about a specific job, we may also obtain a work or personal email address for that person from a licensed data provider, when the recruiter asks for it. An email address obtained this way is shown only to the recruiter’s workspace that asked for it, is used only to contact the person about jobs, and is never shown to other employers. We don’t buy phone numbers, and we don’t collect sensitive information such as health, religion or ethnicity. If you are one of these people, you can ask us to stop any contact and delete your email address at any time, and you have the rights in section 13, including the right to object and to have your information removed.

Hiring contacts. To help candidates reach the right person about a job, we identify the hiring manager and HR contact at the employer. We use the job posting, publicly available sources, licensed professional data providers, what the employer tells us on a candidate’s page (for example, by booking an interview or naming the right person), what candidates tell us, and, where a candidate has connected a calendar, the people on their interview invitations. We keep the person’s name, job title, employer and public professional profile link, and use them only so candidates can contact them about that job. If you are one of these people, you can ask us to correct or remove your details at any time.

People who book an interview or open a shared link

• Interview booking: the name, email and phone number you enter, and the time you choose. This links your booking to the invitation you received.
• Shared links: when someone opens a candidate brief or shared candidate profile, we record that it was opened and when (so the sender can see it was viewed), with standard log information. A candidate brief can offer a “Book an interview” button: it shows only the candidate’s free times (never what is in their calendar), and if you request a time we keep the name, email address and time you enter and share them with that candidate, and email you both a confirmation of the request.

2. How we use it

• To provide the Services: find jobs and candidates, write fit assessments, show shortlists, schedule and track interviews, send booking confirmations, run searches you ask for (including weekly searches for candidates who subscribe to them), and keep records such as stages and interview steps.
• To connect candidates and employers when one of them chooses to (for example, a candidate sending a job brief, or a recruiter inviting a candidate to interview).
• To show competitive insights and send interview alerts, as described in section 5.
• To bill you and manage subscriptions.
• To keep InPlaay safe: prevent fraud and abuse, enforce usage limits, and secure accounts.
• To improve InPlaay: fix problems and make our matching and assessments better. Where we use information to improve our own models, we use it in de-identified or aggregated form wherever we can.
• To communicate with you: service messages about your account, bookings and alerts you’ve asked for, and — only with your consent — news about jobs and features.
• To meet legal obligations and protect our rights.

De-identified and aggregated information. We may create information that no longer identifies anyone (for example, the number of candidates interviewing for a type of role in a region) and use it for any lawful purpose, including market insights. We won’t try to re-identify people from it.

3. Who sees it

Information	Who can see it
A candidate’s resume, preferences, fit assessments, gaps, tips and private notes	Only that candidate. Fit ratings, scores, gaps and private notes are never shown to employers.
A candidate’s job brief (their summary for one job and the resume they chose for it)	Anyone the candidate gives the private link to (for example, a hiring manager). The candidate can turn the link off at any time.
Candidates in a recruiter’s searches, with the recruiter’s notes and stages	Users in that recruiter’s workspace.
A candidate profile a recruiter shares by link	Anyone the recruiter gives the private link to, showing only the sections the recruiter chose. The recruiter can turn the link off.
Competitive insights	Candidates interviewing for the same job see counts, stages and how their experience compares — never who the other candidates are (section 5).
Interview bookings	The candidate and the recruiter or employer who invited them.
Hiring contacts at an employer (the name and job title of a hiring manager or HR contact for a job)	Candidates contacting that employer about that job. Never which candidate the information came from.

Service providers. We use trusted providers to run InPlaay on our behalf: cloud hosting and databases, AI model providers (to read resumes and job postings and write assessments), professional data providers, a payment processor, and email delivery. They may use your information only to provide their service to us, under contracts that require them to protect it. Our AI providers process it under business terms that don’t allow them to train their own models on it.

Other disclosures. We may disclose information if the law requires it, to protect the rights, safety or property of InPlaay or others, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to it.

We don’t sell personal information or share it for cross-context behavioural advertising.

4. Calendar connections (Google and Microsoft)

You can connect a Google or Microsoft calendar. It’s your choice, and you can disconnect at any time from InPlaay or from your Google or Microsoft account settings. When you connect, we receive your calendar’s email address and read-only access to your calendar. We never create, change or delete events in your calendar; interview bookings reach you as calendar invitations by email. You can also connect another calendar (such as iCloud, Yahoo, Fastmail or Zoho) with an app-specific password you create for InPlaay; we store it encrypted, use it only to read your calendar in the same ways, and delete it when you disconnect.

• Recruiters: we read when you’re busy to offer candidates open interview times, check for double bookings, and recognize interviews with candidates in your jobs (including later rounds you’re invited to) so their stage stays current. To recognize them we check each event’s attendees, title and a short part of its description, and meetings with people from outside your team may be assessed by an AI service we use to tell interviews from other meetings (it processes them only to give us its answer, under terms that don’t let it use them to train its models). When your team confirms or ignores a meeting, we keep its title with people’s names and email addresses removed, so InPlaay learns what your interviews look like. For a job you work on with a hiring team, the team sees the interviews found (the time, which interview step it was and who attended — never the event’s title or description). Meetings that look like interviews but don’t match one of your jobs are listed in your InPlaay workspace, with their title and attendees, until you add them to a job or ignore them. People found this way stay within your workspace and the job’s hiring team: they are never shown to other employers or counted in other candidates’ insights unless they register with InPlaay themselves.
• Candidates: we look at events that look like interviews to add them to your interview list and track your progress: meetings with a guest from a company, and meetings you entered yourself whose title says it is an interview or is about a job, role or position, or names an employer or job you follow or a job title you are looking for. Only those events (their title, description and attendees) may be assessed by an AI service we use to tell interviews from other meetings; it processes them only to give us its answer, under terms that don’t let it use them to train its models. Your other calendar entries are not sent to it. Low-confidence matches, and every meeting you entered yourself, are shown to you to confirm or decline. Who you interview with. When an interview is found, we note the people from the employer who are on the invitation and may look up their job titles from public sources. We use this to work out who the hiring manager and HR contact are for that job, so that you, and other candidates applying to the same employer, are pointed to the right person. What other candidates see is the employer’s contact only, such as their name and job title. We never show another candidate your name or anything else from your calendar. If you don’t want your interviews used this way, you can disconnect your calendar or email us.
• When we check: when you open the pages that use your calendar or press Sync, and automatically in the background once a day while your calendar stays connected, so new interviews are picked up without you asking. Anything we find waits for you to confirm; we never add or change anything in your calendar. Disconnecting stops the checks.
• We don’t read your email, and we don’t keep anything from calendar events that aren’t interviews beyond the time they’re busy.
• Calendar access tokens are stored in our secure database, not on our web servers, and deleted when you disconnect.

Google API Services. InPlaay’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to provide and improve the calendar features described here, we don’t sell it or use it for advertising, we don’t use it to train general-purpose AI models, and people at InPlaay don’t read it except with your permission, for security, or where the law requires.

Microsoft (Outlook and Microsoft 365). The same commitments apply to calendar data we receive through Microsoft Graph: read-only access to your calendar, no access to your email, used only to provide and improve the calendar features described here, never sold or used for advertising, never used to train general-purpose AI models, and not read by people at InPlaay except with your permission, for security, or where the law requires. You can remove InPlaay’s access at any time from InPlaay or from your Microsoft account’s “Apps and services” settings.

5. Competitive insights and interview alerts

For some jobs, InPlaay shows a candidate how many other candidates are in the running — for example, “2 others are interviewing and 1 is at the final stage” — and candidates who subscribe to competitive insights can get an email and in-app alert when another candidate’s interview is scheduled or someone reaches the final stage.

• These insights come from recruiters’ records of their jobs (who they contacted, invited and interviewed), from interviews booked through InPlaay, from interviews found in connected calendars, and from candidates’ messages to the people hiring sent through InPlaay.
• Candidates see counts and stages, without names.
• Profile comparisons. When you and another candidate are interviewing for the same job, each of you may see how your experience and fit compare with the other’s. The comparison is drawn from resumes and fit assessments. It never includes a name, contact details or where the person has worked, and we never show another candidate’s resume itself. By using InPlaay you agree to your profile being included, without your name, in comparisons for jobs you interview for. If you don’t want that, you can disconnect your calendar or delete your account.
• Insights are shown only once another candidate is actually interviewing for the same job.
• Personal events in a connected calendar are never shown to anyone.
• If you don’t want interviews from your connected calendar counted, you can disconnect your calendar or email us, and you can turn off alerts at any time.

6. AI-generated assessments

InPlaay uses AI to read resumes and job postings and to write fit assessments, summaries and outreach drafts. These are tools to help people decide — InPlaay does not make hiring decisions, and an employer’s decisions remain the employer’s. Assessments can be wrong or incomplete, especially when a resume leaves out experience someone has. You can ask us to correct information about you, and you can ask for a person to review an assessment about you.

7. The InPlaay Chrome extension

The extension has one purpose: to send outreach messages on LinkedIn that you prepared in InPlaay, from your own LinkedIn account, when you ask it to — recruiters messaging candidates, and candidates messaging hiring managers.

• What it uses: the page of the LinkedIn profile you’re sending to, and the message text from InPlaay. It uses storage to hold the message while LinkedIn pages load, tabs to open the right profile and return to InPlaay, clipboard so you can paste a message yourself, and cookies to confirm you’re signed in to InPlaay.
• It doesn’t collect your browsing history, read your LinkedIn messages, or scrape LinkedIn profiles. Messages are sent from your account, so LinkedIn’s own terms apply to them.
• We don’t sell or transfer extension data to third parties, use it for advertising or credit decisions, or use it for anything unrelated to its purpose.

8. Emails and messages (including CASL)

• Service messages (booking confirmations, sign-in codes, receipts, alerts you turned on) are sent as part of the Services.
• Marketing messages (for example, “other jobs you’re a fit for”) are sent only with your consent, such as ticking a box when you book an interview or signing up, in line with Canada’s Anti-Spam Legislation (CASL), the US CAN-SPAM Act and European rules. Every marketing email identifies InPlaay and has a working unsubscribe link, and we honour unsubscribes within 10 business days.
• Messages recruiters and candidates send (for example, LinkedIn messages through the extension, or emails a recruiter sends with an InPlaay booking link) are sent by that person, who is responsible for them and for having the right to send them.

9. Legal bases (EU and UK)

Where the GDPR or UK GDPR applies, we rely on: contract (to provide the Services you signed up for); legitimate interests (to help recruiters find professionals for jobs, show anonymous competitive insights, keep InPlaay secure and improve it — balanced against your rights, which you can exercise by objecting); consent (calendar connections, marketing, and anything else we ask your permission for — you can withdraw it any time); and legal obligation. If you’re a professional in search results and object, we will stop processing your information unless we have compelling grounds that override your rights.

10. How long we keep it

• Account information is kept while your account is open. When you delete your account, we delete or de-identify it within 30 days, except what we must keep by law.
• Candidate information in a recruiter’s workspace is kept while the workspace uses it, and deleted when the recruiter deletes it or on a valid request from the candidate.
• Calendar tokens are deleted when you disconnect.
• Payment and tax records are kept for as long as tax law requires (generally up to 7 years).
• Server logs are kept for up to 12 months. Backups are overwritten on their normal cycle.

11. Security

We protect information with encryption in transit (TLS), encryption at rest, access controls that keep each workspace’s data separate, restricted staff access, and monitoring. No system is perfectly secure; if a breach affects your information in a way that creates a real risk of significant harm, we’ll notify you and the authorities as the law requires.

12. Where it’s stored

InPlaay is based in Canada. Our service providers store and process information in Canada, the United States and other countries where they operate, which may have different privacy laws. When we transfer personal information out of the European Economic Area, the UK or Switzerland, we use recognized safeguards such as the European Commission’s Standard Contractual Clauses. Information held in another country may be accessible to that country’s authorities under its laws.

13. Your rights and choices

Depending on where you live (for example under Canada’s PIPEDA, Quebec’s Law 25, the GDPR, the UK GDPR, or US state laws such as California’s), you can ask us to:

• see the personal information we hold about you and get a copy (including in a portable format);
• correct it;
• delete it, or de-index it from searches;
• object to or restrict how we use it, including profiling for recruitment;
• withdraw consent (for example, disconnect a calendar or unsubscribe);
• ask for a person to review an automated assessment about you.

Write to support@inplaay.com from the email address we have for you, or tell us which profile is yours. We may need to confirm your identity. We’ll respond within 30 days (or the time your local law sets), free of charge, and we won’t treat you differently for using your rights. You may also complain to your privacy regulator, such as the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, or your EU or UK data protection authority.

Privacy officer. The person responsible for personal information at InPlaay can be reached at support@inplaay.com.

14. Additional notice for US residents

In the last 12 months we collected these categories of personal information: identifiers (name, email, phone); professional and employment information; education information; inferences (fit assessments); internet activity (usage logs); approximate location (city and region); and, if you connect it, calendar information. We collect it from you, from recruiters and employers, from publicly available sources and licensed professional data providers, and from connected calendars, for the purposes in section 2. We disclose it to service providers for business purposes. We don’t sell personal information or share it for cross-context behavioural advertising, and we don’t knowingly sell or share information of anyone under 16. We don’t use sensitive personal information to infer characteristics about you. California residents can exercise the rights in section 13 and may use an authorized agent.

15. Children

InPlaay is for people aged 16 and older who are looking for work or hiring. We don’t knowingly collect information from children under 16; if we learn we have, we’ll delete it.

16. Changes and contact

We’ll post any changes here and update the date at the top. If a change is significant, we’ll tell you by email or in the app before it takes effect, and ask for your consent where the law requires.

Questions or requests: support@inplaay.com. InPlaay Inc., Ontario, Canada.