Privacy Policy

This policy explains how Catalyst Engine (“we”, “us”) handles personal information across the Catalyst Engine platform, our marketing site, and the free HR audit. It is written to meet the requirements of Canada’s PIPEDA and Quebec’s Act respecting the protection of personal information in the private sector (Law 25).

For account holders, marketing contacts, and HR-audit submissions, we decide how information is used — we act as the controller.

For candidate and employee information managed inside a customer’s workspace, the customer organization decides how it is used — we process it only on that organization’s behalf. If you applied to a job or were onboarded through Catalyst Engine, the hiring organization is responsible for your information; contact them first, and we will support their response.

Account data: name, email, role, organization details. Workspace data (on behalf of customers): candidate and employee records — applications, resumes, references, certifications, documents, interview notes. HR-audit submissions: answers and work email. Email engagement: we record when service emails are delivered, opened, or clicked, to power reminder and engagement features. Diagnostics: error reports (which may include IP addresses) and cookieless, aggregated usage analytics.

To operate and secure the platform, deliver transactional email, respond to HR-audit requests, provide support, and debug problems. We do not sell personal information and we do not use it for third-party advertising.

We use a small set of service providers to run the platform:

Personal information handled by these providers is stored and processed outside of Quebec and Canada, primarily in the United States. We assess our providers’ safeguards before using them, as required by Law 25.

We use only essential cookies: session cookies that keep you signed in. We do not use advertising or cross-site tracking cookies, and our usage analytics are cookieless. Because no non-essential cookies are set, we do not show a cookie consent banner.

Account data is kept for the life of the account. Workspace data is controlled by the customer organization, which can edit or delete it at any time; we delete it after account termination as described in our Terms. HR-audit submissions and email engagement events are kept only as long as needed for the purposes above, and deleted on verified request.

Data is encrypted in transit, integration credentials are stored encrypted, and access is restricted by role-based permissions. No system is perfectly secure; we commit to the incident process in section 10.

Subject to applicable law, you can ask to access, correct, or delete your personal information, withdraw consent, and (under Law 25) receive computerized personal information you provided in a structured, commonly used format. Where we act on behalf of a customer organization, we will route your request to them.

Our designated privacy officer (person in charge of the protection of personal information) can be reached at support@catalyst-engine.com. You may also complain to the Commission d’accès à l’information du Québec or the Office of the Privacy Commissioner of Canada.

If a confidentiality incident presents a risk of serious injury, we will notify the Commission d’accès à l’information and the affected persons, and record the incident in our incident register, as Law 25 requires.

Candidates in a customer’s workspace may be under 18. That information is processed on behalf of the hiring organization, which is responsible for any parental or guardian consent its jurisdiction requires.

We will update this policy as our practices change and revise the date at the top. Questions: support@catalyst-engine.com.

This document was prepared for review by legal counsel prior to launch.