HyreMynd AI Inc.

1. Introduction, scope, and roles

This Privacy Policy (the "Policy") explains how HyreMynd AI Inc. ("HyreMynd", "we", "us", or "our"), an Ontario corporation, collects, uses, discloses, retains, and protects personal information. It covers the HyreMynd platform, the Workplace Fit Assessment, the candidate and team portals, the HyreMynd browser extension, our websites, and related services (together, the "Platform").

This Policy applies to individuals in Canada and the United States whose personal information we process: candidates invited to complete an Assessment, employees and managers of Employer clients who complete an Assessment for internal team purposes, authorized users within Employer client organizations, prospective clients, and website visitors. This Policy is incorporated by reference into the HyreMynd Master Service Agreement, the Candidate Terms of Use, and the Internal Team Terms of Use.

1.1 The Workplace Fit Assessment

The "Workplace Fit Assessment" (the "Assessment") is HyreMynd's proprietary structured assessment. It measures how well an individual aligns with a role, with a manager's way of working, and with a team. A proprietary artificial intelligence model assists in scoring responses. The model reports separate fit signals rather than a single composite score, and its output is a conservative summary designed for review by a human decision maker. The model supports decisions. It does not make them, and it is not permitted to be the sole or final basis for any employment decision. All employment decisions are made by the Employer client through its own people.

1.2 Our role

Where HyreMynd processes personal information at the direction of an Employer client, HyreMynd is a service provider, processor, or contracted third party, as those roles are defined under applicable law. In that capacity, the Employer client is responsible for its own legal obligations to the individuals it invites, including candidate notices, consents, bias audit procurement and publication, job posting disclosures, alternative selection procedures, and accommodation decisions, as set out in Section 3.4. HyreMynd acts as an independent business only for the limited purposes of its own described in this Policy.

2. Applicable law

2.1 Canada

HyreMynd designs its practices to comply, where applicable, with the Personal Information Protection and Electronic Documents Act (PIPEDA), the Consumer Privacy Protection Act under Bill C-27 once in force, the Quebec Act respecting the protection of personal information in the private sector as amended by Law 25, the Personal Information Protection Act (Alberta), the Personal Information Protection Act (British Columbia), section 8.4 of the Ontario Employment Standards Act, 2000, which requires employers to disclose artificial intelligence use in publicly advertised job postings effective January 1, 2026, and the French language requirements of the Charter of the French Language as they apply to communications with Quebec residents.

2.2 United States

For U.S. residents, HyreMynd designs its practices to comply, where applicable, with section 5 of the Federal Trade Commission Act, Title VII of the Civil Rights Act as applied by the Equal Employment Opportunity Commission to automated hiring tools, the California Consumer Privacy Act as amended by the California Privacy Rights Act, including its regulations on automated decision-making technology and risk assessments, the Illinois Biometric Information Privacy Act, the Illinois Human Rights Act as amended effective January 1, 2026, New York City Local Law 144 governing automated employment decision tools, the Colorado Privacy Act and Colorado artificial intelligence legislation as in force, the Connecticut Data Privacy Act and the Connecticut Artificial Intelligence Responsibility and Transparency Act as its provisions phase in, the Texas Data Privacy and Security Act and the Texas Responsible Artificial Intelligence Governance Act, the Virginia Consumer Data Protection Act, and the comprehensive consumer privacy statutes of other U.S. states as enacted.

2.3 Classification of Assessment data

Assessment responses and derived fit scores may qualify as sensitive personal information or profiling data in certain U.S. states. HyreMynd applies the safeguards required for sensitive personal information to all Assessment data, and has obtained or will obtain written confirmation from qualified U.S. counsel on classification before processing the personal information of residents of any applicable state.

3. Personal information we collect

3.1 Information you provide

We collect your name, email address, account credentials, and your Assessment responses.

3.2 Information the Platform generates

The Platform generates derived Assessment data: fit scores across HyreMynd's separate scoring signals, response timing, and session integrity data. Derived data is personal information and this Policy treats it as such.

3.3 Information collected through the HyreMynd browser extension

Authorized users at an Employer client may use the HyreMynd browser extension to collect publicly available professional profile information about a candidate, including from professional networking sites, to open or inform a hiring engagement. The Employer client initiates and directs this collection. Before the Assessment begins, HyreMynd delivers a disclosure notice to the candidate in the onboarding flow. The notice identifies what was collected, from where, for what purposes, and the candidate's rights, including withdrawal. It is designed to satisfy the knowledge and consent requirements of PIPEDA Principle 3, the Law 25 disclosure requirement for technology that collects personal information without the knowledge of the person concerned, and applicable U.S. state disclosure obligations.

3.4 Allocation of employment law compliance

As between HyreMynd and the Employer client, and as reflected in the Master Service Agreement, the Employer client alone is responsible for: candidate and employee notices required of employers or employment agencies, including advance notice and publication duties for automated employment decision tools under New York City Local Law 144 and similar laws; disclosure of artificial intelligence use in job postings, including under section 8.4 of the Ontario Employment Standards Act; procuring any independent bias audit required of a deployer and publishing its summary; any adverse impact analysis expected under Title VII as applied by the EEOC; any legally required alternative selection procedure; any consent required of an employer; making and documenting employment decisions through human decision makers; and reasonable accommodations under applicable human rights and disability law. HyreMynd provides Employer clients with documentation and reasonable cooperation in support of these obligations. Assisting compliance is not a substitute for the Employer client's own audits and counsel.

3.5 Information collected automatically

We automatically collect device and usage information: IP address, browser type, operating system, pages viewed, session duration, and log data. We use cookies and similar technologies for authentication, security, and Platform functionality.

4. Why we collect and use personal information

We use personal information to deliver the Assessment and provide fit scores and related decision support to the Employer client, to give each individual portal access to their own scores, to run and secure the Platform, to verify Assessment integrity and protect the validity of results, to communicate about the engagement and support matters, to meet legal and contractual obligations, and to improve the Platform using anonymized data as described below.

4.1 De-identified and anonymized data

HyreMynd may create de-identified, anonymized, and aggregated data from personal information and may use it for any lawful business purpose, including model validation, calibration, benchmarking, research, and product improvement. We keep this data in a form that cannot reasonably identify anyone, we commit publicly not to attempt re-identification except to test whether our de-identification works, and we require the same commitment from recipients, consistent with U.S. state law and Canadian anonymization standards. Once anonymized under applicable law, this data is no longer personal information. We do not use identifiable Assessment data for model training.

5. AI processing and decision support

A proprietary artificial intelligence model assists in scoring Assessment responses. Its output is decision support only. The output reports separate fit signals for the role, the manager's work style, and the team, rather than one opaque composite score, and it presents a conservative summary written for a human reviewer. The Employer client makes every employment decision, and HyreMynd contractually requires Employer clients to keep documented human review over any decision informed by Assessment output.

Where Law 25 applies, individuals are told when a decision rests exclusively on automated processing, can learn the personal information and principal factors behind the decision, and can submit observations to someone at the Employer client positioned to review it. On request, the principal factors behind a result can be explained in plain language, in English or in French for Quebec residents. Where U.S. state law applies, individuals receive pre-use notice of automated decision-making technology and may exercise applicable opt-out or appeal rights through the Employer client as deployer, or through HyreMynd where a statute makes HyreMynd the responsible party.

6. Disclosure of personal information

We disclose personal information only in these situations: to Employer clients on the Platform, as decision support delivered into their workflow when they consider a candidate for a role — including when a candidate's prior self-serve Working Style completion is reused for a later engagement; to service providers working for us under written contracts with confidentiality, security, and use limits, covering cloud application hosting, database and storage infrastructure, caching infrastructure, artificial intelligence model providers accessed through an API gateway, and communications services (a current list of subprocessors is available on request); to professional advisors bound by confidentiality; to public authorities when the law, a court order, or legal process requires it, in which case we disclose only what is legally required; and in a merger, acquisition, financing, or asset sale, with confidentiality protections and this Policy continuing to apply.

6.1 No sale or sharing

HyreMynd does not sell personal information and does not share it for cross-context behavioral advertising, as the CCPA and similar state laws define those terms, and has not done so in the preceding twelve months.

6.2 Not a consumer reporting agency

HyreMynd is not a consumer reporting agency and Assessment output is not a consumer report under the U.S. Fair Credit Reporting Act. Employer clients are contractually prohibited from using Assessment output as a consumer report.

7. Where your information is processed

The Platform is hosted on infrastructure located in the United States. Personal information of Canadian residents is therefore transferred to, stored in, and processed in the United States, where it is subject to U.S. law and lawful access by U.S. authorities.

For communications of personal information outside Quebec, HyreMynd conducts the assessment Law 25 requires to confirm the information will receive adequate protection, and puts contractual safeguards in place with each receiving party. Employer clients carry their own cross-border duties to the individuals they invite, including any privacy impact assessment required under section 17 of the Quebec Act before personal information leaves Quebec, and transparency under PIPEDA about U.S. processing. HyreMynd supports those duties with clear subprocessor and transfer documentation. HyreMynd does not claim Canadian data residency.

8. Retention

We keep personal information only as long as the purposes in this Policy and our legal and contractual obligations require. After that, we destroy it securely or anonymize it under applicable law, including the destruction and anonymization requirements of Law 25.

Assessment data: 24 months after the engagement completes or terminates, unless a longer period is required by law or by the Employer's documented instructions under the DPA.

Portal accounts: Retained while the account is active and as long as necessary to fulfil the stated purposes; no fixed post-termination deletion date; deletion on request within 30 days, subject to legal obligations.

Anonymized data: Kept without time limit once anonymization is complete under applicable law.

Audit and security logs: 12 months.

9. Your rights

Subject to applicable law and identity verification, you may exercise these rights by contacting the Privacy Officer in Section 13:

• Access and knowledge. Confirm whether we process personal information about you and receive access to it, including categories collected, sources, purposes, and categories of recipients.
• Correction. Correct inaccurate or incomplete personal information.
• Deletion. Request deletion, subject to statutory exceptions and Section 9.1.
• Withdrawal of consent. Withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice. Withdrawing during an active Assessment ends your participation in that engagement.
• Portability. Where the law provides, receive computerized personal information you gave us in a structured, commonly used format.
• Automated decision rights. The rights in Section 5, including observations and, where applicable, opt-out or appeal rights for automated decision-making technology.
• U.S. state rights. Know, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, and appeal a refusal, as the privacy statute of your state provides.
• Non-discrimination. We will not treat you differently for exercising your rights.

9.1 Requests about delivered results

Where a request concerns Assessment output already delivered into an Employer client's workflow, our service provider role may require us to direct the request to that Employer client, or coordinate with it, because the Employer client is the business or controller responsible for that data. Deletion by HyreMynd does not recall output already delivered.

9.2 Timelines and appeals

We respond within the timelines applicable law requires, generally 30 days, with extensions where permitted. If we refuse a request, we tell you why and, where the law gives you an appeal right, how to appeal. You may also contact the Office of the Privacy Commissioner of Canada, the Commission d'acces a l'information du Quebec, your provincial commissioner, your state Attorney General, or the California Privacy Protection Agency.

10. Security

HyreMynd maintains administrative, technical, and physical safeguards that match the sensitivity of the information it holds: encryption in transit and at rest, role-based access controls, multi-factor authentication for administrative access, least-privilege access, audit logging, segregation of production data, and vendor security review. No system is perfectly secure, and HyreMynd does not promise absolute security. HyreMynd maintains a documented incident response plan and a confidentiality incident register. Where a confidentiality incident presents a risk of serious injury, we notify the Commission d'acces a l'information and the affected individuals. Where the real risk of significant harm threshold under PIPEDA is met, we notify the Office of the Privacy Commissioner of Canada. We also provide the breach notifications U.S. state law requires.

11. Consent

We collect, use, and disclose personal information with knowledge and consent, except where the law permits or requires otherwise. Consent is collected during onboarding, before the Assessment begins, through clear and plainly worded statements, one for each purpose, including the anonymized data purpose in Section 4.1. This follows the Law 25 requirement that consent be requested for each purpose in clear and simple language.

12. Children

The Platform is built for professional workplace use and is not directed to minors. We do not knowingly collect personal information from anyone under the age of majority in their jurisdiction, and we delete any such information when we become aware of it.

13. Privacy Officer and contact

HyreMynd has designated a Privacy Officer, who is also the person in charge of the protection of personal information under Law 25.

14. Changes to this Policy

We may amend this Policy at our discretion. We will communicate material changes through the Platform or by email before they take effect and update the Effective Date. Continued use after the effective date is acceptance, except where the law requires fresh consent.

15. Governing law

This Policy is governed by the laws of Ontario and the federal laws of Canada that apply there. This does not limit mandatory rights you hold under the privacy laws of where you live, including Law 25 for Quebec residents and state law for U.S. residents.