Privacy Policy

Applying for a job? If you applied for a role through a careers page or application form powered by Lighthouse, the company you applied to decides how your application is used. Lighthouse runs the software for them. We describe below what we collect, how our AI features work, and how you can use your privacy rights. In most cases the quickest route is to contact the employer directly, but you can always contact us too.

1. Who We Are and What This Policy Covers

Lighthouse Hiring Innovations ("Lighthouse", "we", "us" or "our") provides an AI-powered applicant tracking system (the "Service") to employers and recruiting teams ("Customers"). The Service includes hosted and embedded careers pages, application forms, job board syndication, AI resume screening and scoring, talent rediscovery, hiring automations and integrations.

This policy explains how we handle personal information about:

Candidates: people who apply for jobs through a careers page or application form powered by Lighthouse, people whose applications reach a Customer's Lighthouse account from a job board or another applicant tracking system, and people a Customer otherwise adds to the Service;
Customer users: the recruiters, hiring managers and administrators who use the Service; and
Website visitors and business contacts: people who visit lighthousehiring.ai, book a demo, or contact us.

2. Our Role: Service Provider vs. Controller

For candidate information, we act on behalf of the employer. When you apply for a job at a company that uses Lighthouse, that company is responsible for your information (it is the "controller" under the GDPR and UK GDPR, the organization "in control" of your information under Canadian privacy law, and the "business" under U.S. state privacy laws). Lighthouse is its service provider (or "processor"): we host the careers page and application form, receive and store your application, and run the screening and automation features the employer has set up, all on the employer's instructions and under our agreement with them. We do not use candidate information for our own marketing, and we do not sell it.

The employer's own privacy notice governs how it uses your application, including which roles you are considered for, how long your information is kept, and who inside the company can see it. The employer's name and contact details appear on the careers page or job posting you applied through.

For Customer users, website visitors and business contacts, Lighthouse is the controller. We decide how that information is used, as described in this policy.

3. Information We Process About Candidates

Information you provide when you apply. When you apply through a Lighthouse careers page or application form, you give us:

your name, email address, phone number and location;
your resume, cover letter and any other files you upload;
employment history, education, skills, certifications, and links you share (such as a LinkedIn profile or portfolio);
answers to the employer's application and screening questions, which may cover work authorization, availability, pay expectations or willingness to relocate; and
any voluntary self-identification or demographic information the employer asks for, where the law allows. This information is optional. The employer uses it for equal opportunity reporting and similar purposes, and it is not used to score you.

Information from other sources. Depending on how the employer has set up the Service, we may also receive information about you from:

job boards and job sites where you applied to the employer's posting (such as Indeed, LinkedIn or Google Jobs listings);
the employer's other applicant tracking system, HR system or other tools connected to Lighthouse;
the employer's recruiters and hiring managers, such as interview notes, ratings, stage changes and messages;
assessment providers the employer uses, such as Predictive Index behavioral and cognitive assessment results; and
calendar and email tools, for scheduling interviews and sending messages to you.

Information generated by the Service. This includes parsed and structured versions of your resume, AI-generated summaries, match scores and the evidence behind them, whether you met the employer's knockout criteria, pipeline status, and a record of messages sent to you.

Technical information. When you use a careers page or application form, we automatically collect basic technical data: IP address, browser and device type, pages viewed, the referring site, and the source link that brought you to the posting (for example, a job board or social media tracking link). We use this to run and secure the page and to tell the employer which sources its applicants come from.

Information you should not submit. Please do not include government identification numbers (such as a social insurance or social security number), financial account details, health information or other sensitive information in your application unless the employer specifically and lawfully asks for it.

4. How We Use AI and Automated Processing

Lighthouse uses machine learning and large language models, some operated by us and some provided by third-party model providers acting as our subprocessors, to help employers review applications. Depending on the employer's setup, the Service may:

Parse and structure your resume and application into consistent fields;
Score your application against the requirements the employer has defined for the role (for example, a score out of 10 for skills, experience and role fit), with the specific parts of your application that support each score;
Apply knockout rules the employer has configured, such as a required certification, work authorization or location;
Rank or group applicants so recruiters can prioritize their review;
Rediscover past applicants in the employer's own account who may fit a new role the employer opens;
Trigger automations the employer has set up, such as sending an assessment, an interview invitation or a status update when criteria are met; and
Draft messages, summaries and notes for recruiters to review.

The employer is in charge of decisions. The employer defines the screening criteria, knockout rules, score thresholds and automations, and it is responsible for hiring decisions. We design the Service so that recruiters can see why an application received the score it did and can review, override or change any AI output or automated outcome. Some employers set up automations, such as knockout rules or threshold-based stage changes, that act on an application without a person reviewing it first. If you want a person to reconsider an outcome, to challenge the information it was based on, or to ask for an accommodation or an alternative way of being assessed, contact the employer. If you contact us instead, we will pass your request to the employer.

What the AI is designed not to do. Our scoring is designed to evaluate job-related qualifications against the employer's criteria. It is not designed to infer or consider protected characteristics such as race, ethnicity, sex, gender identity, sexual orientation, religion, disability, age, or marital or family status. We do not use facial analysis, voice analysis, emotion recognition or other biometric analysis to evaluate candidates. AI systems can still make mistakes or reflect bias, so we monitor our features for quality and fairness, and we help Customers meet their own obligations, such as bias audits, impact assessments and candidate notices required by laws on automated employment decision tools.

No training of general AI models on your data. We do not use Customer or candidate data to train generally available foundation models. We do not allow our model providers to use it to train their models, and we do not sell it or provide it to anyone for model training. We may use aggregated or de-identified data that does not identify any person or Customer, such as accuracy and performance metrics, to maintain and improve the Service.

Employer notice obligations. Some laws require employers to tell candidates when AI or automated tools are used in hiring. Examples include Ontario's Employment Standards Act, 2000, Quebec's Law 25, New York City Local Law 144, the EU AI Act, and Colorado and California rules on automated decision systems. Under our Terms of Service, the employer is responsible for giving these notices and obtaining any required consents.

5. How Candidate Information Is Used

We process candidate information only to provide the Service to the employer, including to:

host careers pages and application forms and receive your application;
send your application to the employer's Lighthouse account and any tools the employer has connected;
run the screening, scoring, rediscovery and automation features the employer has enabled;
send you messages on the employer's behalf, such as application confirmations, interview invitations, assessment links and status updates;
keep the Service secure, prevent fraud and abuse (including fraudulent or duplicate applications), and fix technical problems; and
comply with the law and respond to lawful requests.

6. Information About Customer Users and Website Visitors

Customer users. We collect account information (name, work email, company, role and password or single sign-on credentials), billing information (handled by our payment processor), your settings and content, support conversations, and logs of how you use the Service (such as features used, IP address, device and browser). We use this to provide, secure, support and bill for the Service, to communicate with you about your account, and to understand how the Service is used so we can improve it.

Website visitors and business contacts. When you contact us, book a demo or subscribe to updates, we collect the information you provide, such as your name, work email, company and message. We use it to respond to you and, where the law allows, to send you information about Lighthouse. You can unsubscribe from marketing emails at any time using the link in the email or by contacting us. Our web servers also record standard technical information, such as IP address, browser type and pages visited, to operate and secure the site.

7. Legal Bases for Processing (EU, UK and Similar Laws)

Where the GDPR, UK GDPR or similar laws apply:

Candidate information is processed on the legal basis the employer, as controller, relies on. This is usually the employer's legitimate interest in recruiting, or steps taken at your request before entering into an employment contract. Where the law requires it, the employer relies on your consent, for example for optional demographic information or for keeping your application to consider you for future roles.
Customer user information is processed to perform our contract with the Customer and for our legitimate interests in operating, securing and improving the Service.
Website and business contact information is processed for our legitimate interests in responding to inquiries and promoting our Service, or with your consent where the law requires it.
We also process information where needed to comply with legal obligations.

In Canada, we rely on the consent of the individual, which the employer obtains for candidate information, or on another basis permitted by applicable privacy law.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We share personal information only as follows:

With the employer. Your application and related information are available to the employer you applied to and the users it authorizes.
With our subprocessors. These are service providers that help us run the Service, such as cloud hosting and database providers, AI model providers, email and messaging delivery providers, authentication providers, and support tools. They may use personal information only to provide services to us, under written contracts that require confidentiality, security and data protection. A current list of subprocessors is available to Customers on request.
With integrations the employer enables. When an employer connects Lighthouse to another system, such as another applicant tracking system, HR system, assessment provider (such as Predictive Index), calendar, email, Slack, a webhook, or an AI assistant connected through the Model Context Protocol (MCP), information flows to that system on the employer's instructions and is then governed by the employer's agreement with that provider and the provider's privacy policy.
For legal reasons. We may disclose information where we reasonably believe it is required by law, court order or other legal process, or is needed to protect the rights, safety or property of Lighthouse, our Customers, candidates or others.
In a business transaction. If Lighthouse is involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction, subject to this policy or protections at least as strong.

9. International Data Transfers

Lighthouse is based in Canada. We and our subprocessors may store and process personal information in Canada, the United States and other countries where they operate. Those countries may have different data protection laws than where you live, and information stored there may be accessible to courts and authorities of those countries under their laws. When we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or rely on an adequacy decision (Canada has one for commercial organizations covered by PIPEDA). Where Quebec law applies, we assess privacy risks before transferring personal information outside Quebec.

10. Data Retention

Candidate information is kept for as long as the employer keeps it in its account. The employer decides how long applications are kept and can delete them at any time. When an employer deletes a candidate's information, it is removed from our active systems and is erased from our backups as they rotate on their normal schedule.
Application data that has been inactive for six (6) years is deleted automatically, unless the employer has deleted it sooner.
When a Customer's subscription ends, its data is available for export for thirty (30) days and is then deleted in the ordinary course, subject to backup cycles and any legal obligation to keep it.
Customer user and business contact information is kept for as long as the account or business relationship is active, and afterwards for as long as needed for legal, accounting, security and dispute resolution purposes.

11. How We Protect Information

We use administrative, technical and physical safeguards to protect personal information, including:

encryption of data in transit and at rest;
hosting with established cloud infrastructure providers;
role-based access controls, so each employer's data is kept separate and only authorized users can reach it;
access for Lighthouse personnel limited to what they need to support and operate the Service; and
logging and monitoring for unauthorized access.

No system is perfectly secure. If you believe your information has been compromised, please contact us right away.

12. Your Privacy Rights

Depending on where you live, you may have the right to:

know what personal information is held about you and get a copy of it;
correct inaccurate or incomplete information;
have your information deleted;
object to or restrict certain processing;
withdraw consent where processing is based on consent;
receive your information in a portable format;
be told when a decision about you was made solely by automated processing, learn what information and main factors it was based on, have the information corrected, and ask for a person to review the decision (for example, under Quebec's Law 25 and the GDPR/UK GDPR); and
opt out of or appeal certain automated decision-making, and not be discriminated against for using your privacy rights (for example, under U.S. state privacy laws, including the California Consumer Privacy Act, which also covers job applicants).

Candidates: the employer controls your application, so please send your request to the employer you applied to. If you send it to us, we will pass it to the right employer and help them respond. We may need to verify your identity before acting on a request. Requests are answered within the time the law requires, usually within 30 days.

Customer users, website visitors and business contacts: contact us using the details in Section 17.

Complaints. If you are not satisfied with our response, you may complain to a privacy regulator. Depending on where you live, this may be the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, the UK Information Commissioner's Office, or your local EU data protection authority. We would appreciate the chance to resolve your concern first.

13. Google Account Services

Customer users can connect a Google account to Lighthouse. We use Google account services as follows:

Profile information: When you sign in with Google, we access basic profile information (your name, email address and profile picture) only to identify you and personalize your account.

Authentication: Google Sign-In is used to securely authenticate users. The unique identifier provided by Google is used only to enable secure account access.

Gmail send: If you enable it, we use Gmail's send permission to send emails from your account that you or your configured automations create, such as candidate communications, interview invitations and recruitment updates.

AI/ML usage disclosure: We do not use or keep any data obtained through Google Workspace APIs, including Gmail, Google Sign-In or other OAuth scopes, to develop, improve or train any generalized or non-personalized artificial intelligence (AI) or machine learning (ML) models. We do not transfer data obtained from Google Workspace APIs to third-party AI/ML tools or services. Data from Google services is used only to provide the features described above, and only with the user's explicit consent.

Lighthouse's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Connecting your Google account is voluntary, and you can disconnect it at any time. We do not access or store any data from your Google account beyond what is needed to provide these features.

14. Cookies and Similar Technologies

Our website, careers pages and application forms use cookies and similar technologies that are needed for them to work, such as keeping you signed in, remembering form progress, preventing fraudulent submissions and keeping the pages secure. Careers pages also record which source link brought an applicant to a posting, so employers can see which job boards and channels work for them. We do not use third-party advertising cookies on careers pages or application forms. You can control cookies through your browser settings, but blocking essential cookies may stop some features from working.

15. Children

The Service is not intended for children. We do not knowingly collect personal information from anyone under sixteen (16) unless an employer lawfully recruits younger workers and has the required consents. If you believe a child's information has been submitted without proper authorization, please contact us.

16. Data Breach Notification

If we become aware of a security breach affecting personal information we process for an employer, we will notify that employer without undue delay and give them the information they need to meet their own notification obligations. Where Lighthouse is responsible for the information, we will notify affected individuals and the relevant regulators as the law requires. This includes the Office of the Privacy Commissioner of Canada where there is a real risk of significant harm, and EU or UK supervisory authorities within 72 hours where the GDPR or UK GDPR requires it.

17. Contact Us

Our Privacy Officer is responsible for our compliance with this policy. For privacy questions, requests or complaints, contact:

Privacy Officer, Lighthouse Hiring Innovations
Email: support@lighthousehiring.ca
Address: 10 Dundas St, Floor 6, Toronto, ON, M7A 1G1, Canada

18. Changes to This Policy

We may update this policy from time to time. When we do, we will change the "Last Updated" date above. If a change is material, we will notify Customers by email or within the Service before it takes effect.