Privacy Policy

1. Who We Are and Our Legal Basis (GDPR)

Jo Inc. is the data controller for personal information collected through the App. Our principal place of business is in Toronto, Ontario, Canada. For users in the European Economic Area ("EEA"), United Kingdom ("UK"), or Switzerland, we process your personal data on the following legal bases under the General Data Protection Regulation ("GDPR") and applicable UK law:

• Performance of a contract: to provide you with the Jo service you have signed up for;
• Legitimate interests: to improve and secure the platform, and to perform aggregated analytics (where your interests do not override ours);
• Consent: for any processing activities for which we request your explicit consent (e.g., use of your data to train AI models - see Section 6 below); and
• Legal obligation: where we are required to process data by applicable law.

2. Information We Collect

We collect the following categories of personal information:

• Account Data: name, email address, resume, and employment history you provide when creating a profile.
• Voice Data: audio recordings of your responses during voice-led conversations with Jo.
• Profile Data: information derived from your voice conversations, including your stated skills, experience, preferences, and communication style.
• Usage Data: logs of how you interact with the App, including session timestamps, features accessed, and technical diagnostics.
• Device Data: device type, operating system version, and IP address, collected automatically when you use the App.

3. How We Use Your Information

We use your personal information to:

• create and maintain your account and profile;
• transcribe your voice responses and analyse the content (skills, experience, communication style) for the purpose of matching you with compatible employers;
• administer automated screening processes on behalf of employers (see Section 5);
• improve the performance, safety, and reliability of the App; and
• communicate with you about your account, matches, and platform updates.

4. Voice Data and AI Analysis

We use third-party AI transcription and voice-processing services to process your audio recordings. Your voice data is analysed for what you say and how you communicate - for example, pace, clarity, and expressiveness - solely for job-matching purposes. We do not use your voice for biometric identification, security authentication, or any purpose unrelated to the Jo service.

Your voice data is processed on servers operated by our infrastructure providers Railway and Supabase. Data may be hosted in the United States and Canada. Please see Section 8 on cross-border transfers.

5. Automated Decision-Making

We use automated processing to screen candidates against criteria set by employers.

• How it works: Employers may set mandatory criteria (for example, minimum years of experience, geographic location, or work authorisation status). These are called knockout criteria.
• The effect: If your profile does not satisfy an employer's mandatory criteria, our system may automatically exclude your profile from consideration for that specific role without human review.
• Your rights: If you believe a technical error has affected your screening outcome, you may contact us at [email protected] to request a manual review. Under GDPR Article 22, EEA/UK users have the right not to be subject to solely automated decisions that produce significant legal or similarly significant effects; where such decisions are made, you have the right to request human review, express your point of view, and contest the decision.

6. AI Training and Data Aggregation

We may use aggregated and anonymised data derived from platform interactions to train, evaluate, and improve Jo's AI matching models. Before any such use, we will obtain your explicit consent, which you may withdraw at any time by contacting us at [email protected]. Aggregated training data will never identify you personally.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the service. Specific retention periods are as follows:

• Audio recordings: retained for 12 months from the date of recording, after which they are permanently deleted or irreversibly anonymised.
• Text transcripts and profile data: retained for the duration of your account and for up to 24 months following account deletion, to enable dispute resolution and legal compliance.
• Usage and device logs: retained for up to 12 months.

You may request earlier deletion of your data at any time (see Your Rights below).

8. Cross-Border Data Transfers

Your personal information may be transferred to and processed in countries outside your country of residence, including Canada and the United States, where our infrastructure providers (Railway and Supabase) operate. These countries may have data protection laws that differ from those in your country.

For transfers from the EEA, UK, or Switzerland to countries without an adequacy decision, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission and/or UK International Data Transfer Agreements to ensure an adequate level of protection. By using Jo, you acknowledge these transfers.

9. Your Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal information:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure (right to be forgotten): request deletion of your personal data, subject to legal retention obligations.
• Restriction: request that we restrict processing of your data in certain circumstances.
• Portability: receive a copy of your personal data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests or for direct marketing purposes.
• Withdrawal of consent: where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.
• Lodge a complaint: if you are in the EEA or UK, you have the right to lodge a complaint with your local supervisory authority (e.g., the Information Commissioner's Office in the UK). Canadian users may contact the Office of the Privacy Commissioner of Canada.

To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law (generally 30 days for GDPR requests).

10. Cookies and Tracking

The App does not currently use cookies. If we introduce cookies or similar tracking technologies in the future, we will update this policy and obtain consent where required.

11. Children's Privacy

The App is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that a child under 16 has provided us with personal data, we will delete it promptly. If you believe we have collected such data, please contact us at [email protected].

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy in the App and, where required by law, by obtaining your consent. Continued use of the App following notice of changes constitutes your acceptance of the updated policy.

13. Contact and Data Controller

Jo Inc.
Toronto, Ontario, Canada
Email: [email protected]