Alfi Matching — Privacy Policy

1. Scope

This policy covers the Alfi Matching browser extension and the backend service it connects to. Alfi Matching is a private business tool distributed to authorized organizations. It is not available to the general public and is not intended for personal use.

The extension operates inside a Bullhorn applicant tracking system (ATS) instance belonging to the organization that licenses it. That organization is the controller of the recruitment data processed. INTO AI Inc. acts as a service provider processing that data on the organization's behalf and under its instructions.

2. What the extension accesses

When a user runs a match on a job posting, the extension reads:

• Job data from the active Bullhorn record (title, description, requirements, location, and related fields)
• Candidate records retrieved from the organization's own Bullhorn data, including professional information such as work history, skills, education and résumé content
• Authentication details for the user's Alfi Matching account

The extension does not read browsing history, does not operate on sites other than the Bullhorn domains it is scoped to, and does not track user activity across the web.

3. How data is used

Data is used for one purpose: producing a ranked candidate shortlist for the job the user is working on, and generating the accompanying match explanations.

Data is not used to train machine learning models. It is not sold, rented, or shared for advertising or marketing. It is not disclosed to any party other than the subprocessors listed below.

4. Storage and retention

Job and candidate data retrieved from Bullhorn is processed by the Alfi Matching backend. To make search possible, the service maintains a derived index of the organization's candidate records.

Bullhorn remains the system of record. Alfi Matching reads from it and writes back only where the user explicitly triggers such an action. Data is retained for the duration of the service agreement with the licensing organization and deleted on termination, or earlier at that organization's request.

5. Subprocessors

Alfi Matching relies on third-party providers to operate:

• Cloud infrastructure providers — hosting and data storage
• Large language model providers — text analysis and generation of match explanations

Content sent to language model providers is transmitted under enterprise API terms that exclude the use of submitted data for model training.

A current list of subprocessors is available from alfi-privacy@weareinto.consulting on request.

6. Security

Data is encrypted in transit. Access to the Alfi Matching backend requires authentication, and administrative access is restricted to authorized INTO AI personnel on a need-to-know basis.

7. Quebec Law 25 and other privacy legislation

INTO AI Inc. is established in Quebec, Canada, and handles personal information with Quebec's Law 25 in mind, alongside applicable Canadian federal privacy legislation.

Because the recruitment data processed belongs to the licensing organization, requests from individuals to access, correct or delete their personal information should be directed to that organization, which is the controller. INTO AI Inc. will support the organization in responding to such requests.

8. Changes

Material changes to this policy will be communicated to licensed organizations. The date at the top of this page reflects the most recent revision.

9. Contact

Questions about this policy, or about how Alfi Matching handles data: