Privacy
Your information, your private career service.
Privacy notice · Version October 9, 2026. Yogimoca is operated by Perboc Inc., Québec enterprise number 1177319895, 5441 rue Waverly, Montréal, Québec H2T 2X8, Canada. Contact our privacy team at contact@yogimoca.com.
Information we process
We process your email, password hash, language preference, professional material, extracted evidence, document presentation observations, versioned Context, opportunities, assessments, interview preparations, application history, consent decisions and processing-disclosure metadata. Original PDF pages, including text and images, are sent to OpenAI to read professional content and assess document presentation. Yogimoca discards uploaded files after processing and retains extracted passages, page references, reading uncertainty and presentation observations. TXT files undergo text extraction only. Word documents are not accepted; export them as PDF before uploading. Do not include identity documents, financial credentials, health information or unnecessary information about other people.
In plain words: we process the career material you choose to share plus account basics, we discard uploaded files once read, and you should never send identity, financial or health documents.
Service processing only
We use your information to deliver your private career service, secure access, send verification and recovery messages, and respond to your requests. We never sell or rent your personal information, never offer it for recruiter discovery, never use it for advertising, and never reuse it to train our models. These secondary uses cannot be enabled in this release — the software rejects them. You choose what to submit, and must confirm necessary service processing before starting.
In plain words: your information runs your service and nothing else. Selling, advertising and model training are off, and this release cannot even switch them on.
How we measure use of Yogimoca
We measure how the service is used with our own infrastructure, never with a third-party analytics platform. Measurement events record only which action happened and when — for example that a source was added or an assessment completed — together with the interface language, account type and short technical labels. They never contain your career material, your documents, free text, or the web addresses you submit. Your browser keeps a random identifier, unrelated to your name or email, so repeat visits can be counted. If you arrive through one of our campaign links, a cookie remembers that link for 30 days so we can tell which invitation brought you here; it identifies the campaign, not you. When your guest session or account is deleted, measurement records are immediately detached from it and continue to exist only as anonymous statistics. We use these measurements for one purpose: understanding and improving Yogimoca.
In plain words: we count actions, not people. No advertising trackers, no third-party analytics, and nothing you write ever enters the statistics.
Providers and processing outside Québec
Render hosts the application and database. OpenAI processes selected professional material and opportunity information to generate analyses. When enabled, Perplexity receives only the public job URL to retrieve a posting that direct reading and OpenAI could not recover; it does not receive your career profile or documents. Amazon SES processes email addresses and message content for transactional delivery. No provider ever receives your password or your session credentials. Processing may occur outside Québec and Canada, including in the United States, and may be subject to local laws. Provider security and abuse-monitoring retention may apply; this notice does not promise zero provider retention. Your Profile lists recorded AI disclosures, not every hosting or email operation. Yogimoca does not send your profile to employers or submit applications for you.
In plain words: named providers process only what their task needs, processing can leave Canada, and none of them ever sees your password.
Retention and deletion
Guest sessions expire after 24 hours. Expired guest data is removed by periodic cleanup while the service is running, and on subsequent guest creation. Saving a session keeps it in your account until deletion. Removing an asset removes its active source text, but earlier Context versions, assessments and their evidence excerpts remain as history. Delete your account to remove its owned records from the active database — directly in Profile, no request needed. Measurement records are kept only in pseudonymous form: deleting a guest session or an account removes the link between those records and you. Encrypted backups can retain deleted data until their scheduled expiry. If we restore a backup, deletion requests must be reapplied before service resumes. Contact us for deletion or correction help, including provider-held information.
In plain words: guests expire in 24 hours, you can delete your account yourself in Profile — no request needed — and backups expire on schedule.
Cookies, storage and abuse prevention
We use only the storage the service needs: a secure session cookie, your language preference, a random measurement identifier in your browser's local storage, and — only if you arrive through a campaign link — a campaign cookie that expires after 30 days. There are no advertising cookies, no third-party tracking and no fingerprinting. To protect the service, we retain short-lived usage counters, keyed hashes of network addresses or email addresses, and temporary analysis locks. Expired abuse-control records are cleaned up after a one-day grace period while the service is running. Infrastructure providers may maintain their own security logs. Passwords, session credentials and private source text must not be placed in application logs.
In plain words: a handful of necessary cookies and counters keep you signed in, in your language and protected — none of them advertises to you or follows you around the web.
Security
Passwords are stored only as strong one-way hashes — we cannot read them and will never ask for them. Sessions use random credentials kept in secure cookies that scripts cannot read, and every change to your data requires request verification. Connections are encrypted in transit in production and the database is access-controlled. Application logs stay minimal and free of private material. No online service can guarantee absolute security; if an incident affecting your information occurs, we will inform you as required by law.
In plain words: hashed passwords, locked-down sessions and encrypted connections — with the honesty that perfect security does not exist.
Your rights and questions
You can review your information and recorded disclosures in Profile and delete your account there. For access, a portable copy where applicable, correction, withdrawal of consent, deletion or a privacy complaint, write to contact@yogimoca.com. You may also file a complaint with the Commission d'accès à l'information du Québec. We may verify your identity without requesting your password. Withdrawing necessary service processing means ending the service and deleting the account. AI guidance may be incomplete or wrong; you remain in control of employment decisions. The service is for adults aged 18 and over. Material privacy changes will be communicated before new uses begin.
In plain words: see, correct, export or erase your information, or complain to us and to the Québec regulator — and the final career decisions are always yours.