Privacy Policy

Pythia Metrics Inc. ("Pythia", "we", "us", or "our") operates a web-based platform that assesses personality traits for use in recruitment, talent management, and team building. We take the privacy of the people who use our platform seriously, and we have designed the service to protect personal information from the outset.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, who we share it with, and the rights you have over your information. It applies to the current beta (development) phase of the Pythia platform, which runs from June 2026 to September 2026. During this phase, participants receive a free personality assessment, and we use the results to improve the accuracy and fairness of our models. We will update this policy before we begin offering the service commercially.

Who is responsible for your information

Pythia's Privacy Officer is responsible for the protection of personal information and for handling your privacy requests:

Louis-Philippe Robichaud
Privacy Officer, Pythia Metrics Inc.
admin@pythiasoftware.ca

You can reach the Privacy Officer using the contact details above for any question about this policy or about how we handle your personal information.

Information we collect

During the beta phase, we collect the following categories of personal information.

Account and participant information

This includes your email address, a password (which is hashed before it reaches us, so we never see it), and optional demographic information: ethnicity, gender, first language, English proficiency, and date of birth. We do not collect your name during the beta phase.

Interview data

When you complete a simulated interview, we capture audio only briefly so that it can be converted into a written transcript. The audio is discarded as soon as the transcript is produced, and we keep only the transcript. Transcripts can be sensitive, because you may mention details about yourself during the interview.

Assessment data

This includes your answers to Likert scale personality questionnaires and the personality scores that our models infer from your interview and questionnaire responses.

Technical and usage information

This includes your IP address, the pages you visit on our site, and information about your browser and device. This information is kept for seven days before it is automatically deleted.

The demographic fields (ethnicity, gender, first language, English proficiency, and date of birth) are optional. We ask for them only with your separate, explicit consent, and we use them to study and correct for bias in our models. You can complete the assessment without providing them.

Why we collect this information

We collect personal information for the following purposes:

• To provide the assessment and generate your personality profile.
• To improve the accuracy of our models and the experience of using our platform.
• To study and reduce bias in our models, so that the assessments we produce are fair across different groups.
• To create and secure your account and communicate with you about the service.
• To meet our legal and regulatory obligations.

We collect only the information we need for these purposes, and we do not use your information for any other purpose without your consent.

Consent

We rely on your consent to collect and use your personal information. Before you take part, we present a consent form in plain language, separate from our terms of service, that explains what we collect and why. Because some of the information we collect is sensitive (such as ethnicity and the contents of your interview), we ask for your express consent for those uses.

You can withdraw your consent at any time by contacting the Privacy Officer. Withdrawing consent does not affect processing that already took place while your consent was in effect.

Automated processing and your right to a human review

Pythia uses automated processing to generate your personality profile. Pythia itself does not make decisions about you, such as hiring or promotion decisions. Any such decision is made by the organization that uses our platform.

You have the right to be told when your information is used to generate a profile through automated processing, the right to ask that a qualified person review the result, and the right to submit your own observations. Organizations that use Pythia are contractually required to provide a human review before making any consequential decision.

How we share your information

We do not sell your personal information. We share it only in the following limited ways.

With service providers who help us operate the platform

We use Fly.io to host our application and database, and Cohere to perform the artificial intelligence processing that generates assessments. These providers act on our behalf under written agreements that require them to keep your information confidential, use it only for the purposes we specify, and notify us promptly of any security incident. Domain name resolution is handled by Cloudflare in a DNS-only capacity; Cloudflare does not inspect your traffic, and no personal information is sent to it in the normal operation of our platform.

With the organization you are assessed for

During the beta phase, assessment results are used for research and model improvement and are not shared with employers. In the operational phase, authorized administrators at the organization you are assessed for will be able to see results for their own candidates or employees only.

When required by law

We may disclose personal information if we are legally required to do so, or to protect our rights.

Where your information is stored

Your personal information is stored in Canada, on Fly.io's managed infrastructure in the Toronto region. We chose Canadian hosting so that your information stays within Canada wherever possible.

One of our providers, Cohere, performs the artificial intelligence processing for our assessments. Cohere is a Canadian company headquartered in Toronto, with data centre infrastructure in Ontario and British Columbia. We have asked Cohere to confirm in writing where this processing takes place. Until we receive that confirmation, we treat the processing conservatively as a possible transfer outside Quebec, and we have assessed that your information receives adequate protection based on Cohere's Canadian incorporation, its Canadian infrastructure, and the written agreement we have signed with it. Information sent to Cohere is pseudonymized and protected in transit.

How long we keep your information

We keep your personal information only as long as we need it for the purposes described in this policy. Technical logs containing your IP address are deleted automatically after seven days, and session data expires automatically after seven days.

Before we move from the beta phase to the operational phase, we will anonymize the demographic information collected during the beta, following the methodology set out in the applicable Quebec regulation on anonymization. If you want to keep a copy of your data, we will let you know before the end of the beta phase so that you can download it.

How we protect your information

We protect your personal information using a combination of technical and organizational measures. Information is encrypted while it is stored, using AES-128 Fernet encryption, and the encryption keys are kept separately from the data. Information is encrypted in transit using TLS. Access to personal information is restricted: within our team, only the Privacy Officer has access to account email addresses, and research staff work with de-identified data. Organizations that use our platform can see only their own candidates' results, enforced by role-based access controls.

No system can be guaranteed to be perfectly secure, but we take reasonable measures proportionate to the sensitivity of the information we hold, and we maintain a register of any confidentiality incidents.

Your rights

You have the following rights over your personal information:

• Access — you can ask us to confirm what personal information we hold about you and to provide you with a copy.
• Rectification — you can ask us to correct information that is inaccurate, incomplete, or ambiguous.
• Portability — you can ask us to provide your information in a structured, commonly used technological format.
• Withdrawal of consent — you can withdraw your consent to our use of your information at any time.

To exercise any of these rights, contact our Privacy Officer at admin@pythiasoftware.ca. We will respond in writing within 30 days. Access is provided free of charge, although a reasonable fee may apply for reproduction, and we will tell you the approximate amount in advance if so.

If you are not satisfied with how we handle your request, you have the right to file a complaint with the Commission d'accès à l'information du Québec (CAI).

Cookies and analytics

We use a limited amount of technical information, including cookies or similar technologies, to operate the website, keep you logged in, and understand how the site is used. This information includes your IP address and details about your browser and device, and it is deleted after seven days.

Children

Pythia's service is intended for adults. It is not directed at minors, and our terms of service restrict use to adults. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time, for example when our practices change or when we move to the operational phase of our service. When we make a significant change, we will post the updated policy on our website and, where appropriate, notify registered users by email. The date at the top of this policy shows when it was last updated.

Contact us

If you have any questions about this policy or about how we handle your personal information, please contact:

Louis-Philippe Robichaud
Privacy Officer, Pythia Metrics Inc.
admin@pythiasoftware.ca or through our contact page.