INTERN INSIDER PRIVACY POLICY

    Effective Tuesday, October 20, 2026.

    At Intern Insider Technologies Inc. (“Intern Insider”, “we”, “us” or “our”), we respect our users’ (“user(s)” or “you(r)”) privacy. This Privacy Policy (“Privacy Policy”) summarizes what personal information we collect and how we use and disclose this information. This Privacy Policy is subject to and forms part of our Terms of Service (the “Terms”). Any terms not otherwise defined in this Privacy Policy shall have the same meaning as in the Terms.

    We may update this Privacy Policy from time to time and will identify the effective date of each version. We will notify you of material changes by email or a prominent notice on the Platform before they take effect, providing any additional notice and obtaining any consent required by applicable law. Non-material corrections may take effect when posted. Nothing in this paragraph overrides any applicable statutory or paid-subscription notice requirement. The updated policy explains the practices that apply from its effective date. Acknowledging this policy or continuing to use the Platform is not a substitute for consent where a particular collection, use or disclosure requires it. We will not use Personal Information we have already collected for a materially new purpose without first notifying you and, where required by law, obtaining your consent.

    What Personal Information We Collect

    Personal information is information about an identifiable individual (“Personal Information”). We collect Personal Information when you voluntarily provide it through our Platform, or when you provide it to us through other means. For example, we may collect Personal Information when you create an Account on the Platform, upload it to the Platform, or contact us through email or any other method, or communicate with us in any other manner.

    We may also collect Personal Information about you from third parties if authorized. If you authorize a connection to a third-party account or service, the information we receive depends on the permissions you grant. Disconnecting the service stops further access through that connection; information already imported remains subject to your correction and deletion rights described below.

    The Personal Information we collect about you may include:

    • your full name and contact information, such as your address, telephone number, or email address and any other information collected to open an Account on the Platform;

    • information included in the materials you submit to the Platform, such as resumes, cover letters, uploaded files, job preferences, saved answers to application questions, survey responses, feedback and support messages;

    • profile information, such as your school, program, graduation year, skills and work history, including information from public professional profiles (such as your LinkedIn URL) or data exports that you choose to link or upload;

    • job activity information, such as the jobs you view, save or track, the application statuses and dates you record, and application progress and submission signals collected when you use our application tools as described below;

    • information you input into AI-powered features of the Platform, the outputs generated, and your interactions with those outputs (such as accepting or rejecting a suggestion), which may be logged for quality, safety and debugging purposes;

    • inferences we generate about you, such as the fit between your profile and a particular role;

    • if you represent an organization using or considering our Services, your business contact information, role and communications with us;

    • subscription and payment records, such as your subscription status and plan and a record of your payments (amount, date and invoice reference). Payments are processed by our third-party payment processor, Stripe, and we do not store your full payment card number; and

    • any other Personal Information that you choose to submit to us.

    We may receive information about you from other sources and combine it with information we already have, such as application status or outcome information from employers you apply to or interact with, enrolment or program information from education partners where you are enrolled in a program with them, and information from public professional profiles or other sources that you provide to us. We may also obtain information from public databases, data providers and social media platforms and combine it with information we already have, including to understand our users’ career outcomes and measure the effectiveness of our Services. Where permitted by applicable law, outcome review is on by default and can be turned off anytime in our settings. You may also ask us to stop using and to delete such information.

    How We Collect Information Through Technological Means

    When you use our Platform, we may collect information that is automatically sent to us by your web browser or your device which runs our applications. This information may include your domain name and your IP address. We may also collect other information, such as the type of browser you use, which of our Website’s pages you view, and the files you request. Additionally, we may also collect other technical and system log information from you, such as the hardware you use to interact with our Platform, operating system and version information, the software you use, API access tokens, mobile network information, pages you view on our Website, your unique device identifier, your system activity, software debug and crash information, and referral website address used to access our Platform. The amount of information that is sent to us by technological means depends on your browser or device and settings you use. Please refer to the instructions provided by your browser or device if you want to learn more about what information it sends to the Website, or how you may change or restrict this.

    We and third parties we partner with may use cookies, web beacons, API access tokens, tracking pixels, HTML5 cookies, entity tags, and other similar technological means (collectively, “Cookies”) on our Platform to help us collect information through technological means. These technological tools may track or collect information set out above. We use Cookies for the following purposes: (a) essential purposes, such as sign-in, session management, security and remembering your preferences; (b) analytics, including page, event and session data and session replays (recordings of how you interact with pages, configured to mask form inputs; this does not mean that all text or other content displayed on a page is masked), to help us understand how users interact with the Platform and to improve it; (c) advertising measurement, including pixels and tags from advertising partners such as Meta, Google and Reddit, used to measure the performance of our advertising; (d) attribution, such as referral and campaign cookies (which may last up to 90 days) used to attribute sign-ups, including for our ambassador program; and (e) retargeting, where we use it, including pixels and tags from advertising partners such as Meta, Google and Reddit, used to show our advertisements on other websites and apps to people who have visited our Platform.

    You may turn off advertising sharing and non-essential tracking, including retargeting and the use of your hashed email address for customer matching, custom audiences and similar audiences, at any time using the “Privacy choices” link in the footer of our Website. We also honour the Global Privacy Control (GPC) browser signal as an opt-out from advertising sharing and, where required by applicable law, from any sale or sharing of Personal Information. Opting out of advertising measurement, retargeting or audience matching does not stop all advertisements you may see elsewhere, and opting out of marketing emails is a separate choice.

    Our analytics requests are served from our own domain, which means browser tracking blockers may not stop them; please use the “Privacy choices” link instead. Where opt-out processing is permitted, these tools may operate until you opt out. Essential functions continue when optional tracking is declined. Optional tracking may involve both browser tools and events sent from our servers; a first-party domain or server-side transmission does not remove the applicable privacy choice. Advertising identifiers and hashed contact details are not necessarily anonymous.

    Where permitted, non-essential tracking operates on an opt-out basis, with the choices described above. This policy and a general acknowledgment do not replace separate consent where applicable law requires it. You can also use your browser controls to remove or block cookies, although those controls may not stop server-side transmissions or all tracking technologies. Browser settings apply separately to each browser and device. Blocking essential sign-in or security storage can prevent the requested feature from working; refusing optional analytics or advertising does not disable essential account functions.

    How We Use and Disclose Information Collected from You

    The information we collect from you may be used by us for the purposes for which it was collected, as provided in this Privacy Policy, or for other purposes that are disclosed to you and to which you consent. We may use and disclose information collected from you as follows:

    • to deliver our Platform, including to provide you with the Services;

    • to register your Account on our Platform and authenticate your Account information;

    • to send you informational or administrative communications needed to operate your Account and requested Services;

    • to send newsletters, onboarding information and promotional communications where we have your consent or another sending basis permitted by applicable law, including a qualifying account relationship, subject to your preferences and unsubscribe requests;

    • to process payments related to the Platform (and for this purpose we may share this Personal Information to the extent necessary with payment providers);

    • to improve our understanding of how users use our Platform and to improve our Platform;

    • to communicate with you and to enable other users to communicate with you, including to provide you with customer support;

    • to increase the security and safety of our Platform and users;

    • to perform analytics on our Platform;

    • to share it with third parties when you ask us to do so, such as when you connect another service to your Account;

    • to develop, train and improve our own models, algorithms and matching features, and to develop new products and services, using Personal Information or de-identified information;

    • to evaluate the fit between you and opportunities (including with AI tools that screen, score, shortlist or rank candidates for employers), make your profile available to employers as described under the Employers heading below, and enable applications you choose to submit;

    • to verify your identity, school enrolment or eligibility (for example, through a school email address or an education partner);

    • to identify and notify you of paid or voluntary opportunities, such as AI evaluation, data annotation, expert feedback or research participation, subject to your communication preferences;

    • to understand our users’ career outcomes and measure the effectiveness of our Services, as described above, and to contact you, including after you stop using the Platform, with voluntary research surveys about your internship and career outcomes, until you opt out or request deletion;

    • to measure the performance of our advertising;

    • for the purpose of sharing limited information (such as hashed email addresses, device and browser information, ad-click identifiers, and event data such as sign-ups and purchases) with advertising platforms such as Meta, Google and Reddit to measure and improve our advertising and, where we use these features: (i) to show our advertisements to people who have visited our Platform (retargeting); (ii) to match hashed email addresses against the advertising platform's own users so that we can show our advertisements to, or exclude from our advertisements, existing users and customers (customer matching or custom audiences); and (iii) to have the advertising platform create audiences of other people who share characteristics with our users (similar or lookalike audiences). We do not use saved voluntary self-identification answers for these purposes. You may turn this off as described under the How We Collect Information Through Technological Means heading above;

    • for any purpose required by law, including to cooperate with or carry out investigations, and in compliance with any court order or subpoena;

    • for any other purposes that are disclosed to you and to which you expressly consent.

    We also combine, analyze, process, and store information we collect from you for the purposes of facilitating and improving our Platform. We may transfer information we collect from you to third-party service providers that assist us with carrying out any of these purposes. These service providers include providers of cloud hosting and infrastructure, database and authentication services, payment processing (Stripe), analytics, AI models (which process content you submit to AI-powered features), email and communications delivery, candidate-sourcing and data-enrichment, and search infrastructure. Where a provider processes Personal Information on our behalf, we require it to use that information for the agreed services and applicable legal obligations, subject to appropriate contractual restrictions and safeguards. Some recipients, including advertising partners, payment providers and Employers, may also act independently for the purposes described in this policy or their own applicable notices; they are not all processors with identical restrictions. We do not authorize a model provider to use restricted integration data or saved voluntary self-identification answers for unrelated training merely because it processes a request for us.

    Voluntary Self Identification and Work Authorization

    Some employer applications ask voluntary demographic or equal-opportunity self-identification questions, such as race or ethnicity, gender, disability or veteran status. If you choose to save these answers, we store them only with your express consent and use them solely to fill those answers into applications you choose to submit. We do not use saved voluntary self-identification answers for advertising, analytics, research, matching or model training, and we do not disclose them except at your direction as part of an application you submit or where required by law. You may delete your saved answers at any time.

    Separately, we may collect work-authorization and sponsorship information that you provide for job matching, such as whether you are authorized to work in the country of a role and whether you require employer sponsorship. We may use and share relevant eligibility information to recommend opportunities and enable Employers to filter candidates against lawful, job-related requirements, subject to your employer-discovery setting or an application you direct. This does not authorize unlawful discrimination based on citizenship, national origin or other protected characteristics, or inference of those characteristics from your name, school or background. Information originally saved solely for autofill is not automatically repurposed for matching; we first provide the relevant notice and obtain any consent required by law. Source and integration restrictions continue to apply.

    Employers

    Your profile, including your name, contact details (such as your email address), education, skills, experience, resume information, relevant work-authorization and sponsorship information provided for matching, details added from your linked profiles, and activity signals (such as when you last updated your profile or applied to an employer’s jobs), is included in employer-facing search and matching from the moment you create your Account. This allows employers hiring on the Platform, including AI labs recruiting people for work, to discover you and contact you directly at the contact details in your profile or through messaging features we offer.

    You can remove your profile from employer discovery at any time using the “Show my profile to recruiters” toggle in our settings. Turning discovery off does not affect applications you choose to submit and takes effect for new searches immediately. Employers who have already received your information keep it subject to the limits described in this section.

    When you deliberately use a feature that sends application materials to a specific employer, we share your application materials with that employer at your direction. Content you author, such as your resume, is shared as you provide it, so please consider carefully before including sensitive information. Once an employer receives your information, it is independently responsible for its handling of that information. To have your information removed from an employer’s systems, please contact that employer directly. Opening a link to an external application site does not itself send your profile or resume. Our team may support candidate searches and prepare reports for employers, subject to the same disclosure and purpose restrictions.

    Our team may assess users when supporting candidate searches and preparing reports, and employers may use our matching tools directly. This may include screening against hard role requirements, scoring and ranking candidates against employer-reviewed criteria, and providing shortlists, reports, explanations and supporting profile evidence. Our screening and recommendations can affect who is presented to employers and how candidates are ordered. Missing information is not itself proof that a requirement is not met. Employers review the results and make their own hiring decisions. Discovery-based processing follows your discovery setting, and assessments associated with an application relate to the application you submit.

    An assessment may contain a candidate reference, relevant profile evidence, the role requirements and criteria, criterion-level scores, ranking, explanations, and a factual reason a clear hard-requirement mismatch was not scored. An assessment is an inference based on available information, not a complete or verified account of your ability, and missing or outdated evidence can affect a result. You may update your profile and request access or correction as described under Your Rights and Choices below, without knowing which employer received a report. We may retain the assessment context and delivery history needed to investigate an error or request. A correction does not guarantee a particular ranking or a job.

    Autofill Tools

    If you use our autofill and related application-tracking tools, we may collect application-form content and structure, including question text, field labels, answer options and required-field indicators; relevant job, employer and application-page details; information you choose to fill; and events showing filling, editing, errors, progress, attempted submissions and available submission confirmations. Collection is limited to application pages and interactions needed for the tools you activate. An attempted submission, a detected confirmation and a status you record are different signals and may not independently verify receipt by an Employer.

    We use this information to provide application assistance and tracking, improve form recognition and completion accuracy, develop related application features, identify errors and abuse, and measure feature performance and reliability. Internal reports may summarize these uses, including completion and submission patterns. Saved voluntary self-identification answers remain subject to the separate restrictions above. A form containing a sensitive question does not authorize reuse of the answer for analytics or training.

    Where information is collected through our browser extension, we comply with the Chrome Web Store User Data Policy, including its Limited Use requirements. Use and disclosure of that information, including aggregated or derived information, are limited to the disclosed single purpose and related operations allowed by those requirements. General research, advertising or commercial-data provisions in this policy do not override that limit. We do not use extension-collected data for unrelated advertising, data sales or institutional reporting. Information independently provided through the Platform or received from other authorized sources follows the applicable purposes, choices and source restrictions described in this policy.

    De-identified and Aggregated Information

    We may create de-identified or aggregated information that does not identify you and cannot reasonably be used to identify you. We maintain and use such information only in de-identified form and do not attempt to re-identify it. Subject to applicable source and integration restrictions, we may use and share de-identified or aggregated information, such as hiring trends and career outcome statistics, for any lawful business purpose, including publishing research, statistics and reports, and may retain it after you delete your Account.

    Education Research and Data Arrangements

    We may prepare institutional reports, academic research and commercial data products using information described in this policy. Standard reports may use de-identified or aggregated information about educational and professional backgrounds, participation, application trends and career outcomes. For example, reports may compare fields of study or experience with the jobs users apply for, subsequent roles or employers observed from authorized sources, and differences between skills evidenced in profiles and skills requested in those jobs. These comparisons reflect the information available; they do not establish that a person lacks a skill or that our Services caused a career outcome. The restrictions on voluntary self-identification answers and extension-collected information continue to apply. Reports may identify employers, roles and other career destinations. Where permitted by applicable law and the permissions described in this section, reports may also identify individual students and their education or career outcomes, including information obtained from qualifying public professional sources. Removing names alone does not establish that information is de-identified. Public career information does not by itself authorize disclosure of non-public Platform activity or assessments. Where an arrangement involves identifiable information, we assess the specified recipient, purpose, fields, source restrictions and applicable choices and provide any further notice, obtain any consent and enter into any agreement required by law. A school association does not by itself authorize giving a university your individual profile or activity history. Employer access does not authorize an Employer to reuse candidate information for unrelated research, advertising or model training. These arrangements are separate from inviting you to apply for a paid research or AI-related work opportunity; an invitation does not enroll you in that work or grant rights in work you have not agreed to perform.

    Affiliates and Third Parties

    We may share Personal Information with our affiliates and subsidiaries under common control for the purposes described in this Privacy Policy. We also reserve the right to transfer Personal Information to a third party in the event that we merge with or are acquired by a third party (whether through an asset or share sale), in connection with a financing, or as part of the negotiations leading up to any such transaction. In any such case, your Personal Information will remain subject to commitments materially consistent with this Privacy Policy.

    Non-Users: Recruiters and Other Professionals

    Our Contact Finder feature helps users reach hiring professionals. For that feature, we collect and disclose professional information about recruiters and similar professionals who may not have an Account, such as name, job title, company, location, public professional profile links and work (business) email addresses, compiled from third-party data providers and other sources, including publicly available information. We disclose professional contact details, not personal ones, and use this information to enable users to contact hiring professionals about roles and networking. If you are a recruiter or other professional and want your information corrected or removed, please contact us using the information below. We will process your request within 30 days.

    Storage and Processing of Personal Information

    We take the protection of your Personal Information seriously and use industry-standard security methods to safeguard it against loss, theft, and unauthorized access, disclosure, copying, use, or modification. These methods include technical measures (such as encryption and firewalls), physical measures (such as secure server facilities), and administrative measures (such as restricting data access only to employees or contractors who need it to perform their duties). While we strive to use commercially acceptable means to protect your data, no system is impenetrable, and we cannot guarantee 100% security of any information transmitted to or stored by us. If a breach of our security safeguards creates a real risk of significant harm to you, we will notify you and report the breach to the Office of the Privacy Commissioner of Canada as required by law, and will comply with other applicable breach notification laws. Please do not send passwords or full payment card details in a support message or through an AI-powered feature.

    Information collected through your use of our Platform may be processed or stored in Canada, the United States or any other country in which we or our service providers maintain facilities. We may transfer information that we collect about you, including Personal Information, to affiliated entities or to other third parties across borders and from your country of jurisdiction to other jurisdictions throughout the world. As a result, this information may be subject to access requests from governments, courts, or law enforcement in those jurisdictions according to laws in those jurisdictions. We use contractual and organizational safeguards for these transfers.

    Inactivity alone does not trigger deletion of your Account data. We retain Personal Information while your Account remains open and for as long as reasonably necessary to provide the Services and fulfil the purposes discussed above, including contacting you with voluntary outcome surveys until you opt out or request deletion. You may also contact us at any time to delete your Personal Information, including any account information you have submitted to us. We will complete deletion within 30 days of verifying your request, except where we are required or permitted to retain certain information, such as billing and transaction records needed for tax, accounting or legal obligations, records needed to resolve disputes or enforce agreements, security records, and limited records needed to document your request or respect an opt-out. When Personal Information is no longer needed, we delete or de-identify it; residual copies in backups are deleted in accordance with our backup retention cycles and are restricted from ordinary use in the meantime. De-identified and aggregated information may be retained after your Account is deleted. Closing an Account, cancelling a paid plan, opting out of a purpose and requesting deletion are different actions. Cancelling a subscription does not automatically delete your Account, and an opt-out stops the covered future activity but does not necessarily erase information needed for another authorized purpose; you may also request deletion.

    Retention is determined by the purpose and sensitivity of the record, Account or feature status, applicable legal periods, security needs, contractual restrictions and pending requests or disputes. Profile, content and outcome records support your Account and authorized ongoing purposes, but an open Account is not a reason to retain every processing copy indefinitely. Billing and transaction records may need to remain after your Account closes for accounting, tax, fraud or dispute obligations; this does not require retaining your entire profile or continuing a subscription. Security records, AI traces, analytics, temporary imports and queued work have their own purpose-based retention and clean-up periods. Request and suppression records may be retained in limited form to document a response, respect an opt-out, prevent re-import of removed information or meet a legal obligation. Backups and copies held by recipients follow the applicable retention and deletion obligations, and any restoration from backup will respect applicable deletions. We may retain limited benefit-claim identifiers to prevent repeated use of a one-time or eligibility-limited benefit, with restricted access and a justified retention period. Where law requires retaining information used for a decision directly affecting you, we preserve the necessary decision record for that period so that access and correction rights can be exercised; this does not permit continued employer discovery, marketing or outcome monitoring after the relevant opt-out or deletion request.

    Where information is lawfully used to develop our own models, deleting source records does not by itself reverse completed training. Subject to applicable law and source restrictions, we may retain and use model parameters and statistical improvements developed before deletion that do not contain or reasonably enable disclosure of your Personal Information. Training datasets, embeddings, model outputs and other records containing Personal Information remain subject to the retention and rights provisions above. This is not permission to retain Personal Information indefinitely or disregard required deletion, correction, restriction or other remedies involving a model or its derivatives.

    Third Party Collection of Information

    This Privacy Policy does not apply to applications, technologies or websites that are owned by and/or operated by other parties. The relevant third party’s terms of use, privacy policy, permissions, notices and choices should be reviewed by yourself regarding their collection, storage and sharing practices since they may be different from ours.

    Age Requirement

    You must be at least 19 years old to create an Account or use the Platform. We do not knowingly collect Personal Information from anyone under 19. If we learn that an Account holder is under 19, we will close the Account and delete the associated Personal Information, subject to the limited retention exceptions described under Storage and Processing of Personal Information. If you believe someone under 19 is using the Platform, please contact us using the information below.

    Your Rights and Choices

    Subject to applicable law, you may request access to, correction of, or deletion of your Personal Information, request a copy of your data, withdraw your consent to non-essential processing (subject to legal or contractual restrictions and reasonable notice), and challenge our handling of your Personal Information. You may also opt out of marketing emails at any time using the unsubscribe link in any such email, and control the privacy settings available in your Account. You, or an agent you authorize, may submit a request by contacting us using the information below. We may need to verify your identity before responding, and we will respond within 30 days, or sooner where required by law. Where an extension is permitted and needed, we will tell you the reason and applicable response period. If we cannot fulfil all or part of a request, we will explain why.

    If you reside in the United States, depending on your state of residence, you may have additional rights, including the right to know the categories and specific pieces of Personal Information we collect, use and disclose; to opt out of the sale or sharing of Personal Information and targeted advertising (including through a recognized opt-out preference signal such as Global Privacy Control); to limit certain uses of sensitive personal information; and not to be discriminated against for exercising these rights. We will respond within the time required by applicable state law. If we deny your request, you may appeal by replying to our decision, and we will respond to your appeal within the time required by applicable law. Where applicable, these rights also include information about specific third-party recipients and rights to opt out of, obtain information about, correct information used in, or seek review of certain profiling or automated decisions that have legal or similarly significant effects. The scope depends on the applicable law and processing; you can contact us to exercise these rights without first identifying a particular Employer or report.

    If you are not satisfied with our response to a privacy concern, you may contact the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or the Office of the Information and Privacy Commissioner for British Columbia (www.oipc.bc.ca), as applicable.

    How to Contact Us

    If you have any questions regarding this Privacy Policy, wish to access your information, or have any concerns about the same, please contact our Privacy Officer at: privacy@interninsider.me.