Privacy policy

Vcansee operates a two-sided recruitment platform for the Philippine labour market. For the purposes of the Data Privacy Act we are the personal information controller for the data described below. You can reach our Data Protection Officer at hello@vcansee.com.

From job seekers:

• Account details — name, email address, password hash, mobile number.
• Profile content — headline, summary, work history, education, skills, certifications, languages, location and salary expectations.
• Resumes you upload or build, including every saved version.
• Applications, cover letters, screening answers and messages.
• Usage data — jobs viewed, searches run and alerts created.

From employers:

• Account and company details, including business verification documents.
• Job postings, screening questions, internal notes and pipeline activity.

We do not collect or ask for age, gender, civil status, religion, political affiliation or health information, and none of these exist as filters anywhere on the platform.

• To operate your account and deliver the service you asked for.
• To match candidates and roles — including generating AI match scores, summaries and fit explanations.
• To send transactional email: verification, application updates, interviews and messages.
• To send job alerts, which you can turn off at any time.
• To detect abuse, fraud and policy breaches, and to moderate reported content.

Employers see your profile, resume, cover letter and screening answers when you apply to their role. Employers on plans with talent search can also see profiles that are marked visible and open to work.

You can hide your profile from search entirely in Settings → Privacy while still applying to jobs — applying always shares your profile with that specific employer.

In the other direction, the employer's identity is hidden from you until they choose to reveal it. We log every reveal.

When you use an AI feature we send the relevant content — your profile, a job description, a resume — to our AI provider to generate the requested output. We log the feature used, the model, token counts and latency. We do not send your email address, phone number or password.

We never send an employer's identity into a candidate-facing prompt, so the AI cannot leak it even accidentally.

AI output is a draft or a signal, never a decision: no application is advanced, rejected or submitted automatically.

• Active accounts: retained while the account is open.
• Deleted accounts: personal fields are overwritten immediately; application records are retained in anonymised form so employers keep an accurate hiring history.
• Audit and reveal logs: retained for 24 months.
• AI generation logs: retained for 12 months, without prompt content.

Under the Data Privacy Act you have the right to be informed, to object, to access, to correct, to erase or block, to damages, and to data portability. In practice:

• Access and portability — export everything we hold in JSON from Settings → Data.
• Correction — edit your profile at any time.
• Erasure — delete your account from Settings; this soft-deletes and anonymises immediately.
• Objection — turn off job alerts and marketing email in notification preferences.

You may also lodge a complaint with the National Privacy Commission at privacy.gov.ph.

Passwords are hashed with bcrypt and never stored in plain text. Verification and reset tokens are stored only as SHA-256 hashes. Sessions are signed JSON Web Tokens. Uploads are validated by MIME type, size and magic-number sniffing, and are served through an authenticated route rather than a public directory.

See docs/SECURITY.md in the repository for the full model, including an honest account of what is and is not production-hardened.

We use a single essential cookie to keep you signed in, plus a local preference for light or dark theme. We do not run advertising or third-party analytics trackers.

If we make a material change we will tell you by email and show a notice in the product before it takes effect.