Privacy Policy

Effective date: August 27, 2026

1. Who we are

This Privacy Policy explains how Capstack Careers, a general partnership registered under the laws of British Columbia, Canada ("Capstack," "we," "us"), collects, uses, and discloses personal information in connection with our website and courses (the "Service").

Privacy contact: Privacy Officer, Capstack Careers — support@capstackcareers.com. We have designated an individual accountable for our privacy compliance; their identity is available on request through this address.

We comply with applicable Canadian privacy laws, including British Columbia's Personal Information Protection Act (PIPA) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

2. What we collect

We deliberately collect little:

• Name and email address — provided by you at Stripe checkout when you purchase. Your email is your account identifier, and is also recorded, in plain text, in our analytics tool (PostHog) as part of the purchase record described in Section 5.
• Payment information — handled entirely by Stripe through its hosted checkout. Your card details never touch our systems. We receive confirmation of payment, the amount, and your name and email.
• Course progress — video watch positions and lesson completions, stored so the course remembers where you left off.
• IP address — collected in a few separate contexts: (1) the free demo endpoint records IP addresses solely for rate limiting (the demo uses a shared account, stores no progress, and collects nothing else); (2) when you visit our purchase page, your IP address is captured by our analytics provider (PostHog) for approximate city-level location and by Meta for advertising measurement, as described in Section 5; and (3) our hosting provider logs IP addresses as part of standard web server logs.
• Support correspondence — if you email us, we keep the correspondence.
• Website usage data — via cookies and similar technologies described in Section 5 (analytics and advertising measurement).

We do not collect government IDs, financial details beyond what Stripe reports, or sensitive personal information, and we do not knowingly collect information from anyone under 16. The Service is intended for adults preparing for professional recruiting.

3. How we use your information

• To deliver the Service: create your account from your purchase email, send sign-in (magic link) and transactional emails, remember your progress, and provide support.
• To personalize downloads: when you download course files, your account email address is embedded in the files as a watermark (e.g., "Intended for the eyes of [your email]"). This deters unauthorized sharing of the materials.
• To improve the product: we use analytics (PostHog) to understand how visitors use our purchase page, as described in Section 5.
• To measure advertising: we use the Meta (Facebook/Instagram) pixel to measure the performance of our ads and build ad audiences, as described in Section 5.
• To prevent abuse: rate limiting, fraud prevention, and security.
• Marketing email (only with consent): we send marketing or promotional email only where you have opted in (for example, a checkbox at checkout) or where otherwise permitted by Canada's Anti-Spam Legislation (CASL). Every marketing email includes an unsubscribe link, honored promptly. Transactional emails (receipts, sign-in links, access notices) are sent regardless, as they are necessary to deliver what you bought.

We do not sell your personal information.

4. Service providers (processors)

We rely on third-party service providers to run the Service. Your information passes through and is stored by these providers as needed for their function:

These providers process personal information on our behalf and under their own security and privacy commitments. We remain accountable under PIPEDA for personal information transferred to service providers. We do not authorize them to use your information for their own purposes except as inherent to the service they provide: Meta processes certain pixel and conversion data under its own privacy policy for its ad-delivery systems, as described in Section 5; PostHog acts solely as our processor for our own analytics and does not use the data for its own purposes.

5. Cookies, analytics, and advertising

• Essential cookie: an authentication session cookie keeps you signed in. It is necessary for the Service to function.
• Analytics (PostHog): used only on our purchase page — never on the logged-in course platform, the demo, or our /privacy, /terms, or /contact pages, with one exception noted below. A first-party cookie and browser storage hold a randomly generated, anonymous visitor and session ID (kept about 12 months); we use no third-party cookies, and analytics requests are routed through our own domain before reaching PostHog's US servers. PostHog records page views, clicks and on-page interactions (including the visible text of clicked elements), "dead clicks" (clicks that don't appear to do anything), aggregated click and mouse-movement data used to build heatmaps, scroll depth and page-leave behavior, page-load performance, a custom event when you start checkout, and a session recording — a reconstruction of scrolling, mouse movement, clicks, and what was on screen — for most visits (recordings under 2 seconds are skipped; browser console logs are captured as part of the recording; network data is limited to request timing only, not headers or message contents; and payment happens entirely on Stripe's domain and is never recorded). This automatically includes your IP address (used for approximate city-level location), browser/device/screen information, referrer and page URL, timezone, and any campaign or ad-click parameters in the URL. You are not identified by name or email through this page-level tracking, and PostHog does not build a named profile of you from it. Separately — for every completed purchase, regardless of page — our server records a purchase event in PostHog containing your email address in plain text, the purchase amount, currency, course purchased, Stripe checkout session ID, and, when available, the same anonymous visitor ID from your purchase-page visit, which links that visit's page-level activity (including any session recording) to your identity at the moment of purchase. This purchase event does not, on its own, create a persistent named profile in PostHog today. This data is used solely for our own analytics; we do not sell it, share it for advertising, or use it to track you across other sites. We honor the Global Privacy Control (GPC) signal for PostHog as well: if your browser sends GPC, PostHog does not load and no analytics cookies are set. We also filter out automated and bot traffic from our analytics.
• Advertising (Meta pixel and server-side events): on our purchase page only, the Meta pixel records a page-view event and sets two first-party cookies — _fbp and _fbc (the latter only if you arrived via a Meta ad link), each lasting approximately 90 days — to help Meta measure our ad campaigns and build audiences. Separately, our server sends Meta matching events at checkout and after payment is confirmed, containing the same cookies (if present), your IP address, your browser's user-agent, and — only after purchase — your email address in cryptographically hashed (not plain-text) form, together with the purchase amount and currency. Meta may associate this data with your Meta account under its own privacy policy. We honor the Global Privacy Control (GPC) signal: if your browser sends GPC, the pixel does not load and no Meta cookies are set for your visit. You can also limit this via Meta's ad settings (facebook.com/adpreferences) and your browser controls.
• Your choices: you can block or delete cookies in your browser, use tracking-protection features, or opt out via the controls above. Blocking the essential session cookie will prevent sign-in.

6. Where your information is stored

Our service providers store and process data in the United States and other jurisdictions outside Canada. While in a foreign jurisdiction, your information is subject to the laws of that jurisdiction and may be accessible to its courts, law enforcement, and national security authorities. By using the Service you acknowledge this cross-border processing. Questions about our use of foreign service providers can be directed to support@capstackcareers.com.

7. Retention

We keep account information and course progress for as long as your account exists (which, given permanent course access, may be indefinitely), and transaction records as required for tax and accounting purposes (generally at least seven years). Demo rate-limiting data is kept only briefly. Session recordings captured by our analytics tool are kept for 30 days; other analytics event data is retained under our provider's standard settings. Support correspondence is kept as long as reasonably needed. You may request deletion as described below; note that deleting your account ends your access to hosted course content.

8. Your rights

Under BC's PIPA and PIPEDA (whichever applies to you) you may request access to the personal information we hold about you, request correction of inaccuracies, withdraw consent (subject to legal or contractual restrictions — e.g., we cannot deliver the course without an email address), and ask questions or make complaints about our practices. Contact support@capstackcareers.com; we will respond within the timelines required by law. You may also complain to the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada. Quebec residents may have additional rights under Quebec's private-sector privacy law, and EU/UK purchasers may have rights under the GDPR/UK GDPR (including access, rectification, erasure, and portability), which we will honor where they apply.

9. Security

We use reasonable technical and organizational safeguards appropriate to the sensitivity of the information: payment handling is delegated entirely to Stripe, access to the course is via time-limited signed links, and internal access to customer data is restricted. No system is perfectly secure; we will notify affected individuals and authorities of any breach as required by law.

10. The free demo

The demo runs on a shared, read-only account: it stores no progress, creates no profile, and collects nothing beyond temporary IP-based rate limiting.

11. Changes to this policy

We may update this policy from time to time (for example, if our provider list changes). The current version, with its effective date, will always be posted on the site. Material changes affecting existing customers will be communicated by reasonable means.

12. Contact

Capstack Careers (a British Columbia general partnership) Attn: Privacy Officer 4288 Grange Street Burnaby BC V5H 1P2 Canada support@capstackcareers.com