What we collect, why we collect it, and how to get it back or deleted.
Cammino asks people about their job search, and some of what you tell us is personal. This page explains, in plain language, exactly what happens to it. If anything here is unclear, email hello@mycammino.com and ask.
Who we are
Cammino is a registered business name of CD Global Holdings Corp., an Ontario corporation that operates the service. We are responsible for the personal information described on this page. Questions, requests and complaints go to hello@mycammino.com, which reaches Chucks Daniel, our Privacy Officer. Our mailing address is CD Global Holdings Corp., PO Box 48006, 93 Dundas St W, Mississauga ON L5B 1H7, Canada.
What we collect, and when
If you join the waitlist
The four-question journey on our home page ends with an email field. If you complete it and press the button under it, we receive:
Your email address.
Where you are on your journey: recently moved to Canada, recently graduated, want to switch careers, or something else.
Where in Canada you are looking for work, if you choose to tell us.
What kind of work you are going for, in your own words.
Where your search feels stuck, chosen from four options.
You can skip any of the four questions and still leave your email. If you skip a question, we do not receive an answer for it. Waitlist answers are submitted only when you press that button. Ordinary website request information is collected when you visit, as explained below.
If you run a diagnosis without an account
The diagnosis is calculated in your browser. A resume file is opened on your device; the original file is not uploaded. Your browser keeps your resume text and intake answers until you clear them. We also store a guest result on our server in the United States: the report, reasons, roles, application counts, and the goal and field you typed. This record has a random claim code rather than an account name or email address. Free text or combinations of information may still identify you, so we treat the record as personal information. If you create an account and choose to save the result, we link it to that account. Otherwise, we delete it after 30 days. The guest result does not include your resume text or the separate city, province, arrival date, credential-country or work-status fields, but report text and your own words may reveal personal details. The guest tool's local download and deletion controls apply to your device copy. To ask us to delete an unclaimed server result sooner, contact us with its claim code; do not send us your resume. Guest results are not sent to Anthropic.
If you create an account
An account exists so that your work stops disappearing. When you create one, the following is stored on our servers, so that it is there when you come back:
Your email address, the name you give us, a password hash used to check your password, and your confirmation that you are 16 or over. Your account name is used to greet you; other members see only the display name you choose to share. We also keep account dates, communication preferences and security records needed to operate your account.
What you told the diagnosis: your city and province or territory, your goal and field, your applications and their outcomes, and your resume text. If you are a newcomer, optional answers also include your arrival month, where you studied or qualified, your work status and language-test information. These answers help tailor career guidance; we do not determine your legal permission to work. You may skip the newcomer questions. Do not provide passport numbers, Social Insurance Numbers or copies of immigration documents.
Every diagnosis you run, the applications you track, and how far you are through your plan.
Your listing, if you choose to make one: a display name, photo, one line about you, field, stage, where you trained and what you are open to. Listing and sharing controls are off by default. Other members see only information you choose to share. Your private work-status field and stored resume are not displayed to other members. Information you put in a shared field or message will be visible to its audience.
Your connections and messages, reports made by or about you, and relevant moderation decisions. When a conversation is reported, an authorised moderator may read that conversation to investigate and act on the report. We record moderator access and actions and restrict access to these records.
About the photo. A photo from a phone usually carries the place it was taken, the device that took it and the date. We remove all of that the moment it arrives, keep only the picture itself as one small square, and show it only to members you have allowed to see it. It is included in the copy of your data, it is deleted with your account, and a moderator can take it down if it is reported.
Download a copy on your profile provides your main account records, including your resume, diagnoses, AI results, tracked applications, plan progress, feedback, follow-up answers, messages and photo. It does not include every security, email or moderation record. You can request additional personal information by email; we assess applicable exceptions and protect other people's information. The account-deletion control asks for your password and confirmation, then removes active account records and the photo. Some copies and limited records remain for the periods explained below. If you cannot sign in, including because your account is suspended, contact us to exercise these rights.
Deleting an account removes the conversations involving that account from the active service, including the other participant's messages in those conversations. The other participant loses access to those conversations in Cammino. Either participant may already have saved a copy outside Cammino. We may preserve limited reported material where necessary to investigate a specific safety incident, comply with law or address a dispute, with restricted access and a documented retention period.
If you ask Cammino to read or write something for you
With an account, you can ask Claude, an AI model provided by Anthropic, to read your resume, compare it with a pasted job posting, prepare an interview answer or draft a cover letter. Each feature sends a request through our server to Anthropic only after you request it and receive the AI-processing notice. All four requests include your resume text. They may also include your goal, occupation and its ratings, career stage, province, diagnosis and supporting explanations. Posting features include the text you paste and, where relevant, the application outcome. Interview requests include the question, our preparation guidance and resume evidence. Cover-letter requests may expressly include the country where you qualified. Diagnosis text and your own words can also reveal credential country, application counts or other personal details.
We do not add your account name, account email address, account ID or the separate work-status field to AI requests. However, resume text, goals, postings and diagnosis explanations may themselves identify you or reveal sensitive information. Remove information you do not want processed before submitting it. We do not open a posting link; we process only the text you paste. An account is required for these features.
Anthropic processes requests under its Commercial Terms and incorporated Data Processing Addendum, which prohibit training its models on our customer content. Under its standard API retention policy, inputs and outputs are normally deleted within 30 days, with exceptions for applicable legal requirements, usage-policy enforcement or services with different retention arrangements. We do not have a zero-retention agreement. Deleting your Cammino account does not immediately erase Anthropic's retained copies. We save the returned reading with your account and remove our active copy when that account is deleted.
If you send us feedback
The Feedback button collects what you write, an optional rating and the screen you were on. Signed-in feedback is associated with your account and included in its download. We also email a copy, including your account email address if you are signed in, to hello@mycammino.com through Google Workspace. Guest feedback is not attached to an account, but what you write may identify you. Account deletion removes the account's database feedback; mailbox copies and guest feedback follow the retention periods below. Please leave out information we do not need to resolve the issue.
Emails and voluntary follow-up
We send requested password resets and, when enabled, notices of messages and connection activity. Four days after a diagnosis, we may send one optional follow-up asking whether you applied, obtained an interview or have not yet applied. We send at most one follow-up in a four-day period and do not send one for a diagnosis more than 21 days old. Its answer links identify the relevant account and diagnosis; we store the selected answer and time with your account to assess how useful the guidance is. Answering is optional and does not sign you in. You can change your answer using the links.
The unsubscribe link or profile email switch stops activity notices and diagnosis follow-ups. Requested password resets and necessary security, privacy or contractual notices are handled separately. We do not include conversation contents in activity emails or use open pixels. Copies of sent emails and feedback correspondence are held in Google Workspace under the retention rules below. Waitlist marketing is governed by the separate choice you make on that form.
Automatically, when you visit
Our hosts record ordinary request information, including your IP address and the requested path, for service operation and security. We keep short-lived records of failed sign-in, sign-up, reset and feedback attempts to limit abuse. We also record scrubbed technical faults and aggregate page counts. The marketing website at mycammino.com loads Google Fonts, which sends Google your IP address. The application at app.mycammino.com serves its own fonts. We do not use advertising trackers or analytics pixels. The application uses browser local storage for your working copy and authentication mechanisms to keep you signed in. On a shared device, sign out and use the local clearing controls when finished.
Why we collect it
We use waitlist contact information to send the launch link you requested and optional answers to prepare relevant guidance. We use account and diagnosis information to provide and save your career guidance, track your progress and deliver the AI features you request. We use shared profile information and messages to run the network, reported content to moderate it, feedback and voluntary follow-up answers to evaluate and improve the service, and limited technical information to secure and maintain it. We also keep necessary records to answer rights requests, meet legal obligations and resolve specific disputes.
We will explain a materially new purpose and obtain any consent the law requires before using your information for it. Optional AI processing, network sharing and marketing choices are separate from accepting the Terms of Service. You can decline optional features without losing the basic account features that do not need them.
What we do not do. We do not sell, rent or trade your personal information or supply it to employers, recruiters or advertisers for their own recruiting or advertising purposes. This does not prevent the sharing you choose through profiles and messages. We do not use your information to build a profile that follows you around the internet. Any materially different use would require a fresh explanation and any consent required by law before it begins.
Where your information is stored
Our website and waitlist submissions are hosted by Netlify and processed outside Canada, including in the United States. Cammino's account database and photos are hosted by Render in Ohio, United States. The AI material described above is sent to Anthropic for processing in the United States. Google Workspace handles our outgoing mail, received feedback and support correspondence; that information may be processed outside Canada, including in the United States. Provider support, security operations and subprocessors may involve additional locations under their applicable arrangements. Contact our Privacy Officer for information about those arrangements. We use service providers to perform these functions on our behalf and remain responsible for information under our control.
While your information is processed or stored outside Canada, it is subject to the laws of those countries. Their courts, law enforcement agencies and national security authorities may be able to compel access. No agreement with a provider can override those laws. We assess provider safeguards and use contractual protections appropriate to the processing. We explain US account storage before sign-up and Anthropic processing before an AI request; accepting our terms does not waive your privacy rights.
How long we keep it
We keep waitlist information until the earliest of these events:
You ask us to delete it.
You tell us you are no longer interested, or unsubscribe.
We close the waitlist or decide not to launch, or 90 days have passed since we sent the launch invitation.
Account information is kept while your account is active and needed to provide the service. You can request deletion at any time. After 24 months without a sign-in or other account use, we give at least 30 days' notice before closing an inactive account and deleting its active records. We do not close an account under this inactivity rule while it has an active paid subscription or unused purchased readings; we contact you to resolve those balances first. Suspended accounts are reviewed within 90 days and are not kept indefinitely simply because they are suspended.
Routine sent emails and their mailbox copies are deleted within 90 days of sending. Necessary contract, purchase and consent records follow the legal and consent-record rules below rather than this routine-email schedule. Guest feedback and routine feedback mailbox copies are deleted within 90 days of receipt. If a specific unresolved support matter, complaint, safety investigation or legal obligation needs part of a record longer, we keep only what is necessary, restrict access and review that need at least every 90 days. Signed-in feedback in the account follows the account-retention rule.
Unclaimed guest results expire after 30 days. Failed sign-in, sign-up, reset and feedback-attempt records are purged after 24 hours. Password-reset links expire after one hour and their database rows are purged after 48 hours. Sessions expire after 30 days; signing out ends that session, and we remove expired session records within 48 hours of expiry. Technical fault records are removed 30 days after the fault was last seen. Render's request-log retention is up to 30 days, depending on the hosting plan.
Render takes a persistent-disk snapshot approximately every 24 hours. Its published guarantee makes snapshots available for at least seven days after creation; it does not establish a maximum deletion period. Deleted database records and photos may therefore remain in backups for seven days or longer. Backups are restricted to disaster recovery, not ordinary account access. If we restore a backup, we reapply completed account deletions before returning the restored service to normal use. Contact our Privacy Officer for the current backup arrangements.
We keep necessary moderation records for up to 180 days after a matter is resolved, unless a specific continuing safety issue, dispute or legal duty justifies longer retention with periodic review. Removing an account identifier does not by itself anonymise a note; we remove identifying free text when it is no longer needed. Account-linked AI usage records follow account deletion unless converted to statistics that no longer identify a person; we retain only genuinely non-identifying aggregate statistics for longer.
We keep a minimal record of consent and withdrawal while relying on it and generally for three years after our last reliance, to demonstrate our handling of consent. A minimal suppression record may remain longer where needed to avoid sending unwanted messages; we review that need annually. These records are not used to restart marketing. Statutory breach records are kept for at least 24 months after we determine a breach occurred. If you later purchase a plan, necessary transaction and tax records are kept for the applicable legal retention period, generally six years from the end of the relevant tax year, rather than retaining your resume or messages for that purpose. A specific legal hold may require particular records to be kept longer. We delete retained personal information when the reason for keeping it ends.
Your rights
Email hello@mycammino.com to request access, correction or deletion, to withdraw consent, or to ask how we have used or disclosed your information. We may need reasonable information to verify your identity, but will not ask for more than is needed. You can:
Ask for your personal information, its sources, uses and disclosures. The profile download is a convenient starting point, not the limit of your access rights. Where a legal exception applies, we explain it and provide separable information where required.
Correct it if something is wrong or out of date.
Ask us to delete your account, waitlist entry, feedback or other personal information. Account deletion and waitlist removal are separate processes; tell us if you want both. Copies and limited records are handled under the retention section above. Deleting account data cannot retrieve copies another person already downloaded or saved.
Withdraw consent for optional processing or sharing. If you withdraw consent needed for a particular service, we explain which feature can no longer be provided. We stop the affected processing and delete information no longer needed, subject to applicable legal restrictions and the limited retention described above.
We respond to access requests within 30 days, subject to extensions permitted by law that we explain to you. We handle other rights requests promptly and within applicable legal deadlines. Our normal request process is free. If we cannot fulfil a request in whole or in part, we explain why and how you can complain.
Keeping it safe
Waitlist submissions and accounts are held in our providers' systems, reached over encrypted connections and protected by access controls. Passwords are stored as hashes, not readable passwords. We restrict access to people who need it for their work. No system is perfectly secure. We investigate privacy incidents, keep required records, and notify affected people and regulators when the applicable legal thresholds are met, including a real risk of significant harm under PIPEDA. We make those notifications as soon as feasible where that law requires it.
Children
Cammino's current service is intended for people aged 16 and over. If you are under 16, do not create an account, join the waitlist or submit personal information to us. We do not knowingly collect personal information from children under 16. If we discover such information, we stop the affected processing and arrange its deletion, subject to any limited legal retention requirement. Contact hello@mycammino.com if you believe a child has submitted information. People aged 16 or 17 may use the free service; purchasing requires the age of majority in the purchaser's province or territory.
If you are unhappy with how we handled your information
You can complain to our Privacy Officer at hello@mycammino.com. We will investigate and explain our response. You do not have to complain to us before contacting a regulator.
You may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376, or to a provincial privacy regulator where its law applies. Quebec's regulator is the Commission d’accès à l'information at cai.gouv.qc.ca. A restriction on accepting new users in a province does not remove rights relating to information we already hold.
Changes to this policy
If we change how we handle personal information, we update this page and its date. We bring material changes to affected account holders and waitlist members through appropriate direct notice, including email or an in-app notice. Where a change requires fresh consent, we ask before the new processing starts; silence or continued use is not a substitute for that consent.