Pandacat Inc. ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website, use our Client Portal, or engage with our services (collectively, the "Services"). It is intended to comply with Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") and Quebec's Act respecting the protection of personal information in the private sector ("Law 25"). Please read this policy carefully. If you do not agree with it, please do not access our Services.

1. Privacy Officer

In accordance with PIPEDA and Quebec's Law 25, we have designated a Privacy Officer who is responsible for our compliance with applicable privacy laws and for handling access, correction, and other privacy requests. You may contact our Privacy Officer at:

Privacy Officer — Pandacat Inc.
Email: privacy@pandacat.ca

2. Information We Collect

We may collect information about you in a variety of ways, including:

• Personal Data: Personally identifiable information, such as your name, business name, shipping or billing address, email address, and telephone number, that you voluntarily provide when you register for our Client Portal, use our Services, or otherwise communicate with us.
• Financial Data: We use Stripe as a third-party payment processor. All payment card information is collected and stored by Stripe. We do not store or collect your full payment card details. You are encouraged to review Stripe's privacy policy.
• Data from Client Services: In the course of providing our Services, you may upload files, task data, and other information to our platform (e.g., through the task management system). This data is stored securely and treated as confidential.
• Derivative Data: Information our servers and service providers automatically collect when you access the Services, such as your IP address, browser type, operating system, access times, and the pages you have viewed.

3. How We Use Your Information

We use the information we collect for the following purposes, and only for purposes a reasonable person would consider appropriate in the circumstances:

• Create and manage your account and provide the Services you request.
• Process your payments and manage your subscriptions.
• Communicate with you regarding your account, orders, and support requests.
• Send account alerts and, where you have consented, informational or promotional messages.
• Resolve disputes, troubleshoot problems, and prevent fraud or abuse.
• Monitor and analyze usage and trends to maintain and improve the Services.
• Comply with our legal and regulatory obligations.

4. Consent

We collect, use, and disclose your personal information with your consent, except where permitted or required by law. By providing your information and using the Services, you consent to the practices described in this policy. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting our Privacy Officer. Withdrawing consent may limit or prevent our ability to provide certain Services.

5. Disclosure of Your Information

We do not sell, rent, or trade your personal information. We may share information in the following limited circumstances:

• Third-Party Service Providers: We share information with providers who perform services on our behalf, including payment processing (Stripe), cloud hosting and authentication (Google Firebase / Google LLC), and email delivery. These providers are authorized to use your information only as necessary to provide services to us.
• By Law or to Protect Rights: We may disclose information where required to respond to legal process, enforce our policies, or protect the rights, property, and safety of Pandacat Inc., our users, or others.
• Business Transfers: We may disclose or transfer information in connection with a merger, financing, acquisition, or sale of all or part of our business.

6. Cross-Border Transfer and Storage of Information

Our Services are hosted using Google Firebase and Stripe. As a result, your personal information may be transferred to, stored, and processed in the United States and other jurisdictions outside of Quebec and Canada. These jurisdictions may have data protection laws that differ from those in your province or country, and your information may be accessible to foreign courts, law enforcement, and governmental authorities under the laws of those jurisdictions.

When we transfer personal information outside of Quebec or Canada, we do so in accordance with PIPEDA's transborder data flow requirements and Quebec's Law 25, and we take reasonable contractual and technical measures — including relying on our service providers' data processing agreements and standard contractual safeguards — to ensure your information receives a comparable level of protection. By using the Services, you acknowledge this transfer, storage, and processing of your information outside your province and country.

7. Data Retention

We retain personal information only as long as necessary to fulfil the purposes for which it was collected, to provide the Services, and to meet our legal, tax, and regulatory obligations. Illustrative retention periods include:

• Account information: for the duration of your account and up to seven (7) years after account termination.
• Payment and billing records: typically seven (7) years, as required by applicable tax and accounting laws.
• Support and communications records: for as long as reasonably necessary to address your inquiries and maintain our records.
• Security and access logs: for a limited rolling period.

When personal information is no longer required, we will destroy, erase, or anonymize it in accordance with applicable law.

8. Security of Your Information

We use administrative, technical, and physical safeguards to protect your personal information, including Firebase's built-in security features, secure data storage, and authentication mechanisms. While we take reasonable steps to secure your information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Data Breach Notification

We maintain a register of confidentiality incidents. In the event of a confidentiality incident or data breach that presents a risk of serious injury or is otherwise reportable, we will notify affected individuals and the applicable regulatory authorities — including the Commission d'accès à l'information (Quebec) and/or the Office of the Privacy Commissioner of Canada — as required by Law 25, PIPEDA, and other applicable laws, within the timeframes those laws prescribe.

10. Your Privacy Rights

Depending on your location, you have rights regarding your personal information. To exercise any of these rights, contact our Privacy Officer at privacy@pandacat.ca. We will respond within the timeframes required by applicable law.

All users may request to:

• Access the personal information we hold about you.
• Correct or update inaccurate or incomplete information.
• Withdraw consent, subject to legal or contractual restrictions.
• Request deletion or deactivation of your account and information.

Quebec residents (Law 25) additionally have the right to:

• Data portability: receive the computerized personal information you have provided to us in a structured, commonly used technological format.
• De-indexing / cessation of dissemination: request that we stop disseminating your personal information or de-index it where the law provides.
• Information about automated decisions: be informed if a decision affecting you is based exclusively on automated processing, and request that it be reviewed. Pandacat Inc. does not currently make decisions about you based exclusively on automated processing.

Upon a valid request to terminate your account, we will deactivate or delete your account and information from our active databases, though some information may be retained where necessary to prevent fraud, comply with legal requirements, resolve disputes, or enforce our agreements.

11. Cookies and Tracking Technologies

We use cookies and similar technologies that are strictly necessary to operate the Services, including for authentication, session management, and security (for example, Firebase Authentication session cookies). You may configure your browser to refuse cookies, but doing so may prevent you from logging in or using certain features. Where we use any non-essential cookies or analytics in the future, we will obtain consent as required by applicable law.

12. Children's Privacy

Our Services are intended for users who are at least 18 years of age and are not directed at children. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact our Privacy Officer so we can delete it.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be effective upon posting the updated policy, and we will update the "Last Updated" date above. Where required by law, we will provide additional notice of material changes. We encourage you to review this policy periodically.

14. Language

This Privacy Policy is available in English and French. You may switch languages using the toggle at the top of this page.

15. Contact Us

If you have questions, comments, or complaints about this Privacy Policy or our handling of your personal information, please contact:

Privacy Officer — Pandacat Inc.
Email: privacy@pandacat.ca