This Privacy Policy (the “Policy”) describes how Flexibl Technologies Inc. (“Flexibl”, “we”, “our”, or “us”) collects, uses, discloses, protects, and retains Personal Information in accordance with the laws of the Province of Quebec, including the Act Respecting the Protection of Personal Information in the Private Sector, CQLR c. P-39.1 (“Law 25”), and the federal Personal Information Protection and Electronic Documents Act (“PIPEDA”).Capitalized terms not defined herein have the meaning set out in the Flexibl Terms of Use.By accessing or using the Flexibl website, Platform, or any related services (collectively, the “Services”), you acknowledge that you have read and understood this Policy and that your Personal Information will be handled in accordance with it.1. PURPOSE AND SCOPE OF THIS POLICYFlexibl provides a web-based Payment Intelligence platform allowing businesses to aggregate, visualize and analyze their payment and financial data through integrations with third-party payment processors.This Policy applies to:Individuals who create and use User accounts on the Platform (the “Users”);Visitors of the Flexibl marketing website (www.goflexibl.com);Any interactions with Flexibl in connection with the Services.This Policy does not apply to personal information of our clients’ customers included within Client Business Data imported into Flexibl through integrations. Flexibl processes such information strictly as a service provider on behalf of its clients and does not control its collection or accuracy.2. ROLES AND RESPONSIBILITIES WITHIN FLEXIBLPrivacy OfficerFlexibl has appointed a Privacy Officer responsible for:Implementing privacy policies and procedures;Responding to requests to access or correct Personal Information;Managing privacy incidents and reporting them when required by law;Overseeing compliance with Law 25 and PIPEDA.Contact information:Email: support@goflexibl.comMail: 158 rue des Fougères, Bromont, Quebec, Canada J2L 0P2Flexibl will respond to written requests within 30 days.Internal ResponsibilitiesFlexibl personnel are responsible for:Maintaining confidentiality obligations;Following internal access control procedures;Reporting any actual or suspected privacy incidents.Flexibl provides privacy awareness training to its employees.3. DEFINITIONS“Personal Information”Means any information relating to an identifiable natural person.Examples: name, email address, login information, device identifiers, IP address.“Client Business Data”Means non-User data provided or imported by Flexibl’s clients through integrations with payment processors (e.g., Stripe, Paysafe, Nuvei, Adyen). This may include transaction data or other business records relating to the client’s customers.Client Business Data is not considered Personal Information of the User.4. WHAT PERSONAL INFORMATION WE COLLECT ABOUT USERSFlexibl collects the following categories of Personal Information:Identity and Contact InformationFull nameEmail addressCompany affiliation (if applicable)Account InformationLogin credentials (processed through Amazon Cognito)Account settingsAuthentication and session identifiersTechnical and Usage Information (via cookies and tracking tools)IP address and geolocation approximationBrowser type, device type, operating systemPages visited, actions taken, session durationInteractions with our website or PlatformCollected through:Google AnalyticsHotjar (heatmaps, session recordings, behavior analytics)Lemlist website trackingCommunications with FlexiblEmails sent to FlexiblForms submitted through the websiteSupport or onboarding interactionsUploaded FilesUsers may upload documents or data files (e.g., CSV, Excel) required to use the Services.Flexibl does not collect credit card numbers or full payment card details. Payments are processed exclusively through Stripe Checkout or other hosted payment flows.5. HOW WE COLLECT PERSONAL INFORMATIONFlexibl collects Personal Information:Directly from UsersWhen creating or managing an accountWhen submitting forms or uploading filesWhen communicating with FlexiblAutomatically (via cookies and tracking tools)Google Analytics (usage analytics)Hotjar (behavior analytics, recordings, heatmaps)Lemlist (website visit tracking)Essential session cookies required for authenticationUsers may disable non-essential cookies through browser settings, though this may affect Platform performance.6. PROCESSING OF CLIENT BUSINESS DATAFlexibl integrates with third-party payment processors, currently including:StripePaysafeNuveiAdyenThrough these integrations, Flexibl processes Client Business Data solely to deliver the Services to the client.Flexibl acts exclusively as a service provider / processor and does not:Control how the client collects its customers’ dataDetermine the purposes for which Client Business Data is usedCommunicate Client Business Data to third parties except as required to provide the ServicesClient Business Data is processed under the contractual instructions of the client and is not governed by the User rights in this Policy.7. WHY WE USE PERSONAL INFORMATIONFlexibl uses User Personal Information strictly for the following purposes:To provide and administer the ServicesAuthenticate Users (Cognito)Enable access to the PlatformDisplay dashboards and featuresProcess file uploadsTo operate, maintain, and improve the PlatformMonitor performanceImprove UX and securityConduct analytics using GA and HotjarTo communicate with UsersTransactional emails (account notices, verification, technical alerts)No marketing or promotional emails are sentTo comply with legal obligationsFlexibl does not use User Personal Information for advertising, remarketing, or promotional messaging.8. THIRD-PARTY PROVIDERSFlexibl shares Personal Information with the following categories of service providers:A. Cloud Hosting and InfrastructureAmazon Web Services (AWS)Region: us-east-1 (North Virginia)Hosting, storage, infrastructure, encryption at rest/in transitB. AuthenticationAmazon CognitoC. Email and NotificationsAmazon Simple Email Service (SES)Amazon Simple Notification Service (SNS)D. Analytics & Tracking (Website and Platform)Google AnalyticsHotjarLemlist (website tracking only)E. Customer Relationship ManagementHubSpot (CRM; no tracking cookies used)Flexibl does not sell, rent, or disclose Personal Information to third parties for marketing or commercial purposes.9. INTERNATIONAL TRANSFERSPersonal Information is stored and processed on AWS servers located in:United States (us-east-1, North Virginia)Before transferring Personal Information outside Quebec, Flexibl conducts a privacy impact assessment as required by Law 25 and ensures that the foreign jurisdiction provides adequate protections.10. RETENTION AND DELETION OF PERSONAL INFORMATIONFlexibl retains Personal Information only as long as necessary to fulfill the purposes described in this Policy or as required by law.User Account DeletionWhen a User deletes their account:Flexibl deletes the User’s Personal Information (identity, contact, credentials, session data).Flexibl retains Client Business Data, as it belongs to the client company and is processed under its instructions.Backup and audit logs may persist for a limited period as required for security and compliance.11. SECURITY MEASURESFlexibl employs administrative, technical, and physical safeguards appropriate to the sensitivity of Personal Information, including:A. Access ControlsMulti-factor authentication (MFA) for employeesRole-Based Access Control (RBAC)Limited employee access on a need-to-know basisUser authentication via Amazon CognitoB. EncryptionTLS encryption for data in transitAWS default encryption (AES-256) for data at restC. Organizational SafeguardsEmployee confidentiality obligationsPrivacy awareness practicesIncident detection and response proceduresFlexibl relies on AWS’s industry-standard infrastructure protections.No representations are made regarding deeper encryption layers or configurations beyond AWS defaults.12. PRIVACY INCIDENTSFlexibl maintains processes for:Detecting, containing, and mitigating privacy incidentsAssessing risks of serious harmNotifying the Commission d’accès à l’information du Québec and affected individuals when legally required13. USER RIGHTSSubject to applicable law, Users have the following rights concerning their Personal Information:Right of accessRight to rectificationRight to withdraw consent (where applicable)Right to data portabilityRight to lodge a complaintRight to request deletion of their Personal InformationThese rights apply only to Personal Information of the User, not to Client Business Data.Requests must be submitted to the Privacy Officer.14. AMENDMENTS TO THIS POLICYFlexibl may update this Policy from time to time.Material changes will be communicated to Users by email or through the Platform.Continued use of the Services after an update constitutes acceptance of the revised Policy.15. CONTACT INFORMATIONQuestions regarding this Policy or the handling of Personal Information may be directed to:Privacy OfficerFlexibl Technologies Inc.Email: support@goflexibl.comAddress: 158 rue des Fougères, Bromont, Quebec, J2L 0P2, Canada