Privacy Policy

1Purpose, scope and identity of the business

1.1 Purpose

This Privacy Policy (the “Policy”) describes how OUIagent (the “Platform”, “we”, “our”, “us”) collects, uses, discloses, retains and protects the personal information of people who use the platform, whether they are clients seeking to engage the services of a security agent (the “Clients”) or licensed security agents offering their services on a self-employed basis (the “Agents”). Together, Clients and Agents are referred to as “Users”, a term defined in Section 2.

This Policy applies to all services offered by the Platform: the website, the responsive web application, the mobile application, transactional communications, and any related services (payments, messaging, licence verification).

1.2 Current status of the entity

“OUIagent” is the name of the platform. The entity operating the Platform has not yet been incorporated. Before any public deployment, the founding team will incorporate a corporation under the Canada Business Corporations Act under the name “OUIagent Inc.”.

1.3 Geographic scope and international expansion

The Platform is currently intended for residents of Canada, with an initial launch focused on Ontario and Québec and planned expansion to British Columbia, Alberta, Saskatchewan and Manitoba. This Policy is therefore structured around the Personal Information Protection and Electronic Documents Act (“PIPEDA / LPRPDE”), which applies in Ontario in particular, and Québec’s Act respecting the protection of personal information in the private sector (“Law 25”), the laws that actually apply to our current activities. If the Platform ever serves users outside Canada to an extent that triggers the application of other laws (e.g. the European Union’s General Data Protection Regulation, the California Consumer Privacy Act), this Policy will be updated with a complete and specific section covering those jurisdictions before any new market is opened.

2Definitions

• “User”: any individual who uses the Platform, whether as a Client (a person seeking to engage the services of a security agent) or an Agent (a licensed security agent offering their services on a self-employed basis).
• “Personal information”: any information about an identified or identifiable individual, within the meaning of PIPEDA and Law 25.
• “Sensitive information”: information that, because of its nature (e.g. a security agent licence number, government-issued identification, payment information), presents a high risk of harm to privacy in the event of a confidentiality incident.
• “Service provider”: any third party to which we entrust the processing of personal information on our behalf for a specific purpose (e.g. hosting, payment processing).
• “Confidentiality incident”: unauthorized access to, use or disclosure of personal information, or the loss of such information, within the meaning of section 3.5 of Law 25.
• “Person in charge of the protection of personal information” (Privacy Officer): the person designated within the business to oversee compliance with this Policy and the law.

3Personal information we collect

We apply the principle of data minimization: we collect only the information needed to operate the Platform securely and in compliance with applicable requirements. Some Users may choose to register or sign in to the Platform using third-party authentication provided by Google (or Apple, when available) instead of creating a separate password. In that case, we receive only the information the User authorizes those providers to share with us (usually the name and email address associated with the account), and we never receive the password for the User’s Google or Apple account. The use of Google Sign-In and Sign in with Apple is also subject to Google’s and Apple’s respective privacy policies.

3.1 Information specific to Agents

Because the profession is regulated, Agents must provide additional information so that the Platform can verify their status as licence holders:

• Personal identification at registration: first and last name, email address, telephone number, city;
• The security agent licence number issued by the competent provincial authority (the register maintained under Ontario’s Private Security and Investigative Services Act, 2005 (PSISA, or LSPSE in French), the Bureau de la sécurité privée (“BSP”) in Québec, or the equivalent authority in other provinces);
• One (1) valid government-issued identity document (driver’s licence, passport or provincial identity card), used only to confirm that the Agent is the holder of the declared licence;
• Professional information: experience, hourly rate, skills, additional certifications, availability, service history, reviews received;
• Tax information required to process payments and produce tax documents (see Section 3.3);
• Approximate location for matching with requests from nearby Clients.

Note: We do not carry out an independent criminal background check ourselves: this check is already performed by the provincial authority (e.g. under the PSISA/LSPSE in Ontario, the BSP in Québec) before a security agent licence is issued. We rely on the validity of that licence, verified manually (see Section 6), as a condition of access to the Platform.

3.2 Information specific to Clients

• Personal identification at registration: first and last name, email address (verified using a code sent to that address), telephone number (used for security and emergency contact purposes, never displayed or shared with Agents) and city;
• Details of posted contracts (service type, location, dates, start time, duration, number of Agents, hourly rate) and selection of Agents;
• Contract history, associated payment receipts, messages exchanged with Agents and reviews given to Agents;
• Where applicable, information about a client business (trade name, business address) when a booking is made on behalf of an organization.

3.3 Payment and tax information

Payments on the Platform are processed through the Stripe Connect integration. Stripe is the direct service provider that processes Users’ payments. The Client makes their payment on Stripe’s hosted checkout page, where they enter their payment information directly (card number, digital wallet), which we neither receive nor store, along with the email address to which the receipt is sent. Stripe may retain the Client’s payment method to allow a charge for a contract extension requested by the Client and accepted by an Agent. The Platform does not offer Clients card management. Stripe automatically emails a payment receipt to the Client. Only Agents are asked to provide Stripe with banking and tax information when opening their payment account (e.g. forms relating to self-employed status), as needed to pay their earnings and produce the appropriate tax documents (including T4A slips).

Note: We never store full payment card numbers or banking details ourselves. This information is transmitted directly to Stripe and managed in accordance with the Payment Card Industry Data Security Standard (PCI DSS), as set out in Section 7.

3.4 Information generated through use of the Platform

When the Platform is used, we also collect:

• Messages exchanged through the integrated messaging service and communications with our support team (email form, contact requests);
• Activation codes, contract start and end timestamps, extension requests and their responses (acceptance, refusal or no response), and the corresponding payment;
• Where a report is submitted under the Terms of Use (activation code not obtained), the photograph of the service location submitted by the Agent;
• Reviews (rating and comment) left by a Client about an Agent;
• The Agent’s availability and alert preferences (e.g. minimum hourly rate), and notifications sent;
• Technical data and security logs (IP address, device, timestamps).

4Purposes of collection and use of information

We use personal information only for the following purposes, and for no other purpose without obtaining additional consent:

• Create and administer the User’s account;
• Verify the validity of an Agent’s licence and their identity before allowing them to offer services on the Platform;
• Enable matching between Clients and Agents, bookings and contract management;
• Publish contracts to eligible Agents in the area, manage interested Agents, Agent selection and contract confirmation, as well as activation codes and extensions;
• Process payments through (Stripe), calculate the Platform’s commission and produce the required (Stripe) tax documents;
• Have Stripe send the Client their payment receipt and make it available in their contract history;
• Provide secure messaging between the parties to a booking;
• Publish and display Agent reviews, and send notifications relating to contracts and the alerts configured by Agents;
• Keep the Platform secure, prevent fraud and enforce our Terms of Use;
• Respond to support requests and communicate about the User’s account;
• Inform you, with your consent, about new features, offers or promotional communications relating to the Platform;
• Meet our legal, tax and regulatory obligations;
• Improve the Platform using aggregated and anonymized usage statistics.

We do not use personal information for third-party behavioural advertising, and we do not sell personal information.

Note: In accordance with Canada’s Anti-Spam Legislation (CASL), any commercial electronic message (email, text message) we send you is subject to your consent and includes a clear, functional unsubscribe mechanism. You may withdraw your consent to receive these communications at any time, without affecting transactional communications essential to the operation of your account (e.g. booking confirmations, security notices, discussions between users).

Personal information that we aggregate and/or anonymize so that it can no longer identify an individual is no longer considered personal information under this Policy. We may use and disclose such aggregated or anonymized data, including for statistical purposes, market analysis or presentations to partners or investors, without additional restriction.

5Legal basis and consent

In accordance with PIPEDA and Law 25, we collect, use and disclose personal information only with the consent of the individual concerned, except where provided for by law (e.g. performance of a contract, legal obligation).

• Consent to the collection of information needed to create an account and provide the service is obtained at registration through acceptance of this Policy and the Terms of Use;
• Consent to licence and identity verification is separate and explicit, and is obtained when registering as a security Agent;
• Consent to Stripe retaining the payment method for a charge relating to a contract extension is obtained at the initial payment;
• For any sensitive information (e.g. identification), consent is express, freely given and informed, and is given for specific purposes;
• The User may withdraw consent to optional processing at any time, subject to Sections 9 and 10 concerning legally required retention.

6Verification of Agents’ licences and identities

Before being admitted to the Platform, every security Agent undergoes manual verification by our team:

• The declared licence number is checked manually on the appropriate government website, the official register for the province concerned, primarily the register maintained under the PSISA (LSPSE) in Ontario at launch, or the Bureau de la sécurité privée (BSP) for Québec;
• The government-issued identification provided is compared manually with the declared information to confirm that the licence holder is the person registering on the Platform;
• A “Verified Agent” badge is added to the Agent’s profile only after both verifications have been completed successfully.

6.1 Retention of identification

The copy of government-issued identification submitted by an Agent is retained for a maximum of 30 days after verification is completed, after which it is securely deleted from our systems. Only the minimum necessary metadata (name, document type, validated licence number, verification date) is kept in the security Agent’s file after that period.

Note: This 30-day period is an operational commitment by the Platform, aligned with recognized industry practices, and is not a period prescribed by law. The law (PIPEDA, Law 25) instead imposes a principle: retain information only for as long as necessary for the purpose for which it was collected. The 30-day period is our reasonable, documented application of that principle to this type of sensitive information.

7Disclosure of your information to third parties

We disclose personal information only to the following third parties, each acting as a service provider bound by a confidentiality and data protection agreement, and only to the extent necessary to perform its function.

• Supabase: the Platform’s database and authentication infrastructure, all account, booking and messaging data
• Vercel: web application hosting and delivery, technical browsing data; no sensitive information stored directly
• Stripe (Stripe Connect): payment processing between Clients and Agents, emailing receipts to Clients, retaining payment methods for extensions, managing Agents’ banking and tax information and producing tax documents (e.g. T4A), Clients’ payment information and email addresses, Agents’ financial and tax information
• Provincial government authorities (e.g. PSISA/LSPSE in Ontario, BSP in Québec): manual verification of the validity of a security agent licence number, licence number (consultation only, no transmission of a complete file)
• Google (Google Sign-In) and, when available, Apple (Sign in with Apple), optional third-party authentication at registration and sign-in, the name and email address associated with the User’s Google or Apple account, according to the permissions they grant

We may also disclose personal information: 1. Where required or permitted by law (e.g. a court order, a request from a competent regulatory authority); 2. As part of a business transaction (merger, acquisition), subject to appropriate notice or with the User’s explicit consent.

An Agent’s profile publicly displays certain information to potential Clients (name, profile photo, skills, reviews, verification badge), never the full licence number, identification or financial information. A selected Agent receives the contract details needed to carry out the work (location, date, duration). The Client’s telephone number and email address are never shared with the Agent.

7.1 Links to third-party websites

The Platform may contain links to third-party websites or services, including the government licence verification registers mentioned in Section 6 and the Google, Apple (when available) and Stripe pages used for authentication and payments. This Policy applies only to personal information we collect directly through the Platform. It does not govern the privacy practices of those third-party websites or services. We encourage each User to review the privacy policy of each third-party website before providing personal information to it, as that policy will apply once the User leaves the Platform to visit it. We are not responsible for the content, privacy practices or security of those third parties.

8Hosting and data transfers

To the extent supported by our providers’ technical capabilities, we favour hosting personal information in data centres located in Canada. Some of our service providers (including Supabase, Vercel and Stripe) may, depending on their technical architecture, process or store data outside Canada, including in the United States.

In accordance with PIPEDA’s accountability principle, which applies in Ontario in particular, we remain responsible for personal information entrusted to our service providers, including when it is processed outside Canada, and we contractually ensure a comparable level of protection, including by reviewing each provider’s contractual clauses and security certifications (e.g. SOC 2, ISO 27001). In addition, in accordance with section 17 of Law 25, before any disclosure of personal information outside Québec, we specifically conduct a privacy impact assessment (“PIA”) to ensure that the information receives protection considered equivalent to that provided in Québec.

9Retention of information

• Copy of identification (Agents): 30 days after verification, followed by secure deletion
• Active account file (Client or Agent): for the duration of active use of the Platform
• Transaction and tax records (payments, commissions, T4A): 6 years after the end of the relevant fiscal year, in accordance with the requirements of the Canada Revenue Agency and Revenu Québec
• File after an account is closed: up to 6 years after the last activity, only to the extent required by our legal and tax obligations, followed by deletion or anonymization
• Security and technical logs: 12 months, unless a security investigation is underway
• Messages, activation codes, timestamps, extensions, contract history, reviews and report photographs: for the duration of active use of the account, followed by limited retention as evidence in the event of a dispute, for a period of [TO BE CONFIRMED WITH ME ALEMIAN: retention period], followed by deletion or anonymization;
• Payment receipts: retained by Stripe and accessible to the Client in their contract history, according to the retention periods set out above for transaction records.

When the applicable retention period expires, personal information is securely and irreversibly destroyed, erased or anonymized.

9.1 Closing an account

When a User closes their account, their profile is immediately removed from search results and the Platform’s public display. However, messages already sent to another User before the account was closed may remain visible in the recipient’s inbox, since we do not control the copy already received by the recipient. We may also retain certain information after an account is closed, only to the extent necessary to prevent fraud, meet a legal or tax obligation, assert our rights in a dispute, or maintain our accounting records, in accordance with the retention periods set out above.

10Your rights

In accordance with PIPEDA and Law 25, each User has the following rights regarding their personal information:

• Right of access: obtain a copy of the personal information we hold about them;
• Right to rectification: have inaccurate, incomplete or outdated information corrected;
• Right to portability: receive the computerized personal information they have provided in a structured, commonly used technological format, or have it transferred directly to a third party, where provided for by law;
• Right to withdraw consent: withdraw consent to optional processing at any time without affecting the lawfulness of processing carried out before withdrawal;
• Right to de-indexing and erasure: request deletion of personal information, subject to the legal and tax retention obligations described in Section 9;
• Right to lodge a complaint: with our Privacy Officer (Section 14) and, if the response is unsatisfactory, with the Office of the Privacy Commissioner of Canada or, for Québec residents, the Commission d’accès à l’information du Québec (CAI), as applicable.

Any request may be made in writing using the contact information in Section 19. We respond to requests within a reasonable time and no later than 30 days after receipt, in accordance with the law.

10.1 Your practical choices

In addition to the formal rights described above, each User has the following practical choices, which they can exercise directly:

• Unsubscribing from alerts: email and SMS notifications for promotional purposes (Section 4) may be disabled at any time in account settings or through the unsubscribe link included in each commercial communication. Essential transactional notifications (e.g. booking confirmations) cannot be disabled while the account remains active;
• Revoking Google or Apple sign-in: a User who registered or signed in using Google Sign-In or Sign in with Apple (Section 3.1) may revoke the access granted to the Platform directly in the privacy settings of their Google or Apple account, ending the sharing of information by that provider;
• Managing location permissions: if the User has authorized the Platform to access their location (through their browser or, eventually, a future mobile application) for matching purposes (Sections 3.1 and 3.2), they may withdraw this authorization at any time in their browser or device settings. This withdrawal is taken into account within a maximum of 10 days after it is received.
• Availability and alerts (Agents): the Agent may change their availability and alerts (e.g. minimum hourly rate) at any time from their dashboard.

11Security measures

We implement administrative, organizational and technical security measures proportionate to the sensitivity of the information processed, including:

• Encryption of data in transit (HTTPS/TLS) and at rest, where technically available from our service providers;
• Secure account authentication and access management based on the principle of least privilege;
• Access restricted to personnel and service providers whose duties require it, subject to confidentiality obligations;
• Secure deletion of identification in accordance with the period set out in Section 6.1;
• Periodic review of our security practices and those of our service providers (Supabase, Vercel, Stripe), including through their published security certifications.
• The Platform maintains appropriate insurance coverage, including cyber liability insurance, to support its security measures and its ability to respond adequately to a confidentiality incident.
• No security measure is infallible. In the event of an incident, the procedure in Section 12 applies.

12Confidentiality incidents

In accordance with PIPEDA, which applies in Ontario in particular, if a breach creates a real risk of significant harm to an affected individual, we undertake to:

• Take reasonable measures to reduce the risk of harm and prevent further incidents;
• Notify the Office of the Privacy Commissioner of Canada promptly, in accordance with legal requirements;
• Notify any affected individual whose personal information is involved in the incident promptly;
• Keep a record of data security breaches, in accordance with the law.
• For affected individuals in Québec, an equivalent and strengthened mechanism applies under section 3.5 and following of Law 25: any confidentiality incident presenting a risk of serious injury must also be reported to the Commission d’accès à l’information du Québec (CAI), in addition to the measures above.

13Automated decisions and matching

The Platform may use automated criteria (e.g. geographic proximity, availability, hourly rate, reviews) to suggest a list of security Agents matching a Client’s request. This process is intended only to make searching easier and does not constitute an automated decision having a legal or significant effect on an individual. The final selection of an Agent remains at the Client’s discretion. No decision based exclusively on automated processing affects an Agent’s eligibility for the Platform. Licence verification continues to be performed manually, as described in Section 6. The Platform also automatically limits, in order of receipt, the number of Agents who may express interest in the same contract. This limit is not based on an assessment of the individual.

We may also use artificial intelligence or machine learning tools, operated by us or by a service provider bound by a confidentiality agreement, to moderate content (e.g. messages exchanged between a Client and an Agent) and detect fraudulent or suspicious activity, with the aim of maintaining a secure platform. These tools may process certain personal information and account activity content for that specific purpose. No information that can personally identify you is used to train third-party providers’ artificial intelligence models, unless expressly stated otherwise in this Policy or required by law.

14Person in charge of the protection of personal information

Requests addressed to the Privacy Officer may be sent to privacy@ouiagent.com

15Cookies and similar technologies

The Platform uses cookies that are strictly necessary for its operation (e.g. maintaining the sign-in session) and, where applicable, analytics cookies used to measure general, anonymized use of the Platform. No third-party advertising cookies are used at this stage. The User may configure their browser to refuse non-essential cookies, which may limit certain features.

16Collection of information from children

The Platform is reserved for people aged 18 or older, both Clients and Agents, a condition consistent with the legal requirements for the issuance of a security agent licence. We do not knowingly collect personal information from minors. Any account that we learn was registered by a minor will be closed and the associated information deleted.

17Links to other websites

Links to third-party websites and services are governed by Section 7.1 of this Policy.

18Changes to this Policy

OUIagent reserves the right to amend this Privacy Policy and our Terms of Use at any time. We will notify you of any material, adverse change to this Privacy Policy or our practices, in accordance with applicable legislation. Material, adverse changes will take effect 30 days after notice is given. Minor changes or clarifications will take effect immediately upon publication of the updated policy on our Platform. We encourage you to review this page regularly for updates. Your use of the Platform or Services after these changes take effect will constitute your acceptance of them.

19Contact us

To exercise your rights and make your privacy choices (Section 10), please contact us by email at legal@ouiagent.com for any other questions concerning this Policy:

• OUIagent Inc. (corporation in the process of incorporation) Attention: Legal Department [Registered office address — Ontario]