LINKIFY REWARDS — PRIVACY POLICY

DRAFT — pending legal review; not legal advice. This is an in-house draft produced from the Linkify Rewards decision register (LR-ENG-001 and LR-BUS-001 only) for review by Linkify's counsel before publication. It is not legal advice. Items in square brackets are facts to be confirmed by Linkify or resolved with counsel; nothing has been invented beyond the decision register.

1. INTRODUCTION

1.1 Linkify Solutions Inc. ("Linkify", "we", "us", "our") operates Linkify Rewards ("the Service"). This Privacy Policy explains what personal information we collect, why we collect it, how we use it, what participating merchants can see about you, and your rights.

1.2 Our registered office is at [registered address of Linkify Solutions Inc. — to be inserted].

Basis: LR-BUS-001 §1.1 (operator of record: Linkify Solutions Inc.).

1.3 We are accountable for the personal information under our control and comply with PIPEDA.

Basis: PIPEDA (accountability principle).

2. PERSONAL INFORMATION WE COLLECT

2.1 Account information. Your email address, mobile phone number and name, and sign-in credentials. Every account holds both an email address and a mobile phone number. You sign in with a one-time code sent to your email address or, when available, with a one-time code sent by text message to your mobile phone number, or with Apple/Google sign-in. Your email address is verified by a code we email to it, and your phone number is verified by a code we text to it: the number becomes your account's verified number once you enter that code. If we cannot send that code when you sign up, we hold the number unverified, apart from your verified details, until you confirm it; we send no text messages to it and use it for nothing else until then. We store phone numbers in international (E.164) format and use the verified number to sign you in and to send you the text messages described in Section 7. We also store a salted, non-reversible hash of your email address and of your verified phone number, used only to detect duplicate accounts.

Basis: LR-ENG-001 §2.6.a (email OTP + Apple/Google sign-in), §2.6.b (hashes of email and phone for uniqueness); LR-TS-000 P0-R32 (identity hashes), P0-R36 (phone-number identity); LR-DEC-001 §9 (phone sign-in in the app, owner decision 2026-09-27; numbers stored in E.164; a number verified after sign-up counts toward the duplicate-account check); owner decision 2026-09-27 (every account holds an email and a phone number; the number is verified by text code; if that code cannot be sent, the number is held unverified and receives no texts until confirmed).

2.2 Device information. A device token used for secure-store device binding, which supports fraud prevention.

Basis: LR-ENG-001 §2.6.b (device binding using the secure-store device-token mechanism); §8.3.

2.3 Transaction and points information. Your Points balances and history, visits, orders, and tender composition at each merchant.

Basis: LR-BUS-001 §5.4.c (tender composition displayed); §5.2.

2.4 Shop points, the Linkify wallet and coupons. Points you earn at a merchant are kept in a separate wallet for that merchant and are spent there, for free product funded by that merchant. Linkify also gives you points of its own, free, in a separate Linkify wallet. Discount coupons are the only thing that works across merchants, and a coupon can be paid for with points from any of your wallets. The Service is free for you, always.

Basis: LR-BUS-001 §5.1, §5.1.1–§5.1.4, §11. Load-bearing for the tax treatment (LR-ENG-001 §7.1).

2.5 Payment information. Payments you make through the Service are processed by our payment processor; we do not store full payment card numbers.

Basis: LR-BUS-001 §8.1 (Stripe Express connected accounts; merchant of record).

2.6 We do not collect more personal information than is needed for the purposes described in this Policy.

Basis: PIPEDA (limiting collection).

2.7 Website visitors. If you use the website without an account, we collect only the information described in Section 9.

Basis: LR-TS-WEB WEB-R49 (website forms), WEB-R50 (website analytics).

3. HOW WE USE PERSONAL INFORMATION

3.1 We use personal information to:

• operate the Service, including earning, redemption, the wallet pass, and checkout;
• verify identity, detect fraud, and prevent abuse (including one-per-person offers);
• send sign-in codes and security alerts by text message, and push notifications and promotional text messages you have opted into (see Section 7);
• respond to waiting-list sign-ups and partner enquiries made through the website (see Section 9);
• provide support; and
• meet legal and regulatory obligations.

Basis: LR-ENG-001 §2.6, §2.12, §8.6; LR-TS-WEB WEB-R49 (website forms); PIPEDA.

3.2 We use the cross-merchant view of activity only to operate the Service and to support the platform's purposes; individual merchants do not see your activity outside their own locations (see Section 5).

Basis: LR-ENG-001 §8.5 (only Linkify holds the full graph).

4. CONSENT

4.1 We rely on your consent to collect, use, and disclose your personal information, except where PIPEDA permits collection, use, or disclosure without consent. Where required, we obtain consent when you create an account, when you opt in to notifications or text messages, and when your information is needed for a purpose not otherwise expected.

Basis: PIPEDA (consent principle).

4.2 You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawal may affect your ability to use parts of the Service (for example, push notifications).

Basis: PIPEDA (withdrawal of consent).

5. WHAT MERCHANTS CAN SEE

5.1 A participating merchant sees a limited customer profile: your first name and last initial; your visit and Points history at that merchant's locations only; and segment tags (new/regular/lapsed).

Basis: LR-ENG-001 §8.5 (first name + last initial; own-location visit/points history; segment tags).

5.2 A merchant does not see your email address, your phone number, or your behavior at other merchants. Merchants do not contact you directly; campaigns reach you through the platform.

Basis: LR-ENG-001 §8.5 (no email, phone, or cross-merchant behavior; campaigns reach customers through the platform).

5.3 Only Linkify holds the full cross-merchant view.

Basis: LR-ENG-001 §8.5 (only Linkify holds the full graph).

6. DISCLOSURE AND SERVICE PROVIDERS

6.1 We disclose personal information to service providers who help operate the Service, subject to contractual safeguards. Current categories of providers include:

• cloud hosting and media storage [providers — confirm; e.g., [OCI VM], [Cloudflare R2]];
• website hosting, content delivery, and image processing (Cloudflare);
• email delivery;
• text-message delivery (Twilio; Amazon Web Services, through AWS End User Messaging SMS and Amazon SNS);
• payment processing (Stripe);
• error and crash monitoring (GlitchTip);
• product analytics (PostHog); and
• session replay in the mobile application only (PostHog, with masking enabled); the website does not use session replay (see Section 9).

Basis: LR-ENG-001 §4 (analytics/observability stack: GlitchTip, PostHog incl. session replay — Clarity dropped, owner decision 2026-08-15); LR-BUS-001 §8.1 (Stripe); LR-DEC-001 §8 (SMS on Twilio and AWS SNS, owner decision 2026-09-25); LR-TS-WEB WEB-R57 (website served from Cloudflare Workers), WEB-R50 (no session replay on the website; Microsoft Clarity deferred until counsel signs off this Policy, owner decision 2026-09-21).

6.2 We do not sell personal information.

Standard; consistent with LR-ENG-001 §8.5.

6.3 We may disclose personal information where required by law, or to protect our rights, the rights of others, or the security of the Service.

Basis: PIPEDA (disclosure without consent where required by law).

7. PUSH NOTIFICATIONS AND TEXT MESSAGES

7.1 We send push notifications only with your consent (opt-in).

Basis: LR-ENG-001 §8.6 (pushes to opted-in customers).

7.2 Notifications are subject to per-merchant monthly quotas and enforced quiet hours. Cross-merchant discovery notifications are curated by the platform.

Basis: LR-ENG-001 §8.6 (per-merchant quota 2–4; quiet hours; platform-curated digests).

7.3 You may change your notification preferences or withdraw consent at any time through the Service.

Basis: LR-ENG-001 §8.6; PIPEDA (withdrawal of consent).

7.4 Text messages (SMS). Linkify Rewards sends text messages to a mobile phone number only for the account that number belongs to. We send three kinds:

• Verification codes: a one-time code, sent when you ask to sign in with your phone number or to add a number to your account;
• Security alerts: messages about the security of your account; and
• Promotional messages: offers and news available through the Service, sent only if you have given the separate, optional consent in Section 7.5, and no more than 4 a month.

Basis: owner decision 2026-09-27 (one combined text-message program: verification codes, security alerts and promotional messages, at most 4 promotional messages a month); LR-DEC-001 §9 (phone sign-in in the app).

7.5 Consent to text messages. You agree to receive verification codes and security alerts at your mobile number when you enter it on a screen that shows these text-message terms. Promotional text messages need a separate consent: an optional setting, off until you turn it on. You do not have to agree to promotional text messages to use the Service or to buy anything. We keep a record of each consent you give so that we can show you agreed: a salted, non-reversible hash of the number (not the number itself), what you agreed to, when, which version of the wording you were shown, and on which screen. [Retention period for text-message consent records after an account is deleted — confirm.]

Basis: LR-DEC-001 §9 (SMS consent wording on the phone sign-in screens, owner decision 2026-09-27); owner decision 2026-09-27 (consent given on the screen showing the disclosures; separate, optional promotional opt-in in Settings; consent records keyed by a salted hash of the number and kept as opt-in proof); PIPEDA (consent principle).

7.6 Frequency and cost. Message frequency varies. Verification codes are sent only when you ask for one, and promotional messages are limited to 4 a month. Linkify does not charge for text messages, but message and data rates may apply under your mobile plan.

Basis: owner decision 2026-09-27 (frequency and rates disclosure; at most 4 promotional messages a month); LR-DEC-001 §8 (Linkify pays all SMS costs).

7.7 Opting out. You may withdraw consent to text messages at any time:

• reply STOP to any text message from us, and we will send no further text messages to that number, including verification codes, until you reply START;
• reply START to receive text messages again; or
• turn promotional text messages off in the Service's Settings, which leaves verification codes and security alerts on.

A STOP reply applies to every provider we send through. We record it as a salted, non-reversible digest of the number rather than the number itself, and check that record before any text message is sent.

Basis: LR-DEC-001 §8 (Linkify's own opt-out list is checked before either provider sends; no SMS is sent until inbound STOP and START are recorded for both providers); owner decision 2026-09-27 (promotional opt-in controlled in Settings); PIPEDA (withdrawal of consent).

7.8 Help. Reply HELP to any text message from us for help, or contact support@linkifyrewards.com.

Basis: LR-ENG-001 §2.12 (support@linkifyrewards.com); owner decision 2026-09-27 (HELP disclosure).

7.9 No sharing for marketing. We never sell, rent, or share your mobile phone number, or your text-message opt-in data and consent, with third parties or affiliates for their own marketing or promotional purposes. We disclose your mobile number only to the text-message providers in Section 7.10, only so that they can deliver our messages to you and process your replies. Merchants do not see your phone number (see Section 5).

Basis: owner decision 2026-09-27 (mobile numbers and SMS opt-in data never sold, rented or shared for third-party marketing); LR-ENG-001 §8.5 (merchants never see phone).

7.10 Text-message providers. Text messages are delivered by Twilio and by Amazon Web Services (AWS End User Messaging SMS and Amazon SNS). Each receives your mobile number, the message, and your replies, and may process them outside Canada (see Section 13).

Basis: LR-DEC-001 §8 (SMS on Twilio and AWS SNS with a default and a fallback; AWS End User Messaging SMS production access).

8. RETENTION

8.1 Points you earn at a merchant never expire, so we keep your points balance for as long as you have an account. Linkify points expire 12 months after each grant, and you are warned 30 days and 7 days before they do.

Basis: LR-BUS-001 §5.7.a, §5.7.b; LR-ENG-001 §8.1 (shop points never expire; Linkify points expire 12 months after each grant with 30/7-day notice).

8.2 We retain personal information only as long as necessary for the purposes described in this Policy or as required by law.

Basis: PIPEDA (limiting retention).

8.3 Information submitted through the website's forms is kept for the following periods, unless you ask us to delete it sooner (see Section 9.6):

• Waiting-list sign-ups: until the app launches, then deleted 90 days after launch.
• Partner enquiries: 24 months from the date of the enquiry.

Basis: owner decision 2026-09-23 (form retention periods); LR-TS-WEB WEB-R49 (retention stated on each form); PIPEDA (limiting retention).

9. WEBSITE VISITORS

9.1 This section applies when you use the Linkify Rewards website at linkifyrewards.com, including merchant pages, without signing in. You can read the website without giving us any personal information.

Basis: LR-TS-WEB §1 (public site on the apex domain); PIPEDA (openness).

9.2 Waiting list. If you join the waiting list, we collect your email address and, if you choose to give it, your city. We use them only to tell you when the app launches [and how the city is used, for example to plan where the app launches first — confirm]. We keep your sign-up until the app launches and delete it 90 days after launch, or earlier if you ask (see Section 9.6).

Basis: LR-TS-WEB WEB-R49 (purpose and retention stated on each form); owner decision 2026-09-23 (waiting-list retention); PIPEDA (identifying purposes; limiting collection; limiting use, disclosure, and retention).

9.3 Partner enquiries. If you ask about offering Linkify Rewards at your business, we collect your business name, city, and email address, and any of the following you choose to give: your name, phone number, business category, number of locations, point-of-sale system, website or map listing, and a message or notes. We use them only to respond to your enquiry and follow up on it. We keep an enquiry for 24 months from the date you send it, or delete it earlier if you ask (see Section 9.6).

Basis: LR-TS-WEB WEB-R49 (purpose and retention stated on each form); owner decision 2026-09-23 (partner-enquiry retention); PIPEDA (identifying purposes; limiting collection; limiting use, disclosure, and retention).

9.4 How form submissions are handled. Form submissions travel over an encrypted connection to our servers, and we do not record their contents in our logs. To prevent automated abuse, we check that each submission comes from our website and limit how many submissions one network address can make in a short period. With each submission we store your browser's language, which part of the Service it came from, and salted, non-reversible digests of your network address and browser identification string; we do not store the network address itself.

Basis: LR-TS-WEB WEB-R48 (origin check, signed form token, honeypot, per-address rate limit, request bodies not logged); LR-IP-RUN D33 (waiting-list and partner-enquiry storage); PIPEDA (safeguards; limiting collection).

9.5 Who sees form submissions. Only authorized Linkify staff can read waiting-list sign-ups and partner enquiries. We do not share them with merchants.

Basis: LR-IP-RUN D33 (team read only); PIPEDA (limiting use, disclosure, and retention).

9.6 Earlier deletion. You may ask us at any time to delete your waiting-list sign-up or partner enquiry before its retention period ends, using the contact details in Section 16. We will honor the request within PIPEDA-consistent timeframes.

Basis: owner decision 2026-09-23 (earlier deletion on request); PIPEDA (limiting retention; individual access).

9.7 Analytics. The website uses product analytics (PostHog) in a cookieless mode. It:

• stores no cookies or similar identifiers on your device;
• creates no profile of you, and does not link your visits to an account, to a form submission, or to your activity on other websites;
• records no events until Linkify has approved the list of events to be recorded, and after that records only page views and interactions with the website's controls (for example, a tap on a call, directions, booking, or app-download button), each with the page, the language, a broad category of where the visit came from (such as search or social media), and a broad device category; and
• does not record what you type into forms.

[Approved list of analytics events — to be inserted before publication.] [Whether the analytics provider retains network addresses — confirm the project setting.]

Basis: LR-TS-WEB WEB-R50 (PostHog in cookieless mode with no personal profiles and no consent banner; the event set is chosen by Linkify before launch). Configuration: cookieless mode always on, person profiles never created, automatic capture off.

9.8 Cookies. The website does not use cookies or similar device storage for analytics, advertising, or tracking. [Whether our hosting provider sets strictly necessary security cookies — confirm.]

Basis: LR-TS-WEB WEB-R50 (cookieless analytics, no consent banner).

9.9 No session replay. The website does not record session replays (recordings of how you move through a page). Session replay in the mobile application is described in Section 6.

Basis: LR-TS-WEB WEB-R50 (Microsoft Clarity session replay deferred until counsel signs off this Policy, owner decision 2026-09-21).

9.10 Error reports. If a page fails, the website sends an error report to our error monitoring provider (see Section 6). Error reports are filtered to exclude form contents and other personal information.

Basis: LR-TS-WEB WEB-R56 (website errors reported to GlitchTip), WEB-R48 (request bodies not logged); PIPEDA (safeguards).

10. ACCOUNT DELETION

10.1 You may request deletion of your account at any time by contacting support@linkifyrewards.com. Once an in-app deletion flow ships, you may also request deletion through the Service. We will honor deletion requests within PIPEDA-consistent timeframes.

Basis: PIPEDA-compatible account deletion; LR-ENG-001 §2.12 (support channel), §3 (TLM legal precedent — delete-account flow, adapted). Phase 1 ships no self-serve deletion endpoint — this clause states the request-based right.

10.2 On account deletion, we will delete or de-identify your personal information, subject to legal retention requirements (for example, records required for tax or fraud-prevention purposes).

Basis: PIPEDA (deletion/de-identification; limited retention exceptions).

11. SECURITY

11.1 We use appropriate administrative, technical, and physical safeguards to protect personal information, including encryption in transit and at rest, and access controls.

Basis: PIPEDA (safeguards principle); LR-ENG-001 §2.5.b (RLS on tenant tables).

12. ACCESS AND CORRECTION

12.1 You may request access to, and correction of, your personal information. We will respond within the timeframes PIPEDA requires (typically within 30 days, depending on the request).

Basis: PIPEDA (individual access; accuracy).

12.2 To make a request, contact us using the details in Section 16.

13. CROSS-BORDER PROCESSING

13.1 Personal information may be processed outside Canada by our service providers. We remain responsible for the protection of personal information under PIPEDA wherever it is processed.

Basis: PIPEDA (cross-border transfer accountability).

14. CHILDREN

14.1 The Service is not directed to children under [age — confirm]. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us so we can delete it.

Standard; pending legal review. No register decision on minimum age — flag for counsel.

15. CHANGES TO THIS POLICY

15.1 We may update this Policy. Material changes will be posted in the Service and, where appropriate, notified to you.

Standard legal boilerplate; no conflicting register decision.

16. CONTACT AND PRIVACY OFFICER

16.1 For privacy questions, complaints, or to exercise your rights, contact:

• [Privacy officer name/title — to be inserted]; or
• support@linkifyrewards.com.

Basis: LR-ENG-001 §2.12 (support@linkifyrewards.com). Privacy officer identity is a bracketed fact.

16.2 You may also contact the Office of the Privacy Commissioner of Canada.

Basis: PIPEDA (right to complain to the supervisory authority).

17. EFFECTIVE DATE

17.1 [effective date — to be inserted]