Privacy Policy

Privacy Policy HOMI TECHNOLOGY LTD. | support@homismart.ca | Calgary, Alberta, Canada Effective Date: May 20, 2026 HOMI TECHNOLOGY LTD. ("Homi", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the Homi mobile application and website (collectively, the "Service"). This policy complies with the Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta's Personal Information Protection Act (PIPA), Quebec's Act respecting the protection of personal information in the private sector (Law 25), and other applicable Canadian privacy legislation. 1. Information We Collect Account Information: When you register, we collect your phone number for OTP verification and account creation. When you register via Google Sign-In, we collect your name and email address from Google. Order Information: When you place an order, we collect your selected Pickup Point, order items, and order preferences. Device Information: We automatically collect device type, operating system version, app version, and IP address for security and troubleshooting purposes. Camera: When you use the barcode scanning feature, the camera processes images locally on your device. Images are not uploaded, transmitted, or stored on our servers. Location: With your permission, we collect approximate location data to show nearby Pickup Points. You may disable location access in your device settings at any time. 2. How We Use Your Information To create, maintain, and secure your account; To process and fulfill your orders; To communicate order updates, pickup reminders, and account-related notifications; To send promotional communications (if you have opted in); To improve and debug the Service; To detect, prevent, and address fraud, security, or technical issues; To comply with legal obligations. 3. Legal Basis for Processing We process your personal information based on: (a) your consent, which you may withdraw at any time; (b) the necessity to perform our contract with you (order fulfillment); (c) compliance with legal obligations; and (d) our legitimate business interests, provided they do not override your privacy rights. 4. Payment Information All payments are processed by Stripe, a PCI-DSS Level 1 certified payment processor. We do not collect, store, or have access to your full credit card number, CVV, or expiration date. Stripe's use of your payment information is governed by Stripe's Privacy Policy. Stripe may tokenize your payment method for future transactions with your consent. 5. Third-Party Services We integrate the following third-party services, each governed by their own privacy policies: Stripe — payment processing; Google Maps — location services, address autocomplete, and map display; Google Sign-In — authentication; Firebase Cloud Messaging — push notifications; Google ML Kit — on-device barcode scanning (images not transmitted). 6. Data Sharing and Disclosure We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances: With Pickup Point operators: limited to your name and order details necessary for order verification and pickup; With service providers who perform functions on our behalf (hosting, analytics), bound by contractual confidentiality obligations; As required by law, court order, or governmental regulation; In connection with a merger, acquisition, or sale of assets, subject to confidentiality. 7. Data Retention Account data: Retained while your account is active. Upon account deletion request, personal data is deleted within 30 calendar days, except as required by law. Order records: Retained for the period required by applicable tax and commercial laws (typically 7 years under Canadian tax law). We regularly review and securely dispose of data that is no longer needed. 8. Data Security We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction, including encryption in transit (TLS), secure server infrastructure, and access controls. However, no method of electronic storage or transmission is 100% secure. 9. Cookies and Tracking Technologies Our website uses essential cookies for session management and security. We do not use advertising cookies or tracking pixels for behavioral advertising. Where applicable, we use Google Analytics with IP anonymization enabled to understand aggregate usage patterns. You may disable cookies in your browser settings. 10. Your Privacy Rights Under PIPEDA and applicable provincial laws, you have the right to: Access: Request a copy of your personal data we hold; Correction: Request correction of inaccurate or incomplete data; Withdrawal of Consent: Withdraw your consent to processing at any time, subject to legal or contractual restrictions; Deletion: Request deletion of your personal data ("right to be forgotten"), subject to our legal retention obligations; Data Portability: Request your data in a structured, commonly used format where technically feasible; Complaint: Lodge a complaint with the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner. To exercise any of these rights, contact us at support@homismart.ca. We will respond within 30 days as required by PIPEDA. We may need to verify your identity before processing your request. 11. Data Breach Notification In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm, we will: (a) notify affected individuals as soon as feasible; (b) report the breach to the Office of the Privacy Commissioner of Canada; and (c) take immediate steps to contain and remediate the breach, in accordance with PIPEDA. 12. International Data Transfers Our servers are located in Canada. Some of our third-party service providers (e.g., Google, Stripe) may process data in the United States or other jurisdictions. Where data is transferred outside Canada, we ensure appropriate safeguards are in place, including contractual protections, to ensure an equivalent level of protection. 13. Children's Privacy The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected personal information from a minor, we will delete it promptly. 14. Changes to This Policy We may update this Privacy Policy from time to time. Material changes will be communicated via the Service or email at least 30 days before taking effect. Continued use after the effective date constitutes acceptance. 15. Contact Us HOMI TECHNOLOGY LTD. Email: support@homismart.ca Address: Calgary, Alberta, Canada For unresolved privacy concerns, you may contact the Office of the Privacy Commissioner of Canada at 1-800-282-1376 or www.priv.gc.ca. Quebec residents may contact the Commission d'accès à l'information du Québec at 1-888-528-7741 or www.cai.gouv.qc.ca. 16. Language This Privacy Policy is available in English, Chinese, and French. In the event of any discrepancy, the English version shall prevail to the extent permitted by applicable law.