Homi Privacy Policy Version: 1.4 Effective date: September 19, 2026 Operator: HOMI TECHNOLOGY LTD. Email: support@homismart.ca Contact and mailing address: 609 28 St NE, Calgary, Alberta T2A 4L6, Canada This document is the complete, formal and current text. The main text and each schedule are integral parts of this document. If they address the same matter inconsistently, the more specific schedule controls, but no provision limits a non-waivable statutory right. Main Terms HOMI TECHNOLOGY LTD. ("Homi", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the Homi mobile application and website (collectively, the "Service"). This policy complies with the Personal Information Protection and Electronic Documents Act (PIPEDA), Alberta's Personal Information Protection Act (PIPA), Quebec's Act respecting the protection of personal information in the private sector (Law 25), and other applicable Canadian privacy legislation. 1. Information we collect Account information: phone number and verification records; an email address, name and authentication details when you use an available email or social sign-in method. Order information: the selected pickup point, items, order preferences, payment references, delivery and pickup status, and support or refund records. Device information: device type, operating system, app version and IP address needed for security and troubleshooting. Camera and photos: barcode scanning processes camera images on the device. Photos you choose to submit for a pickup application, profile or support request are uploaded and stored for that stated purpose; the local-scanning description does not apply to those uploads. Location: with your permission, location information helps show nearby pickup points. You may turn off device access and search manually. A pickup applicant also supplies a site address and map location for review and operation. Pickup-operator, tax and agreement information is described in section 17. Referral information is described in Schedule A. 2. How We Use Your Information To create, maintain, and secure your account; To process and fulfill your orders; To communicate order updates, pickup reminders, and account-related notifications; To send promotional communications (if you have opted in); To improve and debug the Service; To detect, prevent, and address fraud, security, or technical issues; To comply with legal obligations. 3. Consent and lawful purposes Homi collects, uses and discloses personal information for reasonable, identified purposes with meaningful consent where required, or under an exception specifically permitted or required by applicable Canadian law. A business interest or an agreement does not, on its own, remove a legal consent requirement. We explain the purposes and material consequences when requesting information. You may withdraw consent subject to lawful restrictions; we will explain any service that can no longer be provided. Optional marketing consent is separate. A materially new purpose requires fresh consent where the law requires it. 4. Payments and Stripe Connect Stripe processes customer payments. Homi does not store full card numbers or CVVs, but receives transaction references, status and limited payment details necessary for service, reconciliation and fraud prevention. Pickup operators provide the identity, business and banking information requested in Stripe Connect's own onboarding process. Stripe's requirements depend on the actual legal account type and account circumstances. Stripe may act independently for its regulatory and risk obligations, as well as provide payment services to Homi under its applicable terms and privacy notice. Homi receives connected-account identifiers, requirements and verification-status information, and relevant transfer and payout records. Completing Stripe onboarding is not the same as completing Homi's tax profile. Do not assume that Stripe supplies Homi with your SIN or verifies that a name and SIN match for Homi's tax reporting. 5. Third-Party Services We integrate the following third-party services, each governed by their own privacy policies: Stripe — payment processing; Google Maps — location services, address autocomplete, and map display; Google Sign-In — authentication; Firebase Cloud Messaging — push notifications; Google ML Kit — on-device barcode scanning (images not transmitted). 6. Sharing and disclosure Homi does not sell, trade or rent personal information. We share only information reasonably necessary and lawfully permitted for the stated purpose: • With a pickup operator handling your order: limited customer identification, order and pickup information needed to hand over the order and resolve a fulfilment issue. The operator may not use it for unrelated marketing, religious outreach or membership recruitment. • With Stripe and service providers supporting payments, hosting, security, communications, customer support or accounting, subject to the applicable role, confidentiality, security and purpose restrictions. • With authorized Homi staff and professional accountants: the operator's necessary legal identity, tax information and financial records for reconciliation and legally required reporting. Sensitive tax numbers are not public directory information or ordinary pickup-staff information. • With tax or other authorities where required or permitted by law, or in a lawful business transaction subject to appropriate restrictions. Site information visible to customers, including residential pickup addresses, is explained in section 17. 7. Retention and deletion Homi sets retention by record type, purpose and governing law. There is no universal seven-year or six-year rule for every document or piece of personal information. Account and application information is kept while needed to provide the requested service, review an application and handle lawful follow-up. When you request deletion, we assess the request under applicable law and remove or de-identify information no longer required. Necessary contract, order, accounting, tax, fraud-prevention or dispute evidence may remain with restricted access; we will explain a lawful reason for refusing a deletion request. Canadian tax records and supporting payment records generally must be kept for at least six years after the end of the last tax year to which they relate. Late filing, an objection, appeal, a tax authority's direction or another legal requirement can require longer retention. Required records must be kept in the place and accessible form required by law. Agreement and consent evidence is retained during the relevant relationship and afterward only as reasonably needed to establish the parties' rights, address a dispute or comply with applicable limitation periods and legal duties. This does not mean every record must be held for the maximum possible lawsuit period. We review the need and restrict retention to relevant evidence, without attaching full tax numbers to ordinary acceptance logs. An access request, investigation, legal hold or unresolved dispute can suspend deletion of the relevant records. Information used to make a decision about a person is retained long enough to meet applicable access and review requirements. At the end of the necessary period, information is securely deleted or irreversibly anonymized in accordance with law, including controlled treatment of backups. Schedule A provides additional referral retention rules. 8. Data Security We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction, including encryption in transit (TLS), secure server infrastructure, and access controls. However, no method of electronic storage or transmission is 100% secure. 9. Cookies, device storage and attribution Homi uses cookies or device storage needed for sign-in, preferences, security and requested referral attribution. The referral identifiers and risk signals described in Schedule A are not used for unrelated behavioural advertising. Browser or device settings can limit storage, although some requested features may then stop working. Before introducing optional analytics or advertising technology that requires consent, Homi will explain its purpose and provide the choices required by law. This policy does not claim that a particular analytics tool or anonymization setting is currently enabled. 10. Access, correction and other rights Subject to applicable law, you may request access to your personal information, correct inaccurate information, withdraw consent, request lawful deletion or anonymization, and complain to Homi or the relevant privacy regulator. Portability or a computerized copy is provided where the applicable law requires it. These are not unlimited rights to erase required transaction or tax records. Contact our Privacy Officer at support@homismart.ca. Homi verifies identity proportionately and responds within the applicable statutory period, including 30 days under PIPEDA or Québec law and 45 days under Alberta PIPA where those rules apply, subject to lawful extensions and required notice. We do not request a SIN as a routine access-request identifier. 11. Privacy incidents Homi investigates, contains and documents suspected privacy incidents. We notify affected people and the competent regulator where the applicable risk threshold and law require it, including under PIPEDA, Alberta PIPA and Québec's private-sector privacy law. The applicable recipients, reporting threshold and retention period may differ by jurisdiction. Not every incident is reportable to only the federal Privacy Commissioner. 12. Processing outside your province or Canada Homi uses providers, including Stripe and Google, that may process information in the United States or other jurisdictions, as well as outside your province. This may expose information to lawful access by courts, law enforcement or authorities in those jurisdictions. Homi does not promise that every system, backup or provider is located in Canada. For providers processing information on our behalf, Homi remains accountable for its legal obligations and uses appropriate contractual, security and access controls. Before a transfer, Homi conducts any privacy assessment and puts in place the agreement required by applicable law, including Québec requirements where they apply. These measures cannot override a foreign law. Contact our Privacy Officer for information about foreign-service-provider policies, purposes and practices. 13. Children's Privacy The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected personal information from a minor, we will delete it promptly. 14. Changes to this policy Homi identifies the version and date and ordinarily gives at least 30 days' notice of a material change through the Service or email. A shorter period may apply only where necessary to meet a legal or urgent security requirement. Changes are prospective. Homi obtains fresh meaningful consent to a new purpose or other change where required; continued use does not by itself authorize every new use of personal information. 15. Contact Us HOMI TECHNOLOGY LTD. Email: support@homismart.ca Address: 609 28 St NE, Calgary, Alberta T2A 4L6, Canada For unresolved privacy concerns, you may contact the Office of the Privacy Commissioner of Canada at 1-800-282-1376 or www.priv.gc.ca. Quebec residents may contact the Commission d'accès à l'information du Québec at 1-888-528-7741 or www.cai.gouv.qc.ca. 16. Language This document is available in English, French and Chinese. No language term limits a mandatory language right under applicable law. For a contract of adhesion and related documents governed by section 55 of Québec’s Charter of the French Language, Homi will first provide the French version. A party may expressly choose another language only after receiving the French version and through a process permitted by law. If the French and another-language versions differ, the party may rely on the version more favourable to that party to the extent permitted by law. 17. Pickup operators: applications, public locations, tax and agreement evidence At the initial application, Homi collects the chosen operator type (individual, sole proprietor, company or organization), venue type, contact details, pickup address and map location, entrance or storefront photo, and weekly hours. A nickname or trading name may be shown publicly; it is not a substitute for the legal contracting or tax name. Authority to use the premises and act for an entity may be checked where reasonably necessary. The ordinary initial application does not require a SIN. After approval, the operator can complete Stripe Connect onboarding. Homi separately collects the information reasonably required for lawful payment and tax reporting before releasing earnings, or earlier if a legal reporting deadline requires it: legal payee name, tax address and residency, relevant registration and tax numbers, and authorized representative information where applicable. An individual may need to provide a SIN for legally required reporting. A sole proprietor does not necessarily have a business number; having one does not automatically replace a SIN in a tax return field. A company or organization supplies its own applicable legal and tax details, not a representative's SIN merely because that person signs for it. A separate lawful need must be explained if a representative's personal tax identifier is requested. Homi uses a SIN only where legally authorized for income reporting and related administration, never for general login, marketing, public display or ordinary pickup. Submit sensitive tax information through the designated secure form, not a public photo, customer chat or unsolicited email. Homi restricts access to tax records, protects stored sensitive identifiers and limits accounting exports to authorized users. Basic number-format checks and a declaration of accuracy do not establish a government-confirmed match between the name and SIN. Homi may seek a correction or proportionate supporting evidence when necessary. Eligible earnings may be recorded in Homi's accounts-payable ledger while tax or payout requirements remain incomplete. Ledger entries, transfers to Stripe and bank payouts are distinct records; the display of earnings does not mean funds have reached Stripe or a bank. The account's legal recipient must remain consistent; a change requires review and does not change past records silently. Churches, community centres and other organizations are not treated as tax-exempt automatically, and a service payment is not automatically a donation. For an approved, listed point, customers can see the approved pickup address, map location and hours. This includes a private residence: do not apply on the assumption that its address appears only after an order. The ordinary public listing of a private residence hides the coordinator's personal phone number and the application entrance photo; authorized owner and administrative views may still access them. Other approved site photos and business contact details may appear in the listing. Submit photos of the necessary pickup entrance only, without SIN documents, uninvolved people or private living spaces. Contact Homi before changing the approved address or phone number; operators cannot edit those confirmed fields themselves. Homi retains evidence of the document and applicable operator and venue conditions presented and accepted, including version, language, complete-text integrity digest, relevant account and site identifiers, legal party or representative details, subject and location snapshot, and presentation and acceptance times where recorded. Necessary technical audit details may support security and integrity; a digest alone is not a copy of the contract. Earlier records remain distinguishable from later corrections or renewed acceptances. This notice does not assert that a historical acceptance was recorded when it was not. You can request the applicable record and text from Homi, subject to lawful privacy restrictions. You may request access or correction under section 10. Homi may keep the original transaction and append a correction where required for reliable tax or contract records. The retention limits in section 7 apply. Schedule A: Referral Program Personal-Information Terms A.1 Referral information collected To establish, operate and protect referrals, Homi may process: referral codes, link parameters, QR visits, binding and terms-acceptance records; customer and pickup-point account identifiers; registration, first-payment, pickup, refund, chargeback and reward states and timestamps; install identifiers, IP addresses, device type, operating system, app version and user agent; payment-card fingerprints returned by Stripe; risk reasons, review submissions and decisions; and Stripe transfer, reversal and reconciliation records. Install identifiers, IP addresses, user agents and card fingerprints used for risk matching are stored as keyed HMAC digests. Digests reduce direct exposure but may still be personal information; Homi will not treat them as anonymous data for sale or unrelated advertising. Homi does not store full card numbers, CVVs or raw payment credentials for the referral program. A.2 Purposes Homi uses this information to complete a customer-selected referral; confirm new-customer and first-order eligibility; calculate, hold, pay or recover rewards; prevent duplicate rewards, account takeover, false identities, self-referral, payment abuse and manufactured orders; resolve appeals, refunds, disputes and regulatory requests; conduct security, audit, accounting, tax and legal compliance; and improve program reliability without using the data for an incompatible new purpose. Before using existing information for a materially new purpose, Homi will give clear notice and obtain fresh valid consent where required. Referral binding is optional. Refusing or withdrawing non-essential processing does not prevent ordinary registration or shopping, but may make an unfinished referral impossible to attribute or verify. Homi may retain completed transaction, legal, anti-fraud and dispute records as permitted or required by law. A.3 Sharing and visibility Homi may give Stripe and payment, cloud, security, analytics, customer-support and professional service providers the information necessary for these purposes, subject to contractual and access restrictions. Homi may also disclose information to authorities when legally required, to protect rights or to investigate fraud. Referrers do not receive full payment information, identity documents or full order details. They see only limited status, time, reward amount and truncated reference data needed for the program. A customer may ask through the account or support channel whether a referral is bound and which code applies, subject to restrictions needed to protect another person’s privacy or an investigation. A.4 Risk analysis, automation and human review The system may generate a risk score from account, install, network, device, payment-card fingerprint digest, order, refund and referral-frequency signals. Reaching a threshold normally freezes the reward for human review; it is not, by itself, a final finding of fraud. Where applicable law treats an outcome as a decision based exclusively on automated processing that has a significant effect, Homi will notify the affected person of the automation, the types of information used, the principal factors and the effect, and provide a way to submit observations, correct information and obtain review by a person authorized to change the outcome. Homi may withhold weights, keys or details that would enable security circumvention, but not to eliminate statutory access, correction or complaint rights. A.5 Retention Unless law, tax obligations, litigation hold, a security incident or an unresolved dispute requires longer retention: 1. Referral binding, eligibility and risk-signal digests are retained no longer than 24 months after final settlement, cancellation or recovery; 2. Terms-acceptance records and their content digest are normally retained during the relationship and for 24 months afterward, with longer retention only where a documented legal, tax or dispute need under section 7 justifies it; 3. Reward payments, Stripe transfers/reversals, invoices, reconciliation and tax records are retained for the period required by applicable law. Canadian tax records generally must be kept for at least six years after the end of the last tax year to which they relate, and longer in some cases; 4. Unsuccessful QR visits and unbound attribution data are deleted or de-identified within a shorter period reasonably needed for attribution and security. At expiry, information is securely deleted or irreversibly anonymized in accordance with applicable law. Records under a valid legal hold or dispute may be frozen until the matter ends. A.6 Access, correction, withdrawal and complaints A person may use the App privacy entry or contact support@homismart.ca to request access to or correction of referral information, withdraw applicable consent or challenge a risk outcome. Homi will verify identity and explain any legal reason why a record cannot be produced or deleted. Privacy Officer: Privacy Officer, HOMI TECHNOLOGY LTD. Email: support@homismart.ca Mailing address: 609 28 St NE, Calgary, Alberta T2A 4L6, Canada A person may also complain to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner of Alberta, the Commission d’accès à l’information du Québec or another authority with jurisdiction. A.7 Identification, location and profiling technology Where Québec law applies, Homi will clearly explain the purpose and available activation method before enabling technology that can identify, locate or profile a person. Optional technology not necessary to provide requested attribution or security remains off until the person takes the affirmative action required by law. A.8 Privacy and personal-information principles Homi follows applicable Canadian private-sector privacy law. It uses meaningful consent for reasonable, identified purposes and relies on a legal exception only where that exception applies. The Privacy Policy explains access, correction, withdrawal of consent, and lawful deletion or anonymization. Retention is based on record type and governing law, rather than a blanket seven-year period. Canadian tax records generally must be kept for at least six years after the end of the last tax year to which they relate. A privacy incident must be assessed and recorded, and notifications made where required under PIPEDA, Alberta PIPA, Québec private-sector privacy law and any other applicable provincial law—not only to the federal Privacy Commissioner. A.9 Accessible, retainable and consistent versions Customers and pickup points must be able to obtain the complete terms before contracting in a mobile-readable, screen-reader-accessible, downloadable or printable form. The material rules, amounts, dates and links must be consistent across English, French and Chinese for the same version. A translation that has not passed review must not be labelled as the formally published version. A.10 Effectiveness, notice and transition New customers or applicants may accept this version from the stated effective date. For an existing relationship, a material amendment subject to the 30-day notice commitment takes effect no earlier than 30 days after the required notice is actually given, with fresh affirmative consent where required; a necessary urgent legal or security exception remains limited to its lawful scope. Publishing this version does not prove that an existing user received notice or accepted it. Homi supplies the complete text, version and date in a retainable form. No change rewrites an earlier order, earned reward or missing acceptance record. Participation in new referrals requires the applicable referral terms, while previously earned, undisputed rewards are not forfeited solely for refusing a new version.