Privacy Policy

In accordance with Quebec's Law 25, we have designated a person responsible for the protection of personal information. Responsible Person: The Platform Administrator Email: privacy@goprosperia.com This person is responsible for ensuring compliance with the law, handling complaints related to personal information, and overseeing privacy impact assessments.

We collect the following categories of personal information: Account Information: • Full name • Email address • Phone number • Billing address • Language and timezone preferences Business Information: • Contact information (names, contact details, investor profiles) • Asset and opportunity data • Notes and documents you create Technical Information: • IP address • Browser type and device • Activity and audit logs • Login timestamps

We use your personal information for the following purposes: • Service Delivery: Create and manage your account, provide platform features • Billing: Process payments and manage subscriptions • Communications: Send service notifications, alerts, and technical support • Security: Protect against unauthorized access and fraudulent activities • Improvement: Analyze usage to improve our services • Legal Compliance: Meet our legal and regulatory obligations

We process your personal information on the following legal grounds: • Consent: For marketing communications and optional analytics • Contract Performance: To provide the services you have subscribed to • Legal Obligation: To comply with applicable laws (tax, accounting) • Legitimate Interest: To improve and secure our services

Your consent is required for certain processing of your personal information. You may withdraw your consent at any time by: • Modifying your preferences in your account settings • Contacting us at privacy@goprosperia.com Withdrawal of consent does not affect the lawfulness of processing performed before withdrawal. For third-party contact data you enter into the system, you are responsible for obtaining appropriate consent from those individuals.

We may disclose your personal information to the following recipients: Service Providers: • Supabase (authentication and data hosting) • Payment processor (transaction processing) • Email services (transactional notifications) Within Your Organization: Information you enter may be visible to other authorized users within your organization, according to access settings. Legal Authorities: We may disclose information if required by law or in response to a court order. We never sell your personal information to third parties.

Some of our service providers may process information outside Quebec and Canada. In accordance with Law 25, before any transfer of personal information outside Quebec, we conduct an assessment to ensure that the information will receive adequate protection. Our providers are bound by contractual agreements requiring: • Appropriate security measures • Processing of data only according to our instructions • Notification in case of security incidents

We retain your personal information only as long as necessary: • Active account data: Duration of your account plus 2 years • Billing records: 7 years (tax and legal requirements) • Audit logs: 3 years (security and compliance) • Deleted data: Complete erasure within 90 days Upon account termination: • You have 30 days to export your data • Data is then deleted from our active systems • Backup copies are purged according to their normal cycle

Under Quebec's Law 25, you have the following rights: Right of Access: Obtain confirmation that we hold your information and receive a copy. Right to Rectification: Have inaccurate or incomplete information corrected. Right to Deletion: Request deletion of your information when it is no longer necessary. Right to Portability: Receive your information in a structured, commonly used format. Right to Withdraw Consent: Withdraw your consent at any time. Right to Be Informed: Be informed when a decision concerning you is made by automated processing. To exercise these rights, contact us at privacy@goprosperia.com. We will respond within 30 days of your request.

We implement technical and organizational security measures to protect your information: • Encryption in transit (TLS 1.2/1.3) and at rest • Secure authentication with multi-factor authentication support • Strict multi-tenant isolation between organizations • Role-based access control • Access and modification logging • API rate limiting • Continuous system monitoring No system is completely secure. In case of a data breach presenting serious risk, we will notify you in accordance with the law.

In the event of a privacy incident presenting a serious risk of harm, we will: 1. Assess the incident as soon as possible 2. Notify the Commission d'accès à l'information du Québec 3. Inform you with: • A description of the incident • The types of information involved • Measures taken to reduce risk • Measures you can take to protect yourself • Contact information for someone who can answer your questions We maintain a registry of all privacy incidents.

We use cookies for: Essential Cookies (required): • Authentication and session management • Security and fraud protection • Remembering your consent preferences Analytics Cookies (with your consent): • Anonymized usage statistics • User experience improvement You can manage your cookie preferences: • Via the consent banner on your first visit • In your account settings • Via your browser settings Refusing non-essential cookies does not affect your access to the service.

Our service is intended for professionals and businesses. We do not knowingly collect personal information from persons under 18 years of age. If we learn that we have collected information from a minor, we will take steps to delete it promptly. In Quebec, the age of valid consent for collection of personal information is 14 years.

We may modify this policy from time to time. For material changes, we will: • Post the updated policy on our website • Update the effective date • Notify you by email or through the service interface • For significant changes, request renewed consent if required Your continued use of the service after changes constitutes acceptance of the revised policy.

If you are not satisfied with our handling of your personal information, you may: 1. Contact us first: Email: privacy@goprosperia.com We will investigate your complaint and respond within 30 days. 2. File a complaint with the Commission d'accès à l'information du Québec: Commission d'accès à l'information du Québec 525, boul. René-Lévesque Est, bureau 2.36 Québec (Québec) G1R 5S9 Phone: 418-528-7741 Toll-free: 1-888-528-7741 Website: https://www.cai.gouv.qc.ca

For any questions regarding this privacy policy or your personal information: Person Responsible for Protection of Personal Information Email: privacy@goprosperia.com General Support Email: support@goprosperia.com