WIAM.AI — PRIVACY POLICY

The English and French versions are both published. In case of divergence, the French version prevails (Québec Law 96).

Effective date: July 16, 2026 (previous version: July 1, 2026 — added Section 3.1, marketing audiences, opt-in only)

Controller: Rocket Science Development Inc. ("WIAM", "we"), 220-370 boul. Nobert, Longueuil, Québec J4J 2Z3, Canada — NEQ 1176414408.

Privacy Officer (Law 25): support@wiam.ai

1. Scope

This Policy explains how we handle personal information when business customers ("Customers") use the WIAM.ai service (the "Service"). It covers two categories:

• Customer data — information about the Customer and its representatives (we are the controller).
• Audience data — personal information of people who interact with the Customer's connected social accounts (e.g., commenters, message senders). For this data we act as the Customer's service provider / processor; the Customer is the controller and is responsible for its own privacy notices and legal bases (see Section 9).

2. Information we collect

• Account & business profile: name, email, business name, address, phone, website, time zone, role.
• Google data: your Google Maps / Business Profile listing details and photos that you direct us to use.
• Connected-platform credentials: OAuth tokens for the social accounts you connect (stored encrypted). We do not receive or store your platform passwords.
• Content: source material, generated videos/captions, schedules, and analytics about their performance.
• Audience data: comments and direct messages on your connected accounts (which may contain the personal information of your audience) and engagement metrics.
• Payment data: processed by Stripe; we receive limited billing metadata (e.g., plan, status).
• Usage & device data: logs, IP address, browser/device info, and diagnostics, for security and reliability.

3. How we use information

• To provide, operate, secure, and support the Service;
• To generate content and publish/schedule it on your connected accounts;
• To process payments and manage subscriptions and credits;
• To detect, prevent, and investigate fraud, abuse, and security incidents;
• To comply with legal obligations.

We do NOT sell personal information, and we do NOT use Customer content or Audience data to train or improve generative AI models.

We do not disclose personal information for advertising, with one narrow exception: where you have given prior, separate, opt-in consent, we may disclose your own business contact details, in hashed form, to an advertising platform so we can find businesses similar to yours (Section 3.1). This never includes your content, never includes Audience data, and is off by default.

3.1 Marketing audiences (opt-in — off by default)

Only if you switch on "Help WIAM find businesses like mine" (Settings → Privacy) do we disclose the following to advertising platforms (today: Meta Platforms, Inc.):

Purpose. The platform matches these hashes against its own users in order to (a) build an audience of existing WIAM Customers, and (b) derive a "lookalike" audience — other business owners who resemble you — so that we can show them our ads. We use this to find new customers. We do not advertise to you based on your content, and we never disclose your content or your Audience data.

We are explicit about what this is: it is a "share" for cross-context behavioral advertising under California law (CCPA/CPRA), and a communication to a third party for a secondary purpose under Québec Law 25. For the matching operation the platform acts as an independent controller, not as our service provider. That is precisely why it requires your separate, affirmative consent, is never bundled with your acceptance of the Terms, and is never pre-checked.

Withdrawing. You can switch it off at any time (Settings → Privacy, or email support@wiam.ai). We then stop disclosing and ask the platform to delete your identifiers from its audiences. Withdrawal does not affect the lawfulness of disclosures already made, and has no effect on your subscription, price, or features — we do not discriminate against you for declining or withdrawing.

Global Privacy Control (GPC). If your browser sends a GPC signal, we treat it as a valid opt-out: any existing consent is withdrawn automatically and the setting is locked off for as long as the signal is present. You do not need to do anything else.

If you never opt in, nothing about you is disclosed to any advertising platform.

4. Legal bases / consent

We process personal information on the bases of performance of our contract with the Customer, our legitimate/business interests (e.g., security and service operation that does not involve AI model training on your data), consent where required, and legal obligation. The Customer is responsible for the legal basis and consents required for Audience data processed on its behalf.

The marketing audiences described in Section 3.1 rest on consent alone — never on legitimate interests. That consent is requested separately from any other information, in plain language, for that specific purpose, and is never pre-checked (Québec Law 25, arts. 12 and 14). You may withdraw it at any time.

5. Service providers & sub-processors

We share personal information only with vendors that process it on our behalf under contract. By category of recipient:

We require each provider to offer appropriate safeguards. A current list of our named sub-processors is available to Customers on request and forms part of our Data Processing Agreement.

Advertising platforms are deliberately absent from this table. Where you have opted in under Section 3.1, the platform does not process on our behalf — for the matching operation it is an independent controller. That disclosure is therefore governed by Section 3.1 and by your consent, not by this Section, and it is limited to your hashed contact details.

6. AI processing

The Service relies on automated AI systems to generate content. Generated content may be inaccurate and is subject to human review by the Customer (see the Terms). We do not make solely-automated decisions producing legal or similarly significant effects about individuals.

7. Retention

We keep personal information only as long as needed to provide the Service, comply with law, resolve disputes, and enforce agreements. Audience data is retained per the Customer's instructions and our 12-month retention period. On account closure we delete or de-identify Customer data within 30 days, subject to legal holds and backups.

8. Security

We use technical and organizational safeguards including encryption in transit and at rest, encryption of stored OAuth tokens, access controls, and audit logging. No method is perfectly secure; we maintain an incident-response process and will notify affected parties and regulators as required by law (e.g., Law 25, PIPEDA, applicable U.S. state laws).

9. Audience data (your customers' personal information)

When we process comments and messages from your connected accounts, you are the controller and we are your processor / service provider. You are responsible for providing any required privacy notice to, and obtaining any required consent from, your audience, and for honouring their requests. We process such data only to provide the Service to you and per your instructions.

10. International transfers

We are based in Canada and use service providers in the United States and elsewhere. Personal information may therefore be stored or processed outside your province or country, including the U.S., under appropriate contractual safeguards. (Law 25: we conduct a privacy impact assessment before communicating personal information outside Québec and transfer only where that assessment confirms the information will benefit from adequate protection, supported by contractual safeguards with our U.S.-based processors.) A record of this assessment is maintained by our Privacy Officer and made available to the Commission d'accès à l'information on request.

11. Your privacy rights

Canada (PIPEDA) / Québec (Law 25): you may request access to, and correction of, your personal information, withdraw consent (subject to contract), and obtain information about its use and disclosure. Québec residents also have rights regarding de-indexing, portability, and automated processing. Complaints: the Commission d'accès à l'information du Québec (CAI) or the Office of the Privacy Commissioner of Canada (OPC).

United States (CCPA/CPRA and similar state laws — CA, VA, CO, CT, etc.): depending on your state, you may have the right to know/access, delete, correct, and to opt out of sale/sharing/targeted advertising. We do not sell personal information. We "share" personal information for cross-context behavioral advertising only where you have opted in under Section 3.1 — it is off by default. You can turn it off at any time via Settings → Privacy or the "Do Not Sell or Share My Personal Information" link in our footer, and we honour Global Privacy Control (GPC) browser signals as a valid opt-out. We do not discriminate against you for exercising these rights.

To exercise any right, contact support@wiam.ai. We verify and respond within the timeframes required by applicable law. For Audience data, direct requests to the Customer that controls the account; we will assist that Customer.

12. Children

The Service is for businesses and is not directed to children; we do not knowingly collect personal information from anyone under 18.

13. Changes

We may update this Policy. Material changes take effect on notice; the current version and date appear at the top.

14. Contact & complaints

Rocket Science Development Inc. — Privacy Officer, 220-370 boul. Nobert, Longueuil, Québec J4J 2Z3, Canada · support@wiam.ai