Privacy Policy

9327-2920 QUÉBEC INC., operating under the name Intelligence Artificielle PHAiTO / PHAiTO Artificial Intelligence (hereinafter referred to as "PHAiTO," "we," or "our"), operates the website www.phaito.com (hereinafter the "Website"). We place great importance on the protection of your Personal Information (as defined below). We aim to make your experience on our Website as enjoyable as possible.

This privacy policy (hereinafter referred to as the "Policy") aims to protect the Personal Information of users of our Website (hereinafter "you" or "your"), and it outlines how we handle and safeguard Personal Information within the limits imposed by the law.

The Policy does not apply to Personal Information concerning our employees and subcontractors.

Personal Information Collected

"Personal Information" refers to any information related to an individual that allows, directly or indirectly, their identification.

We only collect the necessary Personal Information about you to establish, manage, and maintain the relationships we have with you. In most cases, this collection is limited to the following Personal Information during the registration process (account opening):

• First name;
• Last name;
• Email address;
• Phone / mobile number;
• Physical address;
• Company name;
• Information changes to establish a Lightroom profile;
• Timestamp;
• Information about the operating system and user agent;
• Login cookies.

The following Personal Information is collected during the order process:

• Order data;
• Timestamp;
• Payment data processed by a third party, namely Stripe or PayPal and not stored on our servers;
• User agent;
• Login cookies.

We may also collect Personal Information on the Website directly or during your email, phone, or in-person interactions with one of our employees or representatives.

Additionally, the following material may be collected for the provision of our services:

• Presets and editing preferences;
• Images.

Your Consent

Your consent for the collection, use, or disclosure of your Personal Information must be clear, free, and informed. It must be given for the specific purposes and objectives identified in this Policy.

Depending on the nature and sensitivity of your Personal Information, your consent may be explicit (such consent can be given verbally, in writing, or electronically) or implicit (when you voluntarily provide Personal Information, for example).

By using our Website, you consent to the collection, use, disclosure, and storage of your Personal Information in accordance with this Policy, with one exception: analytics and advertising cookies are optional and are only used if you accept them, as described in the Cookies section below. Please read this Policy carefully.

If you do not consent to these terms, please discontinue your use of the Website. Unless otherwise required by law, you may withdraw your consent at any time with reasonable notice. Please note that if you choose to withdraw your consent for the collection, use, or disclosure of your Personal Information, certain features of our Website may no longer be accessible to you, and we may not be able to provide you with certain services.

Security and Governance

Information security is a top priority for us, but please remember that no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security.

In addition to the administrative measures detailed in the following sections, we have implemented physical and technological measures that are reasonable considering the sensitivity of Personal Information, its use, quantity, distribution, and storage.

Regarding administrative measures, we have adopted policies that include the following:

• The framework applicable to the use, disclosure, retention, and destruction of Personal Information;
• The roles and responsibilities of our employees throughout the lifecycle of this information;
• A process for handling complaints related to the protection of this information;
• Limiting the retention period of personal data and defining appropriate retention periods;
• Restricting access to personal data by implementing role-based access controls;
• Establish procedures to manage all access to data, including revoking access rights when necessary.

On the technological front, we implement the following measures:

• SSL (Secure Sockets Layer) protocol;
• Access management — authorized personnel;
• Access management — data subject;
• Network monitoring software;
• Computer backup;
• Digital certificate development;
• Username / password;
• Firewalls.

Use of Personal Information

We use the Personal Information about you only for the following purposes:

• Provide the Website and ensure its optimal operation;
• Identify a user of the Website and verify the authenticity of this identification;
• Identify your preferences;
• Open and manage an account;
• Complete the transactions you make on our Website (please note that we use an external service like Stripe / PayPal to facilitate your purchase payment, and this service is subject to its own terms of use);
• Track your orders;
• Provide you with access to our services;
• Send you information and promotional offers (please note that you can choose not to receive all or part of these communications by following the unsubscribe link or the instructions provided in any email we send);
• Offer you technical support and respond appropriately to your questions;
• If you accept analytics cookies, obtain statistics on the use of the Website and our services through Google Analytics;
• If you accept advertising cookies, measure the results of our advertising and show relevant PHAiTO ads on Facebook and Instagram to people who visited our Website.

We may also use Personal Information in accordance with our Terms and Conditions.

All of our employees who handle Personal Information are bound by confidentiality obligations and have received appropriate training. Furthermore, they can only access the Personal Information necessary for the performance of their respective duties. In case of a breach, our governance policies and practices provide for sanctions.

We only use Personal Information for the purposes stated above, unless we are authorized by law, in very limited cases, to do so without your consent.

Communication of Personal Information

We may disclose Personal Information to third parties in specific circumstances authorized by law. These third parties are obligated to maintain the confidentiality of your information and are prohibited from using it for any other purpose. In the table below, we summarize these circumstances as well as the measures we take to protect Personal Information.

Our analytics and advertising partners described in the Cookies section, Google LLC and Meta Platforms, Inc., are an exception: they only receive information if you accept the corresponding cookies, and they use it under their own terms and privacy policies.

To subcontractors and agents

We enter into contracts with subcontractors and agents to provide you with a service and/or improve existing services. A contract obliges subcontractors to:

• Use only the Personal Information necessary for the provision of the service;
• Refrain from disclosing or communicating Personal Information without our consent;
• Implement rigorous security measures;
• Allow us to audit these measures;
• Notify us immediately of a confidentiality incident;
• Destroy Personal Information at the end of a contract.

To another party in a commercial transaction

Such a transaction is defined as the sale or lease of all or part of our business or its assets, a change in our legal structure through merger or otherwise, obtaining a loan or any other form of financing, or a security taken to guarantee one of our obligations (hereinafter the "Commercial Transaction"). A contract obliges the other party to:

• Use only the Personal Information necessary for the conclusion of the Commercial Transaction;
• Implement rigorous security measures;
• Refrain from disclosing or communicating Personal Information without our consent;
• Notify us immediately of a confidentiality incident;
• Destroy Personal Information if the Commercial Transaction is not concluded or if they are no longer needed for its conclusion.

To legitimate authorities

To comply with a court order or decision, including a valid search warrant, or a regulatory authority, we may be required to provide Personal Information. The laws governing these authorities require them to put measures in place to respect and preserve the confidentiality of your Personal Information.

In general, we refuse access unless the request is legally binding.

To our lawyers or attorneys

To ensure our defense or assert our rights, we may, in some cases, disclose your Personal Information.

Both the law and the letters of engagement we sign require our lawyers to protect the confidentiality of all our communications with them.

Whenever we need to disclose Personal Information about you, we will make every effort not to disclose more information than is necessary under the circumstances.

Where?

As part of providing our services, we may disclose Personal Information outside of Quebec, particularly in the following regions:

• United States;
• Canada.

Before disclosing Personal Information outside of Quebec, we will conduct a privacy impact assessment that takes into account:

• The sensitivity of the Personal Information;
• The purpose of its use;
• The protection measures it will receive; and
• The legal framework applicable in the state where this Personal Information will be disclosed.

We will only proceed with such disclosure if this assessment demonstrates that the Personal Information will receive adequate protection in accordance with generally recognized principles of Personal Information protection. Furthermore, this disclosure must be subject to a written contract that takes into account all the findings of the assessment.

Retention

We retain Personal Information only for the duration necessary to achieve the purposes for which it was collected unless legal requirements or contractually recognized interests under the law require us to retain it for a longer period. We reserve the right to establish Personal Information destruction policies from time to time. Upon request, we can inform you of the retention period for your Personal Information.

Please note that your data may remain in our backups after the account deletion but will no longer be accessible through the Website. Our backups are periodically rotated and deleted, and your information will not remain indefinitely in our backups.

If you request the deletion of your Personal Information, we will make reasonable efforts to comply with this request as soon as possible. The deletion of your Personal Information is completed within 30 days following the request.

Stored Files

The files you have submitted to us for processing are stored as needed to provide the service. These files are periodically deleted once the service is completed.

Your Rights

Users of the Website have the following rights:

• The right to be informed about their use, disclosure, retention, and destruction, as outlined in this Policy;
• The right to access your Personal Information and obtain, if applicable, additional details on how we use, disclose, retain, and destroy it;
• In certain cases, the right to object, restrict, or withdraw your consent to these operations by providing reasonable notice sent to the email address provided at the end of this Policy;
• The right to have your Personal Information corrected if it is inaccurate or unclear and to have it completed when it is incomplete;
• The right to have your Personal Information deleted, subject to our legal obligations;
• The right to be informed of a privacy incident concerning your Personal Information that may cause you serious harm. For this purpose, we maintain a record that lists all privacy incidents, and we assess the harm they may cause.

You can exercise these rights by logging into your account and accessing the account page or by sending an email to the email address provided at the end of this Policy. Your request must contain sufficient details to identify your Personal Information and the correction you are seeking. We will respond to your requests within 30 days of receiving them, unless the law permits an extension of this timeframe.

Subject to legal restrictions, if we refuse to provide or correct your Personal Information, we will provide you with the reasons for this refusal, information about your recourse, and the applicable provisions of the law.

If we refuse to correct your Personal Information, we will allow you to attach written comments to your record regarding the Personal Information that has been refused for correction. We will also retain the Personal Information that was subject to an access request for as long as necessary to allow you to exhaust the remedies provided by law.

Cookies

Our Website uses cookies and similar technologies. Technical cookies are always active because the Website needs them to work. Analytics and advertising cookies are optional: they are off by default and are only set if you switch them on in our cookie banner. You can change your choice at any time with the "Cookie settings" link at the bottom of every page. When you use the Website, we and, if you accept them, our analytics and advertising partners may automatically collect certain information, which may include:

• The Internet Protocol (IP) address of your computer;
• Your geolocation zone;
• The operating system you are using;
• Your preferred language;
• The identity of your Internet service provider;
• The date and time when you accessed the Website;
• The previous website you visited that provided a link to our Website; and
• The content viewed and downloaded on our Website or the number of visits.

Generally, the cookies we use are grouped into three (3) categories:

• Technical cookies: Technical cookies are used throughout navigation to facilitate the use of our Website. For example, a technical cookie may be used to remember your username to facilitate your login, or to remember your preferences or chosen options;
• Analytics cookies (optional, off by default): if you accept them, Google Analytics, a service of Google LLC, records how you use the Website, such as the pages you view, your device and browser, your approximate location and a pseudonymous identifier stored in a cookie. These cookies are not anonymous. We use them to produce statistics on the use of the Website;
• Advertising cookies (optional, off by default): if you accept them, we use the Meta Pixel and the Meta Conversions API, services of Meta Platforms, Inc., to measure the results of our ads and to show PHAiTO ads on Facebook and Instagram to people who visited our Website. The Meta Pixel records the pages you view and the actions you take on the Website, together with your IP address, browser information and a Meta browser identifier stored in a cookie. When you start a free trial, our server also sends Meta a sign-up event with your IP address, browser information and that identifier; we do not send your email address. Meta may use this information for measurement and ad targeting under its own terms and privacy policy.

If you wish, you can configure your browser to notify you when you receive cookies or to reject them. It is possible to delete cookies from your computer's hard drive, block the creation of cookies, or receive a warning before a cookie is stored.

By doing so, your use of our Website may be affected, and you may no longer have access to all its functions.

Third parties, including Meta, may use cookies, web beacons and other storage technologies to collect or receive information from our Website and elsewhere on the internet, and use that information to provide measurement services and target ads. You can opt out of this collection and use for ad targeting by declining advertising cookies in our cookie banner, in your Facebook and Instagram ad preferences, or through the Digital Advertising Alliance of Canada (youradchoices.ca), the Digital Advertising Alliance (aboutads.info/choices) and Your Online Choices (youronlinechoices.eu).

Profiling technology

Advertising cookies are a technology that can profile you: they let Meta recognize people who visited our Website and include them in advertising audiences, which is known as retargeting. This function is off by default and is only activated if you switch on Advertising in our cookie banner.

To turn it on or off at any time, use the "Cookie settings" link at the bottom of any page of our Website. If you decline, we stop loading Google Analytics and the Meta Pixel and delete their identifiers from your browser. Information already shared with Google or Meta is handled under their own policies.

Privacy of Children

Our service is not intended for individuals under the age of 18. Therefore, we do not knowingly collect personally identifiable information from minors. If you are a parent or guardian and you are aware that your minor child has provided us with Personal Information, please contact us. If we learn that we have collected Personal Information from minors without verification of parental consent, we will take steps to remove that information from our servers.

Changes to This Policy

We may update the Policy from time to time.

Any changes made will be posted on our Website and brought to your attention when you log in. Changes to this Policy take effect when they are posted on this page. The date of the last version of this Policy appears at the bottom of the page. We recommend printing a copy of the Policy for your records and periodically checking this section of our Website to stay informed of any changes.

If we make significant changes to the Policy, we will notify you via the email address you have provided.

Privacy Officer

The Privacy Officer for PHAiTO is Victoria Dimaano.

For any questions or requests related to the Policy, you can send an email to the following address: [email protected].

Applicable Law

The Policy is intended to comply with Canadian and Quebec laws regarding the protection of Personal Information and, when applicable, California laws and the European General Data Protection Regulation "GDPR" (EU/2016/679) relating to such information. Depending on the constraints applicable in these jurisdictions, which you have informed us of, we will adapt, when necessary, our practices that may be complementary to this Policy. Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) governs processing of personal information received from foreign countries, in addition to stringent provincial laws applicable in Quebec. The European Union recognizes Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) as providing adequate protection.