Windfal Canada Privacy Policy v1

Windfal Technologies Inc.
Privacy Policy (Canada)

Effective upon: May 1st, 2026
Last updated: March 13th, 2026

At Windfal Technologies Inc. ("we", "us" and "our"), we are strongly committed to transparency, and we want you to understand how we collect, use, disclose and protect your personal information, as well as how you can manage the information we collect from you. "You" includes the Homeowner, Agent and the Service Provider, as applicable (as the terms "Homeowner", "Agent", and "Home Services Contractors" are defined in our Terms of Use available at Windfal Canada Terms of Use v1).

This Privacy Policy applies to your use of the Windfal Website, the Windfal App, the Windfal Portal, and the Windfal Content under our Terms of Use, and all associated Windfal Services (as the terms "Windfal Website", "Windfal App", "Windfal Portal", "Windfal Content" and "Windfal Services" are defined in our Terms of Use, and collectively under this Privacy Policy, the "Services"). Capitalized terms used but not otherwise defined in this Privacy Policy have the meanings ascribed to such terms in our Terms of Use.

By using the Services, you are accepting the terms of this Privacy Policy. If you do not agree to the terms of this Privacy Policy, please do not use the Services. If you do not understand, or if you have questions about, this Privacy Policy, please contact us before using, or continuing to use, the Services.

The date on which the Privacy Policy was last amended is indicated above. We reserve the right to change our Privacy Policy from time to time. If we choose to amend this Privacy Policy, we will revise the "last updated" date at the top of this policy when we post the updated version. We will display a prominent notice that the Privacy Policy has been amended on our Windfal Website and Windfal App for a period of 30 days. The amended Privacy Policy is effective when posted. Your use of the Services after we have made changes to our Privacy Policy will mean that you have accepted those changes.

1. Information

Personal information means information about an identifiable individual (collectively, "personal information"), and does not include information that cannot be attributed to an identifiable individual, such as information of an aggregate or anonymous nature (collectively, "non-personal information"). We will only collect, use, and disclose the personal information that we need in order to provide you with the Services.

2. Consent

We will obtain your express consent prior to or when collecting, using, or disclosing your personal information for any purpose not described in this Privacy Policy, or for a purpose that was not identified to you nor reasonably expected at the time of collection, unless we are required or permitted by law not to obtain your consent.

We may rely on your implied consent in certain circumstances, after taking into account factors such as the sensitivity of the personal information and your reasonable expectations. We will limit the collection, use, and disclosure of your personal information to only that which is necessary for the purposes identified, unless you have otherwise consented, or when such collection, use, and/or disclosure is permitted or required by law.

You can always refuse to provide your personal information, except that it may prevent you from using our Services or receiving responses to your inquiries or other information of interest.

3. Types of Personal Information We Collect

We may collect various types of personal information from you (as applicable), depending upon how you interact with us or use or interact with our Services. This personal information may include your:

Contact/Location Information. Name, email address, postal address(es), phone number(s), and other contact information.
Purchase/Billing Information. Credit card information, record of purchases, service schedules, other information as requested to facilitate or complete delivery of the Services or to make available and provide ongoing support, maintenance, repair, training, or other Services related to those being purchased.
Property Assessment Data. Structured observations and results from Windfal's proprietary assessment of condition elements across the home, captured and maintained in a digital format tied to the home's record.
Digital Home Record. A record of repairs, upgrades, and maintenance items associated with the home.
Condition of Home. Valuation information that factors in the property's actual condition, together with related outputs including the information necessary to generate, display, and update the Windfal score over time.
Marketplace Activity. Information about how you interact with the marketplace, including views, clicks, saves/favorites, search behavior, preference signals, and similar engagement metrics.
Windfal Portal Data. If you are an Agent, information related to your use of the Windfal Portal, including Token (as defined in the Terms of Use) purchases and allocations, price estimates submitted for properties, communications through the Windfal Portal (including preliminary transaction details such as buyer representation status, financing type, and anticipated possession timelines), listing management activities, and compliance with the Agent Conduct Guidelines (as defined in the Terms of Use).
User-Submitted Third-Party Activity. Information you upload or provide about work performed by contractors on your home outside of the Windfal Website and/or Windfal App (for example, invoices, photos, notes, dates, scope, and costs) to update your home score, as well as records of work performed by contractors engaged through Windfal.
Imaging. Imaging and media of the home, including LiDAR scans and 3D video capture in connection with assessments and listings.
AI Data and Summaries. Queries, prompts, responses, chat logs, and other interactions with Windfal's AI assistant, as well as AI-generated outputs such as summaries, highlights, correlations, and insights derived from your data to provide contextual guidance about the specific home.
General Location Data. Information generated from your IP address that permits us to determine your general location.
Account Information. If you sign up and create an account, we may store and use your name, email address, postal address, phone number, photograph, and other personal information you may provide with your account. You can modify some of the personal information associated with your account. If you believe that someone has created an unauthorized account using your personal information, you can request its removal.
Device Information. IP address, operating system and platform, browser type and version, browser plug-in types and versions, device type, device identifiers, and other information about how you use the Services.
Inferences. Inferences drawn from or created based on any of the information identified in this list.

For clarity, not all information included above is personal information; we treat as personal information only data that identifies, relates to, or can reasonably be linked to an identifiable individual, and information that cannot be attributed to an identifiable individual (including property data on a non-identifiable basis) is considered non-personal information.

Where you provide us with personal information about another individual (i.e. potential buyer, co-owner, tenant, occupant, etc.), you represent and warrant that you have the lawful authority to do so and, where required by applicable law, that you have provided any necessary notices and obtained any required consent from that individual for our collection, use, and disclosure of their personal information as described in this Privacy Policy. Please do not upload sensitive personal information about others unless it is necessary for the Services and you are authorized to share it.

We strive to uphold data minimization principles and only seek to collect personal information from you for the purposes described in this Privacy Policy.

When we combine non-personal information with personal information, we treat the combined information as personal information. You can always refuse to provide the personal information, but please note that some personal information is necessary to provide the Services.

4. How We Collect Personal Information

We need to collect personal information from you in order to provide you with our Services, as well as to improve the experience of using our Services. You may provide us with personal information in several ways, including, for example when you:

use our Services;
create an account;
correspond with us, including through surveys;
sign up to receive our newsletter or promotional information;
ask for customer service, support or other assistance; or
interact with us in any other way, online or offline, including through our Services.

We may also collect personal information from other sources (such as from third party service providers) to, among other things, enable us to complete, verify, or update personal information contained in our records and to better customize the Services we provide. We also may collect personal information from third‑party integrations (for example, MLS/IDX providers, Jobber and calendar tools) in order to synchronize data and provide the Services you request. For example, we may collect MLS listing numbers to connect your MLS listing with your listing in the Windfal App, and we may collect your address and contact information to use Jobber for scheduling purposes. You do not sign in through or directly connect to these third-party applications.

Web Beacons & Cookies

Like many websites and apps, we use web beacons and "cookies", which are small text or image files that are stored on your computer or equipment when you visit certain online pages that record your preferences and actions, including how you use a website. We use this information for analytics purposes which allows us to improve your experience. The information we collect through these technologies will also be used to manage your session. Out of these, the files that are categorized as "necessary" are stored on your browser as they are essential for the working of basic functionalities of the website. Disabling these necessary files may result in a website or app not functioning properly.

You can set your browser or device to refuse beacons or cookies or to indicate when they are being sent. If you delete them or if you opt-out, or if you set your browser or device to decline these technologies, some Services may not function properly. The Services do not currently change the way they operate upon detection of a Do Not Track or similar signal.

Online Analytics

We also use various types of online analytics including, but not limited to, Google Analytics, a web analytics service provided by Google, Inc. ("Google"), on the Windfal Website. Google Analytics uses cookies or other tracking technologies to help us analyze how users interact with and use the website, compile reports on the related activities, and provide other services related to website and app activity and usage. The technologies used by Google may collect information such as your IP address, time of visit, whether you are a return visitor, and any referring website or app. The information generated by Google Analytics will be transmitted to and stored by Google and will be subject to Google's privacy policies. To learn more about Google's partner services and to learn how to opt-out of tracking of analytics by Google, please visit Google's website.

We also use our own in-house analytics tools to measure and improve the Services. These tools may rely on cookies, SDKs, and device identifiers to collect information about how you use the Services (for example, page views, feature usage, session duration, referral URLs, and performance diagnostics). Where feasible, we configure these tools to use de-identified, aggregated, or anonymized data, and we implement safeguards designed to prevent re-identification. We use the resulting reports to operate, maintain, and improve the Services, detect and prevent fraud and abuse, and develop new features. Data processed through our in-house analytics is handled in accordance with this Privacy Policy.

Social Media Integration

The Services may, from time to time, contain links to and from social media platforms. You may choose to connect to us through a social media platform, such as Facebook, LinkedIn or X (formerly Twitter), and when you do, we may collect additional information from you, including the information listed in the Types of Personal Information We Collect section above. Please be advised that social media platforms may also collect information from you. When you click on a social plug-in, such as X's "Tweet" button, that particular social network's plugin will be activated and your browser will directly connect to that provider's servers. We encourage you to review the social media platforms' usage and disclosure policies and practices, including the data security practices, before using them.

Surveys

From time to time, and subject to your consent where required by applicable local law, we may provide you with the opportunity to participate in surveys, some of which might be sponsored or conducted by a third party. Participation in these surveys is completely voluntary. If you choose to participate, we will request certain personal information from you. If there is a third-party sponsor involved in the survey, we may provide certain personal information to the third-party sponsor. Please make sure to review the sponsor's privacy policy and be aware that any surveys offered by us may be governed by specific rules, terms and conditions that are separate from and in addition to this Privacy Notice. By participating in any such surveys, you will become subject to those rules, including but not limited to receiving emails containing survey communications.

5. How We Use Personal Information

Unless otherwise consented by you in advance, or as may be permitted or required by law, we will only use and disclose your personal information to fulfill the purposes for which it was collected (and in accordance with this Privacy Policy).

We may use personal information to do any or all of the following:

facilitate the provision of the Services you request;
facilitate your interactions and transactions with us, such as requests for support or additional Services;
verify your identity and credentials (as applicable);
process and maintain your account;
provide you with a personalized experience;
administer our relationship with you, including creating and managing your account;
respond to your requests, communications, suggestions, comments, and inquiries, including your feedback about the Services;
analyze and measure performance, maintenance, and operations (such as our customer care interactions with you);
enable and operate third party integrations on our behalf (without requiring you to sign in or directly connect to third-party applications), including syncing data to and from third-party service providers. For example, we may collect information such as MLS listing numbers to connect your MLS listing with your Windfal listing, your address and contact information to enable scheduling through Jobber and other calendar tools, and to maintain these connections and configurations;
monitor communications between Homeowners and Agents to ensure compliance with our Terms of Use;
facilitate Windfal Portal functionality;
monitor, review, and audit activity on the Windfal Portal, including communications, to ensure compliance with the Terms of Use and the Agent Conduct Guidelines, investigate complaints and reported violations, and take appropriate enforcement action;
develop new products and services and build products and features;
conduct surveys and research to better understand the preferences of our customers like you;
provide you with, and improve, relevant marketing offers or information from us or third parties;
provide you with promotional items;
develop and manage relationships with our business partners;
ensure our systems are secure;
respond to legally binding demands from law enforcement, regulatory authorities or other third parties;
defend, protect, or enforce our rights or applicable terms of service;
to prevent fraud or the recurrence of fraud;
assist in the event of an emergency; and
comply with applicable law.

We may also combine your personal information collected through various sources, including personal information collected through the Services, and develop a profile that will be used for the purposes above.

In many cases, we de-identify your personal information as soon as we collect it. In these cases, such information is non-personal information. We may use non-personal information for any legitimate business purpose.

6. How We Disclose Personal Information

Except as set forth in this Privacy Policy, or as required or permitted by law, we do not disclose your personal information to any parties other than to the Homeowner, Agent or Service Provider (as applicable), our service providers (including contractors and third party research and development entities) and our affiliates, and their respective directors, officers, employees, agents, consultants, advisors or other representatives that have a need to use your personal information to provide or improve our Services, to legal or regulatory authorities, or for other purposes for which you have provided your consent. We also may disclose personal information to third‑party service providers (for example, MLS/IDX providers, Jobber, and calendar tools) as necessary to enable integrations on our end, synchronize data and deliver the Services you request, in each case consistent with this Privacy Policy. In no event will we sell or rent your personal information.

We may disclose personal information:

to the Homeowner, Agent or Service Provider (as applicable), and/or our third party service providers (within or outside of Canada) to help us with the uses described in the How We Use Personal Information section above. We may process, store and transfer your personal information in and to a foreign country, with different privacy laws that may or may not be as comprehensive as Canadian law, for example, cloud hosting, analytics and AI tooling providers. We may also engage third‑party service providers for hosting, analytics, security, and related services, and we limit their access to personal information to what is necessary to perform services on our behalf. Personal information in the custody and control of a third party service provider is subject to the laws of the jurisdiction applicable to that third party service provider. We will act in a reasonable manner, including by contractual or other means, to ensure that the third party service provider agrees to similarly be bound by this Privacy Policy or a privacy policy that provides substantially similar measures to those employed by us to protect the privacy and security of your personal information and to similarly comply with applicable privacy legislation with respect to your personal information, but we cannot guarantee such latter compliance by the third party;
to comply with your directions or any additional consent you have provided us;
to other parties where we are under a duty to disclose your personal information in order to comply with any applicable legal obligation including a regulatory process, or an order of a government institution, investigative body, regulatory body or judicial authority of competent jurisdiction;
where we transfer or are considering transferring control of any or all of our assets, operations or services to a third party acquirer of all or substantially all of our assets, including our rights and obligations relating to our Services, to a third party. The third party may continue to retain and use the personal information that you provided to us. We will act in a reasonable manner, including by contractual or other means, to ensure that the third party agrees to similarly be bound by this Privacy Policy or a privacy policy that provides substantially similar measures to those employed by us to protect the privacy and security of your personal information and to similarly comply with applicable privacy legislation with respect to your personal information, but we cannot guarantee such latter compliance by the third party acquirer; and
where we merge, consolidate, or amalgamate with a third party, the merged, consolidated, or amalgamated entity may continue to use and disclose your personal information. We will use our best efforts to ensure that the merged, consolidated, or amalgamated entity agrees to similarly be bound by this Privacy Policy or a privacy policy that provides substantially similar measures to those employed by us to protect the privacy of your personal information and to similarly comply with applicable privacy legislation with respect to your personal information, but we cannot guarantee such compliance.

We disclose non-personal information to third parties as reasonably necessary to meet our business needs. We do not disclose your personal information to third parties for their own direct marketing purposes without your consent.

7. How We Protect Personal Information

We are concerned about ensuring the security of your personal information, and we have taken appropriate measures to ensure its security and confidentiality. We exercise great care in providing secure transmission of your personal information from your browser or device to our servers. For example, we use an encrypted channel(s) between our front-end web service and our APIs, and we store encrypted personal information that we have collected in secure operating environments. We will only retain your personal information for the period of time reasonably required to fulfill the purposes for which it was collected. We may retain non-personal information for as long as we have a business need to do so.

Our Services may utilize third‑party hosting, infrastructure, analytics, security, and other service providers. We make reasonable efforts, including by contractual or other means, to require these providers to implement appropriate safeguards and to process personal information in accordance with this Privacy Policy.

An organization must protect personal information that is in its custody or under its control by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction. All of our service providers and contractors are contractually obligated to employ appropriate data security measures with respect to your personal information and to collect/use/disclose/retain it only within the scope required for the provision of our Services. However, we are not responsible for the actions and privacy policies of these third parties and their systems, programs, websites, solutions and/or applications. Check the privacy policies of these third parties for information on their privacy practices.

We try our best to safeguard personal information once we receive it, but please understand that no transmission of data over the Internet or any other public network can be guaranteed to be 100% secure. If you suspect an unauthorized use or security breach of your information, please contact us as soon as possible.

8. Automated Decision Making and AI

Our Services include AI-enabled features that help summarize, organize, and surface insights from your data, such as property assessment elements, the digital home record, imaging, and your interactions with our AI assistant. These features are intended to support your understanding and decision-making, and do not constitute professional advice. You should review AI outputs for accuracy and consult qualified professionals before making decisions about your home.

Nature of processing: AI features may generate summaries, highlights, correlations, or recommendations based on your inputs and the data associated with your property. We log interactions and system performance to improve safety, reliability, and user experience, and we retain these logs for a limited period consistent with our retention schedule. Our AI features may rely on third‑party, publicly available or generalized AI models provided by service providers; we do not build or deploy bespoke models trained on your personal information.
Training and model use: We do not use, or allow third-party AI providers to use, your personal information to train, retrain, or improve generalized AI models.
Accuracy, safety, and bias: We apply testing, monitoring, and safeguards designed to improve accuracy, reduce bias, and mitigate error. We restrict AI features from unsafe or harmful uses and may suspend access in cases of misuse.

9. Your Choices

Access to your personal information

On your reasonable written request, we will provide you, not later than 30 days from our receipt of your request, or such additional time as required by law, with access to or information about your personal information (if any) under our custody or control, and the names of persons to whom, and any circumstances in which, your personal information has been and is being disclosed by us. You must provide sufficient information in your request to allow us to verify your identity and identify the information you are seeking.

If you request a copy of your personal information and the personal information can reasonably be reproduced, we will provide you with a copy of the personal information, or, if applicable, we will give you reasons for any delay in providing a copy of the requested personal information. All requests may be subject to minimal costs, in accordance with applicable privacy legislation.

We reserve all rights not to disclose personal information, in whole or in part, in certain circumstances permitted or required by law, including but not limited to where:

the personal information is protected by any legal privilege;
the disclosure of the personal information would reveal confidential commercial information;
the disclosure could reasonably be expected to threaten the life or security of another individual;
the personal information was generated in the course of a formal dispute resolution process; or
the personal information was collected by us without your knowledge and consent for reasonable purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province.

If access to your personal information is refused, in whole or in part, we will provide you with the reasons for the refusal, the provision of applicable privacy legislation on which the refusal is based, and the contact information of the Privacy Officer who can answer your questions about the refusal, and will inform you that you may ask for a review of the refusal in accordance with applicable privacy legislation.

To submit a request to access your personal information or designate an authorized agent to make a request to access your personal information, please contact us. Our security procedures mean that we may request proof of identity before we disclose your personal information to you.

Updating your personal information

The accuracy of the personal information we have about you is very important. To submit a request that we update your personal information, please contact us.

On your request, we will make every reasonable effort to correct outdated personal information, or errors or omissions in your personal information where that personal information is in our custody or control. Such request must be in writing, signed by you, and include sufficient detail to enable us to identify any personal information in our custody or control in relation to the request.

We will, as soon as reasonably practical and not later than 30 days from our receipt of your request, or within such additional time as permitted or required by law, either correct the personal information and, if applicable and reasonable to do so, send correction notifications to any third party to whom we disclosed the incorrect personal information, or decide not to correct the personal information, but we will annotate the personal information under our control to indicate that a correction was requested but not made.

We will inform you of the action that we have taken in response to your request for correction, the contact information of the Privacy Officer who can answer your questions about your request for correction, and that you may ask for a review of the action taken in accordance with applicable privacy legislation.

Email communications

You may have the opportunity to receive certain communications from us related to our Services. If you provide us with your email address in order to receive communications, you can opt-out of marketing emails at any time by following the instructions at the bottom of our emails and adjusting your email preferences. Please note that certain emails may be necessary for the operation of our Services. You will continue to receive these emails, if appropriate, even if you unsubscribe from our optional communications.

10. Third Party Websites and Apps

The Services may contain links to other websites or apps operated by third parties. Please be advised that the practices described in this Privacy Policy do not apply to information gathered through these third-party websites and apps. We have no control over, and are not responsible for, the actions and privacy policies of third parties and other websites and apps.

11. Contact Us

If you have questions, concerns, or would like to access/update/change your personal information, you can contact us in the following ways:

Email	privacy@windfal.ca Subject Line: Privacy Information Question Attention: Privacy Officer
Mail	10536 178 St NW Edmonton, Alberta, Canada T5S 2J1 Attention: Privacy Officer

For your protection, we may need to verify your identity before assisting with your request, such as verifying that the information used to contact us matches the information that we have on file.