Privacy Policy.

TABLE OF CONTENTS

1. INTRODUCTION AND OVERVIEW

1.1 Purpose and Scope

This Privacy Policy explains how Prioritay ("Company," "we," "us," or "our"), the owner and operator of the Prioritay relationship clarity application (the "App"), collects, uses, processes, and protects personal information when you access or use the Prioritay App and related services (collectively, the "Services").

Prioritay is a relationship clarity app that helps people stay connected to their personal standards inside a relationship. The App enables users to record personal relationship standards across six categories, complete daily check-ins, and receive a daily AI-generated insight sentence based solely on their own standards and responses. Prioritay does not give advice, make decisions, or tell users what to do. It reflects.

This Privacy Policy applies to:

• Users: Individual consumers who create accounts and use the Prioritay Services.
• Website Visitors: Individuals who visit the Prioritay landing page or related web properties.
• All persons whose data is collected, processed, or stored by Prioritay in connection with the Services.

Prioritay is intended for adults only. You must be 18 years of age or older to use the Services. See Section 14 for our Children's Privacy policy.

1.2 Governing Law and Jurisdiction

Prioritay operates as a Canadian Federal corporation. This Privacy Policy is governed by and construed in accordance with the laws of the [Province of Ontario] and the federal laws of Canada applicable therein, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25 / Bill 25).

Prioritay anticipates users globally and also complies with, or is designed to comply with:

• The General Data Protection Regulation (GDPR) for users in the European Union.
• The UK General Data Protection Regulation (UK GDPR) — for users in the United Kingdom.
• The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) for users in California, USA.
• Canada's Anti-Spam Legislation (CASL) — for all electronic commercial messages sent to Canadian recipients.

Where any conflict arises between applicable laws, the provision most protective of personal data shall prevail.

1.3 Prioritay's Role as Data Controller

Prioritay acts as a Data Controller in respect of all personal information it collects directly from users. Prioritay determines the purposes and means of processing your personal data. Prioritay does not act as a data processor on behalf of any other organization.

Prioritay does not sell, rent, or monetize user personal data. Prioritay's business model is a direct subscription relationship with users. Your data is not our product.

1.4 Relationship with Other Policies

This Privacy Policy works together with Prioritay's Terms of Use. In case of conflict, the provision most protective of personal data and most compliant with applicable law prevails. Capitalized terms not defined in this Privacy Policy have the meaning given to them in the Terms of Use.

2. INFORMATION WE COLLECT

2.1 Information You Provide Directly

Account and Registration Information

When you create a Prioritay account, we collect:

• First name — used to personalize your in-app experience.
• Email address — used as your account identity and for account recovery only. Not used for marketing without your consent.
• 4-digit PIN — your primary access method. Stored as a secure cryptographic hash only. Never stored in plain text. Never visible to SIFT staff.
• Age confirmation — a Boolean confirmation (yes/no) that you are 18 years of age or older, and the timestamp of that confirmation. No date of birth is ever collected.

Personal Relationship Standards (Sensitive Data)

During onboarding, you write one personal relationship standard for each of six relationship pillars in your own words:

• Signal Clarity
• Effort
• Integrity
• Momentum
• Reciprocity
• Standards Conflict

These standards are your personal expression of what you need in a relationship. They are highly personal and emotionally sensitive. Prioritay treats them with the highest level of confidentiality. They are:

• Stored exactly as you typed them — never altered, paraphrased, or interpreted by Prioritay.
• Visible only to you inside your account.
• Passed to the Anthropic Claude API (in anonymized form, without your name or email address) to generate your daily insight sentence. See Section 2.4 and Section 6 for full details.
• Never shared with any other party, never used for advertising, and never used for AI model training.

Daily Check-In Responses (Sensitive Data)

After each daily check-in, we collect and store:

• Your answer per pillar: Met / Somewhat Met / Not Met / Not Applicable.
• The calculated raw score and percentage score for that check-in.
• The Closer / Further signal calculated from your answers.
• The AI-generated daily insight sentence produced for that check-in.
• The timestamp of the check-in.
• The first name of the person you are tracking ("person_name") stored as entered by you, used only within your account.

Check-in responses are immutable once submitted. They cannot be edited or deleted individually. This is by design to protect the integrity of your personal record. You may delete all data by deleting your account (see Section 7).

Communications

If you contact Prioritay for support, account recovery, or any other purpose, we collect the content of those communications and any information you provide.

2.2 Information Collected Automatically

Server Logs

When you access the Prioritay App, we automatically collect standard server log information for security and debugging purposes only:

• IP address
• Browser type and version
• Device type (desktop, mobile, tablet)
• Operating system

This information is not linked to your account for profiling purposes and is not shared with advertising networks.

Usage and Behavioral Data

We collect basic in-app usage analytics for product improvement purposes only:

• Check-in frequency
• Feature usage patterns
• Session data and duration

This data is used solely for internal product improvement. It is anonymized or aggregated before analysis and is never shared with third parties in individually identifiable form.

Cookies

Prioritay uses session cookies for authentication purposes only. These cookies are necessary for the App to function securely. They are deleted when your browser session ends.

Prioritay does not use advertising cookies, tracking pixels, retargeting cookies, or any third-party analytics cookies at launch. If this changes in a future version, this Privacy Policy will be updated, and you will be notified in advance.

2.3 Information We Do NOT Collect

To be clear about what Prioritay does not collect:

• No phone numbers.
• No physical or mailing addresses.
• No date of birth (age confirmation only).
• No government-issued ID, SIN, or passport information.
• No health, medical, or biometric data.
• No real-time or GPS location data.
• No financial information (all payments handled entirely by Stripe — Prioritay never sees your card details).
• No content from other platforms or social media.
• No information about your partner or the person you are tracking beyond the first name you provide.

2.4 AI Processing — The Daily Insight

After each check-in, Prioritay makes one API call to the Anthropic Claude API to generate your daily insight sentence. The following information is passed to the API:

• person_name: the first name you assigned to the person you are tracking.
• direction: the Closer or Further signal calculated from your check-in.
• Your six personal standards exactly as you wrote them.
• Your answer for each standard (Met / Somewhat Met / Not Met / Not Applicable).

The following information is NOT passed to the API:

• Your name, email address, account ID, or any other identifying information.
• Any historical check-in data.
• Any information about you beyond the anonymized check-in data above.

The AI's sole output is one plain-text sentence. It does not make decisions about you. It does not give advice. It reflects what happened in today's check-in in warm, plain language. The output is stored as part of your check-in record and displayed in your dashboard.

Anthropic (the operator of Claude) processes this data as a sub-processor. Anthropic is bound by a Data Processing Agreement. By default, Anthropic does not use data submitted via API calls to train its models. See Section 6 for full sub-processor details.

3. LAWFUL BASIS FOR PROCESSING (GDPR / CCPA / PIPEDA)

3.1 Lawful Basis Under GDPR (EU and UK Residents)

Prioritay processes personal data based on one or more of the following lawful bases:

3.2 Legal Basis Under CCPA / CPRA (California Residents)

Prioritay collects and processes personal information for the following purposes:

Prioritay does not sell personal information to third parties. SIFT does not share personal information for cross-context behavioral advertising. See Section 5.3 for our Do Not Sell / Do Not Share statement.

3.3 Legal Basis Under PIPEDA (Canadian Residents)

Prioritay collects personal information with:

• Consent: Express consent obtained at account creation (Screen 0 — Privacy Policy acceptance before any data is collected). Implied consent for standard service delivery after account creation.
• Legal requirement: Compliance with applicable tax laws and regulatory obligations.
• Legitimate interest: Basic anonymized product analytics, security, and fraud prevention — balanced against your privacy rights.

For users in Quebec, Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25) applies as the primary privacy framework governing the collection and use of personal information. Quebec's law has been deemed substantially similar to PIPEDA by the federal government, meaning PIPEDA is largely displaced for provincially regulated organizations operating in Quebec. Certain federal obligations under PIPEDA may still apply in limited circumstances, including in relation to cross-border data transfers. Quebec residents should refer to Section 3.4 for their specific rights and protections under Law 25.

You may withdraw consent at any time by deleting your account (see Section 7) or by contacting us at privacy@prioritay.com except where we are legally required to retain certain data.

3.4 Quebec — Law 25 (Bill 25) Compliance

Prioritay anticipates users in Quebec and is committed to compliance with Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25). Specific obligations include:

• Conducting a Privacy Impact Assessment (PIA) for all projects involving personal information — including but not limited to the Anthropic Claude API integration, the check-in scoring system, and any new third-party sub-processor onboarded prior to or after launch. PIAs must be completed before the relevant project goes live. Maintaining a register of personal information processing activities.
• Appointing a privacy officer (Mark Govindasamy, founder) as the designated contact for privacy matters.
• Providing Quebec residents with the right to data portability and the right to be de-indexed.
• Ensuring that privacy policies and consumer-facing documents are available in French before being presented to Quebec residents, in compliance with Quebec's Charter of the French Language (as amended by Bill 96).
• Publishing a clear and accessible privacy policy (this document) before any personal information is collected.

4. USE AND PURPOSES OF PROCESSING

4.1 Service Delivery

Prioritay processes personal data to:

• Create and manage your account.
• Provide access to the App and its features.
• Display your personal relationship standards exactly as you wrote them.
• Process your daily check-in answers and calculate your score.
• Calculate and display your Closer / Further signal.
• Generate your daily AI insight sentence via a single anonymized API call to Anthropic Claude.
• Display and update your visual funnel showing where the person you are tracking sits relative to your standards.
• Process payments and manage subscription renewals via Stripe.
• Send service-related communications (account recovery, subscription confirmation, security alerts).
• Provide technical support and troubleshooting.

4.2 Daily Check-In Reminders

During onboarding, you set a preferred daily check-in reminder time. Prioritay uses this to send you a daily push notification reminder. You can:

• Change your reminder time at any time in Settings.
• Disable daily reminders at any time in Settings.

The reminder is a floor, not a ceiling. The App is always available for you to complete a check-in at any time, regardless of the reminder schedule.

4.3 Analytics and Product Improvement

Prioritay uses basic anonymized and aggregated usage analytics to:

• Understand how users interact with the App (which features are used, where users may experience difficulty).
• Identify trends to improve product design and user experience.
• Monitor platform performance and error rates.

Individual user data is not used for external research. No profiling of individual users is conducted for marketing or targeting purposes. Prioritay does not use automated decision-making that produces legal or similarly significant effects on users.

4.4 AI-Assisted Features — The Daily Insight Sentence

Prioritay uses the Anthropic Claude API to generate one personalized insight sentence after each check-in. Important disclosures:

• The AI output is a reflective sentence based on your own standards and today's answers only. It does not consider historical data.
• AI does not make decisions about you. It does not advise you to stay or leave, tell you what your partner is feeling, or interpret your data.
• The AI output is probabilistic — the same inputs may produce slightly different outputs. This is the nature of large language models.
• The AI output may occasionally be imperfect. SIFT does not guarantee the accuracy or suitability of any AI-generated sentence.
• Prioritay's AI system prompt is designed to prevent the AI from using therapy language, clinical language, or motivational clichés. The AI is instructed to write warmly, specifically, and without judgment.
• No autonomous decisions about your account, access, or subscription are made by the AI.

AI Training: Anthropic does not, by default, use data submitted through the Claude API to train its AI models. Prioritay has not opted into any such training program. Your data is not used to train any AI model.

4.5 Security and Fraud Prevention

Prioritay processes personal data to:

• Detect, investigate, and prevent fraud, unauthorized access, and security breaches.
• Monitor suspicious login attempts and unusual access patterns.
• Enforce account lockout after three incorrect PIN attempts.
• Comply with applicable legal obligations regarding security incidents.

4.6 Legal and Regulatory Compliance

Prioritay processes personal data to:

• Comply with applicable data protection laws (PIPEDA, Law 25, GDPR, UK GDPR, CCPA/CPRA).
• Respond to lawful government requests (court orders, subpoenas, regulatory inquiries) — see Section 10.2.
• Comply with applicable tax and financial recordkeeping laws.
• Establish, exercise, or defend legal claims.

5. SHARING AND DISCLOSURE

5.1 Who We Share Data With

Prioritay does not sell personal data to third parties. Prioritay does not share personal data for advertising purposes. Prioritay shares data only in the following limited circumstances:

Third-Party Service Providers (Sub-Processors)

SIFT shares data with the following third-party service providers who are contractually bound to process data only on SIFT's instructions and in compliance with applicable data protection laws:

Affiliate and Influencer Partners

Prioritay operates an affiliate program through which influencers and content creators may refer subscribers using unique promo codes. Affiliate partners:

• Do not have access to any user personal data.
• Receive only aggregated revenue reporting data: the number of subscribers they have referred to and their associated earnings.
• Are not provided with the identities, email addresses, or any personal information of referred subscribers.

Legal Requirements

Prioritay may disclose personal data if required by law (court order, subpoena, government request), with notice to you unless legally prohibited or notice would be futile. See Section 10.2 for Prioritay's transparency commitments.

Business Transfer

If Prioritay is acquired, merged, or sold as a going concern, your personal data may be transferred to the acquiring entity, subject to equivalent privacy protections. Prioritay will provide you with notice of any such transfer and, where required by applicable law, an opportunity to request deletion of your data.

Aggregated and Anonymized Data

Prioritay may share aggregated, anonymized analytics (for example, general statistics about user check-in frequency or feature usage) with partners or publicly, without restriction. Such data cannot identify individual users.

5.2 International Data Transfers

Prioritay is based in Canada. Your data may be transferred to and processed in countries outside Canada, including the United States, as a result of our use of Stripe (US) and Anthropic's Claude API (US). See Section 10 for full details on international transfers, applicable safeguards, and your rights.

5.3 Do Not Sell / Do Not Share

SIFT DOES NOT:

• Sell personal data to any third party.
• Share personal data for cross-context behavioral advertising.
• Use personal data for targeted advertising.
• Provide personal data to data brokers.

For California Residents: Under CCPA/CPRA, SIFT does not engage in any "sales" or "sharing" as defined by those laws. You have no need to opt out of a sale, but if you wish to confirm, contact privacy@prioritay.com

6. THIRD-PARTY PROCESSORS AND VENDOR MANAGEMENT

6.1 Sub-Processor Details

Prioritay's current sub-processors are listed below. All sub-processors are contractually required to:

• Process personal data only on Prioritay's documented instructions.
• Implement security measures equivalent to those described in Section 8.
• Comply with applicable data protection laws including GDPR, UK GDPR, CCPA/CPRA, and PIPEDA.
• Delete or return personal data upon termination of the service relationship.
• Not sub-contract processing without Prioritay's prior written consent.

6.2 Data Processing Agreements

Prioritay will establish Data Processing Agreements (DPAs) with all sub-processors listed above prior to launch. Where required by GDPR or UK GDPR, Standard Contractual Clauses (SCCs) will be incorporated into those agreements to govern international data transfers. See Section 10 for further details.

6.3 Changes to Sub-Processors

Prioritay will update this Privacy Policy and notify registered users by email at least 14 days before adding any new sub-processor that will process personal data. If you object to a new sub-processor on legitimate data protection grounds, please contact privacy@prioritay.com If no acceptable alternative can be offered, you may close your account and request deletion of your data without penalty.

7. DATA RETENTION AND DELETION

7.1 Retention Schedule

Prioritay retains personal data only as long as necessary for the purpose for which it was collected and as required by applicable law:

7.2 Account Deletion

You may delete your Prioritay account at any time from within the App (Settings → Delete Account). Upon deletion:

• Your account is immediately deactivated.
• All personal data (account information, relationship standards, check-in responses, AI insight sentences) is permanently deleted within 30 days.
• Your Stripe subscription is cancelled. You will not be charged after deletion.
• You will receive a confirmation email upon successful deletion.

What is not deleted upon account deletion:

• Payment and billing records required by law (retained 7 years — tax compliance).
• Aggregated, anonymized analytics that do not identify you individually.

7.3 Inactive Accounts

If your account has been inactive for 12 consecutive months with no check-ins or logins, Prioritay will send a notification to your registered email address. If no action is taken within 30 days of that notification, your account and all associated personal data will be permanently deleted. You will be notified before deletion occurs.

7.4 Legal Holds

Prioritay may retain personal data beyond the standard retention periods described above if:

• Your data is subject to a legal hold, court order, subpoena, or regulatory requirement.
• Your account was suspended or terminated for breach of the Terms of Use (data retained for 1 year, then deleted).
• Retention is necessary to establish, exercise, or defend a legal claim.

In such cases, data is kept secure and confidential and processed only as legally required.

7.5 Deletion Method

All personal data is deleted using secure deletion methods that render data permanently unrecoverable. Prioritay does not retain "soft-deleted" personal data that could be recovered after the applicable retention period.

8. SECURITY MEASURES

8.1 Technical Security

Prioritay implements the following technical safeguards to protect your personal data:

Encryption

• In Transit: SSL/TLS encryption for all data transmission between your device and Prioritay's servers.
• At Rest: Encryption at rest for all stored personal data, including relationship standards and check-in responses.
• PIN Storage: Your 4-digit PIN is stored as a secure cryptographic hash only. It is never stored in plain text and is never visible to Prioritay staff or any third party.

Access Controls

• PIN Authentication: Required on every fresh App open and after 5 minutes of inactivity.
• Account Lockout: 3 incorrect PIN attempts lock the account. Recovery is available via email link only.
• Account Recovery Tokens: Single-use secure links that expire in 15 minutes.
• Least Privilege: Prioritay staff access to personal data is limited to what is strictly necessary for service delivery and security purposes.

Infrastructure

• Prioritay's App is hosted on a cloud infrastructure provider with industry-standard physical and network security controls.
• Prioritay's preferred hosting location is Canada (see Section 6).

8.2 Organizational Security

• All staff and contractors with access to personal data are bound by confidentiality obligations.
• Access to production systems is restricted and logged.
• Prioritay will develop a formal incident response plan post-incorporation (see Section 12).

8.3 Security Limitations

While Prioritay implements reasonable and industry-standard security measures, no system is 100% secure. Prioritay does not guarantee that breaches will never occur or that unauthorized access to personal data is impossible. You are responsible for:

• Keeping your PIN confidential and not sharing it with others.
• Using a strong, private PIN that you do not use for other purposes.
• Keeping your registered email account secure, as it is used for account recovery.
• Notifying Prioritay promptly if you suspect unauthorized access to your account.

If you become aware of a security incident involving your SIFT account or data, please contact privacy@prioritay.com immediately.

9. DATA SUBJECT RIGHTS AND HOW TO EXERCISE THEM

9.1 Rights Under GDPR (EU and UK Residents)

If you are located in the EU or UK, you have the following rights under GDPR and UK GDPR:

9.2 Rights Under CCPA / CPRA (California Residents)

If you are a California resident, you have the following rights under CCPA/CPRA:

• Right to Know: You have the right to know what personal information Prioritay collects about you, how it is used, and who it is shared with.
• Right to Delete: You have the right to request deletion of your personal information. Prioritay will delete within 30 days, subject to legal retention exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: Prioritay does not sell or share personal information. No action required but confirm at privacy@prioritay.com if desired.
• Right to Limit Use of Sensitive Personal Information: Prioritay limits the use of sensitive personal information (your relationship standards and check-in data) to what is necessary to provide the core Services. This data is not used for any secondary purpose.
• Right to Non-Discrimination: Prioritay will not discriminate against you for exercising your CCPA/CPRA rights. No price increases, service denial, or reduced quality of service will result from exercising these rights.

9.3 Rights Under PIPEDA (Canadian Residents)

• Right of Access: You have the right to access your personal information held by Prioritay. Response within 30 days.
• Right to Correction: You have the right to request correction of inaccurate information. You may update most account information directly in the App.
• Right to Withdraw Consent: You may withdraw consent to collection, use, or disclosure of your personal information at any time, except where Prioritay is legally required to retain data. The most complete form of withdrawal is account deletion.
• Right to Complaint: If you are dissatisfied with Prioritay's privacy practices, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or, if you are a Quebec resident, the Commission d'acces a l'information du Quebec (www.cai.gouv.qc.ca).

9.4 How to Exercise Your Rights

To exercise any of the rights described in this Section:

• Email privacy@prioritay.com with the subject line: "[RIGHT NAME] REQUEST" (e.g., "ACCESS REQUEST", "DELETION REQUEST", "PORTABILITY REQUEST").
• Include your first name, registered email address, and a clear description of the right you are exercising.
• Account deletion can be completed directly in the App (Settings → Delete Account) without contacting us.

Verification: Prioritay may ask you to verify your identity before processing your request, to prevent fraudulent requests. This may involve confirming details about your account or a verification email to your registered address.

Response Timeline:

• Acknowledgement: Within 5 business days of receiving your request.
• Full response: Within 30 days (or applicable legal deadline if shorter). If complexity requires more time, SIFT may extend by a further 30 days with notice.

Right to Appeal: If Prioritay denies your request, we will explain the reason in writing. You have the right to ask Prioritay to reconsider, or to file a complaint with your applicable supervisory authority (see Section 16.2).

9.5 Limits to Rights

Prioritay may refuse or limit a rights request if:

• The request is manifestly unfounded or abusive (e.g., repetitive requests within 12 months).
• Granting the request would violate another person's privacy rights.
• Data is required for legal compliance, fraud prevention, or defense of legal claims.
• Data is anonymized and cannot be used to identify you.

In such cases, Prioritay will explain the refusal and advise you of your right to appeal.

10. INTERNATIONAL DATA TRANSFERS

10.1 Where Your Data Is Processed

Prioritay is [incorporated] and primarily operates in Canada. Your data may be transferred to and processed in the United States as a result of Prioritay's use of:

• Stripe Inc. (payment processing) incorporated and operating in the USA.
• Anthropic PBC (Claude API — AI insight generation) incorporated and operated in the USA.
• Cloud hosting provider (TBD — may be US-based if Canadian hosting is not available for all services).

Prioritay's strong preference is for Canadian data storage, and we will select Canadian hosting wherever available. All international transfers will be disclosed in this Privacy Policy.

10.2 Safeguards for International Transfers

For transfers of personal data from the EU or UK to Canada or the USA, Prioritay relies on:

• Canada: Canada has been granted an adequacy decision by the European Commission under GDPR Article 45 (for PIPEDA-covered organizations). Prioritay, as a Canadian Federal Incorporation subject to PIPEDA, benefits from this adequacy decision for transfers of EU personal data to Canada.
• USA (Stripe, Anthropic): For transfers to US-based processors where no adequacy decision applies, Prioritay relies on Standard Contractual Clauses (SCCs) as approved by the European Commission (Decision EU 2021/914, Module Two — Controller to Processor), incorporated into the relevant Data Processing Agreements. For UK residents, Prioritay will rely on the UK International Data Transfer Addendum (IDTA) to SCCs.
• Supplementary measures: Strong encryption (in transit and at rest), access controls, minimum data transfer (anonymized check-in data only passed to Anthropic), and data processing agreements with all processors.

10.3 Government Access and Transparency

Prioritay will not voluntarily disclose your personal data to government agencies or law enforcement without a valid legal requirement. If Prioritay receives a court order, subpoena, warrant, or lawful government request for your data:

• Prioritay will comply with lawful requests as required by applicable law.
• Where legally permitted, Prioritay will notify you before disclosing your data.
• Prioritay will challenge overbroad, disproportionate, or unlawful requests where legally permissible.

Canadian Context: Canadian law permits law enforcement access to data via court orders, production orders, and warrants subject to Charter protections. Canada is part of the Five Eyes intelligence sharing agreement. SIFT has no control over intelligence access to data stored with third-party cloud providers.

US Context (for data processed by Stripe and Anthropic): US law permits government access via FISA warrants, NSLs, and subpoenas. Prioritay has no direct control over US government access to data processed by US-incorporated sub-processors.

10.4 Your Rights Regarding Transfers

If you believe Prioritay's international data transfers do not provide adequate protection for your personal data, you may:

• Contact Prioritay at privacy@prioritay.com to request more information about the safeguards in place.
• File a complaint with your applicable supervisory authority (see Section 16.2).
• Request deletion of your account and all associated personal data (see Section 7).

11. MARKETING, COOKIES, AND TRACKING

11.1 Marketing Communications

Prioritay sends the following types of communication:

11.2 Cookies and Tracking

Prioritay uses cookies sparingly and only where necessary:

If Prioritay introduces additional cookies or tracking technologies in a future version of the App, this Privacy Policy will be updated, and you will be notified with a minimum of 14 days' advance notice. A cookie consent mechanism will be implemented before any non-essential cookies are deployed.

11.3 No Targeted Advertising

Prioritay does not use targeted advertising. SIFT does not serve ads of any kind inside the App. Prioritay does not share your data with advertising networks. Your relationship data is never used for advertising purposes.

11.4 Promo Codes and Affiliate Tracking

Prioritay's affiliate program uses unique promo codes to track referrals. When you enter a promo code at account creation:

• The promo code is recorded in Prioritay's systems and linked to the applicable affiliate partner's account in Stripe for revenue attribution.
• The affiliate partner is not provided with your personal information. They receive only aggregate reporting (subscriber count and earnings).
• The promo code does not affect the personal data Prioritay collects from you or how it is used.

12. SECURITY INCIDENTS AND BREACH NOTIFICATION

12.1 What Constitutes a Security Breach

A security breach is a security incident involving:

• Unauthorized access to personal data.
• Unauthorized disclosure of personal data to a third party.
• Loss or theft of personal data.
• Corruption, alteration, or destruction of personal data without authorization.

12.2 Prioritay's Breach Response

Upon discovery of a security breach, SIFT will:

• Immediately assess and contain the breach — isolate affected systems and prevent further unauthorized access.
• Investigate the root cause, scope, and nature of the breach within 48 hours.
• Notify affected users by email to their registered address as soon as reasonably practicable and in any event within the timeframes required by applicable law.
• Report the breach to applicable regulatory authorities within legally required timeframes — 72 hours under GDPR (where applicable), and as required under PIPEDA and Law 25.
• Implement remediation measures to prevent recurrence.

Breach notifications to affected users will include:

• A description of the nature of the breach.
• The categories and approximate number of personal data records affected.
• Contact information for follow-up questions.
• A description of steps SIFT has taken or proposes to take to address the breach.
• Recommendations for steps you can take to protect yourself (e.g., updating PIN, monitoring email account).

12.3 Notification to Authorities

Prioritay will notify applicable privacy and data protection authorities as required by law:

• Office of the Privacy Commissioner of Canada (OPC) — under PIPEDA, for breaches that create a real risk of significant harm to individuals.
• Commission d'acces a l'information du Quebec (CAI) under Law 25, for applicable incidents.
• Applicable EU supervisory authorities — under GDPR Article 33, within 72 hours where Prioritay is subject to GDPR.
• UK Information Commissioner's Office (ICO) under UK GDPR, within 72 hours where applicable.

12.4 Incident Response Plan

Prioritay is developing a formal written incident response plan post-incorporation. This plan will cover containment, investigation, notification, and remediation procedures in detail. The plan will be in place before the App launches.

12.5 Reporting a Security Concern

If you discover or suspect a security vulnerability or breach involving SIFT's systems or your personal data, please report it immediately to:

Email: privacy@prioritay.com

Subject line: "SECURITY INCIDENT REPORT"

Prioritay will acknowledge your report within 24 hours and keep you informed of the investigation's progress.

13. THIRD-PARTY LINKS AND SERVICES

13.1 External Links

The Prioritay App and landing page may contain links to third-party websites or services (for example, links to Stripe's customer portal for subscription management, or to Anthropic's privacy policy). Prioritay is not responsible for:

• Privacy practices of third-party websites or services.
• The content, accuracy, or security of third-party services.
• Any data breaches or misuse by third parties.

When you follow a link to a third-party website, you are subject to that website's privacy policy, not Prioritay's. We encourage you to review the privacy policy of any third-party service before providing personal information to it.

13.2 Stripe Customer Portal

Prioritay uses Stripe's hosted checkout and customer portal for subscription management. When you access the Stripe customer portal (to manage your payment method, view invoices, or cancel your subscription), you are interacting directly with Stripe. Stripe's privacy policy governs the data you provide to Stripe. Prioritay does not have access to your payment card details at any point.

14. CHILDREN'S PRIVACY

14.1 Age Restriction

Prioritay is not intended for individuals under 18 years of age. You must be 18 years of age or older to create an account or use the Services. Prioritay deals with romantic relationships and is designed for adults only.

Prioritay requires all users to confirm at account creation that they are 18 or older (Screen 0 — Privacy Policy and Terms of Use acceptance, and the age confirmation checkbox on Screen 1). The timestamp of this confirmation is stored. No date of birth is collected.

14.2 Discovery of Minor's Data

Prioritay does not knowingly collect personal data from individuals under 18 years of age. If Prioritay discovers that personal data has been collected from a minor:

• Prioritay will promptly delete the data.
• Prioritay will deactivate the account.
• Where required by applicable law, Prioritay will notify the applicable authority.

If you believe that Prioritay has collected personal data from a person under 18 years of age, please contact privacy@prioritay.com immediately.

15. YOUR PRIVACY CHOICES AND ACCOUNT SETTINGS

15.1 In-App Controls

You have the following privacy controls available directly in the Prioritay App:

• Change PIN: Change your 4-digit PIN at any time in Settings (which requires confirmation of current PIN).
• Adjust check-in reminders: Change your daily reminder time or frequency at any time in Settings.

15.2 Email Preferences

Transactional emails (account recovery, subscription confirmation, payment notifications, policy updates) are necessary for the operation of your account and cannot be unsubscribed from without deleting your account.

If Prioritay introduces optional marketing or promotional emails in a future version, an unsubscribe link will be included in every such email, and your preference will be honored within 10 business days.

15.3 Data Export

You may request an export of your personal data at any time by emailing privacy@prioritay.com with the subject line "DATA EXPORT REQUEST". SIFT will provide your data in a structured, machine-readable format (CSV or JSON) within 15 business days. A self-service data export feature is planned for a future version of the App.

16. CONTACT INFORMATION AND YOUR RIGHTS

16.1 Privacy Contact

Prioritay's designated privacy contact is:

Mark Govindasamy — Privacy Officer

Prioritay Technologies Inc. (operating as [Prioritay])

Email: privacy@prioritay.com

For all privacy inquiries, data subject rights requests, security concerns, or complaints, please contact us at the email above. Include your full name, registered email address, and a clear description of your inquiry.

16.2 Supervisory Authority Contacts

If you are not satisfied with Prioritay's response to your privacy concern, you have the right to lodge a complaint with your applicable supervisory authority:

16.3 Policy Updates

Prioritay may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we update this Policy:

• We will update the "Last Updated" date at the top of this Policy.
• For material changes, we will notify you by email at your registered address at least 14 days before the changes take effect.
• For non-material changes (e.g., corrections, clarifications, new sub-processor additions), we will post the updated Policy on our website and on the App.
• Your continued use of the Services after the effective date of any updated Policy constitutes your acceptance of the revised terms.

If you do not agree with any update to this Privacy Policy, you may close your account and request deletion of your data before the changes take effect.

17. ACKNOWLEDGEMENT

By creating an account or using Prioritay's Services, you acknowledge and agree to the following:

• You have read this entire Privacy Policy and understand how your personal information will be collected, used, shared, and protected as described herein.
• You consent to the collection, processing, and disclosure of your personal data in accordance with this Privacy Policy and all the terms and conditions outlined in it.
• You confirm that you are 18 years of age or older and that the information you provided on account creation is accurate and complete.
• You understand that this Privacy Policy may be updated from time to time (per Section 16.3), and that your continued use of Prioritay's Services after any such update constitutes your acceptance of the revised terms.

If you do not agree with any part of this Privacy Policy or any future updates to it, you must discontinue use of the Prioritay Services and may delete your account at any time.

For our part, Prioritay reaffirms its commitment to handle your personal information with the care, transparency, and respect it deserves — treating your relationship data as the deeply personal information it is and using it only in ways that serve you directly.