Customer Privacy Policy

Effective Date: September 11, 2026

Last Updated: September 20, 2026

1. Introduction

AddYea Technologies Inc. (“AddYea,” “we,” “us,” or “our”) respects the privacy of individuals who use or interact with our services.

This Customer Privacy Policy describes how AddYea collects, uses, discloses, stores, protects, and otherwise handles personal information in connection with the AddYea customer application, customer-facing website features, ordering, pickup, delivery, payment, account, and support services (the “Customer Services”).

This Privacy Policy applies to customers and, where relevant, individuals who interact with AddYea in connection with the customer services.

AddYea currently operates from Ontario, Canada and handles personal information in accordance with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (“PIPEDA”) where applicable.

Questions, requests, or complaints relating to privacy may be directed to:

Privacy Officer

AddYea Technologies Inc.

Ontario, Canada

Email: admin@addyea.com

This Customer Privacy Policy should be read together with the AddYea Customer Terms & Conditions where those Terms apply.

2. Accountability

AddYea is responsible for personal information under its control.

AddYea has designated a Privacy Officer responsible for privacy compliance and maintains policies, procedures, technical safeguards, and access controls intended to protect personal information.

Privacy inquiries, access or correction requests, account-deletion or closure requests, consent-related requests, and privacy complaints may be submitted to admin@addyea.com.

3. Personal Information We Collect

AddYea may collect customer information including:

• full name;

• telephone number;

• email address;

• delivery address;

• billing address, where applicable;

• account and login information;

• saved addresses;

• order history;

• products and quantities ordered;

• order totals;

• delivery preferences;

• delivery instructions;

• unavailable-item preferences and, where an approved substitution feature is offered, substitution preferences;

• cancellation information;

• refund information;

• account credits or promotional credits, where applicable;

• customer support inquiries and communications;

• records relating to account or phone verification;

• OTP and security-verification records;

• SMS consent records where applicable;

• delivery status information;

• recipient name, delivery address, telephone number, and delivery instructions where a customer places an order for another person;

Customers should provide another person’s recipient information only where they are authorized to do so and where it is reasonably necessary to complete the requested order.

• proof-of-delivery records and proof-of-delivery photographs captured by an assigned driver where applicable;

• information associated with complaints or disputes; and

• other information voluntarily provided to AddYea.

Order history and transaction-related information may be generated automatically when a customer uses the Customer Services.

4. Customer Location Information

With appropriate device permission or consent, AddYea may access customer location information for purposes such as:

• determining or confirming a customer’s current location;

• assisting the customer in selecting a delivery address;

• identifying stores or services available within the customer’s area;

• determining whether an address falls within an applicable delivery area; and

• operating and improving location-based functionality.

Customers may control device-level location permissions through their device settings. Certain location-based features may not operate properly if location permission is disabled.

AddYea does not use customer device location for continuous background tracking or unrelated marketing. Location access is intended for customer-requested or service-related location features, such as identifying nearby stores or validating a delivery area.

5. Payment and Transaction Information

Customer payments may be processed through third-party payment processors. AddYea does not store full payment card numbers or card security codes (CVV/CVC).

AddYea may receive or maintain limited transaction information necessary to operate the Customer Services, including:

• transaction identifiers;

• payment status;

• authorization status;

• payment amounts;

• applicable fees and taxes;

• driver tip amounts where a tipping feature is used;

• refund information;

• cancellation information;

• payment dates;

• limited card-related information made available by the payment processor, such as card type or last digits where applicable; and

• other transaction records required for accounting, support, fraud prevention, dispute resolution, or legal compliance.

During the initial launch period, if an approved refund cannot be processed through the original payment method, AddYea may offer to send the refund by Interac e-Transfer to the verified email address associated with the customer’s AddYea account. AddYea will obtain the customer’s confirmation before using this method and does not collect bank account numbers to process the transfer.

6. Automatically Collected and Technical Information

When individuals use AddYea websites or applications, AddYea or its service providers may automatically collect information such as:

• IP address;

• device type;

• operating system;

• browser type;

• app version;

• device identifiers where applicable;

• session information;

• login timestamps;

• activity timestamps;

• app or website interactions;

• pages or screens viewed;

• crash reports;

• error logs;

• diagnostic information;

• security logs;

• notification tokens;

• approximate location information where applicable;

• referral or source information;

• cookies; and

• similar technical information.

This information may be used to operate, maintain, analyze, secure, troubleshoot, and improve the Services.

When a visitor uses AddYea’s public website, AddYea may use Wix or another website service provider to host, secure, and maintain the website. The provider may process limited technical information, such as IP address, browser type, device information, session information, and security-related logs, as reasonably necessary to operate and protect the website.

7. Camera, Photograph, and File Permissions

Certain AddYea features may require access to a device camera, photographs, or uploaded files.

Examples may include:

• support or complaint photographs;

• images or files voluntarily uploaded by the customer;

• barcode or product-related features where offered; and

• other customer features requiring images or documents.

AddYea will request applicable device permission where required. Access is used only in connection with features for which such permission has been provided.

8. How AddYea Uses Customer Personal Information

AddYea may use customer personal information for purposes including:

• creating and maintaining customer accounts;

• verifying identities and account information;

• authenticating logins;

• providing OTP and security verification;

• processing and managing customer orders;

• providing selected stores with information necessary to prepare orders;

• coordinating unavailable items and any supported substitution preferences;

• arranging pickups and deliveries;

• determining service and delivery areas;

• operating location-based features;

• processing customer payments;

• processing refunds and cancellations, including issuing or communicating about an Interac e-Transfer refund to a verified account email address when the customer confirms that method;

• administering wallet or account credits where applicable;

• providing customer support;

• communicating about active orders and deliveries;

• investigating complaints and disputes;

• verifying delivery completion;

• using recipient information to complete orders placed for another person;

• using proof-of-delivery records or photographs to verify delivery, handle support requests, investigate disputes, and prevent fraud;

• preventing fraud and unauthorized use;

• maintaining platform and account security;

• complying with accounting, taxation, and regulatory obligations;

• maintaining business records;

• improving AddYea products and services;

• troubleshooting technical issues;

• performing analytics and forecasting demand;

• improving product availability and delivery operations;

• protecting the rights, property, safety, and security of AddYea and users; and

• complying with applicable legal requirements.

AddYea will not use personal information for a materially different purpose without appropriate notice and consent where required by law.

9. Analytics and Business Insights

AddYea may use analytics to understand, operate, develop, and improve the Customer Services, including analysis of customer usage patterns, product demand, purchasing trends, search and product-discovery activity, product popularity, inventory availability, out-of-stock patterns, order cancellations, refund patterns, checkout performance, delivery performance, technical performance, app interactions, and demand forecasting.

Where appropriate, AddYea may provide participating stores with aggregated or de-identified analytics and business insights. AddYea does not intend such aggregated or de-identified information to identify individual customers.

AddYea does not use personal information for third-party targeted advertising under this Privacy Policy.

10. Customer Information Shared With Stores

Participating stores receive only information reasonably necessary to prepare and fulfil customer orders. This may include:

• customer name;

• ordered products;

• quantities;

• unavailable-item information and, where AddYea offers an approved substitution feature, applicable substitution preferences;

• order notes where relevant; and

• other order information reasonably necessary to prepare the order.

Participating stores do not receive the customer’s delivery address or customer telephone number from AddYea for ordinary order preparation unless AddYea specifically authorizes disclosure for a legitimate operational purpose. Stores do not receive general access to customer profiles.

11. Customer Information Shared With Drivers

When a driver is assigned to an order, AddYea may provide the driver with information reasonably necessary to complete the delivery for the customer or recipient, including:

• customer or recipient name, where applicable;

• customer or recipient delivery address;

• delivery instructions;

• customer or recipient telephone number;

• store and pickup information; and

• other delivery-related information reasonably necessary to complete the assigned delivery.

Drivers receive this information only for the applicable delivery and may use the provided telephone number only for necessary delivery coordination. Drivers may not retain, disclose, or use customer or recipient information for unrelated purposes.

12. SMS Communications

AddYea may verify an account or contact information using an email OTP, an SMS OTP when available, or another reasonable security method.

SMS/text messaging, when available, is used only for one-time passwords, security verification codes, and related account-verification purposes. It is not used for advertising, promotions, marketing campaigns, promotional offers, or unrelated commercial messaging.

Where an SMS consent mechanism is presented, AddYea will obtain consent in accordance with applicable requirements. Phone numbers may be provided to an SMS service provider only as necessary to deliver requested or authorized OTP/security-verification messages and administer the SMS service.

Message and data rates may apply depending on the individual’s wireless service provider. Where applicable, users may follow available STOP or HELP instructions associated with the SMS service. SMS consent is not treated as consent to receive promotional or marketing messages.

13. Email Communications

AddYea may use email for transactional, authentication, security, legal, support, and service-related purposes, including:

• account registration and login;

• email OTP or verification codes;

• account recovery and security notices;

• customer account communications;

• important service announcements;

• Privacy Policy updates;

• Terms or agreement updates; and

• legally required notices.

Where relevant to the service, email may also be used for order confirmations, receipts, delivery information, support, refund or cancellation information, confirmation and delivery of Interac e-Transfer refunds, and other operational communications.

AddYea does not send promotional or marketing emails under this Privacy Policy.

Telephone and WhatsApp Support

Where AddYea offers telephone or WhatsApp support, AddYea may use the customer phone number and process the content of support or operational communications as reasonably necessary to provide assistance, coordinate the Services, document decisions, resolve disputes, address safety concerns, or maintain business records.

Telephone and WhatsApp communications are separate from SMS. AddYea does not use these support channels for promotional or marketing messaging under this Privacy Policy unless a separate lawful consent process is introduced.

AddYea does not ordinarily record telephone calls. If call recording is introduced in the future, AddYea will provide appropriate notice and obtain consent where required by applicable law.

Where a third-party messaging service such as WhatsApp is used, that service may process information under its own terms and privacy practices.

14. Push and In-App Notifications

AddYea may send transactional, operational, security, and service-related push notifications or in-app notifications to customers.

These may include notifications relating to account activity, security, order status, unavailable items, pickup or delivery status, receipts, support, and other service-related information applicable to the account.

Push notifications are separate from SMS communications. Users may generally control push-notification permissions through their device settings. Disabling notifications may result in missed or delayed operational updates.

AddYea does not treat permission for push notifications as consent to receive promotional SMS.

15. Service Providers and Other Third Parties

AddYea may use third-party companies and service providers to assist in operating the Services. Such providers may perform functions including:

• cloud hosting;

• database management;

• authentication;

• app infrastructure;

• analytics;

• diagnostics;

• security;

• fraud prevention;

• payment processing;

• banking or payment transmission;

• OTP and security-verification delivery;

• email delivery;

• push notifications;

• POS integrations;

• inventory integrations;

• mapping and location services;

• accounting;

• tax reporting;

• legal services;

• insurance-related services; and

• other technical or operational functions.

AddYea seeks to limit the information provided to service providers to information reasonably necessary for them to perform their functions. Service providers are expected to process information only for authorized purposes and subject to appropriate contractual, technical, organizational, or other safeguards.

AddYea may use Wix to host and maintain its public website. AddYea does not currently collect customer contact, order, payment, or delivery information through the public website; customers are directed to the AddYea application for those services.

16. Professional Advisers and Authorities

AddYea may disclose information where reasonably necessary to accountants, auditors, lawyers, tax advisers, insurers, financial institutions, governmental authorities, regulators, courts, or law-enforcement authorities.

Such disclosure may occur where reasonably necessary to comply with applicable law, satisfy tax or regulatory reporting obligations, respond to lawful legal process, protect legal rights, investigate fraud, address safety concerns, enforce agreements, or establish, exercise, or defend legal claims.

17. Sale of Personal Information

AddYea does not sell or rent personal information to third parties for their independent marketing purposes.

Aggregated or effectively de-identified information may be used or shared for legitimate business, analytical, operational, or statistical purposes where such information is not intended to identify an individual.

18. Corporate Transactions

Personal information may be disclosed or transferred as part of a proposed or completed investment, financing, merger, acquisition, restructuring, reorganization, sale of assets, sale of business, or similar corporate transaction.

Where appropriate, AddYea will take reasonable steps to require that personal information remain subject to appropriate confidentiality and privacy safeguards.

19. Cross-Border Processing

AddYea and its service providers may store or process personal information in Canada or in other jurisdictions.

Where personal information is transferred outside Canada, it may be subject to the laws of the jurisdiction in which it is processed and may be accessible to courts, law-enforcement agencies, regulatory authorities, or governmental authorities in accordance with applicable law.

AddYea remains responsible for personal information under its control and seeks to use reasonable contractual, organizational, and technical safeguards when information is processed by third-party service providers.

20. Access Controls and Confidentiality

Access to personal information is restricted based on legitimate operational requirements. Sensitive information is restricted to authorized AddYea personnel on a need-to-know basis.

Sensitive information such as banking information, tax information, identity documentation, driver’s licence documentation, insurance documentation, and other highly sensitive records is intended to be accessible only to appropriately authorized administrative, finance, compliance, or other personnel where required for their responsibilities.

21. Security Safeguards

AddYea uses reasonable administrative, technical, and organizational safeguards appropriate to the sensitivity of personal information.

These safeguards may include:

• access controls;

• authentication controls;

• password protection;

• OTP verification;

• role-based access restrictions;

• secure communications;

• encryption in transit;

• encryption at rest where supported and appropriate;

• secure cloud infrastructure;

• restricted access to sensitive documents;

• monitoring and security logging;

• backups;

• fraud-prevention measures;

• system updates;

• vulnerability remediation; and

• procedures for responding to security incidents.

No electronic system, network, or method of storage or transmission can be guaranteed to be completely secure. Accordingly, AddYea cannot guarantee absolute security.

22. Retention of Customer Personal Information

AddYea retains customer personal information only for as long as reasonably necessary to fulfil the purposes for which it was collected, operate the Customer Services, comply with legal obligations, resolve disputes, prevent fraud, enforce agreements, and satisfy tax, accounting, and regulatory requirements.

Customer account information may be retained while an account remains active and for a reasonable period afterward where required for legitimate business or legal purposes.

Order, recipient, payment, cancellation, refund, wallet/credit, proof-of-delivery, and transaction records may be retained for accounting, tax, customer-support, fraud-prevention, delivery verification, legal, and dispute-resolution purposes.

Support communications and complaint records may be retained while an issue is active and for a reasonable period afterward for operational, dispute-resolution, legal, security, or record-keeping purposes.

23. Account Closure and Deletion Requests

Customers may request account closure or deletion by contacting admin@addyea.com.

An account-deletion or closure request does not necessarily result in immediate deletion of every record associated with the account.

AddYea may retain information where reasonably necessary or required for tax obligations, accounting, payment records, regulatory reporting, fraud prevention, security, dispute resolution, insurance matters, enforcing agreements, legal claims, or other requirements imposed by applicable law.

Where information is no longer required, AddYea will take reasonable steps to delete, destroy, or de-identify it in accordance with applicable requirements.

24. Access and Correction Rights

Subject to applicable law, individuals may request confirmation of whether AddYea holds personal information about them, access to their personal information, information about how their information has been used or disclosed, correction of inaccurate or incomplete information, or updates to account information.

Requests may be submitted to admin@addyea.com. AddYea may need to verify the requester’s identity before providing access to or changing personal information. Certain information may not be provided where access is restricted or prohibited by applicable law.

25. Withdrawal of Consent

Where AddYea relies on consent for a particular collection, use, or disclosure of personal information, an individual may withdraw that consent subject to reasonable notice and any legal or contractual restrictions.

Withdrawal of consent may affect AddYea’s ability to provide certain Services or features. Consent may not always be withdrawn where AddYea must retain or process information to comply with applicable laws, maintain required records, complete a transaction, prevent fraud, resolve an active dispute, or exercise legal rights.

Requests may be directed to admin@addyea.com.

26. Cookies and Similar Technologies

AddYea websites or web-based account pages may use cookies and similar technologies for purposes such as essential website functionality, session management, authentication, maintaining security, remembering preferences, analytics, diagnosing technical problems, and measuring website performance.

Browser settings may permit users to restrict or disable certain cookies. Disabling essential cookies may affect website functionality. Under this Privacy Policy, AddYea does not use cookies for third-party targeted advertising.

27. Third-Party Links and Services

The AddYea Services may contain links to or integrations with third-party websites, platforms, POS systems, payment services, or other external services.

Third-party services operate under their own privacy policies and terms. Except where required by applicable law, AddYea is not responsible for the independent privacy practices of third-party services that are not under AddYea’s control.

28. Accuracy of Information

AddYea relies on customers to provide accurate and current information. Information relevant to the Services should be updated when it changes. Correction requests may be submitted to admin@addyea.com.

29. Age Requirements

The Customer Services are intended for individuals who are at least 16 years of age. AddYea does not knowingly permit children under 16 to independently create customer accounts. If AddYea becomes aware that personal information has been collected from a child in circumstances where appropriate authorization or consent was required but not obtained, AddYea may take reasonable steps to delete or otherwise appropriately handle the information.

30. Privacy and Security Incidents

AddYea maintains procedures intended to identify, investigate, contain, document, and respond to suspected privacy or security incidents.

Where a breach of security safeguards occurs, AddYea will take steps appropriate to the circumstances. Where required by applicable law, AddYea will notify affected individuals and applicable privacy or regulatory authorities.

31. Privacy Complaints

Individuals who have questions or concerns regarding AddYea’s privacy practices are encouraged to contact admin@addyea.com.

AddYea will review privacy complaints and take reasonable steps to investigate and respond. Individuals may also have the right to raise unresolved privacy concerns with the Office of the Privacy Commissioner of Canada or another applicable privacy regulator.

32. Changes to this Privacy Policy

AddYea may update this Privacy Policy from time to time to reflect changes to the Services, new functionality, technological developments, operational changes, changes to service providers, changes to legal or regulatory requirements, or changes to AddYea’s information-handling practices.

The updated Privacy Policy will be made available through the applicable AddYea application, website, or another appropriate location and will identify the date of the most recent revision.

Where a change materially affects how AddYea collects, uses, or discloses personal information, AddYea will provide appropriate notice and, where required by applicable law, obtain additional consent before the new practice takes effect.

33. Future Features

This Privacy Policy applies to AddYea’s currently offered Services for this user group. Where AddYea introduces materially different services or features in the future that involve new types of personal information or materially different uses or disclosures of information, AddYea may update this Privacy Policy and provide any notice or obtain any consent required by applicable law before implementing those practices.

34. Contact AddYea

Questions, requests, account-deletion or closure requests, correction requests, consent-related requests, or complaints regarding this Privacy Policy or AddYea’s handling of personal information may be submitted to:

Privacy Officer

AddYea Technologies Inc.

Ontario, Canada

Email: admin@addyea.com