Privacy Policy

Kosvio is a technology platform developed and managed by SJ Development Inc., a Canadian corporation.

In this Privacy Policy, “Kosvio,” “SJ Development Inc.,” “we,” “us,” and “our” refer to SJ Development Inc. and the Kosvio brand. “Website” refers to the Kosvio website available at www.kosvio.com, including its webpages, contact forms, newsletter forms, waitlist forms, and related online services that link to this Privacy Policy.

We respect your privacy and are committed to handling personal information responsibly, transparently, and in accordance with applicable Canadian privacy laws.

This Privacy Policy explains:

• What personal information we collect;
• Why we collect it;
• How we use and disclose it;
• How long we retain it;
• How we protect it;
• The choices and rights available to you; and
• How you can contact us about a privacy concern.

Our privacy practices are intended to comply with applicable Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act, commonly known as PIPEDA, and applicable provincial private-sector privacy laws.

This Privacy Policy currently applies to personal information collected through:

• The Kosvio marketing website;
• Newsletter and product-update subscriptions;
• Early-access and waitlist registrations;
• Contact, support, partnership, and feedback forms;
• Surveys or research forms that link to this Privacy Policy;
• Communications sent directly to Kosvio or SJ Development Inc.; and
• Cookies, analytics technologies, and similar technologies used on the Website.

Unless expressly stated otherwise, this Privacy Policy does not yet govern personal information processed through a future Kosvio mobile application, authenticated customer account, receipt-processing service, financial-document platform, payment system, or other commercial product.

Before launching services that process receipts, invoices, expense information, financial documents, account data, or other potentially sensitive information, we will update this Privacy Policy or publish an additional product-specific privacy notice.

SJ Development Inc. is responsible for personal information under its control.

We have designated a Privacy Officer who is responsible for overseeing our privacy program, responding to privacy questions and requests, and helping ensure that our practices comply with applicable privacy requirements.

You may contact our Privacy Officer at:

The name, title, and contact information of the individual serving as our Privacy Officer will be made available as required by applicable law.

“Personal information” generally means information about an identifiable individual.

Depending on the circumstances, personal information may include:

• A person’s name;
• Email address;
• Telephone number;
• Internet Protocol address;
• Device identifiers;
• Online activity;
• Communication history;
• Business affiliation when connected to an identifiable individual;
• Preferences or interests;
• Account information; and
• Other information that can identify a person directly or indirectly.

Information that has been anonymized so that it can no longer reasonably identify an individual is not treated as personal information where permitted by applicable law.

The information we collect depends on how you interact with us.

We may use personal information for the purposes described at the time of collection and for the following reasonable business purposes:

We seek meaningful consent for the collection, use, and disclosure of personal information where consent is required.

The appropriate form of consent may depend on:

• The sensitivity of the information;
• The reasonable expectations of the individual;
• The purpose for which the information is collected;
• The way the information will be used or disclosed; and
• Applicable legal requirements.

Consent may be express or implied where legally permitted. We generally seek express consent for optional marketing communications and other activities that are not necessary to provide a requested service.

When requesting consent, we aim to explain in clear language:

• What information is being collected;
• Why it is being collected;
• How it will be used;
• Whether it will be shared;
• The reasonably foreseeable consequences of the collection, use, or disclosure; and
• How consent may be withdrawn.

You may withdraw consent, subject to legal or contractual restrictions and reasonable notice. Withdrawal may prevent us from providing an optional feature or communication, but it will not affect processing that occurred lawfully before the withdrawal.

We may collect, use, or disclose personal information without consent when permitted or required by law.

We intend to send commercial electronic messages in accordance with Canada’s Anti-Spam Legislation, commonly known as CASL.

Where required, we will:

• Obtain express or valid implied consent before sending a commercial electronic message;
• Identify SJ Development Inc. and Kosvio as the sender;
• Provide valid contact information;
• Include a clear and functioning unsubscribe mechanism;
• Process unsubscribe requests within the period required by law; and
• Maintain appropriate records of consent.

You can unsubscribe by using the unsubscribe link included in an email or by contacting us at [email protected].

Even after you unsubscribe from marketing messages, we may continue to send non-commercial communications that are necessary to respond to your request, administer a service, provide important legal notices, or address security matters.

We use PostHog for optional, consent-based Website analytics to understand general usage and performance.

PostHog remains disabled unless you accept analytics. We have disabled automatic interaction capture and session recording. Analytics events do not include email addresses.

When analytics is enabled, PostHog may process:

• Truncated or complete Internet Protocol addresses;
• Device and browser information;
• Pages visited;
• Referral information;
• Approximate location;
• Interaction events; and
• Cookie or similar identifiers.

The Website currently uses the following analytics provider:

Analytics providers

PostHog — optional, consent-based Website analytics

Where reasonably possible, we will configure analytics services to minimize personal information collection, limit retention, and disable unnecessary advertising or profiling functions.

We do not sell or rent personal information.

We may disclose personal information in the circumstances described below.

Website hosting and content delivery

Cloudflare Pages

Form or waitlist processing

Sender

Email and newsletter delivery

Sender

Analytics

PostHog — enabled only after consent

Error and performance monitoring

No separate provider currently configured

Customer support

Handled directly by SJ Development Inc.; no separate provider currently configured

Some service providers may process or store personal information outside your province, territory, or Canada.

As a result, personal information may be subject to the laws of the jurisdiction in which it is processed and may be accessible to courts, law-enforcement agencies, national-security authorities, or other government bodies under the laws of that jurisdiction.

When using service providers outside Canada or outside the province in which information was collected, we will take reasonable steps appropriate to the sensitivity of the information. These may include:

• Reviewing the provider’s security and privacy practices;
• Limiting the information transferred;
• Using contractual privacy and confidentiality obligations;
• Restricting the provider’s permitted purposes;
• Applying access controls;
• Requiring appropriate incident notification; and
• Assessing legal and privacy risks where required.

You may contact our Privacy Officer for information about the jurisdictions in which our primary service providers process personal information.

We retain personal information only for as long as reasonably necessary to:

• Fulfil the purposes for which it was collected;
• Provide requested communications or services;
• Maintain business and consent records;
• Meet legal, accounting, tax, security, and regulatory obligations;
• Resolve disputes;
• Investigate incidents; and
• Enforce agreements.

Retention periods may vary depending on the type of information and its purpose.

Examples may include:

• Contact-form submissions retained while responding to the inquiry and for a reasonable follow-up period;
• Waitlist information retained until the waitlist purpose ends, the individual withdraws, or the information is no longer required;
• Newsletter information retained while a subscription remains active;
• Limited unsubscribe or suppression records retained to honour future opt-out requests and demonstrate compliance;
• Security logs retained for a limited period appropriate to incident detection and investigation; and
• Consent records retained for the period reasonably necessary to demonstrate compliance.

When personal information is no longer required, we will securely delete, destroy, or anonymize it, subject to applicable legal requirements and technical limitations.

SJ Development Inc. will maintain an internal retention and destruction schedule appropriate to its operations.

We use administrative, technical, organizational, and physical safeguards appropriate to the sensitivity, amount, format, and use of the personal information under our control.

Safeguards may include:

• Encryption during transmission;
• Encryption at rest where appropriate;
• Restricted access;
• Role-based permissions;
• Multi-factor authentication;
• Secure development practices;
• Security updates and vulnerability management;
• Logging and monitoring;
• Vendor assessments;
• Confidentiality obligations;
• Staff privacy and security training;
• Backup protections;
• Incident-response procedures; and
• Secure deletion practices.

No website, network, or storage system can be guaranteed to be completely secure. We therefore cannot promise absolute security. We continually review and improve safeguards as our systems and services evolve.

If you believe that personal information has been submitted to us insecurely or that your interaction with the Website may have been compromised, please contact our Privacy Officer promptly.

We maintain procedures for identifying, investigating, containing, documenting, and responding to suspected privacy or security incidents.

Where a breach of security safeguards creates a risk that meets the applicable legal reporting or notification threshold, we will:

• Notify the appropriate privacy regulator where required;
• Notify affected individuals where required;
• Provide information intended to help affected individuals reduce potential harm;
• Notify other organizations or government institutions where legally required or appropriate; and
• Maintain breach records as required by law.

The nature and timing of any notice will depend on the circumstances and applicable legal requirements.

Depending on the law that applies and the circumstances, you may have the right to:

• Ask whether we hold personal information about you;
• Request access to your personal information;
• Request information about how your information has been used or disclosed;
• Request correction of inaccurate or incomplete information;
• Withdraw consent to optional processing;
• Unsubscribe from marketing communications;
• Challenge our compliance with applicable privacy law;
• Request deletion of information where we are not legally required or otherwise permitted to retain it;
• Request information about our service providers or cross-border processing;
• Request a copy of eligible computerized personal information in a structured and commonly used technological format where the right to portability applies;
• Request that we cease disseminating or de-index certain information where such a right applies; and
• Receive information about an eligible decision made exclusively through automated processing, where applicable law provides that right.

These rights are subject to legal limitations. For example, we may be unable to provide information that:

• Contains personal information about another person;
• Is protected by solicitor-client privilege;
• Contains confidential commercial information;
• Could threaten another person’s safety or security;
• Was generated in the course of a formal dispute-resolution process; or
• Cannot legally be disclosed.

The current Kosvio marketing Website does not use personal information to make decisions that produce legal effects or similarly significant effects about Website visitors solely through automated processing.

We may use limited analytics or form-routing automation, but those activities are not intended to make consequential decisions about individuals.

If we introduce automated decision-making, profiling, artificial-intelligence processing, or technologies that materially affect individuals, we will provide any additional notice, explanation, consent mechanism, and rights required by applicable law.

The Website is intended for business owners, professionals, organizational representatives, and other adults. It is not directed to children.

We do not knowingly collect personal information from children through the Website.

If you are a parent or legal guardian and believe that a child has provided personal information to us without appropriate authorization, contact our Privacy Officer. We will review the matter and take reasonable steps, including deletion where appropriate and legally permitted.

Where Quebec law applies, we will obtain consent from a parent or guardian before knowingly collecting personal information from a person under 14, unless the collection is clearly for that minor’s benefit and is otherwise permitted by law.

Kosvio may maintain profiles on social media platforms.

When you interact with us through a social media platform, the platform may collect and process information according to its own privacy policy and settings. We may receive information such as:

• Your public profile name;
• Your username;
• Your comments or messages;
• Your interactions with Kosvio content; and
• Information you choose to make publicly available.

This Privacy Policy applies to information that we receive and control. It does not govern the independent privacy practices of social media platforms.

The Website may contain links to third-party websites, applications, or services.

We do not control and are not responsible for the privacy, security, content, or practices of third parties. A link does not mean that SJ Development Inc. endorses the third party’s privacy practices.

You should review the privacy policy of a third-party service before providing personal information.

Some browsers provide a “Do Not Track” setting. There is not currently a universally adopted technical standard for responding to these signals.

The Website may not respond to every Do Not Track signal. However, visitors can manage optional cookies through our cookie settings where available and through their browser or device settings.

We will update our practices if a binding technical or legal standard becomes applicable.

We may update this Privacy Policy to reflect:

• Changes to the Website;
• New products or services;
• Changes to our service providers;
• Changes to our information practices;
• Legal or regulatory developments; or
• Security and operational improvements.

When we make changes, we will update the “Last updated” date.

If a change is material, we will provide additional notice where appropriate or required. This may include:

• A prominent Website notice;
• An email;
• A renewed consent request; or
• Another appropriate communication.

We will not use previously collected personal information for a materially new purpose without obtaining additional consent where required by law.

Questions, requests, and complaints about this Privacy Policy or our handling of personal information should first be directed to:

We will review privacy complaints fairly and investigate them as appropriate. We may contact you for additional information and will communicate the outcome of our review.

If you are not satisfied with our response, you may contact the privacy regulator that has jurisdiction over the matter, which may include:

• The Office of the Privacy Commissioner of Canada;
• The Commission d’accès à l’information du Québec;
• The Office of the Information and Privacy Commissioner of Alberta; or
• The Office of the Information and Privacy Commissioner for British Columbia.

Nothing in this Privacy Policy limits any rights or remedies available to you under applicable law.