Privacy Policy

Creative Society Studios Inc. ("we," "us," or "our") operates 02File. This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with the 02File platform. We are committed to complying with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation, including Quebec’s Law 25 (Law Modernizing Privacy Protection Provisions).

1. Information We Collect

Account Information

When you register, we collect your name, email address, and payment information. Payment details are handled by our payment processor and we do not store raw payment card numbers on our systems. We also retain your subscription plan, billing history, and account preferences.

Email and Document Data

When you connect an email mailbox to 02File, we read your incoming emails and attachments in order to provide the platform’s core features — document triage, classification, filing, and AI-assisted analysis. This includes the content of emails and their attachments (such as PDFs, images, and documents), sender and recipient information, and message metadata (subject, date, thread identifiers).

The documents processed by 02File typically contain personal information about your clients (names, addresses, financial data, identity documents). 02File retains this information to provide the service. Structured borrower fields store sensitive government and financial identifiers (such as Social Insurance Numbers and bank account numbers) in masked form only — see "Data Retention" below. Raw email, OCR, and model-output fields may still contain identifiers from source documents until additional redaction or encryption ships. As a mortgage broker, you act as the data controller for this client personal information, and 02File processes and stores it as a data processor on your behalf.

Usage Data

We collect information about how you use the platform, including pages visited, features used, actions taken, and technical information such as IP address, browser type, and device information. This helps us improve the platform and diagnose operational issues.

2. How We Use Your Information

• —To provide the service: Process and classify documents, generate AI summaries and draft replies, file documents to your connected storage, and operate all platform features.
• —To operate your account: Manage your subscription, process payments, send service notifications, and provide customer support.
• —To improve the platform: Analyze aggregated usage patterns to improve features and develop new capabilities. We do not use individual client document contents to train AI models.
• —To communicate with you: Send product updates, important notices, and — with your consent — marketing communications. You can opt out of marketing emails at any time.
• —To comply with legal obligations: Retain records as required by applicable law and respond to lawful requests from regulatory authorities.

3. How We Share Your Information

We do not sell your personal information or your clients’ personal information to third parties. We share information only in the following circumstances:

• —Service providers: We engage trusted third-party providers to operate the platform, including infrastructure, authentication, payment processing, AI processing, document storage, and email connectivity. These providers are contractually bound to process data only as instructed by us and to maintain appropriate safeguards.
• —Legal requirements: We may disclose information if required to do so by law, court order, or regulatory authority.
• —Business transfers: If Creative Society Studios Inc. is acquired or merges with another company, your information may be transferred as part of that transaction. We will notify you beforehand.

4. Data Storage and Security

Your data is stored on servers located in Canada and/or the United States through our infrastructure providers. We implement reasonable technical and organizational security measures, including encryption at rest and in transit, access controls, and regular security reviews.

No system is completely secure. You are responsible for maintaining the security of your account credentials. If you believe your account has been compromised, contact us immediately at privacy@02file.com.

5. Data Retention

02File is a system of record. We retain the client documents, extracted data, emails, and mortgage application data you process through the platform for as long as your account is active, so that your files, history, and workflows remain available to you. This retention is a core part of how the platform works.

For structured borrower fields we store only a masked form of sensitive government and financial identifiers (such as Social Insurance Numbers, driver’s licence numbers, passport numbers, or bank account numbers) — typically the last three or four characters — for reference and matching. Separately, we retain email content, OCR text, model responses, and extracted document data to operate the product. Those materials may still contain identifiers that appeared in the source documents until redaction or encryption controls are applied to those fields. We are actively improving that protection and will update this policy as those controls ship.

After account deletion, we retain certain information for up to 90 days to allow for account recovery, after which it is deleted, unless longer retention is required by law or by mortgage broker regulatory requirements (typically six years post-close for certain document types under FINTRAC guidelines).

6. Your Rights

Subject to applicable law, you have the following rights regarding your personal information:

• —Access: Request a copy of the personal information we hold about you.
• —Correction: Request correction of inaccurate personal information.
• —Deletion: Request deletion of your account and associated personal information, subject to legal retention obligations.
• —Portability: Request an export of your data in a portable format.
• —Withdraw consent: Disconnect email accounts or revoke access at any time through your account settings.
• —Opt out of marketing: Unsubscribe from marketing emails at any time via the link in those emails.

To exercise any of these rights, contact us at privacy@02file.com. We will respond within 30 days as required by PIPEDA.

7. Cookies and Tracking

02File uses session cookies and local storage necessary for authentication and platform operation. We do not use third-party advertising cookies or cross-site tracking technologies. We may use privacy-respecting analytics to understand how the platform is used in aggregate. You can disable cookies in your browser, but this may affect platform functionality.

8. Children’s Privacy

02File is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, contact us immediately at privacy@02file.com.

9. Quebec-Specific Provisions (Law 25)

For users in Quebec, we comply with the Act respecting the protection of personal information in the private sector as amended by Law 25. Specifically:

• —We have designated a Privacy Officer responsible for compliance with privacy legislation. Contact: privacy@02file.com.
• —We conduct privacy impact assessments for new features involving significant personal information processing.
• —In the event of a confidentiality incident (data breach) affecting Quebec residents, we will notify the Commission d’accès à l’information (CAI) and affected individuals as required by law.
• —You have the right to request that automated processing decisions about you be explained, and to have a human review significant automated decisions.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice within the platform at least 14 days before the changes take effect. Your continued use of 02File after the effective date constitutes acceptance of the updated policy.

11. Contact Us

For privacy-related questions, requests, or concerns, contact our Privacy Officer at privacy@02file.com. For general support, contact us at hello@02file.com.

Draft document prepared on May 27, 2026. This document is not in force and is subject to change.