PRIVACY POLICY

This Privacy Policy describes how Alula ("we," "us," or "our") accesses, collects, stores, uses, and shares ("processes") your personal information when you use our services (the "Services"), including when you:

• Visit our website at https://www.alulaplan.ca
• Use the Alula retirement planning tool, a web application that helps Canadians plan for retirement
• Sign up for our mailing list to hear about new features, paid tiers, or other updates
• Contact us through our website or by email
• Engage with us in other related ways, including any sales, marketing, or events

If you do not agree with our policies and practices, please do not use the Services. If you have questions or concerns, please contact us at alula.admin@gmail.com.

This summary highlights the most important points. The full details are in the sections that follow.

In Short: We collect only what we need. The free retirement planning tool is anonymous and does not store your inputs. Other parts of the Services collect names, email addresses, and (for future Premium users) financial planning data.

1.1 Free retirement planning tool (anonymous)

The free retirement planning tool currently available on alulaplan.ca operates anonymously. We do not ask for your name, email address, or any other identifying information to use the tool.

When you use the tool, you enter financial information about yourself — for example, your age, retirement goals, account types and balances, planned expenses, and pension expectations. This information is collected by the tool in your browser and sent to our solver running on Microsoft Azure servers in Canada. The solver computes your retirement plan and returns the results to your browser.

We do not store, log, cache, or persist your inputs or results on our servers. The data passes through our solver only for as long as it takes to compute your plan. Once the result is returned to your browser, the data is discarded server-side.

The information you enter may be temporarily retained in your browser (for example, in cookies, session storage, or local storage) so that you can continue your session, refresh the page, or revisit the tool without re-entering everything. This information remains on your device and under your control. You can clear it at any time using your browser settings.

1.2 Information you provide to us directly

If you choose to interact with us beyond the anonymous tool, we collect what you give us. This may include:

• Your name and email address (if you sign up for our mailing list about new features, paid tiers, or other updates)
• Your name, email address, and message contents (if you contact us through our website's contact form or by email)
• How you heard about us (if you choose to provide that on a form)
• Any feedback or other information you submit through forms on our website

1.3 Information collected when our paid Premium tier launches

We are planning to eventually launch a paid Premium tier. Premium users will create accounts and may provide the following categories of personal information when using Premium features:

• Identity and contact information: name, email address, date of birth, contact preferences, province of residence
• Account credentials and subscription status
• Detailed retirement planning inputs, including (without limitation):
  • Whether the user is currently retired or still saving
  • Plan start date, life expectancy, desired retirement age
  • Planned recurring retirement expenses and inflation assumptions
  • Desired value of investments at death
  • For each financial account: account type (e.g., chequing, savings, TFSA, RRSP, LIRA, non-registered), account name, current balance, fees, asset allocation, return assumptions, and (where applicable) cost basis
  • LIRA-to-LIF conversion age elections
  • Monthly savings contribution amounts and contribution strategy preferences
  • Withdrawal strategy preferences
  • Available TFSA and RRSP contribution room
  • Estimated employment income and salary growth assumptions
  • Information about expected lump-sum income or expenses
  • Information about expected employment or self-employment income during retirement
  • Defined benefit pension plan details
  • Canada Pension Plan (CPP) and Old Age Security (OAS) eligibility and benefit estimates
  • Canadian residency and citizenship status

When Premium launches, this Privacy Policy will be updated as needed and Premium users will be presented with the relevant terms before subscribing.

1.4 Information collected when our Expert Review service launches

Expert Review will be a paid add-on for Premium users that connects them with a Certified Financial Planner (CFP) employed or contracted by Alula. When Expert Review launches, we will collect:

• The information you provide before, during, and after your session (which may include the financial scenarios you wish to discuss, additional context you share, and any documents you choose to upload)
• A record of your session and any written deliverable produced (for example, a follow-up email summarizing the conversation and action items)

1.5 Information collected automatically

When you visit our website, certain information is collected automatically. This includes:

• Log and usage data: technical information about how you interact with the Services, such as IP address, browser type, device type, pages viewed, timestamps, and referring URLs. This is recorded by our hosting provider (Azure) for security, diagnostic, and operational purposes.
• Approximate location: Google Analytics provides us with country-level (and sometimes region-level) information based on your IP address. We do not use GPS or other precise geolocation technologies.
• Cookies and similar technologies: see Section 6 and our Cookie Policy.

1.6 Sensitive information

Some of the information processed by the Services (especially the financial planning inputs) may be considered "sensitive" under applicable Canadian privacy law. We process such information only with your consent (which is implied when you choose to enter it into the tool or provide it to a CFP) or as otherwise permitted by law.

In Short: We process your information to deliver the Services, communicate with you, prevent fraud, comply with law, and improve the Services.

We process your personal information for the following purposes:

• To deliver the Services. For example, to compute your retirement plan, to manage your Premium account (when Premium launches), and to facilitate Expert Review sessions (when Expert Review launches).
• To communicate with you. This includes responding to inquiries you send us, sending administrative messages (such as billing notices or changes to our policies), and notifying mailing-list subscribers about new features and updates.
• To manage subscriptions (when paid tiers are available). This includes processing payments through our payment processor (currently planned to be Stripe), updating subscription status, and communicating about billing or plan changes. Alula does not sell, ship, or receive physical products.
• To request and process feedback from beta users and other Service users.
• To send marketing and promotional communications consistent with your preferences. You can opt out at any time using the unsubscribe link in our emails or by contacting us.
• To publish testimonials. If we publish user testimonials in the future, we will only do so with the user's explicit prior written consent. We will only publish a first name and a province (and possibly a city or region — to be determined). Testimonials are uncompensated; we do not pay for reviews and do not edit them substantively.
• To protect the Services. This includes monitoring for fraud, abuse, and security issues.
• To improve the Services. We analyze usage patterns to understand how the Services are used and how to improve them.
• To comply with legal obligations and to establish, exercise, or defend legal claims.

In Short: We process your information when we have a valid legal reason to do so under applicable Canadian privacy law.

We rely on one or more of the following legal bases, depending on the activity:

• Your consent, which may be express (for example, when you submit information through a form) or implied (for example, when you voluntarily enter information into the planning tool). You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice.
• Performance of a contract with you (for example, providing Premium services to Premium subscribers).
• Compliance with our legal obligations.
• Our legitimate interests, such as operating the Services securely and improving them, where those interests are not overridden by your privacy rights.

In limited circumstances permitted by Canadian privacy law, we may process information without your consent — for example, for fraud detection and prevention; in connection with a business transaction (subject to legal conditions); or where required by court order, subpoena, or law.

In Short: We share information with a small number of service providers who help us run the Services, and in limited other circumstances described below. We do not sell your personal information.

4.1 Service providers

We share information with the following categories of service providers who perform services on our behalf:

• Cloud hosting and computing (Microsoft Azure). Our website and retirement planning solver run on Azure servers located in Canada (Toronto region). Azure may also process limited diagnostic and security information about your visit (such as IP address and request metadata).
• Web3Forms. We use Web3Forms to handle submissions from forms on our website. Web3Forms processes this information on servers located outside Canada (in the United States).
• HubSpot. We use HubSpot to manage our contact list. HubSpot processes this information on servers that may be located outside Canada (typically in the United States or European Union).
• Google Analytics. We use Google Analytics to understand website traffic patterns. Google may process this information on servers located outside Canada. To opt out of Google Analytics across all websites, visit https://tools.google.com/dlpage/gaoptout.
• Payment processing (when paid tiers launch). We plan to use Stripe to process subscription and Expert Review payments. Stripe will collect and process payment information directly; Alula does not store full payment card details. Stripe processes information on servers that may be located outside Canada.

We choose service providers that we believe offer appropriate privacy and security protections, and we limit what we share to what each provider needs to perform its function.

4.2 Cross-border data transfers

As described above, some service providers may process personal information outside Canada — primarily in the United States. By using the Services, you understand that your information may be processed in jurisdictions whose privacy laws differ from those in Canada. We take reasonable steps to ensure that information processed by these providers is protected by appropriate contractual and technical safeguards.

4.3 Other situations in which we may share information

• Business transfers. If we are involved in a merger, acquisition, financing, or sale of all or part of our business, we may share or transfer your information to the parties involved. We will notify users of any such transfer to the extent required by law.
• Legal requirements. We may disclose information when required to do so by law, court order, or government request, or to establish, exercise, or defend our legal rights.
• With your consent. We may share information for other purposes with your consent.

In Short: We are not responsible for the privacy practices of third-party websites linked from our Services.

The Services may link to third-party websites or services that are not operated by us. We do not control these third parties and are not responsible for their content or privacy practices. We encourage you to review the privacy policies of any third-party websites you visit.

In Short: Yes — we use a small number of cookies and similar technologies for essential functions and analytics. See our Cookie Policy for details.

We use cookies and similar browser storage technologies (such as local storage and session storage) to:

• Operate the retirement planning tool (for example, to retain your inputs as you progress through the tool)
• Remember your preferences
• Understand how the Services are used (through Google Analytics)
• Maintain the security and operation of the Services

We do not use cookies or similar technologies for targeted advertising, and we do not allow third parties to do so on our Services.

For more details, see our Cookie Policy. When you first visit the Website, a cookie consent banner lets you accept or reject non-essential analytics cookies. You can change your preferences at any time on our Cookie Policy page.

In Short: We keep your information only as long as necessary, and not longer than required by law.

• Free-tier retirement planning tool inputs and outputs: not stored on our servers. Information temporarily retained in your browser (cookies, local storage) remains on your device and is under your control.
• Mailing list and contact form submissions: retained while you are subscribed to updates or until you ask us to delete your information, plus a reasonable period for legal and operational purposes.
• Premium account data (when Premium launches): retained while your Premium subscription is active, plus 7 years after your subscription ends, for tax, accounting, and legal purposes. After that period, we will delete or anonymize the information.
• Expert Review records (when Expert Review launches): retained for 7 years after the date of the review, in line with CFP professional record-keeping standards.
• Website analytics and logs: retained for the period configured by our analytics and hosting providers, typically up to 26 months for analytics data.

If you ask us to delete your information, we will do so to the extent permitted by law. Some information may need to be retained for legal, regulatory, or legitimate business reasons; in those cases we will isolate it from further use until deletion is possible.

In Short: We use reasonable security measures, but no system is perfectly secure.

We have implemented appropriate organizational and technical security measures designed to protect the personal information we process. Our architecture is designed to minimize risk:

• The free retirement planning tool does not persist user inputs on our servers.
• Data transmitted between your browser and our servers is encrypted in transit (HTTPS).
• We restrict access to systems and data to authorized personnel only.

Despite our safeguards, no electronic transmission or storage system can be guaranteed to be 100% secure. We cannot promise that hackers, cybercriminals, or other unauthorized third parties will never be able to defeat our security measures. You should access the Services within a secure environment (for example, a trusted device on a trusted network) and take reasonable precautions to protect your own information.

If we become aware of a data breach affecting your personal information, we will notify you and applicable regulators in accordance with the law.

In Short: We do not knowingly collect information from minors.

The Services are not directed at minors. We do not knowingly collect or solicit personal information from anyone who is a minor in their jurisdiction. If we learn that we have collected personal information from a minor without verified parental consent, we will take reasonable steps to delete that information. If you believe we may have collected information from a minor, please contact us at alula.admin@gmail.com.

In Short: Depending on where you live, you have rights to access, correct, delete, and restrict our processing of your personal information.

Subject to applicable law and certain exceptions, you may have the right to:

• Access the personal information we hold about you and obtain a copy
• Correct inaccurate or incomplete information
• Delete your personal information
• Restrict or object to certain processing
• Withdraw your consent to processing where we rely on consent
• Data portability, where applicable
• Not be subject to fully automated decision-making with legal or similarly significant effects. The retirement planning tool generates informational projections based on your inputs; it does not make automated decisions with legal effects on you. All decisions about your finances are made by you.

To exercise any of these rights, please contact us at alula.admin@gmail.com with the subject line "Privacy Rights Request." We will respond within the timeframe required by applicable law.

Marketing opt-out. You can unsubscribe from our marketing emails at any time using the unsubscribe link in any email we send, or by contacting us.

Cookies. Most web browsers accept cookies by default. You can change your browser settings to remove or reject cookies, and you can manage analytics preferences through the cookie consent banner or on our Cookie Policy page. See our Cookie Policy for more.

Complaints. If you have a concern about how we handle your personal information, we encourage you to contact us first. You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, if you reside in Quebec, with the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

Most web browsers include a "Do-Not-Track" (DNT) signal you can activate. Because no uniform standard for responding to DNT signals has been adopted, we do not currently respond to DNT signals. If a recognized standard is adopted in the future, we will update our practices and disclose them here.

In Short: Yes — we will update this notice as needed.

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last updated" date at the top. If we make material changes, we will notify you by prominently posting a notice on the website or by sending you a direct notification (where we have your contact information). We encourage you to review this Privacy Policy periodically.

The person responsible for the protection of personal information at Alula is:

Jonathan Pepper
Email: alula.admin@gmail.com

If you have questions, comments, or concerns about this Privacy Policy or how we handle your personal information, please contact us at the above address.

You may have the right to request access to, correction of, or deletion of the personal information we hold about you. To make a request, please contact us at alula.admin@gmail.com with the subject line "Data Subject Access Request."

We will respond within the timeframe required by applicable law. Some rights are subject to legal exceptions; we will explain any limits in our response.