Privacy Policy

Openhouse.ai Incorporated (the “Company”, “we”, “us”, “our”)
Last Updated: April 22, 2026

Statement from the Company: We are committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information when you visit our websites, use our products and services, or otherwise interact with us.

1. Who We Are and the Scope of This Policy

Controller Identity

Legal Entity	Openhouse.ai Incorporated
Registered Address	903 8 Ave SW #900, Calgary, AB T2P 0P7
Email	support@openhouse.ai
Data Protection Officer	Will Zhang, CEO, wzhang@openhouse.ai

Scope

This Privacy Policy applies to personal information we collect when you:

• Visit our websites, including https://openhouse.ai and any subdomains that link to this Policy;
• Use our cloud-based software products, APIs, and related services;
• Attend our events, webinars, or respond to our marketing communications;
• Communicate with us via email, chat, phone, or social media; or
• Apply for employment (subject to our separate Candidate Privacy Notice)

(collectively, the “Services”).

This Policy does not apply to personal information we process on behalf of our customers as a data processor or service provider. When we process data on behalf of our customers, the customer’s privacy policy governs, and our obligations are set forth in our Data Processing Agreement.

Processor/service provider role: When you interact with our Services through your employer or another organization, that organization is the controller (or “business” under the CCPA). We process personal data on their behalf pursuant to written agreements. Please refer to that organization’s privacy policy for details on how your data is handled.

2. Information We Collect

Information You Provide Directly

You may provide us with the following information directly through your interactions with our Services:

• Account registration data: name, email address, password, job title, company name;
• Payment and billing information: credit card details (processed by our PCI-compliant payment processor), billing address, tax ID;
• Communications: content of emails, support tickets, chat messages, and feedback forms;
• Survey and research responses: when you voluntarily participate in surveys, beta programs, or user research;
• Event registration: name, email, dietary requirements, and accessibility needs when you register for events; or
• Any other information that you voluntarily provide us.

Information Collected Automatically

We may collect certain information automatically, including through the use of cookies or similar technology, through your interactions with our Services, including:

• Device and browser information: IP address, browser type and version, operating system, device identifiers, screen resolution, and preferred language;
• Usage data: pages visited, features used, clickstream data, session duration, referring URL, and search queries within the Services;
• Log data: server logs, error reports, API call metadata, and timestamps;
• Location data: approximate geographic location derived from IP address. We do not collect precise geolocation unless you separately consent.

Information from Third Parties

We may collect certain information that is shared to us from third parties, including:

• Single sign-on providers: if you authenticate via Google, Microsoft, or another SSO provider, we receive your name, email, and profile information as authorized by you;
• Business partners and resellers: contact and account information provided by channel partners in connection with joint sales activities;
• Public sources and data enrichment: business contact information from publicly available sources (e.g., LinkedIn, company websites) and third-party data providers, used for B2B marketing in accordance with applicable law;
• Integrations: if you connect third-party services to your account (e.g., CRM, cloud storage), we receive data you authorize those services to share.

Sensitive Personal Information

We generally do not collect sensitive personal information as defined under the GDPR (also known as “special category data” under Article 9), such as racial or ethnic origin, political opinions, religious beliefs, health data, biometric data for identification purposes, or sexual orientation. If you submit such information to us (for example, in the body of a support message), we will process it only as necessary to respond to your inquiry and will apply additional safeguards including access restrictions and prompt deletion.

Under the California Privacy Rights Act (CPRA), certain categories of information we collect may be classified as “sensitive personal information,” including account log-in credentials (i.e., your email address in combination with a password) and, where applicable, precise geolocation data. We use these categories only as necessary to provide and secure the Services. You have the right to limit the use of your sensitive personal information to purposes authorized by CPRA Section 1798.121. To exercise this right, please see Section 8.2 below.

3. How We Use Your Information and Our Legal Basis

We process your personal information only for the purposes described below. For individuals in the European Economic Area (EEA), United Kingdom (UK), and Switzerland, we identify the legal basis for each purpose under the GDPR.

Purpose	Description	Legal Basis (GDPR)
Provide the Services	Create and manage your account, process transactions, deliver features, provide customer support, and maintain system performance.	Performance of contract (Art. 6(1)(b))
Communicate with you	Send transactional messages (e.g., confirmations, invoices, security alerts, service updates) and respond to your inquiries.	Performance of contract (Art. 6(1)(b))
Improve and develop products	Analyze usage patterns, conduct A/B testing, develop new features, fix bugs, and optimize performance.	Legitimate interest (Art. 6(1)(f)): improving products for users
Marketing and promotions	Send newsletters, product announcements, event invitations, and promotional content. Display targeted advertisements.	Consent (Art. 6(1)(a)) where required; otherwise Legitimate interest (Art. 6(1)(f)): promoting our services to existing and prospective customers
Analytics and personalization	Understand how users interact with the Services, generate aggregated insights, and personalize user experience.	Legitimate interest (Art. 6(1)(f)): understanding and optimizing the user experience
Security and fraud prevention	Detect, investigate, and prevent fraudulent transactions, unauthorized access, abuse of the Services, and other illegal activities.	Legitimate interest (Art. 6(1)(f)): protecting the security of our systems and users; Legal obligation (Art. 6(1)(c)) where required
Legal compliance	Comply with legal obligations, respond to lawful requests from public authorities, enforce our terms, and establish, exercise, or defend legal claims.	Legal obligation (Art. 6(1)(c)); Legitimate interest (Art. 6(1)(f)): establishing, exercising, or defending legal claims
Recruitment	Evaluate job applications, conduct interviews, and manage the hiring process (subject to our separate Candidate Privacy Notice).	Pre-contractual steps at your request (Art. 6(1)(b)); Legitimate interest (Art. 6(1)(f)): evaluating candidates

Legitimate Interest Assessments: Where we rely on legitimate interest as a legal basis for processing (as indicated in the table above), we have conducted a balancing test weighing our interests against your rights and freedoms as a data subject. We have determined that our interests do not override your rights in each case.

Whether Providing Your Data is Required

In most cases, providing your personal information is voluntary. However, some information is necessary to enter into or perform a contract with us (for example, your name and email to create an account, or billing information to process a payment). If you do not provide such information, we may be unable to provide the relevant Services to you. Where we are required by law to collect certain information (for example, tax identification for invoicing), we will inform you at the point of collection.

Data Minimization

We adhere to the principle of data minimization. We collect and process only the personal information that is adequate, relevant, and limited to what is necessary for the purposes stated in this Policy. We regularly review the data we hold to ensure it remains necessary for the stated purposes.

4. How We Share Your Information

We do not sell your personal information as defined under the CCPA. We may share certain categories of personal information (specifically, Identifiers, Internet or Network Activity, and Inferences) with advertising partners for cross-context behavioral advertising purposes, as further described in Section 8. You have the right to opt out of such sharing. We share personal information only in the following circumstances:

Service Providers

We engage third-party companies and individuals to perform services on our behalf (e.g., hosting, payment processing, analytics, email delivery, customer support).

Below is a current list of our sub-processors:

Company Name	Category	Purpose of Use	Personal Data Processed
Google Cloud Services	Cloud hosting provider	Database and cloud storage	End Users: user name, name, email address & phone numbers
HubSpot CRM Platform	CRM	Lead management	End Users: user name, name, email address & phone numbers
Clerk	Authentication provider	Authentication	Customers: user name, name, email address
OMNI	Reporting and BI	Internal reporting	Customers: user name, name, email address
Docusign	Document management	Document management	Customers: name, email address

Affiliates

We may share personal information with our corporate affiliates for the purposes described in this Policy. All affiliates are bound by this Policy or equivalent data protection standards.

Business Transfers

In connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy, personal information may be transferred to the acquiring entity. When necessary, we will notify you via email and/or prominent notice on our website of any change in ownership or uses of your personal information, as well as any choices you may have regarding your personal information.

Legal Requirements and Protection of Rights

We may disclose personal information if required to do so by law or if we believe in good faith that such action is necessary to: (a) comply with a legal obligation, subpoena, court order, or governmental request; (b) protect and defend our rights or property; (c) prevent or investigate possible wrongdoing in connection with the Services; (d) protect the personal safety of users or the public; or (e) protect against legal liability.

With Your Consent

We may share personal information for other purposes with your express consent.

5. International Data Transfers

Openhouse.ai Incorporated is headquartered in Canada. Your personal information may be transferred to and processed in countries other than your country of residence, including the United States, which may have data protection laws that differ from those in your jurisdiction.

6. Data Retention

We retain personal information for as long as reasonably necessary to fulfill the purposes for which it was collected. Retention periods are determined based on the following criteria:

• the duration of our contractual relationship with you;
• applicable legal and regulatory retention obligations (including tax, financial reporting, and employment record-keeping requirements);
• applicable statutes of limitation for potential legal claims;
• the operational necessity of the data for security, fraud prevention, and service continuity; and
• whether the purpose for which the data was collected has been fulfilled or the data subject has requested deletion.

When personal information is no longer required under any applicable criterion, we will securely delete or irreversibly anonymize it. Anonymized data may be retained indefinitely for analytics purposes.

7. Your Privacy Rights

Rights Under the GDPR (EEA, UK, and Switzerland)

If you are located in the EEA, UK, or Switzerland, you have the following rights under the GDPR with respect to your personal data:

• Right of access (Art. 15): You have the right to obtain confirmation of whether we process your personal data and, if so, to receive a copy of that data along with information about the processing.
• Right to rectification (Art. 16): You have the right to correct inaccurate personal data and to have incomplete data completed.
• Right to erasure (Art. 17): You have the right to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.
• Right to restriction of processing (Art. 18): You have the right to request that we restrict processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
• Right to data portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.
• Right to object (Art. 21): You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will cease processing immediately.
• Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right not to be subject to automated decision-making (Art. 22): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless the decision is necessary for a contract, authorized by law, or based on your explicit consent.
• Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. For EU/EEA residents, our lead supervisory authority is the Privacy Commissioner of Canada. A list of EEA supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en. For UK residents, complaints may be directed to the UK Information Commissioner’s Office (ico.org.uk). For California residents, complaints may be directed to the California Privacy Protection Agency (cppa.ca.gov) or the California Attorney General. For Canadian residents, complaints may be directed to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

How to Exercise Your Rights

To exercise any of the rights described in this Section 7, please submit a request to:

• Email: support@openhouse.ai
• Mail: Openhouse.ai Incorporated, Attn: Data Protection Officer, 903 8 Ave SW #900, Calgary, AB T2P 0P7

We will respond to your request within ninety (90) days (or one (1) month under the GDPR). If we need to extend this period, we will notify you of the extension and the reasons for the delay. We will verify your identity before processing your request. Requests are free of charge unless manifestly unfounded or excessive.

8. Additional Information for California Residents

This section provides additional disclosures required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”), for residents of California. This section should be read in conjunction with our California Notice at Collection, available as a schedule attached to this Policy, which is incorporated into this Policy by reference.

Your CCPA Rights

As a California resident, you have the following rights:

• Right to know and access (§ 1798.100, 1798.110): You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of collection, the business or commercial purposes, and the categories of third parties with whom we share it.
• Right to delete (§ 1798.105): You have the right to request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to correct (§ 1798.106): You have the right to request that we correct inaccurate personal information we maintain about you.
• Right to opt-out of sale or sharing (§ 1798.120): You have the right to direct us not to sell or share (as those terms are defined under the CCPA) your personal information. We do not sell personal information.
• Right to limit use of sensitive personal information (§ 1798.121): If we collect sensitive personal information for purposes beyond those authorized by the CCPA, you have the right to limit such use. We do not use sensitive personal information for purposes that would trigger this right.
• Right to data portability (§ 1798.100(d)): You have the right to request that we transmit your personal information to another business in a structured, commonly used, machine-readable format, to the extent technically feasible.
• Right to non-discrimination (§ 1798.125): We will not discriminate against you for exercising any of your CCPA rights. We will not deny you services, charge you different prices, or provide a different level or quality of service because you exercised a privacy right.

How to Exercise Your Rights

To exercise any of the rights described in this Section 8, please submit a request to:

• Email: support@openhouse.ai

We will verify your identity by matching information you provide with information we have on file. You may designate an authorized agent to make a request on your behalf by providing written authorization or a power of attorney. We may require verification of both the agent’s authority and your identity.

Global Privacy Control

We honor Global Privacy Control (“GPC”) signals. If your browser or device transmits a GPC signal, we will treat it as a valid request to opt out of the sale or sharing of personal information for that browser or device, as required by § 1798.135(b)(1). GPC signals apply to the specific browser and device from which they are sent. For more information about GPC, visit https://globalprivacycontrol.org.

We do not respond to Do Not Track (“DNT”) browser signals, as there is no industry-standard technology for recognizing or honoring DNT signals at this time.

Financial Incentive Programs

We do not offer financial incentives or price or service differences in exchange for the retention or sale of personal information.

CCPA Metrics

In accordance with CCPA regulations, we will publish annual metrics on the number of requests to know, delete, correct, and opt-out received, complied with (in whole or in part), and denied, along with median response times. These metrics are available in a schedule attached hereto.

9. Cookies and Tracking Technologies

We may use cookies, pixels, local storage, and similar technologies to operate and personalize the Services, analyze usage, and deliver targeted advertising. In jurisdictions requiring prior consent for non-essential cookies (e.g., the EEA under the ePrivacy Directive), we will obtain your consent before placing such cookies.

10. Security

We implement appropriate technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. If you would like to learn more, please contact us at support@openhouse.ai.

No method of transmission over the Internet or method of electronic storage is completely secure. While we strive to use commercially reasonable means to protect your personal information, we cannot guarantee its absolute security.

11. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required by GDPR Article 33.

Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify affected individuals without undue delay, as required by GDPR Article 34, unless one of the exceptions in Article 34(3) applies.

For California residents, we will notify you of a breach of security involving your personal information as required by California Civil Code § 1798.29 and § 1798.82.

12. Children’s Privacy

The Services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16 without verification of parental consent, we will take steps to delete that information promptly.

In compliance with the Children’s Online Privacy Protection Act (“COPPA”), 15 U.S.C. §§ 6501–6506, and 16 C.F.R. Part 312, we do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us at support@openhouse.ai so we can promptly delete it.

We do not knowingly sell or share (as those terms are defined under the CCPA) the personal information of consumers under the age of 16. If we become aware that a user is under 16, we will not sell or share their personal information unless we have received affirmative authorization from the consumer (if aged 13–15) or verifiable parental consent (if under 13), as required by CCPA Section 1798.120(c).

13. Additional U.S. State Privacy Rights

To exercise your rights under any applicable state privacy law, please use the contact methods described in this Policy.

Appeal Rights: If we deny your privacy rights request, you have the right to appeal our decision. To appeal, contact us at support@openhouse.ai with the subject line “Privacy Rights Appeal.” We will respond to your appeal within the timeframe required by applicable law (typically 60 to 90 days). If your appeal is denied, you may contact your state’s attorney general to submit a complaint. Contact information for state attorneys general is available at https://www.naag.org/find-my-ag/.

Universal Opt-Out Mechanisms: We honor Global Privacy Control (GPC) signals as valid opt-out requests under all applicable state privacy laws that recognize universal opt-out mechanisms, including Colorado, Connecticut, Montana, Delaware, Oregon, New Hampshire, New Jersey, and Texas. If your browser or device transmits a GPC signal, we will treat it as a request to opt out of the sale, sharing, or targeted advertising uses of your personal data for that browser or device.

Profiling and Automated Decision-Making: Under applicable state laws (including Virginia, Colorado, Connecticut, and others), you may have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. To exercise this right, please use the contact methods described herein or enable a GPC signal on your browser.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:

• Update the “Last Updated” date at the top of this Policy;
• Provide notice via email to account holders and/or a prominent notice on our website at least 30 days before the changes take effect;
• Where required by applicable law, obtain your consent before applying material changes to previously collected data.

We encourage you to review this Privacy Policy periodically.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: support@openhouse.ai
• Mail: Openhouse.ai Incorporated, Attn: Data Protection Officer, 903 8 Ave SW #900, Calgary, AB T2P 0P7

Schedule A: California Notice at Collection

Openhouse.ai Incorporated (the “Company”, “we”, “us”, “our”)
Last Updated: April 22, 2026

This Notice at Collection is provided to California residents pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”), Cal. Civ. Code §§ 1798.100 et seq. This Notice supplements our Privacy Policy. Capitalized terms not defined herein have the meanings set forth in the Privacy Policy.

Categories of Personal Information Collected

The following table describes the categories of personal information we collect, the purposes for which each category is used, whether it is sold or shared, and the applicable retention period. These categories correspond to the categories set forth in CCPA § 1798.140(v).

Category (CCPA)	Commercial Purpose	Sold or Shared?	Retention Period	Categories of Third Parties
A. Identifiers (Name, email, phone, IP address, etc.)	Provide Services; communicate; marketing; security	Not sold or shared.	Duration of account + 1 year	Cloud hosting providers; analytics providers; advertising networks (if shared for CCBA)
B. Personal information (Name, address, phone, financial info)	Billing; provide Services; legal compliance	Not sold or shared.	7 years	Payment processors; cloud hosting providers; tax/accounting service providers
C. Protected classifications (Age, gender)	Analytics; legal compliance	Not sold or shared.	Duration of account + 1 year	Analytics providers; cloud hosting providers
D. Commercial information (Transaction history, subscription)	Provide Services; billing; analytics	Not sold or shared.	7 years	Payment processors; cloud hosting providers; analytics providers
E. Biometric information	N/A	N/A	N/A	N/A
F. Internet or network activity (Browsing history, interaction with Services)	Improve products; analytics; security	Not sold or shared.	2 years, then aggregated	Analytics providers; advertising networks (if shared for CCBA); cloud hosting providers
G. Geolocation data	Provide localized features; analytics; security	Not sold or shared.	2 years	Analytics providers; cloud hosting providers
H. Sensory data (Audio recordings)	Quality assurance; training	Not sold or shared.	2 years	Cloud hosting providers; quality assurance service providers
I. Professional or employment info (Job title, company name)	Provide Services; marketing; recruitment	Not sold or shared.	Duration of account + 1 year	Analytics providers; cloud hosting providers; CRM providers
J. Education information	Provide Services; marketing	Not sold or shared.	Duration of account + 1 year	N/A
K. Inferences (User preferences, product interests)	Personalization; analytics; marketing	Not sold or shared.	2 years	Analytics providers; advertising networks (if shared for CCBA); cloud hosting providers
L. Sensitive personal information (log-in credentials, email)	Account authentication and security; providing location-based features (with consent)	Not sold or shared.	2 years	Cloud hosting providers; authentication service providers

Retention Criteria: The retention periods specified in the table above are determined based on the following criteria: (a) the duration of our contractual relationship with you; (b) legal and regulatory retention requirements (e.g., tax and financial reporting obligations, statute of limitations for legal claims); (c) the operational necessity of the data for the purposes for which it was collected; and (d) our legitimate business interests, including product improvement and security. When personal information is no longer required under any applicable criterion, it is securely deleted or irreversibly anonymized.

Sources of Personal Information

We collect personal information from the following categories of sources:

• Directly from you: when you create an account, make a purchase, contact support, or otherwise provide information to us;
• Automatically: through cookies, pixels, server logs, and similar technologies when you interact with our websites and Services;
• From third parties: single sign-on providers, business partners, resellers, data enrichment providers, and publicly available sources;
• From your employer or organization: when they set up an account on your behalf.

Your Rights

You have the right to:

• Know what personal information we collect, use, disclose, sell, and share about you;
• Delete personal information we have collected from you;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of your personal information;
• Limit our use of sensitive personal information to purposes authorized by the CCPA;
• Not be discriminated against for exercising your rights.

How to Exercise Your Rights

To submit a verifiable consumer request:

• Email: support@openhouse.ai

Opt-Out of Sale or Sharing

To opt out of sharing any of your personal information for cross-context behavioral advertising, contact us at support@openhouse.ai.

Authorized Agent

You may designate an authorized agent to submit a request on your behalf by providing the agent with written permission signed by you. We may require verification of both the agent’s authority and your identity before processing the request.

Automated Decision-Making Technology (ADMT): We use automated decision-making technology as described in our Privacy Policy, Section 8.5. To the extent our use of ADMT is subject to the CPPA’s regulations on automated decision-making technology, you have the right to receive a pre-use notice, to access information about the logic involved in such decisions, and to opt out of ADMT-based decisions that produce legal or similarly significant effects. For details and to exercise your ADMT rights, see our Privacy Policy, or contact us at support@openhouse.ai.