Privacy and Cookie Policy (Canada)

This Privacy Notice is issued by Student Outlets Inc. (referred to in this policy as "we", "us", or "our") and governs the processing of personal information on the Koupon.ai Canada platform (the "Site"). We act as the organization responsible for your personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA), the federal private-sector privacy law of Canada. Unlike our other regional operations, the Koupon.ai Canada Platform maintains a strictly isolated data infrastructure. This means your personal information collected through this Site is stored and processed independently and is not shared with or integrated into our United States or United Kingdom operations or any other regional databases. Our Site contains links to third-party merchant websites; once you navigate away from Koupon.ai via these links, you are subject to the privacy notices of those respective merchants. We do not exercise control over, and assume no liability for, the data processing practices of these external retailers.

Under PIPEDA, "personal information" means any information about an identifiable individual, whether that identification is direct (such as your email address) or indirect (such as your IP address, browser metadata, or device identifiers that, combined with other data, could identify you). Our "Services" consist of providing valid discount codes and coupons, deal aggregation, and a personalized user interface designed to enhance your shopping efficiency. We treat all such information with the highest standards of security and confidentiality.

For all matters relating to your data privacy or to exercise your statutory rights, you may reach our Privacy Officer at contact@koupon.ai. General product support and inquiries should be directed to support@koupon.ai, or submitted via our digital portal. Our registered headquarters for formal legal service is located at Student Outlets Inc., 2225 W. Commonwealth Ave, Suite 306, Alhambra, CA 91803, USA. To ensure the security of your data, we may require you to verify your identity before processing specific requests related to your personal information.

The information we collect is strictly limited to what is necessary for the delivery of our Services. We currently do not support third-party social logins, meaning all account data is provided directly by you.

• Account Information: your registered email address and an encrypted (hashed) version of your password.
• User-Generated Content: information you voluntarily provide when saving a deal, following a specific store, or contributing to community feedback.
• Automated Technical Data: when you access our Site, our servers automatically record your IP address, device type, operating system, and unique hardware identifiers. We use this hardware-level data specifically to prevent fraud, such as the systematic creation of multiple accounts or the manipulation of deal popularity metrics through automated scripts.
• Affiliate Redirect Data: technical markers indicating which deal links you have interacted with, used to ensure correct merchant redirection and to attribute affiliate commissions.

The collection of your email address is necessary to provide you with a personalized account experience. Without this information, we are unable to facilitate features such as "Saved Deals" or "Store Following." Technical data, including IP addresses and device identifiers, is collected as a fundamental security requirement to maintain the integrity of our voting and verification systems. Declining to permit the collection of these technical markers may result in restricted access to certain interactive elements of the Site to prevent potential system abuse.

PIPEDA requires that we obtain meaningful consent — express or implied, depending on the sensitivity of the information — before collecting, using, or disclosing your personal information.

• Implied consent applies to non-sensitive information collected for purposes that would be reasonably obvious to you, such as basic technical data needed to operate the Site securely.
• Express consent is required for anything more sensitive, or for any use beyond what you would reasonably expect — such as sending marketing communications or deploying non-essential analytics or advertising cookies.
• Quebec residents: if you are located in Quebec, Quebec’s Act respecting the protection of personal information in the private sector (as amended by Law 25) applies alongside PIPEDA and requires express, opt-in consent for non-essential cookies specifically, with clear information provided before any such technology is activated. Because we cannot always reliably determine whether a given visitor is located in Quebec, we apply the Law 25 opt-in standard to all visitors across Canada, regardless of province, so that no visitor receives a lower standard of consent than the law requires.
• You may withdraw consent at any time, subject to legal or contractual restrictions, by contacting us or adjusting your Cookie Settings on the Site.

Koupon.ai is a commercial entity supported by affiliate marketing commissions. We do not offer direct cashback or financial rewards to users; instead, our revenue is derived from merchants when a successful referral is made. When you click a deal link or copy a coupon code, you are redirected to the merchant’s site through an affiliate network. This redirection involves the transmission of a non-identifying click-ID which signals to the merchant that the referral originated from Koupon.ai. It is important to understand that the merchant, as an independent organization, will process your purchase data according to its own privacy practices once you leave our Platform.

We operate under a principle of strict data minimization and do not sell your personal information to any third parties. Your data is only shared with trusted service providers who act as our processors, such as secure cloud hosting facilities and email delivery platforms. These processors are contractually prohibited from using your data for any purpose other than providing services to us. We may also disclose limited technical identifiers to affiliate networks solely to confirm the success of a deal referral. We may be legally compelled to share information with Canadian law enforcement or regulatory bodies if required by a court order or to prevent criminal activity.

Your personal information may be stored and processed on secure infrastructure located outside Canada, including in the United States. Canadian privacy law (PIPEDA) does not require a specific formal transfer instrument (such as the European Union’s Standard Contractual Clauses) for moving personal information across borders. Instead, PIPEDA’s accountability principle requires that we remain responsible for your information at all times and ensure that a comparable level of protection is maintained through contractual and technical safeguards with any service provider that processes your data on our behalf, regardless of where that processing takes place.

We retain your personal information only for the duration of your active relationship with the Platform. If an account remains inactive for a period of three years, we will initiate a process to permanently delete or anonymize the data, unless a specific legal or tax obligation requires a longer retention period. We implement organizational and technical security measures, including encryption for data in transit and strict access controls for our internal systems, to prevent unauthorized access, alteration, or disclosure of your information.

Our Site uses cookies to distinguish you from other users and to optimize site performance.

• Strictly Necessary Cookies: essential for core site functions, such as security tokens and session management.
• Functional Cookies: allow the Site to remember your preferences, such as your UI layout or "Expired Deal" display settings.
• Affiliate Tracking Cookies: deployed when you click a deal link to facilitate the referral process. As set out in Section 6, we apply an opt-in consent standard across all of Canada for any non-essential cookie (functional, analytics, or affiliate tracking cookies that are not strictly necessary for the Site to function), managed via Cookie Settings on the Site. You can withdraw consent or change your preferences at any time.

If, in the future, we send you marketing or promotional emails, we will do so in compliance with Canada’s Anti-Spam Legislation (CASL), which requires express or implied consent before sending commercial electronic messages, clear sender identification, and a functional unsubscribe mechanism in every message. At MVP launch, Koupon Canada does not send marketing emails or push notifications; this section is included so the obligation is documented ahead of any future rollout of these features.

Under PIPEDA, you have the right to know why your personal information is collected, to access the personal information we hold about you, to challenge its accuracy, and to have it corrected as appropriate. You may also withdraw your consent to our collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions.

If you are located in Quebec, you have additional rights under Quebec's privacy law, including the right to request the deletion of your personal information in certain circumstances and the right to data portability.

To exercise any of these rights, please contact us at contact@koupon.ai. We aim to respond to all legitimate requests within 30 days of receipt, in line with PIPEDA's expectations for timely response.

If you have a concern about how we handle your personal information, we encourage you to contact our Privacy Officer at contact@koupon.ai first, so we can attempt to resolve the issue directly. If you remain unsatisfied, you have the right to file a complaint with:

• The Office of the Privacy Commissioner of Canada (OPC) — for matters arising anywhere in Canada under PIPEDA; or
• The Commission d'accès à l'information (CAI) — for Quebec residents, for matters arising under Quebec's provincial privacy law.
• We generally do not charge a fee for the exercise of these rights. However, if a request is manifestly unfounded, repetitive, or excessive, we reserve the right to charge a reasonable administrative fee or decline to act on the request, as permitted by applicable law.