Privacy Policy

Effective Date: June 22, 2026 | Jurisdiction: Ontario, Canada

Our Commitment to Your Privacy

Esmeralda Systems is committed to protecting the privacy and security of personal information in compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL), and applicable provincial privacy laws. This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with our Platform services.

1. Who We Are

Esmeralda Systems is a business name of 787 Ventures Inc. (Ontario Corporation No. 1001602766), a corporation incorporated under the Business Corporations Act (Ontario). Our registered office is located at 2967 Dundas St. W, #699, Toronto, ON M6P 1Z2. We provide a white-labeled marketing automation platform to business clients ("Clients").

For questions about this Privacy Policy or to exercise your privacy rights, contact our Privacy Officer (President)| privacy@esmeraldasystems.com | 437-476-7117.

2. Scope of This Policy

This Privacy Policy applies to: (a) personal information of our Clients (business contacts, authorized users, and billing contacts); and (b) personal information of our Clients' end users that is processed through the Platform on behalf of our Clients. Our Clients are responsible for their own privacy policies governing their relationship with their customers. We process end-user data as a service provider acting on behalf of our Clients.

The Platform is not intended for the collection or processing of health information or other specially regulated data. Our Client Terms of Service prohibit clients from uploading such data unless a separate written agreement is in place.

3. What Personal Information We Collect

3.1 Information About Our Clients

• Contact information: name, business name, email address, phone number, mailing address
• Account credentials: username, password (stored in encrypted form)
• Billing information: credit card or payment details (processed by our third-party payment processor; we do not store full card numbers)
• Business information: industry, company size, and related information provided during onboarding
• Communication records: emails and support communications between you and us

3.2 End-User Data Processed on Behalf of Clients

When our Clients use the Platform to send commercial electronic messages or manage customer relationships, they may upload or collect personal information about their customers ("End-User Data"). This may include names, email addresses, phone numbers, and engagement data (such as whether a message was opened). We process End-User Data only on the instructions of our Clients and in accordance with our Client Terms of Service.

3.3 Technical Data

• IP addresses, browser type, and device information collected automatically when you access the Platform
• Usage data: features used, pages visited, time spent on Platform
• Log data: access logs and error reports

4. How We Use Personal Information

We use personal information for the following purposes:

• To provide, maintain, and improve the Platform and related services
• To process billing and manage your account
• To communicate with you regarding your account, service updates, and support
• To send you service-related notices and important updates (these are not marketing messages and do not require separate consent under CASL)
• To comply with legal obligations under PIPEDA, CASL, and other applicable laws
• To detect, investigate, and prevent fraud and security incidents
• To generate aggregated, anonymized usage statistics to improve our services (this data does not identify individuals)

We do not use your personal information or your End-User Data for any purpose other than those described above without your express consent.

5. Commercial Electronic Messages (CASL)

Esmeralda Systems may send you commercial electronic messages ("CEMs") in connection with our services, including information about new features, service changes, and educational content relevant to your use of the Platform. We will only send CEMs where we have obtained the required express or implied consent under CASL.

You may withdraw your consent to receive marketing CEMs at any time by using the unsubscribe link included in each message or by contacting us at privacy@esmeraldasystems.com. We will process unsubscribe requests within 10 business days. Note that withdrawal of consent to marketing CEMs does not prevent us from sending transactional and service-related messages that are necessary for the provision of our services.

5.1 SMS Messaging Privacy and Compliance

This Section describes SMS messages that Esmeralda Systems sends in connection with its own services. Where you use the Platform to send SMS to your own customers, you are the sender, and your own SMS Terms and Conditions and privacy practices apply, as required under your Client Terms of Service.

Program Description

Esmeralda Systems' SMS messaging program sends account, billing, onboarding, and service-related communications, including appointment and consultation reminders and support communications, to individuals who have opted in through the contact and booking forms on our website at getesmeralda.com. Where we send marketing or promotional SMS content, it is registered as a separate campaign in accordance with Section 2.6 of our Client Terms of Service.

Marketing SMS Program Description

Where Esmeralda Systems sends marketing or promotional SMS, such as service announcements or special offers, to individuals who have separately opted in for marketing messages, this content is registered as its own campaign, distinct from the transactional program described above. Consent to receive marketing SMS is never a condition of purchasing any product or service from Esmeralda Systems.

Sample Marketing Message

"Esmeralda Systems: Founding client discount closes Friday. Reply STOP to unsubscribe. Msg & data rates may apply."

SMS Consent

Where applicable, Esmeralda Systems offers SMS (text messaging) communications related to our services. We only send SMS messages to individuals who have provided the appropriate consent required under applicable laws and messaging carrier requirements.

Consent is collected through a dedicated SMS opt-in checkbox on our website contact and booking forms. This checkbox is not pre-selected, is not required to submit the form, and is presented separately from acceptance of our general Privacy Policy and Terms of Service.

We maintain records of SMS consent, including the date, time, source, and method of opt-in, for compliance, auditing, and record-keeping purposes.

Types of SMS Messages

Depending on the services you request or your relationship with Esmeralda Systems, SMS messages may include:

• Appointment reminders
• Customer support communications
• Account notifications
• Service updates
• Requested information
• Marketing or promotional messages (only where the required consent has been obtained)

Consent to receive marketing or promotional SMS messages is never required as a condition of purchasing an product or service.

Message frequency varies based on your interactions with Esmeralda Systems and the services you request. Standard message and data rates may apply according to your mobile carrier's plan.

Our SMS program is supported by all major U.S. and Canadian wireless carriers, including AT&T, T-Mobile, Verizon, Bell, Rogers, and Telus. Carriers are not liable for delayed or undelivered messages.

SMS Opt-Out

You may opt out of receiving SMS messages at any time by replying STOP to any text message you receive from us. After opting out, you will receive a final confirmation message, and no additional SMS marketing messages will be sent unless you provide new consent.

If you require assistance, you may reply HELP to a supported message or contact us directly using the contact information provided in this Privacy Policy. Transactional or service-related messages that are necessary to provide requested services may still be sent where permitted by applicable law.

Protection of SMS Information

Esmeralda Systems is committed to protecting the privacy of SMS communications. No mobile information, phone numbers, SMS opt-in data, SMS consent records, or text-messaging originator information will be sold, rented, shared, or disclosed to third parties or affiliates for marketing or promotional purposes.

SMS opt-in information and consent records may only be shared with trusted service providers, including SMS platform providers, telecommunications carriers, messaging aggregators, and subcontractors that assist in delivering text messages or supporting our communications infrastructure. These providers are contractually required to use such information solely for the purpose of providing messaging services on our behalf and to maintain appropriate security safeguards.

All other categories of personal information sharing described in this Privacy Policy exclude SMS opt-in data, mobile numbers collected for SMS communications, and SMS consent records.

Compliance

Esmeralda Systems maintains administrative, technical, and organizational safeguards designed to protect SMS consent records and related personal information from unauthorized access, disclosure, alteration, or misuse. Our SMS communications are administered in accordance with applicable Canadian privacy legislation, Canada's Anti-Spam Legislation (CASL), applicable telecommunications requirements, and industry messaging standards established by mobile carriers and messaging service providers.

6. Disclosure of Personal Information

We do not sell personal information to third parties. SMS opt-in data, mobile numbers collected for SMS, and consent records are never shared with third parties or affiliates for marketing or promotional purposes. We may disclose personal information in the following limited circumstances:

6.1 Service Providers

We engage third-party service providers to assist in delivering our services, including payment processors, cloud infrastructure providers, and our upstream Platform technology provider. These service providers are contractually required to protect personal information and use it only for the purposes for which it was disclosed.

6.2 Cross-Border Transfers

Our Platform infrastructure is operated by a third-party provider with servers located in the United States. By using our Platform, you acknowledge that personal information (including End-User Data) may be transferred to and processed in the United States. The United States does not have privacy laws equivalent to Canada's PIPEDA. Consistent with PIPEDA's accountability principle, we remain responsible for personal information transferred to our service providers for processing, and we take reasonable contractual measures to ensure a comparable level of protection, including requiring our third-party providers to maintain appropriate security safeguards. However, personal information transferred to the United States may be subject to access by US law enforcement or government authorities in accordance with US law.

6.3 Legal Requirements

We may disclose personal information when required by law, court order, or regulatory authority, or where we have a good-faith belief that disclosure is necessary to protect the rights, property, or safety of Esmeralda Systems, our Clients, or the public.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of substantially all assets, personal information may be transferred to the successor entity, subject to this Privacy Policy.

7. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Specifically:

• Client account data is retained for the duration of the agreement and for 7 years following termination to satisfy tax and legal record-keeping obligations
• End-User Data processed on behalf of Clients is retained in accordance with our Client Terms of Service (90 days post-termination) unless earlier deletion is requested
• CASL consent records are retained for a minimum of 3 years from the date of the last CEM sent to the relevant recipient, as a matter of best practice and to evidence consent
• Billing records are retained for 7 years as required under the Income Tax Act (Canada) and the Excise Tax Act (Canada)
• SMS consent records, opt-in timestamps, opt-out requests, and related communication preference records are retained for as long as necessary to demonstrate compliance with applicable laws, carrier requirements, and our record-retention obligations

8. Security of Personal Information

We implement appropriate technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, or destruction. These measures include encryption of data in transit (TLS/SSL), access controls and authentication requirements, regular security assessments, and employee confidentiality obligations. However, no security measure is perfect or impenetrable, and we cannot guarantee the security of information transmitted over the Internet.

In the event of a breach of security safeguards involving a real risk of significant harm, we will notify affected individuals and report to the Office of the Privacy Commissioner of Canada, and maintain records of the breach, as required under PIPEDA's breach-of-security-safeguards regulations.

9. Your Privacy Rights

Subject to applicable law, you have the following rights in respect of your personal information:

• Access: You may request access to personal information we hold about you
• Correction: You may request correction of inaccurate or incomplete personal information
• Withdrawal of Consent: You may withdraw consent to the collection, use, or disclosure of your personal information, subject to legal and contractual restrictions
• Complaint: You have the right to file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca if you believe we have violated your privacy rights

To exercise any of these rights, please contact us at: privacy@esmeraldasystems.com. We will respond to requests within 30 days. We may require verification of your identity before processing requests.

10. Cookies and Tracking Technologies

The Platform may use cookies and similar technologies to collect usage data and improve functionality. By using the Platform, you consent to the use of cookies as described in this Policy. You may disable cookies in your browser settings, but this may affect the functionality of certain Platform features.

11. Children's Privacy

The Platform is intended for use by business clients and is not directed to individuals under 18 years of age. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected personal information from a minor, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Platform. The updated Policy will be effective upon posting or as otherwise indicated. Your continued use of the Platform following notice of changes constitutes your acceptance of the updated Policy.

13. Contact Our Privacy Officer