How we handle your data

01

Scope of this policy

This Privacy Policy applies to CactusCo Inc. ("CactusCo," "we," "us," or "our") and covers information collected through our precision agriculture platform, our website at cactusco.ca, and any associated services, APIs, or mobile applications (collectively, the "Services").

CactusCo is incorporated in Québec, Canada. Our privacy practices comply with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and Québec's Act respecting the protection of personal information in the private sector (Law 25).

02

What we collect

The information we collect depends on how you interact with the Services. We collect only what is necessary.

Account and contact information

• Name and job title of the account holder and invited team members
• Email address, phone number, and business address
• Organization name and operation type (farm, cooperative, research institution)
• Authentication credentials (passwords are hashed and never stored in plain text)

Platform usage data

• Log-in timestamps, session duration, and feature interaction events
• Dashboard configurations, alert rule settings, and report exports you generate
• Support tickets, in-app messages, and feedback submissions

Technical and device data

• IP address, browser type, and operating system at login
• API access tokens and integration configuration metadata
• Error logs and diagnostic reports when you submit them to support

Farm operational data (on-site only)

Sensor readings, plot maps, irrigation logs, species records, and harvest data are processed locally on your deployment. This data only reaches CactusCo systems if you explicitly enable cloud backup or remote monitoring features, in which case you will be presented with a separate data processing agreement.

03

How we use your information

We use the information we collect for the following purposes, each tied to a specific legitimate interest or contractual need:

• Provisioning and operating your account and the Services
• Authenticating users and maintaining platform security
• Responding to support requests and technical inquiries
• Sending transactional communications (account setup, password resets, service notices)
• Improving platform reliability through anonymized aggregate usage analytics
• Meeting legal obligations under Canadian law, including responding to lawful requests
• Sending product updates and newsletters, if you have opted in

We do not use your information for automated decision-making that produces legal or similarly significant effects without human review. We do not build advertising profiles or sell data to third parties.

04

Sharing your information

We share personal information only in the following circumstances:

Service providers

We engage sub-processors to help operate the Services — including cloud infrastructure, email delivery, and customer support tooling. These providers are contractually bound to process data only as instructed by CactusCo and are prohibited from using it for their own purposes. A current list of sub-processors is available upon request.

Legal and regulatory requirements

We may disclose information if required to do so by law, court order, or a valid request from a Canadian regulatory authority. Where legally permitted, we will notify you before complying.

Business transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you prior to any such transfer and ensure continued protection under terms no less protective than this policy.

With your consent

We share information with third parties when you have given us explicit permission to do so — for example, when you authorize a third-party agronomic advisor to access your dashboard.

05

Data retention

We retain account and usage information for as long as your account remains active. When you close your account, we delete or anonymize your personal information within 90 days, except where we are required to retain it for legal, accounting, or regulatory purposes.

Support ticket content and communications are retained for 3 years from the date of closure to allow us to address recurring issues and meet professional obligations.

Anonymized, aggregated analytics data — from which no individual can be identified — may be retained indefinitely for platform improvement purposes.

06

Security

CactusCo implements technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These include:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest on CactusCo-managed systems
• Role-based access controls and least-privilege principles for internal staff
• Regular penetration testing and vulnerability assessments
• Audit logs for all access to production systems

In the event of a data breach that poses real risk of harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada within 72 hours of becoming aware of the breach, as required by PIPEDA.

07

Your rights

Under PIPEDA and Québec Law 25, you have the following rights regarding your personal information:

• Access. You may request a copy of the personal information we hold about you.
• Correction. You may request that we correct inaccurate or incomplete information.
• Withdrawal of consent. You may withdraw consent to non-essential uses at any time, subject to legal or contractual restrictions.
• Deletion. You may request that we delete your personal information, subject to our legal retention obligations.
• Portability. Under Law 25, you may request a copy of your information in a structured, machine-readable format.
• Complaint. You have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.

To exercise any of these rights, contact us at privacy@cactusco.ca. We will respond within 30 days. Complex requests may take up to 60 days; we will notify you if this is the case.

08

Cookies and tracking

Our website uses a minimal set of cookies:

• Session cookies — required to keep you authenticated while using the platform. These expire when you close your browser.
• Preference cookies — to remember settings such as your language choice. These persist for 12 months.
• Analytics cookies — anonymized usage statistics to understand how the platform is being used. You may opt out via your account settings.

We do not use advertising or cross-site tracking cookies. We do not share cookie data with advertising networks.

09

Children's privacy

The Services are intended for agricultural and commercial use by organizations and adults. We do not knowingly collect personal information from individuals under the age of 16. If we become aware that we have inadvertently collected such information, we will delete it promptly. Contact us at privacy@cactusco.ca if you believe this has occurred.

10

Changes to this policy

We may update this policy from time to time. When we make material changes, we will notify you by email and display a notice on the platform for at least 30 days before the changes take effect.

The "Effective" date at the top of this page reflects when the current version came into force. Continued use of the Services after the effective date constitutes acceptance of the updated policy.

11

Contact and complaints

If you have questions about this policy, want to exercise your rights, or wish to file a complaint, reach us through any of the following: