Privacy Policy

PART I – GENERAL POLICY

1. Identification of the company and the person in charge

CubicSpace Technologies Inc. is a corporation incorporated under the laws of Québec (Canada), also conducting business in the United States.

Person in charge of the protection of personal information: Francis Labonté, CTO

Email: privacy@cubicspace.ai

You may also contact the Commission d'accès à l'information:

https://www.cai.gouv.qc.ca/commission-acces-information/nous-joindre

2. Scope

This policy applies to all activities of CubicSpace Technologies Inc., including the operation of its website and the CubicScreen application.

3. Collection methods

Personal information is collected in particular through:
- The use of the CubicScreen application;
- Commercial transactions;
- Browsing of the website, subject to the required consent.

4. Categories of personal information

Depending on the context in which our services are used (website and CubicScreen application), the following categories of personal information may be collected:

For more details on the information collected by the CubicScreen application, see Part II. For website analytics technologies, see Part III.

5. Purposes of collection

Personal information is collected only for specific, explicit and legitimate purposes. The table below establishes the link between each category of information and the purposes pursued:

Important: When we use your information to improve our services, the data is aggregated and anonymized so that no individual can be identified. Specific details about the tools used can be found in Part II (application) and Part III (website).

6. Communication to third parties

We may share your personal information with third parties when necessary for the purposes described in this policy or where authorized by law.

6.1 Service providers

We use service providers who process personal information on our behalf. The table below details these disclosures:

Note: These providers act as subcontractors and may only use your personal information for the purposes for which we share it with them. They are contractually required to protect your data in accordance with applicable laws.

Exception — Meta Pixel: Unlike other providers, Meta Platforms, Inc. acts both as a joint controller (for the collection of data via the Pixel) and as an independent controller (for subsequent processing for its own purposes, including advertising profiling across its entire ecosystem). This means that Meta determines its own processing purposes beyond those of CubicSpace. The Meta Pixel places a persistent unique identifier (fbp cookie) that allows Meta to track you across your browsing sessions and potentially across different websites. The Meta Pixel is activated only after your explicit consent via our cookie preference center. Event data is retained by Meta for a maximum of 2 years.

U.S. residents — sale and sharing disclosure: Under the California Consumer Privacy Act (CCPA/CPRA), the transmission of personal information to Meta via the Pixel for cross-context behavioral advertising purposes constitutes "sharing" of personal information. CubicSpace does not "sell" personal information as defined under the CCPA. You may opt out of this sharing at any time (see Part IV for details on how to exercise your rights under U.S. state privacy laws).

Note — Google Analytics: Google LLC acts primarily as a subcontractor (Processor) for data collected via Google Analytics 4 under the Google Ads Data Processing Terms. However, if certain advanced features are enabled (Google Signals, demographics and interests data), Google may act as a joint controller for those specific data. Google Analytics places first-party cookies (_ga, _ga_*) that allow identifying a visitor across their browsing sessions on the site. The IP address is truncated by default in GA4 and used only for approximate geolocation. User-level data is retained by Google for a configurable period (default 2 months, up to 14 months maximum). Google Analytics and Google Merchant Center are activated only after your explicit consent via our cookie preference center.

7. Transfers outside Québec

Some of our service providers are located outside Québec, which results in the communication of personal information to other jurisdictions.

7.1 Transfer locations

Personal information may be transferred to the following jurisdictions:

• Europe (Sentry, PostHog - Frankfurt, Germany)

• United States (Google Analytics, Google Merchant Center, Meta Pixel, Intercom)

• Singapore (Shopify — e-commerce infrastructure)

Important: Information transferred to these jurisdictions is subject to the data protection laws of those countries, which may differ from Québec laws.

7.2 Protection measures

Before transferring personal information outside Québec, we take the following measures:

1. Privacy Impact Assessment (PIA): We assess all factors that may affect your privacy and verify that the information will be adequately protected.

2. Contractual measures: We sign contracts or agreements including appropriate security measures, such as encryption, access limitation, and the obligation to comply with data protection standards.

For more details: See the table in section 6 for the specific providers and their locations.

8. Internal access to personal information

8.1 General principle

Within CubicSpace, only individuals who need to process your personal information to perform their duties have access to it.

8.2 Categories of personnel with access

The following categories of employees may access your personal information according to their responsibilities:

• Technical support team: Access to technical and usage information to resolve issues and respond to assistance requests.

• Development team: Access to error logs and aggregated technical data to improve the application.

• Customer service: Access to identification and transactional information to handle requests and resolve complaints.

• Management and administration: Limited access to data required for management, regulatory compliance, and security.

8.3 Principle of minimal access

We apply the strictly necessary principle: each individual has access only to the information essential to performing their tasks.

Roles and responsibilities throughout the personal information lifecycle (collection, use, communication, retention, destruction) are described in our internal governance policy and are regularly reviewed.

9. Your rights

You have several rights regarding your personal information under the Act respecting the protection of personal information in the private sector.

9.1 Right of access

You have the right to access the personal information we hold about you. This includes the right to know what information we keep, how we use it, and to whom we disclose it.

9.2 Right of rectification

You have the right to have your personal information corrected or updated if it is inaccurate, incomplete, or outdated.

9.3 Right to withdraw consent

You may withdraw your consent to the use, communication, or retention of your personal information at any time, subject to legal or contractual restrictions. In some cases, withdrawing your consent may limit our ability to provide you with certain services.

9.4 Other rights

You also have the following rights:

• Right to the portability of your personal information (in a structured and commonly used format)

• Right to request the cessation of dissemination or the de-indexation of information concerning you (art. 28.1 of Law 25 — specific conditions apply)

• Right to file a complaint regarding the management of your personal information (see section 11)

10. Exercising your rights and complaint process

10.1 How to exercise your rights

Step 1: Written request

To exercise your rights, you must send a written request to the person in charge of personal information protection, whose contact details are listed in section 1. Your request must include:

• Your identity (full name, contact information)

• The precise subject of your request (access, rectification, withdrawal, deletion, etc.)

• A detailed description of the information concerned, where applicable

Step 2: Identity verification

We must verify your identity before processing your request to protect your personal information. We may ask you to provide identification or additional information.

Step 3: Processing your request

We will process your request within 30 days of receiving all necessary information (Law 25 – Québec). If you are a resident of a U.S. state with applicable privacy laws, we will respond within 45 days (extendable once by an additional 45 days with notice), as required by the CCPA and similar state laws.

If exceptional circumstances prevent us from meeting the applicable deadline, we will inform you of the extension and the reasons for it. For Québec residents, we may request an extension from the Commission d'accès à l'information in accordance with section 46 of the Act.

Step 4: Response

You will receive our response in writing. If we refuse your request in whole or in part, we will explain the reasons for the refusal and inform you of your remedies.

10.2 Complaint process

If you believe we have not respected your rights or the obligations set out by law regarding your personal information, you may file a complaint.

Internal complaint

1. Send a written complaint to the person in charge of personal information protection (contact details in section 1)

2. We will process your complaint within 45 days of receiving all necessary information

3. You will receive a written response detailing the results of our investigation and, where applicable, the corrective measures taken

External recourse

If you are not satisfied with our response, or if you wish to file a complaint directly with the supervisory authority, you may contact:

Commission d'accès à l'information du Québec

2045 Stanley Street, Suite 900

Montréal (Québec) H3A 2V4

Telephone: 1-888-528-7741

Website: www.cai.gouv.qc.ca

11. Refusal of collection

You may refuse to provide certain information or withdraw your consent for certain data collection activities. The following outlines your options and their consequences.

Collection you can choose to refuse:

• Analytics cookies (Google Analytics): refuse via the cookie preference center on our website. Consequence: no usage statistics will be collected; all site features remain available.

• Marketing cookies (Meta Pixel): refuse via the cookie preference center. Consequence: no personalized advertising via Meta; all site features remain available.

• Identification information (email address): do not create an account or do not fill out contact forms. Consequence: it will not be possible to receive support or communications; the application remains accessible based on your license type.

Collection required for service delivery:

Certain information is collected because it is essential to the operation, security, or stability of the service. These activities cannot be individually disabled. If you do not wish this data to be collected, you may discontinue use of the relevant service.

• Diagnostic data (Sentry, PostHog): these tools collect technical data (errors, performance, environment) necessary for the stability and ongoing improvement of the application.

• In-app support (Intercom): the in-app support module collects the information necessary to process your support requests.

• Camera access (CubicScreen): camera access is required for the calibration and eye-tracking features that constitute the application's core functionality. Without this access, the application cannot fulfill its purpose.

12. Retention and destruction

Information is retained for the period necessary for the purposes pursued, then securely destroyed or anonymized.

13. Cookies and similar technologies

Non-essential cookies, including analytics and marketing cookies, are used only after obtaining explicit consent.

14. Amendments to the policy

This policy may be amended at any time. Any changes will be published on the website.

15. Internal documents

The company maintains internal policies related to the management of privacy incidents and the governance of personal information.

The current version of these policies is version 1.0.0, in effect since June 23, 2026.

PART II – PRIVACY NOTICE – CUBICSCREEN APPLICATION

Application description

CubicScreen is a mobile application that enables the display of 3D content.

Technological tools used

Sentry (European instance)

• Tool for error management, stability monitoring, and diagnosis of application incidents.

• May collect technical information related to errors, such as information about the technology environment (device type, operating system, application version), error logs, and technical traces.

• The data transmitted is minimized and filtered in order to exclude any unnecessary or sensitive information.

• No data is used for profiling or individual tracking purposes.

PostHog (Frankfurt, Germany)

• Usage analytics tool used exclusively to produce global and aggregated statistics on application usage.

• Used notably to measure, in a non-individualized way:

• the frequency of application use;

• the number of contents viewed;

• the average duration of use or display.

• No individualized analysis, no user profiling, no targeted advertising, no session recording, and no detailed behavioral tracking is performed.

Supabase (Canada)

• Server platform used for the application infrastructure, including the activation server.

• Used for the secure management of the application's essential features, notably product activation and communication with server services.

• The information processed is limited to that strictly necessary for the operation and security of the service.

Intercom (United States)

• In-app customer support platform integrated via the iOS SDK, allowing users to communicate in real time with our support team.

• The identifier transmitted automatically is the product activation code (pseudonymized — no name, email, or directly identifying information is transmitted automatically). Technical attributes necessary for diagnosis (device type, operating system, application version, license type, language) are also transmitted.

• Support conversation content (messages exchanged) is stored by Intercom in the United States (AWS infrastructure). If a user voluntarily provides identifying information (name, email) during a conversation, this is done at their own initiative.

• No sensitive data is transmitted to Intercom. No data is used for profiling or advertising purposes.

3. Information collected

Depending on the features used and the technology tools employed, the following information may be collected:

Technical information:

• IP address (where applicable, truncated or anonymized), device type, operating system, application version, and other similar information related to the technology environment;

• Unique identifier generated for technical or functional purposes;

• Unique activation code associated with the product.

Sentry

• device type;
• operating system and version;
• application version;
• pseudonymized technical identifiers;
• performance and technical logging information;
• crash reports;
• approximate user region.

PostHog

• a pseudonymized identifier (product activation code — no name, email, or directly identifying information is transmitted);
• device type and operating system;
• application version;
• aggregated usage events (session duration, usage frequency, features viewed, onboarding step progression);
• IP address (used only for approximate geolocation, not retained in raw form).

Intercom (United States)

• a pseudonymized identifier (product activation code — no name, email, or directly identifying information is transmitted automatically);
• device type and operating system;
• application version;
• license type;
• preferred language;
• support conversation content (messages exchanged between the user and our support team).

No information is transmitted automatically by the application that directly identifies the user. If a user voluntarily provides their name, email address, or other identifying information during a support conversation, this is done at their own initiative.

No information is used for advertising profiling or individual identification of users, except where required by law or with explicit consent.

4. Specific purposes

The information collected is used exclusively for the following purposes:

Verification of the legitimacy of the user;

• Product activation and access management;

• 3D calibration and proper functioning of features;

• Security, stability, and correction of application errors;

• Continuous improvement of the application, based on global and aggregated statistics;

• In-app customer support (via Intercom).

5. Access to device features

Camera

Used only for calibration and local eye tracking for the purposes of 3D display.

• Processing is performed exclusively on your device (local processing). No images are transmitted to our servers or to third parties.

• No biometric template is created, recorded, or retained. Eye-tracking data does not persist beyond the active session.

• You may revoke camera access at any time in your device settings. This will disable calibration and tracking features, without affecting the other features of the application.

Network

- Activation and transmission of anonymized data

Photo library

- Local consultation only

PART III Website Analytics and Marketing Technologies

CubicSpace Technologies Inc. uses the following technologies, activated only after explicit consent:

- Google Analytics (GA4): statistical analytics tool for website usage. Google LLC acts primarily as a subcontractor (Processor), but may act as a joint controller if certain advanced features are enabled (see section 6.1 for more details).

- Google Merchant Center: product catalog synchronization tool with Google Shopping, integrated via the online store infrastructure.

- Meta Pixel: tool for measuring and optimizing advertising campaigns. Meta Platforms, Inc. acts as a joint controller for data collected via the Pixel (see section 6.1 for more details).

Categories of personal information collected through these tools:

Google Analytics (GA4):

- Technical information (truncated or anonymized IP address, screen resolution, device type, browser, operating system, language, time zone);
- Browsing data (pages visited, visit duration, interactions, referral source);
- Online identifiers (first-party cookies _ga and _ga_*), when consent is given.

User-level data is retained by Google for a configurable period (default 2 months, up to 14 months maximum for a standard account). The IP address is truncated by default in GA4 and is not retained in its complete form.

Google Merchant Center:

- Product data (catalog, descriptions, prices, availability);
- Conversion data (where applicable: products viewed, purchases made).

Google Merchant Center is integrated via the online store infrastructure (Shopify) and allows synchronization of the product catalog with Google Shopping.

Meta Pixel:

- Technical information (IP address, screen resolution, device type, browser, operating system, time zone);
- Browsing data (full URLs of pages visited, page titles and descriptions, actions taken on the site, referral source);
- Persistent unique identifier (first-party fbp cookie) allowing Meta to identify you across your browsing sessions and potentially across different websites;
- Conversion data (where applicable: products viewed, added to cart, purchases made).

Event data transmitted to Meta is retained for a maximum of 2 years. Custom audiences created from this data are retained until deleted by CubicSpace.

Specific purposes:

- Statistical analysis and continuous improvement of the website (Google Analytics);
- Product catalog synchronization with Google Shopping (Google Merchant Center);
- Marketing and targeted advertising, including advertising profiling (Meta Pixel), only after explicit consent. Meta also uses the collected data for its own purposes, including advertising profiling across its entire ecosystem (Facebook, Instagram, and the Meta advertising network).

Transfers outside Québec:

The use of Google Analytics, Google Merchant Center, and Meta Pixel may result in transfers of personal information outside Québec, notably to the United States. CubicSpace Technologies Inc. carries out, where required, a Privacy Impact Assessment (PIA) and implements appropriate contractual measures.

Consent:

Analytics and marketing technologies are disabled by default and are activated only after obtaining free, informed, and specific consent, in accordance with the requirements of Law 25 and the guidelines of the Commission d'accès à l'information (CAI). Consent may be withdrawn at any time, without justification.

When a person withdraws consent, the collection of personal information ceases for the future. However, some information previously collected may have been aggregated or anonymized and no longer allow the person to be identified. In this case, individual deletion is neither technically possible nor required.

In the case of third-party technologies such as Meta Pixel, CubicSpace Technologies Inc. does not have direct control allowing retroactive deletion of information already transmitted.

PART IV — YOUR U.S. STATE PRIVACY RIGHTS

This section applies to residents of U.S. states that have enacted comprehensive consumer privacy laws, including California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), and other states with similar legislation. If any provision of this Part IV conflicts with an earlier section of this policy, this Part IV governs for U.S. residents.

1. Applicability

This section applies to you if you are a resident of a U.S. state with an applicable consumer privacy law and CubicSpace processes your personal information in connection with the CubicScreen application, the cubicscreen.com website, or related services.

2. Categories of personal information we collect

The following table maps the categories of personal information we collect to the standardized categories used in U.S. state privacy laws:

3. How we use personal information

We use the categories of personal information listed above for the purposes described in sections 5 and Part II of this policy. We do not use or disclose sensitive personal information for purposes other than those permitted under applicable law.

4. Sale and sharing of personal information

We do not sell your personal information as defined under the CCPA or any other U.S. state privacy law.

Sharing for cross-context behavioral advertising: When you consent to the activation of the Meta Pixel on our website, personal information (online identifiers, browsing data, and device information) is transmitted to Meta Platforms, Inc. for the purpose of measuring and optimizing advertising campaigns. Under the CCPA/CPRA, this constitutes "sharing" of personal information for cross-context behavioral advertising. This sharing occurs only when you have given your explicit consent via our cookie preference center.

Sharing for analytics: When you consent to the activation of Google Analytics, browsing data and online identifiers are transmitted to Google LLC. Google acts primarily as a service provider (processor), but may process certain data as a controller if advanced features are enabled (see section 6.1).

We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

5. Your rights under U.S. state privacy laws

Depending on your state of residence, you may have some or all of the following rights:

Right to know / Right of access. You have the right to know what personal information we collect, use, disclose, sell, or share about you, and to request a copy of that information. You may request this information up to twice per 12-month period.

Right to delete. You have the right to request that we delete the personal information we have collected from you, subject to certain legal exceptions (e.g., completing a transaction, detecting security incidents, complying with legal obligations).

Right to correct. You have the right to request that we correct inaccurate personal information we maintain about you.

Right to opt out of sale or sharing. You have the right to opt out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising. As noted, CubicSpace does not sell personal information but does share data with Meta when you have consented to the Meta Pixel.

Right to opt out of targeted advertising. You have the right to opt out of the processing of your personal information for the purposes of targeted advertising. This right is recognized in California, Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and other states.

Right to opt out of profiling. Certain states grant you the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. CubicSpace does not engage in such profiling.

Right to data portability. You have the right to obtain a copy of your personal information in a portable, readily usable format.

Right to non-discrimination. We will not discriminate against you for exercising any of your privacy rights. We will not deny you goods or services, charge you different prices, or provide a different level or quality of service because you exercised your rights.

Right to limit use of sensitive personal information (California). CubicSpace does not collect sensitive personal information as defined by the CCPA/CPRA.

6. How to exercise your rights

Submitting a request. You may exercise any of the rights described above by contacting us at:

Email: privacy@cubicspace.ai

Subject line: "U.S. Privacy Rights Request"

In your request, please include your full name, your state of residence, and a description of the right(s) you wish to exercise.

Verification. We will verify your identity before processing your request. We may ask you to provide information that matches information we already have on file. If we cannot verify your identity, we may deny the request and will explain the basis for the denial.

Authorized agents. California residents may designate an authorized agent to submit a request on their behalf. The authorized agent must provide written proof of authorization (such as a power of attorney or a signed permission from the consumer). We may still require the consumer to verify their own identity directly.

Response time. We will respond to verified requests within 45 days of receipt. If additional time is needed, we will notify you of the extension (up to an additional 45 days) and the reason for it.

7. Appeal process

If we decline to take action on your request, you have the right to appeal our decision. To submit an appeal:

Email: privacy@cubicspace.ai

Subject line: "Privacy Rights Appeal"

We will respond to your appeal within 60 days. Our response will include a written explanation of the reasons for our decision. If your appeal is denied, we will provide you with information on how to contact your state's Attorney General or relevant supervisory authority to submit a complaint:

California: Office of the Attorney General — https://oag.ca.gov/contact/consumer-complaint-against-business-or-company

Virginia: Office of the Attorney General — https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint

Colorado: Office of the Attorney General — https://coag.gov/file-complaint/

Connecticut: Office of the Attorney General — https://www.dir.ct.gov/ag/complaint/

Texas: Office of the Attorney General — https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint

8. Global Privacy Control (GPC)

CubicSpace honors the Global Privacy Control (GPC) signal. If your browser or device transmits a GPC signal, we will treat it as a valid opt-out request for the sale or sharing of your personal information and for targeted advertising, as required by applicable law (including the CCPA and the Colorado Privacy Act). When a GPC signal is detected, analytics and marketing technologies that would constitute sale or sharing (Meta Pixel, Google Analytics) will not be activated, regardless of any prior consent.

For more information about GPC, visit: https://globalprivacycontrol.org

9. Do Not Track signals

Some browsers offer a "Do Not Track" (DNT) setting. There is currently no universally accepted standard for how companies should respond to DNT signals. CubicSpace treats DNT signals in the same manner as GPC signals: when detected, non-essential analytics and marketing technologies will not be activated.

10. Data retention for U.S. residents

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, unless a longer retention period is required by law. Specific retention periods by provider are described in the relevant sections of this policy (see sections 6 and Parts II–III). Upon verified request, we will delete your personal information in accordance with the applicable response timeframes.

11. Children's privacy

CubicSpace does not knowingly collect personal information from children under 13 years of age (or under 16 years of age in California for the purposes of sale or sharing). If we become aware that we have inadvertently collected personal information from a child under the applicable age, we will take steps to delete such information promptly. If you believe a child has provided us with personal information, please contact us at privacy@cubicspace.ai.

12. Contact for U.S. privacy inquiries

For any questions about your privacy rights under U.S. state laws, you may contact:

CubicSpace Technologies Inc.

Attn: Privacy — U.S. Rights

Email: privacy@cubicspace.ai

Version history