Solenery Privacy Policy (Canada)

1. Who we are

This Privacy Policy explains how Solenery ( "Solenery", "we", "us") collects, uses, discloses, and protects personal information when you use our websites, applications, and services (collectively, the "Platform").

Solenery is a two-sided marketplace platform that helps:

• Property owners (residential, condo, cottage, rural/off-grid, and commercial) explore energy upgrades such as solar, heat pumps, insulation, EV charging, and batteries, and
• Service providers (solar installers, HVAC contractors, energy auditors, insulation companies, and similar professionals) connect with interested property owners.

Contact email: [email protected]

Privacy Officer: Solenery has designated a Privacy Officer who is responsible for our compliance with Canada's PIPEDA and Quebec's Law 25, including overseeing how we handle personal information and respond to privacy requests and complaints. You can reach our Privacy Officer at [email protected] (Attention: Privacy Officer).

2. What personal information we collect

A) Information you provide

B) Information collected automatically

• IP address — collected automatically on every request for security logging, fraud prevention, and abuse detection. IP addresses are treated as personal information under PIPEDA and are retained only for a limited period for these security purposes. We do not use your IP address to match you with service providers — matching is based on the postal code or address you provide.
• Device type, operating system, and browser type
• Approximate location derived from your IP address — used only for security and fraud prevention and, where you have opted in to marketing cookies, for geographically relevant advertising (see Sections 3 and 10). No GPS or precise location is collected without your explicit permission.
• Pages visited, session duration, referral source, and other usage data
• Cookies and similar technologies (see Section 10)

C) Information from third parties

• Analytics and performance data (Google Analytics, Google Tag Manager) where you have consented to analytics cookies
• Payment confirmation and fraud-prevention signals from payment processors, where applicable

3. How we use personal information

Under PIPEDA, we collect only the information necessary for identified purposes. We use personal information to:

• Operate, maintain, and improve the Platform
• Match property owners with relevant local service providers based on property type, the postal code or address you provide, and upgrade interests
• Generate and deliver quotes: when you submit a quote request, we transmit your name, email address, phone number, property address or postal code, property type, and selected upgrade categories to the service providers you have selected or who serve your area, so they can prepare and send you a quote
• Use your IP address for security logging, fraud and abuse prevention
• With your consent (marketing cookies only): derive your approximate location from your IP address to show geographically relevant advertisements on third-party platforms (e.g. Google Ads). This is a form of profiling under Quebec's Law 25. It is turned off by default and only occurs if you have opted in to marketing cookies, and you can turn it off again at any time through the Cookie Preferences link in our footer.
• Provide customer support and respond to inquiries
• Send transactional messages (account activity, quote status) and, where you have provided express consent under CASL, marketing communications
• Maintain platform security, detect and prevent fraud, and comply with applicable legal obligations
• Conduct aggregated analytics to understand platform usage and improve our services

4. Consent

We rely on different bases for handling your personal information depending on the purpose:

• Information needed to provide the Platform — such as creating your account, processing the quote requests you submit, and keeping the Platform secure — is handled because it is necessary to deliver the service you ask for and to meet our legal obligations.
• Optional, non-essential uses — such as analytics and marketing cookies, IP-based location for advertising, and marketing communications — are based on your separate, opt-in consent, which you can withdraw at any time (see Sections 9, 10, and 11). We do not treat your general use of the Platform as consent to these optional uses.

By using the Platform and providing personal information, you agree to the collection, use, and disclosure of information that is necessary to provide the service to you, as described in this Policy.

Quote requests: when you click "Request Quotes" or submit a quote inquiry, you are providing explicit, informed consent for Solenery to share the personal information described in Section 3 with the relevant service providers for the sole purpose of receiving quotes. You may withdraw consent at any time by contacting us; however, withdrawal does not apply retroactively to information already transmitted to a provider at your request and cannot undo communications already sent.

Automatic collection: your IP address and device information are collected automatically as a technical necessity of operating an internet service. By continuing to access the Platform, you acknowledge this collection as described in Section 2(B).

5. How we share personal information

We may share personal information in the following circumstances:

• With service providers for quote generation: when you submit a quote request, we share your name, email address, phone number, property address or postal code, property type, and selected upgrade categories with the service providers you have selected or who serve your region. These providers receive your information solely to prepare and deliver a quote. Providers act as independent businesses (separate controllers) once they receive your information, and we require them, through our terms and data- sharing agreements, not to use it for unrelated purposes or marketing without your separate consent. After that point, each provider is responsible for its own handling of your information under applicable privacy law.
• With platform vendors: we use third-party vendors to help operate the Platform, including infrastructure hosting (Supabase), analytics (Google Analytics, Google Tag Manager), email delivery, and payment processing. These vendors access personal information only as necessary to perform services on our behalf and are contractually required to protect it and use it only for the purposes we specify.
• For legal or safety reasons: we may disclose information if required by applicable law, court order, or regulatory authority, or if we have a good-faith belief that disclosure is necessary to protect the rights, property, or safety of Solenery, our users, or the public.
• Business transactions: in the event of a merger, acquisition, financing, or sale of business assets, personal information may be transferred as part of that transaction, subject to equivalent privacy protections.
• Aggregated or de-identified data: we may share statistical, aggregated, or anonymized information that cannot reasonably be used to identify any individual.

We do not sell personal information to data brokers, advertisers, or any third party as consumer data lists.

6. International data transfers

Our primary infrastructure is hosted in Canada. However, some of our third-party vendors — including Google (Analytics, Tag Manager, Ads) and Supabase (database hosting) — may store or process data on servers located in the United States or other countries. When your information is transferred outside Canada, it may be subject to the laws of those jurisdictions, including lawful access by foreign governments or courts.

Before transferring personal information outside Quebec or Canada, and as required under Quebec's Law 25, we conduct a privacy impact assessment that evaluates the sensitivity of the information, the purposes for which it will be used, the protections in place (including contractual clauses with the recipient), and the legal framework of the destination jurisdiction. We proceed with a transfer only where we are satisfied the information will receive protection that is adequate and substantially comparable to Canadian privacy law standards.

7. Retention

We retain personal information only as long as necessary to fulfill the purposes described in this Policy. The actual retention period depends on the type of information and the reason we hold it. As a general guide:

• Account information — kept for as long as your account is active, and deleted or anonymized within a reasonable period after you close your account, unless we must keep it longer for legal reasons.
• Quote and inquiry details — retained for the period needed to deliver and follow up on your request and to resolve any related disputes, typically up to 24 months after your last activity.
• Security and IP address logs — retained for a limited period for fraud prevention and abuse detection (generally no more than 12 months), then deleted or aggregated.
• Billing and transaction records — retained as long as required to meet tax, accounting, and other legal obligations (commonly up to 6–7 years).

When personal information is no longer needed for these purposes or required by law, we securely delete or anonymize it.

8. Safeguards

We use reasonable administrative, technical, and physical safeguards to protect personal information against unauthorized access, disclosure, copying, use, or modification. These include encryption in transit, access controls, and security monitoring. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.

9. Your privacy rights

Under Canada's PIPEDA and Quebec's Law 25 (and other applicable provincial privacy laws), you have the following rights:

• Access: request a copy of the personal information we hold about you and information about how it is used and disclosed.
• Correction: request that we correct inaccurate or incomplete personal information.
• Deletion: request deletion of your personal information, subject to our legal retention obligations and any overriding legitimate business purpose.
• Portability (Quebec residents): request that we provide your personal information in a structured, commonly used, and machine-readable format, or transfer it to a third party of your choice where technically feasible, as required under Quebec's Law 25.
• Withdraw consent: withdraw consent to our use of your personal information at any time, subject to legal or contractual restrictions. Withdrawal does not affect any processing that occurred before your withdrawal or any processing we are otherwise permitted to continue by law.
• File a complaint: if you believe we have not handled your personal information in accordance with applicable law, you may lodge a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca, or for Quebec residents, the Commission d'accès à l'information du Québec at www.cai.quebec.ca.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days of receiving your request. We may need to verify your identity before processing your request.

10. Cookies, analytics, and IP logging

We use cookies and similar technologies to operate and improve the Platform. We also automatically log your IP address on every server request for security, fraud prevention, and abuse detection. IP address logs are retained for a limited period consistent with these security purposes and are not used to track individual users across unrelated websites.

For optional analytics and marketing cookies (such as Google Analytics and Google Ads), we ask for your explicit consent before enabling them. You may manage or withdraw cookie consent at any time via the Cookie Preferences link in the footer, or through your browser settings. Rejecting analytics cookies does not affect your ability to use the Platform.

11. Marketing communications

We comply with Canada's Anti-Spam Legislation (CASL). We will only send commercial electronic messages where you have provided express or implied consent as defined under CASL. You may unsubscribe from marketing emails at any time using the unsubscribe link in any message, or by contacting [email protected]. We will process unsubscribe requests within 10 business days.

12. Children

Solenery is not intended for individuals under the age of majority in their province or territory. We do not knowingly collect personal information from minors. If we learn that we have inadvertently collected such information, we will delete it promptly.

13. Security breach notification

In the event of a privacy breach that creates a real risk of significant harm to individuals, we will notify affected individuals and report to the Office of the Privacy Commissioner of Canada (and, for Quebec residents, the Commission d'accès à l'information) as required by applicable law.

14. Changes to this Privacy Policy

We may update this Policy from time to time. Material changes will be posted on the Platform with a revised "Last updated" date. Where required by law, we will provide notice of material changes before they take effect.

15. Contact us

Questions, requests, or concerns about this Privacy Policy or our privacy practices can be directed to:

Solenery Privacy Inquiries
[email protected]

If you are not satisfied with our response, you may escalate your complaint to the Office of the Privacy Commissioner of Canada at www.priv.gc.ca, or for Quebec residents, to the Commission d'accès à l'information at www.cai.quebec.ca.