Privacy Policy

VolcanoBox ("we", "us", "our") is committed to protecting your privacy and complying with Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial privacy regulations. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the VolcanoBox platform, website, and mobile application. Please read this Privacy Policy carefully. If you do not agree with our practices, do not use the VolcanoBox platform.

2.1 Account Information When you create a VolcanoBox account, we collect: • Full name and email address • Phone number • Shipping and billing addresses • Date of birth (optional) • Payment information (processed via Stripe) • Account preferences and settings 2.2 Transaction Information We collect information about your orders, including: • Products purchased and order history • Delivery addresses and fulfillment preferences • Payment method and transaction amounts • Refund and return activity 2.3 Communications We collect: • Email messages you send to customer support • Chat or message history with VolcanoBox team • Push notification opt-in/opt-out preferences • Marketing email subscription status 2.4 Usage Analytics We automatically collect: • IP address and device identifier • Browser type, device type, and operating system • Pages visited, time spent, and clicks • Search queries and product browsing history • Location data (if permitted) 2.5 Cookies & Tracking We use cookies, web beacons, and similar technologies to: • Remember login information and preferences • Track website usage and conversion funnels • Personalize content and recommendations • Improve platform performance 2.6 Third-Party Data We may receive information from: • Payment processors (Stripe, e-Transfer networks) • Fulfillment partners regarding delivery status • VibeRadar referral context, such as the discovery surface, vendor or content record, and selected VolcanoBox product • Analytics providers and marketing platforms • Social media platforms (if you connect accounts) VibeRadar referral links do not include your email or account ID. If you sign in and continue, VolcanoBox connects the referral to your VolcanoBox account server-side so the selected product or vendor can be preserved and referral performance can be measured.

3.1 We use your personal information to: • Process and fulfill orders • Communicate about your account and transactions • Send promotional emails and founder credit updates • Provide customer support and resolve disputes • Detect and prevent fraud and abuse • Improve the platform and user experience • Conduct marketing research and analytics • Comply with legal and regulatory requirements 3.2 Marketing Communications With your consent, we send: • Promotional emails about new products and promotions • Founder credit updates and campaign announcements • Product recommendations based on purchase history • Community updates and special offers You may opt out of marketing emails at any time by clicking "unsubscribe" in the email or by updating your account preferences. 3.3 Analytics & Personalization We use analytics to: • Understand how customers interact with the platform • Measure VibeRadar-to-VolcanoBox discovery and ordering handoffs • Improve user experience and platform features • Personalize product recommendations • Create targeted marketing campaigns 3.4 Fulfillment & Operations We share relevant order and address information with fulfillment partners solely to facilitate delivery.

4.1 VolcanoBox does not sell your personal information to third parties. 4.2 We may share information with: • Fulfillment partners and vendors (order details, shipping address) • Payment processors (Stripe, payment information) • Email marketing platforms (email, purchase history) • Analytics providers (usage data, anonymized information) • Legal authorities (if required by law or court order) • Business successors (in case of acquisition or merger) 4.3 Fulfillment Partner Sharing Fulfillment partners receive only the information necessary to prepare and deliver your order: • Full name and phone number • Shipping address • Order contents and quantities • Delivery preferences Fulfillment partners have their own privacy policies and are responsible for the security of information they receive. 4.4 Third-Party Service Providers Third-party providers are contractually obligated to use your information solely to provide services to VolcanoBox and to maintain confidentiality. 4.5 Legal Requirements We may disclose information if required by: • Court order or subpoena • Law enforcement request • Regulatory or government inquiry • Protection of public safety or rights

5.1 VolcanoBox implements industry-standard security measures to protect your personal information, including: • Encryption of payment information via Stripe (PCI DSS compliant) • Secure socket layer (SSL) encryption for data transmission • Firewalls and intrusion detection systems • Regular security audits and vulnerability assessments • Limited employee access to personal data (need-to-know basis) 5.2 Despite our security measures, no online platform is 100% secure. You use VolcanoBox at your own risk. 5.3 We do not store complete credit card information on our servers. Payment processing is handled securely by Stripe. 5.4 If a data breach occurs, we will notify affected customers within 30 days as required by law. 5.5 You are responsible for maintaining the confidentiality of your account password. VolcanoBox will never ask for your password via email.

6.1 We retain personal information for as long as: • Your account is active • Necessary to provide services and process transactions • Required by law or regulation • Necessary to resolve disputes or investigate fraud 6.2 Typical retention periods: • Account information: Duration of account + 3 years after closure • Transaction records: 7 years (tax and regulatory compliance) • Customer communications: 3 years • Marketing data: Until you unsubscribe • Analytics data: 24 months (anonymized after 12 months) 6.3 You may request deletion of your account and associated data at any time, subject to legal retention requirements.

Under Canadian privacy law, you have the right to: 7.1 Access Your Information You may request a copy of your personal information held by VolcanoBox. We will provide this within 30 days. 7.2 Correction You may request correction of inaccurate or incomplete information. 7.3 Withdrawal of Consent You may withdraw consent for marketing communications, analytics, or specific data uses (except where required for service delivery). 7.4 Account Deletion You may request deletion of your account and associated personal information, subject to legal retention obligations. 7.5 How to Exercise Your Rights To exercise any of these rights, email privacy@volcanobox.ca with: • Your name and account email • Specific request and reason • Verification of identity We will respond within 30 days. If we cannot comply, we will explain the reason.

8.1 VolcanoBox uses cookies to: • Store login information and session data • Remember preferences and settings • Track website usage and conversion funnels • Personalize content and recommendations • Enable analytics and performance monitoring 8.2 Types of Cookies: • Essential cookies (required for platform function) • Performance cookies (analytics and optimization) • Functional cookies (remember preferences) • Targeting cookies (personalization and marketing) 8.3 You can control cookies through your browser settings. Disabling cookies may impact platform functionality. 8.4 Third-Party Cookies Third-party service providers (Google Analytics, Stripe, etc.) may place their own cookies on your device. See their privacy policies for details. 8.5 Do Not Track We respect "Do Not Track" signals where feasible, but some platform features require tracking to function properly.

9.1 VolcanoBox may contain links to third-party websites, social media platforms, and vendor sites. 9.2 We are not responsible for the privacy practices of third-party sites. Please review their privacy policies before providing information. 9.3 If you connect your VolcanoBox account to social media (Facebook, Instagram), we may collect basic profile information with your consent. 9.4 Third-party payment processors (Stripe) have separate privacy policies. Your payment information is governed by their terms.

10.1 VolcanoBox is not intended for individuals under 18 years of age. 10.2 We do not knowingly collect personal information from children under 18. 10.3 If we become aware that we have collected information from a child under 18, we will delete it immediately. 10.4 Parents or guardians who believe we have collected information from their child should contact privacy@volcanobox.ca.

11.1 Your personal information may be stored and processed in Canada, the United States, and other countries where VolcanoBox or its service providers operate. 11.2 By using VolcanoBox, you consent to the transfer of your information to countries that may have different privacy standards than Canada. 11.3 VolcanoBox implements appropriate safeguards (encryption, contractual protections) for international data transfers.

12.1 VolcanoBox may update this Privacy Policy periodically to reflect changes in practices or legal requirements. 12.2 Changes are effective upon posting. Your continued use of the platform constitutes acceptance. 12.3 We will notify you via email of material changes to this policy. 12.4 Last updated: August 10, 2026

For privacy questions, requests, or complaints: Email: privacy@volcanobox.ca Mailing Address: VolcanoBox Privacy Office British Columbia, Canada We will respond to all inquiries within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).