ROOMEEO PRIVACY POLICY

Last Updated: February 28th, 2026

1. INTRODUCTION

ROOMEEO Inc. (“we,” “us,” “our,” or “ROOMEEO”) is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our marketplace platform, website (roomeeo.com), mobile applications, and related services (collectively, the “Services”).

By accessing or using our Services, you consent to the data practices described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use our Services.

Key Points: - We collect information to verify your student status and facilitate marketplace transactions - We do not sell your personal information to third parties - You have control over your data and privacy settings - We comply with Canadian privacy laws, including PIPEDA

2. INFORMATION WE COLLECT

2.1 Information You Provide Directly

Account Registration Information: - Full name - Institutional (.edu) email address - Password (encrypted) - Educational institution name - Expected graduation date - Date of birth - Phone number (optional) - Profile photo (optional)

Listing Information: - Item descriptions and photos - Pricing information - Condition and category details - Location preferences for meetups

Transaction Information: - Purchase and sale history - Communication with other users through our platform - Feedback, ratings, and reviews - Dispute reports and resolutions

Registry and Roommate Coordination: - Shared registry items and preferences - Roommate connections and household information - Budget tracking data - Purchase assignments

Payment Information (Future): When we implement facilitated payments, we will collect: - Payment card information (processed securely by third-party providers) - Billing address - Transaction history

Note: We do NOT store full credit card numbers; our payment processors handle sensitive payment data.

Communications and Support: - Messages sent through our platform - Customer support inquiries and correspondence - Survey responses and feedback - Marketing communication preferences

2.2 Information Collected Automatically

Device and Usage Information: - IP address and device identifiers - Browser type and version - Operating system - Device model and manufacturer - Mobile carrier - Language preferences - Time zone settings

Activity Data: - Pages viewed and features used - Search queries and filters applied - Listings viewed and clicked - Time spent on platform - Referral source (how you found us) - Interaction with emails and notifications

Location Information: - Approximate location based on IP address - Campus/university location (for localized marketplace) - Meetup location preferences (only what you voluntarily provide)

Note: We do NOT track precise GPS location unless you explicitly grant permission for specific features.

Cookies and Similar Technologies: We use cookies, web beacons, pixels, and similar technologies to: - Authenticate users and prevent fraud - Remember your preferences and settings - Analyze platform performance and user behavior - Deliver targeted advertising (with your consent) - Provide social media features

Types of cookies we use: - Essential Cookies: Required for platform functionality - Performance Cookies: Analyze usage and improve services - Functional Cookies: Remember preferences and settings - Advertising Cookies: Deliver relevant ads (opt-out available)

You can control cookies through your browser settings, but disabling cookies may limit platform functionality.

2.3 Information from Third Parties

Student Verification Services: - We may use third-party services to verify your student status - This may include confirmation of enrollment and graduation date

Social Media: If you connect your social media accounts (optional): - Profile information from connected accounts - Friends or connections who also use ROOMEEO - Posts or content you choose to share

Retail Partners and Affiliates: - Purchase confirmation for affiliate transactions - Product preferences and shopping behavior - Click-through data from affiliate links

Analytics Providers: - Aggregated usage statistics - Platform performance metrics - User behavior patterns

Payment Processors (Future): - Transaction completion status - Fraud detection signals - Chargeback or dispute information

2.4 Publicly Available Information

We may collect publicly available information from: - Your educational institution’s public directory (if available) - Public social media profiles (if you choose to connect them) - Public listings on our platform

3. HOW WE USE YOUR INFORMATION

3.1 To Provide and Improve Services

Platform Functionality: - Create and maintain your account - Verify your student status and institutional affiliation - Enable marketplace listings, browsing, and transactions - Facilitate communication between buyers and sellers - Process and complete transactions (when payment feature launches) - Provide customer support and respond to inquiries - Send transactional notifications (listings, messages, transactions)

Service Enhancement: - Analyze usage patterns to improve platform features - Conduct research and development for new features - Personalize your experience and recommendations - Optimize search results and listing relevance - Test new features and functionality - Troubleshoot technical issues and bugs

3.2 For Safety and Security

Platform Safety: - Verify user identity and prevent fraud - Detect and prevent prohibited conduct - Enforce our Terms and Conditions - Monitor for suspicious activity or policy violations - Respond to user reports and disputes - Cooperate with law enforcement when legally required

Data Security: - Protect against unauthorized access - Prevent data breaches and security threats - Maintain system integrity and reliability

3.3 For Communication

Transactional Communications: - Account creation and verification - Listing updates and status changes - Messages from buyers or sellers - Transaction confirmations - Payment receipts (future) - Security alerts and account notifications

Service Announcements: - Platform updates and new features - Changes to Terms and Conditions or Privacy Policy - Scheduled maintenance or service disruptions - Important security or policy notices

Marketing Communications (With Your Consent): - Promotional offers and deals from retail partners - Platform news and feature highlights - Tips for successful buying and selling - Surveys and feedback requests - Event invitations and campus-specific promotions

You can opt-out of marketing emails at any time through account settings or email unsubscribe links.

3.4 For Business Operations

Analytics and Insights: - Understand how users interact with the platform - Measure effectiveness of features and campaigns - Generate aggregated, anonymized statistics - Create internal reports and dashboards

Legal and Compliance: - Comply with legal obligations and regulations - Respond to legal requests and court orders - Exercise or defend legal claims - Protect our rights, property, and safety - Enforce our policies and agreements

Business Transactions: - Facilitate mergers, acquisitions, or asset sales - Due diligence for potential investors or partners - Financial reporting and auditing

4. HOW WE SHARE YOUR INFORMATION

4.1 With Other Users

Public Information: The following information is visible to other verified students on the platform: - Your first name and last initial - Profile photo (if provided) - Educational institution - Active listings and item details - Seller ratings and reviews - General location (campus area, not specific address)

Private Information: Your email address, phone number, and full address are NOT shared publicly. However, you may choose to share contact information with specific buyers or sellers through our messaging system.

4.2 With Service Providers

We share information with trusted third-party service providers who assist us in operating the platform:

Infrastructure and Hosting: - Cloud hosting providers (e.g., Vercel, AWS, Google Cloud) - Database management services - Content delivery networks (CDNs)

Analytics and Performance: - Google Analytics (anonymized data) - Platform performance monitoring tools - A/B testing and optimization services

Communication Services: - Email service providers (Mailchimp, SendGrid) - SMS notification services - Customer support platforms

Payment Processors (Future): - Stripe, PayPal, or similar payment gateways - Fraud detection services - PCI compliance partners

Student Verification: - Third-party student verification services - Educational data verification providers

Marketing and Advertising: - Advertising networks (Google Ads, Facebook Ads) - Social media platforms - Affiliate marketing partners

Legal and Compliance: - Legal counsel and advisors - Auditors and accountants - Compliance monitoring services

All service providers are bound by confidentiality agreements and are only permitted to use your information as necessary to provide services to us.

4.3 With Retail Partners

When you make purchases through our affiliate links: - Retail partners receive information about your purchase (through their own tracking) - We receive confirmation of completed purchases for commission purposes - Your personal information is governed by the retailer’s privacy policy

We do NOT share your ROOMEEO account information with retail partners without your consent.

4.4 For Legal Reasons

We may disclose your information when required by law or to protect rights: - To comply with legal obligations, subpoenas, or court orders - To respond to government requests or law enforcement - To protect against fraud, security threats, or illegal activity - To enforce our Terms and Conditions - To protect the rights, property, or safety of ROOMEEO, our users, or the public - To investigate suspected policy violations

4.5 Business Transfers

If ROOMEEO is involved in a merger, acquisition, asset sale, or bankruptcy: - Your information may be transferred to the acquiring entity - We will notify you via email and/or platform notice - The new entity will be bound by this Privacy Policy (unless you consent to a new policy)

4.6 With Your Consent

We may share your information in other circumstances with your explicit consent, such as: - Participating in promotional campaigns or contests - Connecting your account with third-party apps or services - Sharing testimonials or case studies (with your permission)

4.7 Aggregated and Anonymized Data

We may share aggregated, anonymized data that cannot identify you: - Usage statistics and platform metrics - Market research and trend analysis - Academic research partnerships - Public reports or presentations

5. YOUR PRIVACY CHOICES AND CONTROLS

5.1 Account Settings

You can access, update, or delete your account information at any time through: - Profile settings page - Account preferences dashboard - Contacting customer support at support@roomeeo.com

5.2 Marketing Communications

Opt-Out Options: - Click “Unsubscribe” in any marketing email - Adjust email preferences in account settings - Contact us at support@roomeeo.com to opt-out of all marketing

Note: You cannot opt-out of essential transactional emails (account, security, or transaction notifications).

5.3 Cookie Management

Control Cookies: - Adjust cookie preferences through our cookie consent banner - Modify browser settings to block or delete cookies - Use browser plugins to manage tracking

Note: Disabling essential cookies may impair platform functionality.

5.4 Location Services

Control Location Sharing: - We only access precise location if you explicitly grant permission - You can revoke location permissions through device settings - Campus location is based on your institutional email and profile

5.5 Data Access and Portability

Your Rights: - Request a copy of your personal information - Export your data in a machine-readable format - Receive information about how we process your data

To exercise these rights, contact support@roomeeo.com.

5.6 Data Correction and Deletion

Update Information: - Edit profile information through account settings - Correct errors in your listings or transaction history - Contact support for assistance with data corrections

Delete Information: - Delete individual listings or messages - Close your account to delete most personal information - Request full data deletion (may take up to 30 days to complete)

Note: We may retain certain information as required by law or for legitimate business purposes (e.g., transaction records, dispute resolutions).

5.7 Do Not Track (DNT)

Some browsers support “Do Not Track” (DNT) signals. We do not currently respond to DNT signals, as there is no industry-wide standard for compliance.

5.8 Third-Party Account Connections

Disconnect Accounts: - Revoke access to connected social media accounts through settings - Disconnect retail partner integrations - Remove third-party app permissions

6. DATA RETENTION

6.1 Active Accounts

We retain your personal information for as long as your account remains active or as needed to provide Services.

Typical Retention Periods: - Account information: Duration of account + 1 year after closure - Transaction records: 7 years (for financial and legal compliance) - Communications: 3 years after last activity - Support tickets: 3 years after resolution - Usage logs: 2 years

6.2 Closed Accounts

When you close your account: - Most personal information is deleted within 30 days - Transaction history is retained for 7 years (legal requirement) - Anonymized usage data may be retained indefinitely - Content in active disputes is retained until resolution

6.3 Legal and Compliance Retention

We may retain information longer when required by: - Applicable laws and regulations - Ongoing investigations or disputes - Legitimate business needs (e.g., fraud prevention) - Contract obligations

6.4 Backup Systems

Information may persist in backup systems for up to 90 days after deletion from production systems.

7. DATA SECURITY

7.1 Security Measures

We implement industry-standard security measures to protect your information:

Technical Safeguards: - Encryption of data in transit (TLS/SSL) - Encryption of sensitive data at rest - Secure password hashing (bcrypt) - Regular security audits and penetration testing - Intrusion detection and prevention systems - Secure coding practices and code reviews

Access Controls: - Role-based access controls for employees - Multi-factor authentication for admin accounts - Regular access reviews and audits - Principle of least privilege

Operational Security: - Employee training on data protection - Background checks for employees with data access - Confidentiality agreements for all personnel - Incident response and breach notification procedures

7.2 Your Security Responsibilities

Protect Your Account: - Use a strong, unique password - Do NOT share your password with others - Enable two-factor authentication (when available) - Log out after using shared devices - Monitor your account for suspicious activity - Report security concerns immediately

7.3 Security Limitations

No Guarantee of Security: While we strive to protect your information, no security measures are 100% effective. We cannot guarantee: - Absolute security of information transmitted over the internet - Prevention of all unauthorized access or disclosure - Security of information you share with other users

User Responsibility: - Be cautious when meeting users in person - Do not share sensitive personal information with other users - Report suspicious users or listings immediately

7.4 Breach Notification

In the event of a data breach affecting your personal information: - We will notify you within 72 hours of discovery - We will inform relevant authorities as required by law - We will provide information about the breach and steps to protect yourself

8. CHILDREN’S PRIVACY

8.1 Age Restrictions

ROOMEEO is intended for use by post-secondary students who are at least 18 years old (or the age of majority in their jurisdiction). We do NOT knowingly collect information from children under 18.

8.2 Parental Notice

If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately at support@roomeeo.com. We will delete such information promptly.

9. INTERNATIONAL DATA TRANSFERS

9.1 Canadian Operations

ROOMEEO is based in Canada, and your information is primarily stored and processed in Canada.

9.2 Cross-Border Transfers

Some of our service providers may be located outside Canada, including: - United States (cloud hosting, analytics) - European Union (certain service providers)

When we transfer data internationally: - We use standard contractual clauses or equivalent safeguards - We ensure service providers comply with data protection standards - Data is encrypted in transit

9.3 Your Rights

If your data is transferred outside Canada, you retain your privacy rights under Canadian law. You may contact us to inquire about international transfers.

10. PRIVACY RIGHTS BY JURISDICTION

10.1 Canadian Privacy Rights (PIPEDA)

Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to: - Know what personal information we collect - Access your personal information - Correct inaccurate information - Withdraw consent for certain data uses - File a complaint with the Privacy Commissioner of Canada

10.2 Provincial Privacy Laws

Additional rights may apply depending on your province:

Quebec (Law 25): - Enhanced consent requirements - Right to data portability - Stricter security requirements

British Columbia (PIPA): - Right to request information about disclosures - Enhanced accuracy requirements

10.3 European Users (GDPR)

If you are located in the European Economic Area (EEA), you have additional rights under GDPR: - Right to access and receive your data - Right to rectification of inaccurate data - Right to erasure (“right to be forgotten”) - Right to restrict processing - Right to data portability - Right to object to processing - Right not to be subject to automated decision-making

10.4 California Users (CCPA)

If you are a California resident, you have rights under the California Consumer Privacy Act: - Right to know what information we collect - Right to delete personal information - Right to opt-out of sale of personal information - Right to non-discrimination

Note: We do NOT sell personal information to third parties.

11. CHANGES TO THIS PRIVACY POLICY

11.1 Updates

We may update this Privacy Policy from time to time to reflect: - Changes in our data practices - New features or services - Legal or regulatory requirements - User feedback and best practices

11.2 Notification of Changes

When we make material changes: - We will update the “Last Updated” date at the top - We will notify you via email (to your registered email address) - We will post a notice on the platform - We will provide at least 30 days’ notice before changes take effect

11.3 Acceptance of Changes

Your continued use of the Services after changes take effect constitutes acceptance of the updated Privacy Policy. If you do not agree with changes, you must stop using the Services and close your account.

11.4 Version History

We maintain prior versions of this Privacy Policy for your review. Contact support@roomeeo.com to request previous versions.

12. CONTACT US

12.1 Privacy Questions

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:

Privacy Contact: Email: support@roomeeo.com Subject Line: “Privacy Inquiry”

General Support: Email: support@roomeeo.com Website: www.roomeeo.com/privacy

Mailing Address: ROOMEEO Inc. [To be added upon incorporation] Ontario, Canada

12.2 Privacy Officer

Our Privacy Officer is responsible for overseeing compliance with this Privacy Policy and applicable privacy laws. You may contact our Privacy Officer at: support@roomeeo.com

12.3 Response Time

We strive to respond to all privacy inquiries within: - Simple questions: 5 business days - Data access requests: 30 days - Data deletion requests: 30 days - Complaints: 10 business days

12.4 Regulatory Complaints

You have the right to file a complaint with your local data protection authority:

Canada: Office of the Privacy Commissioner of Canada Website: www.priv.gc.ca Phone: 1-800-282-1376

Quebec: Commission d’accès à l’information du Québec Website: www.cai.gouv.qc.ca

European Economic Area: Your local Data Protection Authority

ACKNOWLEDGMENT

BY USING OUR SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY AND CONSENT TO THE COLLECTION, USE, AND DISCLOSURE OF YOUR INFORMATION AS DESCRIBED HEREIN.

Last Updated: February 19, 2026 Version: 1.0

© 2026 ROOMEEO Inc. All rights reserved.