Flint Privacy Policy

1. Who Is Responsible for Your Information (Privacy Officer)

Flint is accountable for the personal information in its custody or control. We have designated a Privacy Officer responsible for our compliance with this Policy and applicable privacy law. You can reach the Privacy Officer at:

Privacy Officer
[Name / Title]
Flint Worldwide Inc
64 Castle Oaks Cross, Brampton, Ontario, Canada
Email: privacy@getflint.ai

2. Personal Information We Collect

We collect the following categories of personal information:

Information you provide directly

• Contact and account details: your name, mobile phone number, and email address.
• Payment information: billing details processed by our third-party payment processor (we do not store full card numbers).
• Preferences and requests: the content of your messages to Flint, including your travel, dining, and coordination preferences, dietary or accessibility needs you choose to share, dates, budgets, and similar details.

Information about people you ask us to coordinate with

• When you ask Flint to coordinate with another person (for example, a friend or group member), you may provide us with their name and contact information. See Section 7 for how we handle this.

Information we collect automatically

• Usage and interaction data: message metadata (such as timestamps and delivery status), and how you interact with the Service.
• Website data: if you visit getflint.ai, limited technical data such as IP address, device and browser type, and cookie or similar-technology data (see Section 9).

Information from third parties

• Booking and availability data from providers we work with to fulfill your requests (for example, hotel and restaurant availability and confirmations).

We collect only the personal information reasonably necessary to provide and improve the Service.

3. How and Why We Use Your Information (Purposes)

We use personal information for the following purposes:

• To provide the Service — to understand your requests, respond to you, send you proactive suggestions and reminders, coordinate plans, and arrange bookings you direct.
• To communicate with you — to send Service-related messages by SMS and email, consistent with your consent under Canada's Anti-Spam Legislation (CASL). You can withdraw messaging consent at any time (see our Terms of Service and Section 8 below).
• To process payments — to bill your subscription and process transactions.
• To personalize and improve — to tailor Flint's suggestions to your stated preferences and prior interactions, and to improve the quality, safety, and reliability of the Service.
• For safety, security, and legal compliance — to detect and prevent fraud and misuse, secure the Service, and comply with legal obligations.

We identify the purposes for which we collect personal information at or before the time of collection, and we do not use it for materially different purposes without your consent, unless permitted or required by law.

4. Consent

We collect, use, and disclose personal information with your consent, except where the law permits or requires otherwise.

• Express consent. Where required — including for sending you commercial electronic messages by SMS and email under CASL, and for collecting, using, or disclosing sensitive information — we obtain your express, informed consent. Consent for one channel (for example, email) does not by itself authorize another (for example, SMS); we obtain consent per channel.
• Withdrawing consent. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. Because messaging is core to the Service, withdrawing messaging consent may limit or end your ability to use Flint. To withdraw messaging consent, reply STOP/ARRÊT (SMS) or use the unsubscribe link (email); to withdraw other consents or close your account, contact our Privacy Officer.
• Quebec residents. Consistent with Law 25, we request your consent for each specific purpose in clear and plain language, separately from other information where required, and we obtain express consent for sensitive personal information.

5. AI Processing and Automated Suggestions

Flint uses artificial intelligence, including AI models provided by third parties, to interpret your messages and generate responses, suggestions, and reminders. In doing so, your message content and relevant preferences are processed by these AI providers on our behalf under contractual confidentiality and security obligations (see Sections 6 and 10).

Flint's proactive suggestions are generated based on the information you provide and your prior interactions. Flint does not make decisions that produce legal or similarly significant effects about you without human involvement. You remain in control: Flint asks for your confirmation before taking meaningful actions such as bookings, and you are responsible for reviewing and confirming them. If you are a Quebec resident and believe a decision affecting you was based exclusively on automated processing, you may contact our Privacy Officer to be informed of the personal information used and your right to submit observations, consistent with Law 25.

6. How We Share Personal Information

We do not sell your personal information. We share it only as described here:

• Service providers and processors. We share personal information with third parties that perform services for us, each under a written agreement requiring them to protect the information and use it only for the services we entrust to them. These include:
  • AI model providers — to generate Flint's responses;
  • Messaging and infrastructure providers — to deliver SMS and email and host the Service;
  • Payment processors — to bill subscriptions;
  • Booking and travel partners — to search availability and arrange the bookings you request.
• At your direction. We share information as needed to fulfill a request you make — for example, sending a reservation detail to a restaurant or booking partner, or a coordination message to a person you designate.
• Legal and safety reasons. We may disclose personal information where required or permitted by law, to comply with a legal process, to enforce our Terms, or to protect the rights, safety, or property of Flint, our users, or others.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to applicable law and appropriate confidentiality protections.

7. Information About Third Parties You Ask Us to Contact

A core feature of Flint is helping you coordinate with other people. When you provide us with another person's contact information or ask Flint to contact them:

• You represent that you are entitled to share that information and to request the contact.
• We use that person's information only to carry out the coordination you request (for example, to reach them about a plan you are organizing) and to handle any resulting interaction, consistent with CASL and applicable privacy law.
• If that person interacts with Flint, we may collect and process their information as described in this Policy, and they may become a user subject to their own consent.
• Any person can contact our Privacy Officer to ask what information we hold about them, to access or correct it, or to ask us to stop contacting them.

8. Cross-Border Transfer and Storage

Flint is based in Canada. However, some of our service providers — including AI model providers, messaging infrastructure, and booking partners — may store or process personal information outside your province or outside Canada, including in the United States and other jurisdictions. While personal information is in another jurisdiction, it may be subject to the laws of that jurisdiction, including lawful access by courts, law enforcement, and government authorities there.

We take steps to ensure that personal information transferred to a service provider receives a comparable level of protection through contractual and security measures. For Quebec residents, before transferring personal information outside Quebec we conduct the assessments required by Law 25. You may contact our Privacy Officer for more information about our transfer practices and the safeguards we use.

9. Cookies and Website Technologies

Our website getflint.ai may use cookies and similar technologies for essential functionality, and — where you consent — for analytics. Consistent with Law 25, we do not activate non-essential tracking technologies that can identify, locate, or profile you without your prior opt-in consent. You can manage cookie preferences through the tools we provide and through your browser settings.

10. How We Protect Your Information

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including access controls, encryption in transit, and contractual protections with our service providers. No method of transmission or storage is completely secure, but we work to protect your information and to respond appropriately to any incident. Where a confidentiality incident presents a risk of serious injury, we will notify affected individuals and the relevant regulator(s) as required by law, and we maintain a register of such incidents.

11. Retention

We keep personal information only as long as necessary to fulfill the purposes described in this Policy, to provide the Service, and to meet legal, accounting, or reporting requirements. When personal information is no longer required, we securely destroy, delete, or anonymize it. We also retain records of messaging consent as required under CASL.

12. Your Privacy Rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you and be informed about how it is used and disclosed;
• Correct inaccurate or incomplete information;
• Withdraw consent, subject to legal or contractual restrictions;
• Deletion / de-indexing — for Quebec residents, request that we cease disseminating personal information or de-index certain information in the circumstances set out in Law 25;
• Portability — for Quebec residents, request that computerized personal information you provided be communicated to you in a structured, commonly used technological format, as provided under Law 25;
• Complain to us or to the applicable regulator.

To exercise any of these rights, contact our Privacy Officer (Section 1). We will respond within the timeframe required by law (generally within 30 days). We may need to verify your identity before acting on a request.

13. Children

The Service is intended for adults and is not directed to children. We do not knowingly collect personal information from children under the age of majority in their province. For Quebec, we do not collect personal information from a minor under 14 without the consent of a person having parental authority, except where collection is clearly for the minor's benefit as permitted by law. If you believe we have collected a child's information, contact our Privacy Officer.

14. Contacting Us and Filing a Complaint

If you have questions, requests, or complaints about your privacy or this Policy, contact our Privacy Officer at privacy@getflint.ai or the address in Section 1. We will investigate and respond.

If you are not satisfied with our response, you may contact:

• the Office of the Privacy Commissioner of Canada (oversees PIPEDA); and/or
• for Quebec residents, the Commission d'accès à l'information du Québec (oversees Law 25); and/or
• the privacy regulator in your province, where applicable.

15. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new "Last Updated" date and, where required by law, take additional steps to notify you or obtain your consent. Your continued use of the Service after changes take effect constitutes acceptance, except where applicable law requires otherwise.