1. Introduction

Afto Dynamo Technologies Inc. ("Afto", "we", "us", or "our") provides technology and software solutions that help small and medium-sized businesses operate and grow their retail and commerce businesses.

Our products and services may include online storefronts, ordering and checkout experiences, customer engagement tools, loyalty programs, marketing automation, personalized recommendations, customer relationship management ("CRM"), analytics, AI-powered shopping assistants, and other commerce and business automation capabilities (collectively, the "Services").

This Privacy Policy explains how Afto collects, uses, discloses, stores, and protects Personal Information when:

• you visit an Afto website;
• you contact or communicate with Afto;
• you create or use an Afto account;
• you use Afto's products or Services;
• you interact with an online store, restaurant ordering experience, mobile application, AI assistant, loyalty program, marketing communication, or other digital experience powered by Afto; or
• you otherwise interact with Afto.

"Personal Information" means information that identifies, relates to, describes, or can reasonably be associated with an identifiable individual, or information otherwise considered personal data or personal information under applicable privacy laws.

This Privacy Policy should be read together with any applicable terms of service, agreements, or other privacy notices that apply to your relationship with Afto.

Afto currently provides Services to businesses and users primarily in Canada and the United States.

---

Afto may process Personal Information in different capacities depending on how you interact with our Services.

2.1 When you interact directly with Afto

When you visit our website, create an Afto account, communicate with us, request a demonstration, become an Afto customer, or otherwise interact directly with Afto, Afto may act as the organization responsible for determining how and why your Personal Information is processed.

2.2 When Afto provides Services to a merchant or business

Afto provides technology infrastructure to businesses, including grocery stores, restaurants, retailers, and other merchants.

When you interact with a merchant that uses Afto's Services — for example, when you place an order, create an account, participate in a loyalty program, use a shopping assistant, or receive marketing communications — the merchant may determine how your Personal Information is collected and used.

In these circumstances, Afto may process Personal Information on behalf of the merchant as a service provider, processor, or other similar role under applicable privacy law.

If you have questions about how a particular merchant uses your information, you should contact that merchant directly and review the merchant's privacy policy.

---

Depending on your relationship with Afto and how you use the Services, we may collect the following categories of information.

3.1 Information you provide to us

We may collect information that you provide directly, including:

• Name
• Email address
• Telephone or mobile number
• Mailing or business address
• Account credentials
• Business name and business information
• Billing and payment information
• Information provided when requesting a demonstration or contacting our sales team
• Information provided to customer support
• Communications and correspondence with us
• Information submitted through forms on our websites
• Preferences and communication choices

3.2 Merchant and business information

If you use Afto as a merchant or business customer, we may collect information such as:

• Business name and contact information
• Business location information
• Business category
• Store, restaurant, or catalog information
• Product and menu information
• Pricing and promotional information
• Inventory and availability information
• Order and transaction information
• Customer engagement and marketing information
• Configuration and account information
• Information relating to employees or authorized users of the Afto platform

3.3 Shopper and consumer information

When Afto provides technology for a merchant or retailer, we may process information relating to that merchant's customers.

This may include:

• Name
• Email address
• Telephone or mobile number
• Delivery or billing address
• Order history
• Products viewed, searched for, or purchased
• Shopping cart activity
• Wishlist or saved-item activity
• Loyalty program activity
• Coupons, rewards, and offers
• Customer preferences
• Marketing engagement
• Responses to communications
• Interactions with AI shopping assistants or other customer engagement tools
• Device, browser, and technical information
• Information generated from interactions with the merchant's digital properties

Afto generally processes this information to provide Services to the applicable merchant.

3.4 Information collected automatically

When you use our websites or Services, we may automatically collect information such as:

• IP address
• Browser type and version
• Device type
• Operating system
• Device identifiers
• Pages or screens visited
• Referring and exit pages
• Date and time of access
• General location information derived from IP address
• Interactions with websites and applications
• Search and navigation activity
• Performance and diagnostic information

We may collect this information through cookies, pixels, SDKs, logs, tags, and similar technologies.

3.5 Information received from third parties

We may receive information from third parties, including:

• merchants using Afto;
• payment providers;
• point-of-sale systems;
• delivery and fulfillment providers;
• communication providers;
• analytics providers;
• authentication providers;
• advertising and marketing platforms;
• AI and technology providers;
• integration partners; and
• other service providers supporting the Afto Services.

We may combine information received from these sources with information collected directly from you where permitted by applicable law.

---

We use Personal Information for purposes including:

Providing and operating the Services

We use information to:

• create and manage accounts;
• provide online ordering and commerce functionality;
• process and manage transactions;
• provide customer support;
• operate merchant storefronts and applications;
• provide loyalty and rewards functionality;
• provide personalized recommendations;
• operate AI-powered shopping assistants;
• facilitate marketing campaigns;
• provide analytics and reporting;
• maintain and improve our infrastructure; and
• provide other functionality requested by our customers.

Improving our Services

We may use information to:

• understand how our Services are used;
• troubleshoot problems;
• analyze performance;
• improve product functionality;
• develop new features;
• improve personalization and recommendations;
• detect and prevent fraud or abuse;
• maintain security; and
• improve the reliability and performance of our systems.

Communications

We may use contact information to:

• provide transactional communications;
• respond to inquiries;
• provide customer support;
• send service-related notifications;
• provide information about products and Services; and
• send marketing communications where permitted by applicable law.

You may unsubscribe from certain marketing communications at any time.

Legal and compliance purposes

We may process information when necessary to:

• comply with applicable laws and regulations;
• respond to lawful requests from government authorities;
• establish, exercise, or defend legal claims;
• enforce agreements and policies;
• protect the rights, property, and safety of Afto, our customers, users, or others; and
• detect or prevent fraud, security incidents, or other unlawful activity.

---

Afto uses artificial intelligence, machine learning, analytics, and automation technologies as part of certain Services.

Depending on the Services used, Afto may use models and technologies provided by OpenAI, Google Gemini, and open-source AI models, as well as other technology providers that may be introduced from time to time.

These technologies may be used to provide:

• personalized product recommendations;
• customer segmentation;
• AI-powered shopping assistance;
• search and product discovery;
• personalized offers and promotions;
• loyalty recommendations;
• marketing campaign generation;
• customer engagement;
• inventory and business insights; and
• other automated commerce experiences.

For example, Afto may analyze information such as purchase history, browsing activity, search activity, shopping cart activity, loyalty activity, and interactions with merchant services to generate recommendations, insights, or personalized experiences.

Use of information to improve AI and machine-learning systems

Afto may use Personal Information and other data processed through its Services to train, evaluate, improve, and develop AI and machine-learning systems and models, subject to applicable law and the agreements governing our relationship with the applicable merchant.

This may include using information such as interactions, transactions, searches, product engagement, customer preferences, campaign performance, and other Service activity to improve the accuracy, relevance, safety, and performance of Afto's AI-powered functionality.

Where appropriate, Afto may use aggregated, de-identified, or anonymized information for these purposes.

Afto may also provide information to third-party AI providers when necessary to operate AI-powered features. Such providers may process information in accordance with their applicable contractual terms and privacy practices.

Where Afto processes information on behalf of a merchant, the merchant may have rights and controls concerning the processing of its data, including controls over deletion and retention as described below.

Afto does not intend for its AI systems to make decisions that produce legal or similarly significant effects on individuals unless expressly disclosed and permitted under applicable law.

---

We do not sell Personal Information for monetary consideration.

We may disclose Personal Information in the following circumstances.

6.1 To merchants and businesses

When Afto provides Services to a merchant, we may provide the merchant with information necessary to operate its business and provide services to its customers.

For example, a merchant may receive information about orders, customers, loyalty activity, shopping behavior, and marketing engagement occurring through the merchant's Afto-powered experiences.

6.2 Service providers

We may share Personal Information with third-party service providers that help us operate our business and provide the Services.

These providers may include companies providing:

• cloud hosting and infrastructure;
• databases and data storage;
• payment processing;
• analytics;
• security and fraud prevention;
• communications;
• email, SMS, and messaging;
• customer support;
• delivery and fulfillment;
• authentication;
• AI and machine-learning infrastructure;
• monitoring and logging; and
• other technical or operational services.

Our principal cloud infrastructure providers include Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).

Afto's cloud infrastructure may process or store Personal Information in the United States East region.

Our service providers are permitted to process information only as necessary to provide services to us or our customers and subject to applicable contractual and legal requirements.

6.3 Analytics and advertising providers

Afto uses third-party analytics and advertising technologies, including:

• Google Analytics 4 (GA4); and
• Meta Pixel.

These technologies may collect information about how users interact with our websites and Services, including information about devices, pages visited, interactions, and other usage information.

These providers may use cookies, pixels, or similar technologies in accordance with their own privacy policies and applicable law.

6.4 Business transfers

If Afto is involved in a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or other corporate transaction, Personal Information may be transferred as part of that transaction, subject to applicable law.

6.5 Legal requirements

We may disclose Personal Information where we believe disclosure is reasonably necessary to:

• comply with applicable law;
• respond to a valid legal process;
• comply with a court order or government request;
• protect the safety of an individual;
• investigate fraud or security incidents; or
• protect Afto's rights or property.

---

Afto integrates with third-party services and platforms to provide certain functionality.

Depending on the Services used by a merchant, these may include payment processors, point-of-sale systems, delivery providers, communication platforms, analytics services, cloud infrastructure providers, AI technology providers, and other business systems.

Our AI functionality may use technologies provided by OpenAI, Google Gemini, and open-source AI models. The particular AI technology used may vary based on the feature, merchant configuration, technical requirements, availability, performance, cost, and other considerations.

When you interact with a third-party service, that third party may collect and process information under its own privacy policy and terms.

Afto does not control the privacy practices of third parties that operate independently of Afto.

---

Afto and our service providers may use cookies, pixels, SDKs, local storage, tags, logs, and similar technologies.

These technologies may be used to:

• operate our websites and Services;
• remember preferences;
• authenticate users;
• understand how visitors use our websites;
• measure marketing and advertising effectiveness;
• maintain security;
• diagnose technical problems; and
• improve our Services.

Afto uses technologies including Google Analytics 4 (GA4) and Meta Pixel for analytics, measurement, and advertising-related purposes.

You may be able to control cookies through your browser settings or other tools provided by Afto.

Some cookies may be necessary for the operation of our Services and cannot be disabled without affecting functionality.

For more information about the cookies and similar technologies used by Afto, please see our Cookie Policy.

---

Afto may send marketing communications to individuals with whom we have a direct relationship where permitted by applicable law.

You can unsubscribe from marketing emails by using the unsubscribe mechanism contained in the communication.

If you receive marketing communications from a merchant using Afto, those communications are generally sent on behalf of or at the direction of that merchant. In that situation, you should contact the merchant directly regarding its marketing practices or communication preferences.

For SMS, WhatsApp, or other messaging channels, additional consent and opt-out requirements may apply.

---

Afto generally retains Personal Information for one (1) year unless a longer period is required or permitted by applicable law, contractual obligations, or legitimate business requirements.

We retain information as necessary to:

• provide the Services;
• maintain business and transaction records;
• comply with legal and regulatory requirements;
• resolve disputes;
• enforce agreements;
• protect our systems and users; and
• improve our products and Services.

After the applicable retention period, Afto may delete, anonymize, or otherwise securely dispose of Personal Information.

Merchant-controlled retention and deletion

Merchants using Afto's Services may have the ability to configure the retention and deletion of shopper and customer information processed through their Afto-powered experiences.

Where a merchant requests deletion of customer information, Afto will process that request in accordance with the merchant's configuration, contractual requirements, and applicable law.

Where Afto processes information on behalf of a merchant, the merchant may determine the applicable retention period, subject to the capabilities of the Afto platform and applicable legal requirements.

---

Afto is a Canadian company serving businesses and users in Canada and the United States.

Afto's infrastructure and third-party service providers may process or store Personal Information in the United States, including in US East regions operated by Microsoft Azure, Amazon Web Services, and Google Cloud Platform.

As a result, Personal Information may be processed or stored outside the province, state, or country in which you live.

When Personal Information is transferred across borders, we take reasonable steps designed to ensure that the information receives appropriate protection consistent with applicable privacy laws.

---

Afto takes reasonable technical, administrative, and organizational measures designed to protect Personal Information against unauthorized access, use, alteration, disclosure, loss, or destruction.

Our security measures may include access controls, authentication mechanisms, encryption where appropriate, monitoring, logging, infrastructure security, and other safeguards appropriate to the nature of the information and the Services.

However, no method of transmission over the Internet or electronic storage system is completely secure. We therefore cannot guarantee absolute security of Personal Information.

---

Depending on where you live and subject to applicable law, you may have rights regarding your Personal Information, including the right to:

• request access to Personal Information we hold about you;
• request correction of inaccurate or incomplete information;
• request deletion of your Personal Information;
• request portability of certain information;
• object to or restrict certain processing;
• withdraw consent where processing is based on consent; and
• opt out of certain marketing communications.

These rights may be subject to exceptions and limitations under applicable law.

If Afto processes your Personal Information on behalf of a merchant, you may need to submit your request directly to that merchant. We may assist the merchant in responding to your request where appropriate.

We may need to verify your identity before fulfilling a privacy request.

---

Afto is a Canadian company and seeks to comply with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

Depending on where you live and how Afto processes your information, you may have rights to access and request correction of Personal Information held about you.

You may also have the right to withdraw consent to certain uses of your Personal Information, subject to legal or contractual restrictions and reasonable notice.

If you have concerns about how Afto handles your Personal Information, we encourage you to contact us first so that we can investigate and attempt to resolve your concern.

---

Afto currently provides Services to businesses and users in the United States.

Depending on where you live and applicable law, you may have rights regarding your Personal Information, including rights to access, correct, delete, or obtain a copy of certain Personal Information and rights relating to certain forms of processing.

Afto does not sell Personal Information for monetary consideration.

Where applicable law provides additional rights, Afto will provide the applicable mechanisms required to exercise those rights.

If you interact with a merchant using Afto's Services, the merchant may be responsible for responding to requests relating to Personal Information that Afto processes on the merchant's behalf.

---

Afto's Services are not directed to children under the age required by applicable law to provide consent to the processing of their Personal Information.

We do not knowingly collect Personal Information directly from children in circumstances where such collection is prohibited by law.

If you believe that a child has provided Personal Information to Afto in violation of applicable law, please contact us so that we can investigate and take appropriate action.

---

Our websites and Services may contain links to websites, applications, or services operated by third parties.

Afto is not responsible for the privacy, security, or content practices of third parties.

We encourage you to review the privacy policies of third-party services before providing them with Personal Information.

---

We may update this Privacy Policy from time to time to reflect changes to our Services, technology, business practices, legal requirements, or privacy practices.

When we make material changes, we may provide notice through our website, Services, email, or other appropriate communication channels.

The "Last Updated" date at the top of this Privacy Policy indicates when this Privacy Policy was most recently revised.

---

If you have questions about this Privacy Policy, want to exercise your privacy rights, or have concerns about how Afto processes Personal Information, please contact us:

Afto Dynamo Technologies Inc.

Attn: Privacy Officer

Email: privacy\@getafto.com

Website:[ www.getafto.com](http://www.getafto.com/)

If your question concerns Personal Information collected by a particular merchant using Afto, please contact that merchant directly.

We will make reasonable efforts to respond to privacy requests within the time required by applicable law.

---

If you are a business using Afto's Services, you are responsible for determining the purposes and means of processing Personal Information collected from your customers, employees, or other individuals through your use of the Services, except where Afto independently determines the purposes of processing.

Afto does not currently provide a separate Data Processing Addendum (DPA) to merchants. The parties' applicable agreement, this Privacy Policy, and applicable law govern Afto's processing of Personal Information.

As a merchant, you are responsible for:

• providing appropriate privacy notices to your customers;
• obtaining consents where required;
• ensuring that your use of Afto's Services complies with applicable privacy laws;
• responding to applicable customer privacy requests;
• configuring marketing and communication preferences appropriately;
• configuring available data retention and deletion settings;
• ensuring that Personal Information provided to Afto may lawfully be processed for the purposes described in your agreement with Afto; and
• ensuring that your use of Afto's AI, personalization, marketing, and customer engagement features complies with applicable law.

Afto provides technology and tools intended to help merchants manage their customer relationships and commerce operations, but use of those tools does not relieve merchants of their own legal privacy obligations.

---

For all privacy-related inquiries, requests, or concerns, please contact:

Afto Dynamo Technologies Inc.

Privacy Officer

Email: privacy\@getafto.com

Website:[ www.getafto.com](http://www.getafto.com/)

Last Updated: Aug 12, 2026