Wevenda — Privacy Policy

Version 1.1
Effective date: September 30, 2026
Last updated: September 30, 2026

---

1. Our commitment

Climbware Corporation and its affiliates, subsidiaries, divisions and brands (“Wevenda”, “we”, “us”, “our”) respect your privacy and are committed to maintaining the privacy, accuracy and security of your Personal Information in accordance with applicable privacy legislation — including the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation — and best industry practices.

“Personal Information” means information about you as an identifiable individual that is protected by applicable privacy legislation.

This Privacy Policy explains what we collect, why, how we use and disclose it, how long we keep it, and the choices available to you. It applies to the Wevenda website, mobile applications and related services (the “Wevenda Services”).

In this Policy, “you” and “your” mean any individual who uses the Wevenda Services, whether as a Client, a Vendor, or a visitor.

This Policy forms part of, and should be read with, our Terms of Service.

2. Accountability and our Privacy Officer

We train our personnel to handle Personal Information properly and have designated a Privacy Officer who is accountable for compliance with this Policy.

Privacy Officer, Climbware Corporation
privacy@wevenda.com
Ontario, Canada

We remain responsible for Personal Information transferred to a third party for processing, and we use contractual and other means to require a comparable level of protection.

3. Personal Information we collect

We collect information only by lawful and fair means, and not in an unreasonable or obtrusive way. We limit collection to what is necessary for the purposes identified in this Policy.

3.1 Information you provide

If we add features that collect other information — for example reviews, ratings, attachments or verification documents — we will update this Policy before they do.

We ask you not to include sensitive personal information — such as health information, government identification numbers, financial account details, or information about other people — in free-text fields, request descriptions, or messages. Information you volunteer there is collected as part of that content.

3.2 Payment information

Payment card details are collected and processed directly by our payment processor, Stripe, and are stored and handled solely by Stripe under the Stripe privacy policy. We do not collect, see, receive or store your full card number or security code. We receive limited transaction information such as a payment identifier, the last four digits of the card, card brand, expiry, billing postal code, transaction amount, currency, tax applied and success or failure status.

3.3 Information collected automatically

3.4 Information from others

• Sign-in verification. When you sign in, Google (Firebase Authentication) sends a one-time code to your phone by SMS and confirms it to us.
• Other users. Information another user provides about you, such as a review or a report.
• Advertising platforms. If you reach us through an advertisement, we may receive aggregated or pseudonymous information about that interaction.
• Public and third-party sources. Publicly available business information, licensing registries and similar sources, where lawful.

4. Why we collect, use and disclose Personal Information

We use Personal Information for the following purposes:

To provide the Wevenda Services

• create, identify, authenticate and maintain your account;
• publish your service request to matching Vendors;
• disclose Client contact information to a Vendor when that Vendor opens a paid connection (see §5.1 — this is a core function of the service);
• deliver messages between users and deliver notifications;
• process Credit purchases, calculate and remit applicable taxes, issue refunds, and maintain the credit ledger;
• provide customer support and respond to your requests.

To keep the platform safe and honest

• screen, filter, scan, redact and moderate content using automated systems (see §6);
• detect, investigate and prevent fraud, abuse, spam, collusion, fee circumvention, fake requests, multi-accounting and other prohibited conduct;
• verify identity, business registration, and information you provide;
• investigate complaints, disputes and reports, and enforce our Terms of Service;
• protect the security, integrity and availability of the Wevenda Services and the rights, property and safety of Wevenda, our users and the public.

To operate and improve our business

• analyse how the Wevenda Services are used, measure performance, diagnose errors and develop new features;
• understand which service categories and geographic areas have unmet demand, so we can decide where to expand;
• measure the effectiveness of our advertising and marketing.

To communicate with you

• send service and transactional messages (account, security, billing, connection and request notifications) — these are not marketing and you cannot opt out of them while you hold an account;
• send marketing communications where you have consented, with an unsubscribe mechanism in every message (see §8).

To comply with law

• satisfy applicable legal, regulatory, tax and accounting requirements;
• respond to lawful requests from law enforcement, regulators, courts and tribunals;
• establish, exercise or defend legal claims;
• keep a record of your acceptance of our Terms of Service and this Policy — the version and a fingerprint of the text you accepted, when you accepted it, your account and phone number at that time, your IP address, and your browser or device and app version — as evidence of the agreement between us.

Any other purpose you consent to, or that is permitted or required by law.

5. When we disclose Personal Information

We do not sell your Personal Information.

5.1 To other users — the core mechanic

The Wevenda Services are designed so that Clients and Vendors are anonymous to each other until a Vendor pays to open a connection. This is symmetric: Clients are anonymous to Vendors, and Vendors are anonymous to Clients.

Before a connection is opened, each party is shown only a neutral alias.

Withheld until a connection is opened. The following are stored in records that only you (and we) can access, and are released to the other party only when a Vendor pays to open a connection:

• your phone number, email address and website;
• the street address and exact location of your service request. Vendors are shown only an approximate location, accurate to roughly one kilometre, and an approximate distance.

Not displayed until a connection is opened. The following are not displayed to the other party in the Wevenda Services before a connection is opened:

• your real name, and any business or trade name;
• your avatar, profile photograph or business logo;
• images, photographs, documents and other attachments.

These are hidden in the app's interface, but they are stored in records other signed-in users' devices can technically retrieve, and profile photographs and logos are stored at web addresses that are not access-restricted. Treat them as not secret.

Contact information detected in the text of a request or message is automatically removed or altered before it is shown to the other party. Non-identifying information — such as approximate location and distance, service category and activity on a request — may be shown so each party can make an informed choice.

Only a Vendor can open a connection, and only by paying the Lead Access Fee. A Client may send a Vendor a request to connect; that request is informational only and discloses nothing.

When a Vendor opens a paid connection, your information is disclosed to that Vendor (and the Vendor's to you) — including name, avatar or logo, images and documents, phone number, email address, website, and the street address and exact location of the request. By posting a service request you consent to this disclosure.

There is no limit on the number of Vendors who may connect to your request. Each Vendor who connects receives your contact information. You choose which Vendors to respond to, you are under no obligation to respond to any of them, and you may close or remove your request at any time.

Once disclosed, we cannot control, restrict or retrieve what a Vendor does with your information. Our Terms of Service prohibit Vendors from using it for any purpose other than responding to your request, and prohibit adding you to any marketing list without your separate consent — but that is a contractual obligation on them, not a technical control by us. If a Vendor misuses your information, please report it to privacy@wevenda.com.

These protections are privacy and anti-circumvention features, not security guarantees. Automated detection is imperfect, another user may identify you from information you yourself provide or from the circumstances of a request, and we do not warrant that your identity, image or contact details cannot be discovered. See our Terms of Service.

Information you choose to include in a public service request, public profile or review is visible to other users. Do not include anything — in text, images or attachments — that you would not want disclosed.

5.2 To service providers

We disclose Personal Information to service providers who help operate our business, bound by contract to use it only for the purposes we specify:

5.3 In other circumstances

We may also disclose Personal Information:

• where necessary to protect the safety, property, rights or security of Wevenda, our users or the public;
• to professional advisors (lawyers, accountants, auditors, insurers) under confidentiality;
• in connection with a prospective or completed financing, merger, acquisition, reorganization or sale of assets — in which case Personal Information may be among the assets transferred, subject to this Policy continuing to apply;
• where the information is publicly available;
• where it is impossible or impractical to seek consent;
• where required by law, subpoena, warrant, court or tribunal order, or regulatory authority;
• where we believe on reasonable grounds there is an imminent risk of death or serious bodily harm to an identifiable person or group;
• where necessary to collect a debt owing to us;
• for any other purpose permitted or required by law.

We may also share aggregated or de-identified information that cannot reasonably identify you — for example, the number of requests posted in a postal area, or category demand statistics — with partners, advertisers, investors and the public. We do not attempt to re-identify de-identified information.

6. Automated processing and artificial intelligence

You should know that some processing of your information is automated.

Content moderation. Service requests and messages are automatically screened before or shortly after publication. This screening may:

• redact contact details and other identifiers;
• flag content for human review;
• withhold, delay or block content;
• contribute to a decision to restrict or suspend an account.

This screening is rule-based: it runs on our own servers and checks content against patterns (for example, the shapes of phone numbers, email addresses and web links). Your content is not currently sent to any third-party artificial-intelligence provider. If we add an AI-based screening or assistance feature, we will update this Policy — naming the provider, where it processes data, and whether it retains or trains on your content — before that feature processes your information.

Fraud and abuse detection. We use automated signals — including device characteristics, usage patterns, payment signals and relationships between accounts — to detect fraud, collusion and prohibited conduct. This may result in automatic restrictions.

Matching. Requests are matched to Vendors automatically based on service category and geography.

Your rights. Automated moderation is imperfect. If an automated decision affects you and you believe it is wrong, you may request human review by contacting privacy@wevenda.com, and we will review it.

We do not use your Personal Information to train our own general-purpose artificial-intelligence models.

7. Cookies and similar technologies

Cookies are small text files transferred from our websites and stored on your device. We and our service providers use cookies, local storage, software development kits, device identifiers and similar technologies to:

• keep you signed in and maintain your session;
• remember preferences;
• keep the service secure and detect fraud;
• understand how the service is used and measure performance.

We do not currently use advertising or analytics cookies or tracking pixels. If we introduce them, we will update this section first, naming them, what they collect and how to opt out.

Managing them. Most browsers let you refuse or delete cookies through their settings. On mobile, you can reset or limit advertising identifiers in your device privacy settings. If you disable or refuse cookies, you may not be able to sign in or use many features of the Wevenda Services.

8. Marketing communications and CASL

Canada's Anti-Spam Legislation (CASL) governs commercial electronic messages. We comply with it.

• We send marketing emails and messages only where you have given consent, or where an exemption under CASL applies.
• Consent is never pre-checked, never bundled into acceptance of our Terms of Service, and never a condition of creating an account.
• Every marketing message identifies us, includes our mailing address, and contains a working unsubscribe mechanism that we honour promptly and in any event within 10 business days.
• We keep records of the consent you gave, including its wording and the date and time.

Transactional and service messages — such as security alerts, billing receipts, notification of a new message, or notice that a Vendor has connected to your request — are necessary to provide the service and are sent regardless of marketing preferences.

To change marketing preferences, use the unsubscribe link in any message, adjust your in-app notification settings, or contact privacy@wevenda.com.

9. Consent

By submitting Personal Information to us, you agree that we may collect, use and disclose it in accordance with this Policy and as permitted or required by law.

We obtain consent appropriate to the sensitivity of the information. In most cases, consent is express — given when you create an account, post a request, or check a consent box. In some cases, consent may reasonably be implied, such as when you send us an email and we use your address to reply.

Withdrawing consent. Subject to legal, regulatory and contractual requirements, you may refuse or withdraw consent at any time by written notice to privacy@wevenda.com. We will explain the consequences. If you withdraw consent to collection or use that is necessary to provide the Wevenda Services, you will not be able to continue using them. We will act on your instructions as quickly as possible, but some uses cannot be stopped immediately, and withdrawal does not apply retroactively — information already disclosed to a Vendor through a paid connection cannot be recalled.

10. Your rights: access, correction and deletion

10.1 Access and correction

You have the right to request access to the Personal Information we hold about you, to be informed of its existence, use and disclosure, and to have inaccurate information corrected. Much of it is directly viewable and editable in your account settings.

Send written requests to privacy@wevenda.com. We will respond within 30 days as required by PIPEDA, or tell you if we need an extension and why. We may require verification of your identity. Detailed requests requiring archival retrieval may be subject to a reasonable cost, of which we will notify you in advance.

Access may be denied where:

• denial is required or authorized by law;
• the information relates to existing or anticipated legal proceedings against the individual;
• granting access would reveal Personal Information about another person, or would have an unreasonable impact on another person's privacy;
• the information is subject to solicitor-client or litigation privilege;
• disclosure would reveal confidential commercial information, or compromise fraud detection, security or an investigation;
• the request is frivolous or vexatious.

If we deny a request in whole or in part, we will explain why.

10.2 Deleting your account

You may delete your account at any time in the app, under Settings → Privacy & Security → Delete account, or by contacting support@wevenda.com. Instructions are also at wevenda.com/delete-account/.

What deletion does and does not do:

• Your sign-in account is deleted, together with your contact details, device notification tokens, notifications, profile photo and store logo. Your profile and store are replaced by a placeholder with no name or photo, so the other party's conversations still display, and your open requests are withdrawn.
• Your conversations are closed: no new messages can be sent in them.
• We retain certain information after deletion where required by law or for legitimate business purposes — including transaction and tax records, credit ledger entries, fraud and abuse records, records of banned accounts, records of your acceptance of our Terms of Service and this Policy, and records needed to establish or defend legal claims. See §12.
• Information already disclosed to a Vendor through a paid connection cannot be recalled. That Vendor holds it independently and remains subject to their own legal obligations.
• Messages you sent may remain visible to the other party to the conversation.
• De-identified and aggregated information is not deleted, because it can no longer be associated with you.
• Unspent Credits are handled under the Terms of Service. Credit purchases are non-refundable, so closing your account does not entitle you to a refund of unspent Credits. Any unspent balance is forfeited when the account is deleted.
• If you later sign in with the same phone number, you start a new, empty account. We keep a one-way, keyed code derived from the number (not the number itself) so that a suspension or a one-time promotion cannot be reset by deleting and re-registering.

11. Where your information is stored and processed

Your Personal Information is stored and processed in the United States. Our database, file storage and server functions are hosted by Google Cloud / Firebase in the United States, and our payment, mapping and notification providers also process data there. Some service providers may also process information in other countries where they operate.

This means your information may be subject to the laws of those jurisdictions and may be accessible to their courts, law enforcement and national security authorities under the laws of those jurisdictions, which differ from Canadian law. This is a requirement of PIPEDA transparency, not a waiver of your rights.

We use contractual and other means to require comparable protection from our service providers, and we remain accountable for information transferred for processing.

12. How long we keep information

We retain Personal Information only as long as reasonably necessary for the purposes identified in this Policy, or as required by law. Our retention periods are:

We may retain information longer where required by law or necessary to establish, exercise or defend legal claims. Once no longer needed, Personal Information is destroyed, erased or de-identified.

13. Safeguarding Personal Information

The security of your Personal Information is one of our top priorities. We have implemented administrative, technical and physical safeguards appropriate to its sensitivity, including:

• encryption of data in transit (TLS) and at rest;
• authentication and access controls, with access on a need-to-know basis;
• server-side authorization rules restricting what each account can read or write, including rules that reject phone numbers, email addresses and websites from being written to publicly readable profile records at all — real contact values are held in owner-only records and released to a counterparty only after a connection is paid for;
• storing the street address and exact location of a service request in an owner-only record, and publishing only an approximate (roughly one-kilometre) location, until a paid connection;
• hiding names, avatars, logos, images and documents in the app, and automated redaction of contact information in text, prior to a paid connection;
• logging and monitoring;
• vendor due diligence and contractual protections.

These measures reduce risk; they do not eliminate it. In particular, the anonymity measures described in §5.1 are privacy and anti-circumvention features rather than security guarantees — automated detection is imperfect, and identifying information you volunteer in the text, images or circumstances of a request may reveal who you are regardless.

While we do our very best to protect your Personal Information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for protecting your own credentials: use a strong, unique password, do not share it, and sign out at the end of each session. Notify us immediately at support@wevenda.com if you suspect unauthorized access.

Breach notification. If a breach of security safeguards occurs that creates a real risk of significant harm to you, we will report it to the Privacy Commissioner of Canada and notify you as soon as feasible, as required by PIPEDA, and maintain records of breaches as required.

14. Children

The Wevenda Services are not directed to anyone under 18 and we do not knowingly collect Personal Information from anyone under 18. If we learn we have, we will delete it promptly. If you believe a person under 18 has provided us information, contact privacy@wevenda.com.

15. Third-party links and services

The Wevenda Services may contain links to, or integrate with, websites and services operated by others. We are not responsible for the content, privacy practices or security of any third party, and inclusion of a link is not an endorsement. We encourage you to review the privacy policy of any third party you interact with, including:

• Stripe — stripe.com/privacy
• Google / Firebase — policies.google.com/privacy
• Apple — apple.com/legal/privacy

16. Openness

We are committed to providing understandable and readily available information about our policies and practices relating to the management of Personal Information.

17. Changes to this Policy

From time to time we may change this Policy. We will post the updated version with a revised "Last updated" date, and for significant changes we will provide notice by email or in-app notice before the change takes effect. Please review this Policy periodically. Your continued use after a change takes effect constitutes acceptance, except where applicable law requires fresh consent, in which case we will obtain it.

18. Questions, requests and complaints

For questions, to exercise your rights, or to make a complaint:

Privacy Officer, Climbware Corporation
privacy@wevenda.com
Ontario, Canada

We will respond in a timely manner and in any event within the period required by applicable law.

If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada:

• priv.gc.ca
• 1-800-282-1376
• 30 Victoria Street, Gatineau, Quebec, K1A 1H3

You may also have the right to complain to the privacy regulator in your province.