Max Portal Subscription Agreement

Version 1.1 · Effective date: November 4, 2026

Version 1.1. This Agreement governs every Max Portal subscription bought on or after the effective date shown where it is published at maxportal.ca.

Accepting this Agreement

You accept this Agreement by ticking the acceptance box and completing your purchase on maxportal.ca, or by signing an order that refers to it. No separate signature is needed. If you accept on behalf of a firm or other organisation:

• that organisation is the "Customer";
• you confirm that you have the authority to bind it.

If you do not agree, do not tick the box or use the Service.

Who can subscribe. The Service is offered only to businesses and professional firms located in Canada, outside the Province of Quebec. It is not offered to consumers for personal use. By accepting, you confirm that your firm meets these conditions.

Cosmic Road keeps a record of each acceptance: the version accepted, the date and time, the account and the person who accepted. A copy of this Agreement and your order is emailed to the account owner after purchase.

1. Parties and structure

1.1 Parties. This Max Portal Subscription Agreement (the "Agreement") is between Cosmic Road Ltd., a Canadian corporation based in British Columbia ("Cosmic Road", "we", "us"), and the Customer ("you"). Max Portal is the software service Cosmic Road provides.

1.2 Billing agent and support. Team Evo Integrated Solutions Ltd., a Canadian corporation affiliated with Cosmic Road ("Team Evo"), may:

• collect fees and issue invoices and receipts as Cosmic Road's billing agent, so charges may appear on statements under the Team Evo name;
• provide onboarding, data migration and support on Cosmic Road's behalf.

Payment to Team Evo is payment to Cosmic Road. Cosmic Road remains responsible to you for everything Team Evo does under this Agreement.

1.3 What makes up the Agreement. The Agreement consists of:

1. these terms;
2. your order (Schedule A);
3. the Service Levels (Schedule B);
4. the Data Processing Addendum (Schedule C).

If they conflict, this order applies: Schedule C for anything about Personal Information, then your order for its commercial details (plan, Modules, price, billing cycle), then these terms, then Schedule B.

1.4 Affiliates. A Customer affiliate may use the Service under your account only with Cosmic Road's written agreement. You are responsible for its use as if it were your own.

2. Definitions

3. Subscription and licence

3.1 What you get. While your fees are paid, Cosmic Road gives you a non-exclusive, non-transferable right to access and use the Service for your internal business purposes, within your plan's limits and the Modules in your order.

3.2 What you do not get. The Service is subscribed to, not sold. Cosmic Road and its licensors keep all ownership of the Service, including:

• its software, source code, design and databases (excluding Customer Data);
• the Documentation;
• every improvement or customisation, even one you requested or paid for.

No source code is delivered.

3.3 Plan limits. Each plan has limits on staff logins, active customers and SMS messages per month, shown when you buy. An active customer is a customer record you have not archived. If you go over a limit, Cosmic Road will tell you. You may then move to a larger plan or buy an add-on pack. If you do neither within 30 days, Cosmic Road may move you to the next plan up from your next billing date.

3.4 Restrictions. You must not, and must not let anyone else:

1. copy, modify, translate or create derivative works of the Service;
2. reverse engineer or decompile it, or try to obtain its source code, except where the law expressly allows it despite this clause;
3. resell, sublicense or rent the Service, or offer it to others as a bureau or white-label service;
4. share a login, or let anyone use another Authorised User's login;
5. use the Service to build a competing product, or publish benchmarks of it without written consent;
6. probe, scan or test the Service's security, or bypass any access or usage control, without written consent;
7. remove proprietary notices or branding from the Service.

3.5 Changes to the Service. Cosmic Road may improve and change the Service. It will not materially reduce the core functionality of a plan or Module you have paid for during your current Subscription Term. It announces material changes at least 30 days ahead.

3.6 Early-access features. Features marked beta, preview or early access are optional and provided as-is. They may change or be withdrawn, and Schedule B does not apply to them.

4. Customer responsibilities and acceptable use

4.1 Accounts. You are responsible for everything done under your account. You must:

• keep passwords confidential;
• turn on multi-factor authentication for every Authorised User who can access Sensitive Personal Information;
• remove a person's access promptly when they leave.

4.2 Lawful collection. You collect Personal Information from your own clients, and you are responsible for:

1. having a lawful purpose and the consent or other authority Privacy Law requires;
2. telling your clients, in your own privacy notice, that you use a cloud service provider to store their information;
3. collecting a Social Insurance Number only where the law requires or allows it for that purpose, such as tax filing;
4. answering your clients' requests to access or correct their information. Cosmic Road helps as set out in Schedule C.

4.3 Client Portal Users. You decide who receives a client portal login, and you are responsible for verifying that person's identity before you send it.

4.4 Acceptable use. You must not use the Service to:

1. break any law, including Privacy Law, Canada's Anti-Spam Legislation (CASL) and telemarketing rules;
2. send messages to people who have not consented to receive them;
3. store or send malware, or content that is unlawful, defamatory or infringing;
4. store payment card numbers outside the payment fields designed for them;
5. store health records regulated by health-information law, unless Cosmic Road agrees in writing;
6. overload the Service, or use automated access beyond the published limits.

4.5 Your own systems. You are responsible for your own devices, internet access, email domain settings and any third-party accounts you connect to the Service.

5. Fees, billing and taxes

5.1 Fees. You pay the fees shown in your order. Fees are in Canadian dollars, per firm, and exclude GST/HST and any other sales tax, which is added at the rate for your province.

5.2 Billing cycle. Fees are charged in advance, automatically, to the card or bank account you provide:

• Yearly plans: once a year, paid up front, at 20% less than twelve monthly payments.
• Monthly plans: once a month.

You authorise these recurring charges until you cancel under section 6.

5.3 Training, customization and data migration. Yearly plans include 5 hours of training, customization and data migration at no extra charge. On monthly plans these are optional one-time purchases: $250 for 5 hours of training, and $750 for customization and data migration. Data migration means moving your data from your existing system, within the scope agreed at onboarding.

5.4 Add-on packs. SMS messages above your plan's monthly allowance are sold in packs of 500 messages a month, for $6 per pack per month. Unused messages do not carry over to the next month. On the Team and Pro plans, room for more active customers is sold in packs of 100 customers, for $15 per pack per month.

5.5 First-time offer. If your order includes the first-time offer:

1. on a yearly plan, your first year costs 30% less than twelve monthly payments, in place of the 20% in section 5.2. From your first renewal you pay the yearly price in your order;
2. on a monthly plan, your first monthly payment is 10% less. From your second month you pay the full monthly price in your order.

The offer does not apply to add-on packs or one-time purchases.

5.6 Price changes. Cosmic Road may change fees with effect from your next renewal. It gives at least 60 days' notice by email, and never changes fees during a paid term.

5.7 Failed payments and late payment. If a charge fails, Cosmic Road will retry it and email you. Overdue amounts bear interest at 1.5% per month (19.56% per year), or the highest rate the law allows if that is lower. Section 15 covers suspension for non-payment.

5.8 Disputed charges. Raise any good-faith dispute in writing within 30 days of the charge. Cosmic Road will not suspend the Service over an amount disputed this way while both parties work to resolve it.

5.9 Refunds. Fees already paid are non-refundable. The exceptions: you end this Agreement because of Cosmic Road's uncured breach (section 6.4), or Cosmic Road discontinues the Service. In those cases, Cosmic Road refunds the prepaid fees for the unused part of the term.

6. Term, renewal, cancellation and exit

6.1 Start. This Agreement starts when you accept it and continues until your subscription ends.

6.2 Automatic renewal. Your subscription renews automatically for the same period (one month or one year) at the end of each Subscription Term. For yearly plans, Cosmic Road emails a reminder at least 30 days before renewal.

6.3 Cancelling. You may cancel at any time from your account's billing page or by emailing [email protected]. Cancellation takes effect at the end of the current Subscription Term, and you keep access until then.

6.4 Termination for breach. Either party may end this Agreement by written notice if the other materially breaches it and does not fix the breach within 30 days of being told about it in writing. Unpaid fees are covered by section 15.

6.5 Termination for insolvency. Either party may end this Agreement immediately if the other becomes bankrupt or insolvent, makes an assignment for the benefit of creditors, or has a receiver appointed.

6.6 When it ends.

1. Your right to use the Service stops.
2. You pay all fees owed up to the end date.
3. Each party returns or destroys the other's Confidential Information, except as section 6.7 and Schedule C allow.

6.7 Your data at exit.

Cosmic Road keeps Customer Data longer only where the law requires it, and only for that purpose.

6.8 Surviving terms. Sections 5 (for amounts owed), 6.6 to 6.8, 7, 10, 11, 13, 14 and 18 continue after this Agreement ends.

7. Customer Data and privacy

7.1 You own your data. As between the parties, you own all Customer Data. Cosmic Road acts only as your service provider and processes Customer Data on your behalf. You stay accountable for that information under Privacy Law, and Cosmic Road carries the safeguarding obligations of Schedule C.

7.2 Purpose limit. Cosmic Road uses Customer Data only to provide, secure, support and improve the Service for you, and as the law requires. Cosmic Road will not:

1. sell, rent or trade Customer Data;
2. use it for advertising, or to market to your clients;
3. use it to train artificial-intelligence models that serve other customers;
4. look at it, except to give support you asked for, to keep the Service secure, or as the law requires.

7.3 Usage information. Cosmic Road collects technical and usage data about how the Service runs, such as logins, feature use and performance. It may use that data, aggregated and de-identified so no customer or individual can be identified, to operate and improve the Service.

7.4 Hosting in Canada. Cosmic Road stores Customer Data, including backups, in data centres in Canada. SMS and email delivery providers handle a message's content and recipient while delivering it, and may do so outside Canada. Schedule C says where each Sub-processor processes data.

7.5 Sensitive Personal Information. Because the Service stores Sensitive Personal Information, Cosmic Road will:

1. encrypt Customer Data in transit and at rest;
2. additionally encrypt Social Insurance Numbers and similar identifiers at the field level, and show them masked by default;
3. limit its own staff's access to named personnel with a need to know, using multi-factor authentication, with every access logged.

7.6 Legal demands. If a court, regulator or police force demands Customer Data from Cosmic Road, Cosmic Road will:

• refer the requester to you where possible;
• tell you promptly, unless the law forbids it;
• disclose only the minimum legally required.

7.7 Your clients' requests. If one of your clients asks Cosmic Road to access, correct or delete their information, Cosmic Road will pass the request to you within five business days and will not answer it directly.

8. Security and breach notification

8.1 Security programme. Cosmic Road keeps administrative, technical and physical safeguards suited to the sensitivity of Customer Data. The minimum safeguards are in Schedule C, Part 3, and Cosmic Road will not reduce them during your Subscription Term.

8.2 Notice of a Security Incident. Cosmic Road will tell you about a Security Incident without undue delay, and no later than 72 hours after confirming it. The notice will say, as far as then known:

1. what happened and when;
2. which kinds of Customer Data were involved, and roughly how many individuals;
3. what Cosmic Road has done to contain it;
4. who to contact.

Cosmic Road will update you as it learns more.

8.3 Who notifies regulators and individuals. As the organisation in control of the information, you decide whether a Security Incident creates a real risk of significant harm. You then notify the Privacy Commissioner and affected individuals where Privacy Law requires it. Cosmic Road will:

• give you the facts and help you need to decide and to notify;
• keep its own record of the incident for at least 24 months;
• not notify your clients directly, unless you agree or the law requires it.

8.4 Costs. If a Security Incident is caused by Cosmic Road's breach of this Agreement, Cosmic Road pays the reasonable costs of notifying affected individuals. Where appropriate, it also pays for 12 months of credit monitoring for them. Section 14 applies.

8.5 Certifications. Cosmic Road does not currently hold SOC 2 or ISO 27001 certification. If it obtains one, it will provide a summary report on request, under confidentiality.

9. Service levels and support

9.1 Availability and support. Cosmic Road provides the Service and support to the levels in Schedule B. Service credits under Schedule B are your only financial remedy for missed service levels. Your termination right in Schedule B, and any claim for a separate breach, are not affected.

9.2 Updates. Cosmic Road updates the Service centrally. Every customer receives the same releases, with no upgrade fees for your plan and Modules.

9.3 Onboarding. Setup and data migration are scoped with you at onboarding. You provide your source data and a contact person on the dates agreed.

9.4 Not included. Unless agreed in writing, your subscription does not include:

• custom development;
• your own IT support;
• training beyond the included onboarding;
• correcting your data at its source.

Cosmic Road may quote these separately.

10. Confidentiality

10.1 Definition. "Confidential Information" is any non-public information one party (the discloser) gives the other (the recipient) that is marked confidential or that a reasonable person would understand to be confidential. It includes:

• Customer Data;
• pricing and the details of your order;
• the fact that you use the Service;
• Cosmic Road's non-public product information.

10.2 Exclusions. Information is not Confidential Information if the recipient can show it:

1. is or becomes public through no fault of the recipient;
2. was already lawfully known to the recipient without restriction;
3. was lawfully received from a third party without restriction;
4. was developed independently without use of the discloser's information.

Personal Information in Customer Data stays protected under section 7 and Schedule C even if an exclusion applies.

10.3 Obligations. The recipient uses Confidential Information only for this Agreement and protects it with at least reasonable care. It shares it only with employees, contractors and advisers who need it and are bound by similar duties.

10.4 Compelled disclosure. The recipient may disclose what the law requires. Where allowed, it gives the discloser prompt notice, so the discloser can seek protection.

10.5 Publicity. Neither party names the other publicly, including as a reference customer or in a list of logos, without written consent.

10.6 Duration. These duties last for the term of this Agreement and five years after it. For Customer Data and trade secrets, they last indefinitely.

11. Intellectual property

11.1 Cosmic Road's property. Cosmic Road owns the Service and all intellectual property in it, including anything built at your request. Nothing in this Agreement transfers that ownership to you.

11.2 Your property. You own your Customer Data, your logo and your own content. You give Cosmic Road a limited licence to host, copy, process and display them, only as needed to provide the Service.

11.3 Feedback. If you suggest improvements, Cosmic Road may use them freely, without payment or attribution. Feedback never includes Customer Data or your Confidential Information.

11.4 Third-party components. The Service includes open-source and third-party software under their own licences. Cosmic Road provides the required notices on request, and those licences do not reduce your rights under this Agreement.

12. Warranties and disclaimers

12.1 Cosmic Road's promises. During your subscription, Cosmic Road promises that:

1. the Service will perform materially as described in the Documentation;
2. it will not materially reduce the security safeguards in Schedule C;
3. it will provide the Service with reasonable skill and care, using qualified personnel.

12.2 Remedy. If the Service does not meet section 12.1, report it in writing and Cosmic Road will fix it within a reasonable time. If Cosmic Road cannot fix it within 30 days, you may end your subscription and receive a refund of prepaid fees for the unused period.

12.3 Mutual promises. Each party promises that it has authority to enter into this Agreement and will comply with the laws that apply to its part of it.

12.4 No professional advice. The Service is a tool. It does not give tax, accounting, legal or financial advice. You remain responsible for your professional work, including filing deadlines, calculations, and documents sent to your clients or to government. Reminders and automated workflows help, but must not be your only control.

12.5 Disclaimer. Apart from the promises in this Agreement, the Service is provided "as is". To the extent the law allows, Cosmic Road gives no other warranty or condition, express or implied. That includes merchantability, fitness for a particular purpose, and uninterrupted or error-free operation. Cosmic Road does not promise that the Service will increase your revenue or business results.

13. Indemnities

13.1 By Cosmic Road. Cosmic Road will defend you against any third-party claim that the Service, used as this Agreement allows, infringes a Canadian or US patent, copyright or trademark, or misappropriates a trade secret. It will pay the damages and costs finally awarded, or the settlement it agrees to.

If such a claim is made or seems likely, Cosmic Road may, at its choice:

1. get you the right to keep using the Service;
2. change the Service so it no longer infringes, without losing material functionality; or
3. end your subscription and refund prepaid fees for the unused period.

This does not cover claims caused by Customer Data, by combining the Service with things Cosmic Road did not supply, or by use that breaches this Agreement.

13.2 By the Customer. You will defend Cosmic Road against any third-party claim, including one by a regulator, that arises from:

1. Customer Data, or your collection of it without the required consent or authority;
2. messages you send through the Service in breach of CASL or other law;
3. your use of the Service in breach of section 4.

You will pay the damages and costs finally awarded, or the settlement you agree to.

13.3 Process. The party being defended must:

• notify the other promptly;
• let it control the defence and settlement;
• cooperate, at the defending party's cost.

A settlement that admits fault for the defended party, or places obligations on it, needs that party's consent, which it will not unreasonably withhold.

14. Limitation of liability

14.1 Excluded losses. Neither party is liable for indirect, incidental, special or consequential losses, even if warned they were possible. Those include loss of profits, revenue, goodwill or anticipated savings. The costs Cosmic Road pays under section 8.4 count as direct losses.

14.2 General cap. Each party's total liability under this Agreement is limited to the fees you paid and owed in the 12 months before the event giving rise to the claim.

14.3 Data cap. For breach of section 7, section 8, section 10 or Schedule C, the limit is two times the fees you paid and owed in the 12 months before the event.

14.4 No cap. These limits do not apply to:

1. your duty to pay fees;
2. either party's defence obligations under section 13;
3. fraud, wilful misconduct or gross negligence;
4. anything the law does not allow to be limited.

15. Suspension

15.1 For non-payment. If an undisputed amount is more than 30 days overdue, Cosmic Road may suspend the Service after giving at least 10 days' notice by email. Staff logins are suspended first. Client portal access is suspended only after a further 15 days.

15.2 For risk. Cosmic Road may suspend access immediately, and only as far as necessary, if your account:

1. is compromised;
2. is being used in breach of section 4.4; or
3. creates a real threat to the security or availability of the Service for others.

Cosmic Road will tell you as soon as it can, and will restore access once the problem is fixed.

15.3 Your data during suspension. Suspension never deletes Customer Data. Fees continue during a suspension for non-payment or breach.

16. Third-party services and messaging

16.1 Integrations. You may connect the Service to third-party services you choose, such as Microsoft 365, accounting software or payment gateways. Your use of them is governed by your own agreements with their providers. Cosmic Road is not responsible for their availability or changes, or for what they do with data you send them. Connecting one authorises Cosmic Road to exchange Customer Data with it as you configure.

16.2 Payments you collect. Card and bank payments you take from your clients through the Service are processed by the payment provider you connect. Cosmic Road does not store full card numbers.

16.3 You are the sender. For email and SMS you send to your clients through the Service, you are the sender under CASL. You must:

1. have the recipient's express or implied consent where CASL requires it;
2. identify yourself in each commercial message and include a working unsubscribe method;
3. honour unsubscribe requests within 10 business days. The Service records SMS "STOP" replies automatically.

16.4 Delivery. SMS and email travel through carriers and providers Cosmic Road does not control. Cosmic Road is not liable for messages delayed, filtered or not delivered for reasons outside its systems.

16.5 Messages to you. Cosmic Road may send your Authorised Users service messages by email or SMS, such as security codes and outage or billing notices. Product news goes only to users who opt in, and each user can opt out at any time.

17. Changes to this Agreement

17.1 New versions. Cosmic Road may update this Agreement by publishing a new version at maxportal.ca. It emails the account owner at least 30 days before a new version applies to an existing subscription.

17.2 When a new version applies. A new version applies to your subscription from your next renewal date after the notice period. It applies sooner only where the law requires the change, or where a Sub-processor change follows Schedule C, Part 4. A change that materially reduces your protections never applies in the middle of a paid term.

17.3 If you do not agree. If you do not accept a new version, you may cancel before it applies, and the current version continues until your subscription ends. Renewing after the new version applies means you accept it.

17.4 Agreed changes. Any other change needs a written agreement signed or confirmed by email by both parties.

18. General

18.1 Governing law. This Agreement is governed by the laws of the Province of British Columbia and the federal laws of Canada that apply there, wherever in Canada you are located. The parties submit to the courts of British Columbia, sitting in Vancouver.

18.2 Disputes. Before starting a court case (other than for urgent relief), a party gives written notice of the dispute. Senior representatives of both parties then meet within 15 days and try in good faith, for 30 days, to resolve it.

18.3 Notices. Legal notices are in writing and delivered by hand, by courier, or by email with confirmation of receipt.

• Notices to Cosmic Road go to [email protected].
• Notices to you go to the account owner's email address.
• Operational messages may be sent through the Service.

18.4 Assignment. Neither party may assign this Agreement without the other's written consent, which will not be unreasonably withheld. Either party may assign it without consent, by notice, to a successor of all or most of its business that agrees in writing to be bound. Cosmic Road may also assign it to an affiliate, including Team Evo.

18.5 Events outside a party's control. A party is not in breach for a delay or failure caused by events outside its reasonable control, such as fire, flood, war, pandemic, government action, or a regional power or internet failure.

• The affected party must notify the other promptly and use reasonable efforts to keep performing.
• This does not excuse payment obligations, or Cosmic Road's duty to maintain its backup and security safeguards.
• If such an event stops the Service for more than 30 days in a row, either party may end the subscription, with a refund of prepaid fees for the unused period.

18.6 Independent parties. The parties are independent contractors. Neither is the other's agent, partner or employee.

18.7 Entire agreement. This Agreement is the whole agreement between the parties about the Service and replaces earlier proposals and discussions. Terms on your purchase orders do not apply.

18.8 Severability and waiver. If a court finds any part unenforceable, the rest stays in force, and that part is enforced as far as the law allows. Not enforcing a right does not waive it.

18.9 Electronic acceptance. This Agreement may be accepted and kept electronically. An electronic record of acceptance has the same effect as a signed paper copy.

18.10 Language. This Agreement is written in English.

Schedule A: Your order

Your order is what you chose at checkout on maxportal.ca and what appears in the confirmation email Cosmic Road sends after purchase. It sets out:

• the firm (Customer) name and the account owner;
• your web address (yourfirm.maxportal.ca);
• your plan (staff, customer and monthly SMS limits);
• the Modules you chose;
• monthly or yearly billing;
• the price, any add-on packs, any one-time purchases, and any discount, including the first-time offer;
• the date your subscription starts.

The prices in your order are the ones that apply to you, even if prices published on maxportal.ca later change. Section 5.6 is the only exception. If you change plan or Modules later, the confirmation email for that change becomes part of your order.

Schedule B: Service levels

Cosmic Road commits to 99.5% monthly availability, which allows about 3 hours 39 minutes of unplanned downtime a month.

B1. Availability. "Available" means Authorised Users can log in and use the core functions. Availability is measured per calendar month and excludes:

• scheduled maintenance announced at least 48 hours ahead, held between 10 pm and 6 am Pacific Time, up to 4 hours a month;
• emergency security patches;
• problems caused by you, your integrations, or events under section 18.5.

B2. Service credits. Claim a credit by email within 30 days after the month ends. Credits are applied to your next charge and are never paid in cash.

If availability is under 95% in any two months within six months, you may also end your subscription and receive a refund of prepaid fees for the unused period.

B3. Support.

• Channels: email to [email protected] and the in-app support form.
• Hours: business days, Monday to Friday, 9 am to 5 pm Pacific Time, excluding British Columbia statutory holidays.
• Outages: the Service is monitored automatically around the clock, and outages are worked on as they are detected.

B4. Backup and recovery.

• Customer Data is backed up continuously, with a recovery point target of 15 minutes (at most 15 minutes of data lost).
• The recovery time target for restoring the Service is 4 hours.
• Backups are encrypted and kept in a second location in Canada.
• A restore is tested at least every quarter.

Schedule C: Data Processing Addendum

This addendum sets out how Cosmic Road handles the Personal Information in Customer Data. If it conflicts with any other part of the Agreement, it prevails.

Part 1. Roles and instructions. You control the Personal Information. Cosmic Road processes it only on your documented instructions: this Agreement, your configuration of the Service, and your support requests. Cosmic Road will tell you if it believes an instruction breaks Privacy Law.

Part 2. People. Everyone at Cosmic Road and Team Evo with access to Customer Data:

• is bound by a written duty of confidentiality;
• passes a background check before getting production access;
• completes privacy and security training every year.

Part 3. Minimum safeguards.

1. TLS 1.2 or higher for all traffic, and AES-256 encryption at rest for databases, files and backups.
2. Field-level encryption of Social Insurance Numbers and similar identifiers, masked by default.
3. Each customer's data is logically separated from every other customer's, with isolation tested before every release.
4. Multi-factor authentication required for all Cosmic Road and Team Evo staff, and available to all Authorised Users.
5. Role-based permissions within each firm, and a tamper-resistant audit log of staff and administrator access.
6. Security patches applied within 14 days, and within 72 hours for critical ones.
7. An independent penetration test at least once a year; a summary is available to you on request.
8. Encrypted backups in a second location in Canada, as set out in Schedule B4.
9. A written incident response plan, tested every year.

Part 4. Sub-processors. The current list, with each Sub-processor's name, purpose and location, is published at maxportal.ca. It always includes:

When Cosmic Road adds or replaces a Sub-processor, it emails the account owner at least 30 days ahead. If you reasonably object on privacy grounds and the parties cannot resolve it, you may end your subscription, with a refund of prepaid fees for the unused period. Cosmic Road holds each Sub-processor to data-protection terms at least as protective as this addendum, and remains responsible for them.

Never put a Social Insurance Number or full date of birth in the body of an SMS or email. Those messages may leave Canada and are not encrypted end to end.

Part 5. Processing outside Canada. Some provincial laws, including Alberta's PIPA for firms in Alberta, require your privacy notice to say that a service provider outside Canada may process Personal Information. Cosmic Road's published Sub-processor list gives you the information you need to do this.

Part 6. Assistance and audit. Cosmic Road will:

1. help you answer your clients' access and correction requests and regulators' enquiries;
2. complete one reasonable security questionnaire a year at no charge;
3. allow an audit by an independent auditor, at your cost and on 30 days' notice, after a Security Incident or where a regulator requires it.

Part 7. Return and deletion. Section 6.7 applies.