• Contact details: name, email address, phone number, mailing address.
• Property information: property address, type, and characteristics submitted during risk assessments.
• Consultation preferences and scheduling information.
• Payment and billing details (processed by our payment processors; we do not store full card numbers).
• Communications you send us via forms, email, chat, or telephone.
• Partner and affiliate registration information.

• Technical data: IP address, device type, browser type and version, operating system, screen resolution.
• Usage data: pages visited, time on site, links clicked, session duration, referral URLs.
• Attribution data: UTM parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term), referral codes, and click identifiers (including Meta's fbclid).
• Cookie and tracking data: session identifiers, visitor IDs, consent preferences. See our Cookie Policy for full details.
• Geolocation: general geographic location derived from IP address (not precise GPS location unless you grant permission).

• Advertising and attribution data from Meta Platforms, Inc. (including Meta Pixel events and Conversions API data). See Section 5.
• Analytics data from Google Analytics 4. See Section 6.
• Partner and affiliate referral data from our partner network.
• Lead data from social media advertising platforms (Facebook, Instagram lead forms).

We use SPI only for the following purposes: (a) to provide the specific service you requested (risk assessment, mapping, system design); (b) to detect and prevent security incidents; (c) to ensure the physical safety of persons; and (d) to comply with legal obligations. We do not use SPI for purposes of inferring characteristics about you unrelated to the services we provide, and we do not sell or share SPI for cross-context behavioural advertising.

California residents have the right to direct us to limit our use and disclosure of SPI to only what is necessary to perform our services. To exercise this right, contact us at admin@prodigywildfire.com with the subject line "Limit SPI Use." We will respond within 15 business days.

• Our AI Risk Assessment Engine automatically processes your property address, satellite imagery, topographic data, historical fire records, climate data, and vegetation proximity to generate a numerical risk score and narrative risk report.
• Our AI systems use large language models (LLMs) that apply pattern matching and statistical inference to generate risk narratives. These narratives are probabilistic outputs, not expert determinations.
• Our CRM and marketing systems may use behavioural data (pages visited, forms submitted, UTM source) to segment leads and prioritise sales follow-up — this is profiling for commercial purposes.
• Our voice AI system (VAPI) analyses call content and may classify callers by intent, property type, or urgency for routing and follow-up purposes.

An automated risk score may influence: (a) the urgency with which our sales team follows up with you; (b) the type of system we recommend; (c) information you share with insurers or property buyers; and (d) decisions you make about evacuation preparedness. These scores are not legally binding determinations and do not constitute professional advice. See our Terms Section 3 for full limitations.

If an automated assessment or score has materially affected a decision you have made regarding your property, insurance, or safety — and you believe it is inaccurate — you have the right to request human review of that assessment. Contact admin@prodigywildfire.com with the subject "Human Review Request" and we will arrange for a member of our team to manually review the relevant assessment inputs and output. This right applies regardless of your jurisdiction. For EU/EEA residents, this right is provided under GDPR Article 22.

You may opt out of profiling for marketing segmentation purposes at any time by contacting admin@prodigywildfire.com. Opting out of marketing profiling will not affect your ability to use the Platform or receive risk assessments, but may affect the relevance of communications you receive from us.

We collect personal information with your consent (express or implied), or where collection is necessary for a legitimate business purpose. You may withdraw consent at any time subject to legal and contractual restrictions, by contacting admin@prodigywildfire.com. Quebec residents have additional rights under Law 25 (Act respecting the protection of personal information in the private sector, as amended).

We process personal information as necessary to provide our services, comply with legal obligations, and pursue our legitimate business interests (such as advertising measurement, fraud prevention, and service improvement), in ways that do not override your rights. We do not sell personal information. See Section 13 for California-specific rights.

We collect personal information under the Australian Privacy Principles (APPs). We rely on consent, contractual necessity, and legitimate interests as bases for processing. We comply with APP 3 (collection), APP 5 (notification), and APP 6 (use and disclosure).

While our primary markets are Canada, USA, and Australia, to the extent GDPR applies, we rely on: consent (e.g., marketing communications); contract performance (e.g., fulfilling service requests); legal obligations (e.g., tax compliance); and legitimate interests (e.g., fraud prevention, service improvement), balanced against your rights.

The Meta Pixel loads JavaScript in your browser when you visit our website. It places cookies (_fbp, _fbc) and transmits information about your browsing activity and actions on our site to Meta. This enables us to measure advertising effectiveness and deliver relevant ads on Facebook and Instagram.

In addition to the browser Pixel, we use Meta's Conversions API (CAPI) for server-side tracking. When you take a significant action (submitting a lead form, completing a risk assessment), our servers send event data directly to Meta. This data may include hashed (encrypted) versions of your email address, phone number, first name, last name, city, state, country, and zip code. Hashing is a one-way process that converts data into an encrypted string before transmission — the raw data is not sent. A unique event ID is used to deduplicate browser and server events so Meta does not double-count a single conversion.

When you arrive via a Meta ad, a fbclid parameter is appended to the landing URL. We capture and store this identifier to attribute your visit to the relevant campaign. It is shared with Meta as part of conversion reporting.

We are an independent data controller for the personal information we collect. Meta Platforms, Inc. is a separate independent data controller for the data they receive and process through their platforms. Our data sharing with Meta is governed by Meta's Business Tools Terms.

You can manage Meta ad preferences at facebook.com/adpreferences. Opt out of interest-based advertising via the Digital Advertising Alliance. Declining non-essential cookies disables the browser-based Pixel; however, server-side CAPI events may continue for form submissions already in progress. For more information, see Meta's Privacy Policy.

• Cookies: Small text files placed on your device. Categories: (a) Strictly Necessary — essential for Platform operation; (b) Performance & Analytics — anonymised usage statistics via GA4; (c) Functional — enhanced features and personalisation; (d) Marketing & Targeting — relevant advertising via Meta Pixel; (e) Attribution & Referral — campaign and referral source tracking.
• Pixels & Web Beacons: Tiny invisible images or JavaScript code embedded in web pages or emails that transmit information when loaded. We use the Meta Pixel (see Section 5) as our primary pixel technology. If we add additional pixels (e.g., TikTok Pixel, Google Ads conversion tag, LinkedIn Insight Tag), we will update this Policy and our Cookie Policy to disclose each additional pixel, its provider, and its purpose before deployment.
• Local Storage & Session Storage: Browser storage mechanisms used to maintain session state, store visitor identifiers, and remember your preferences between visits.
• Server-Side Tracking (CAPI): In addition to browser-based tracking, we use server-side data transmission to Meta's Conversions API. See Section 5 for full details.

When you first visit our Platform, we present a cookie consent banner. Your consent choices are recorded, including the timestamp of consent, the version of our Cookie Policy at the time, and the specific categories you accepted or declined. This record is retained for a minimum of 3 years as evidence of consent. You can change or withdraw your consent at any time via the cookie settings link in our website footer. Proof of your consent record is maintained by us — you may request a copy by contacting admin@prodigywildfire.com.

We respect the Global Privacy Control (GPC) browser signal as an opt-out of the "sale" and "sharing" of personal information as required under the California Privacy Rights Act (CPRA) and California Attorney General regulations (Cal. Code Regs. tit. 11, § 7025). If your browser transmits a GPC signal when you visit our Platform, we will treat this as a valid opt-out of sharing your personal information with advertising partners (including Meta Pixel data transmission for targeted advertising purposes) to the extent technically feasible for that session. This does not affect strictly necessary cookies or server-side CAPI events required for legal compliance. See Section 13 for your full California rights.

Third-party providers who perform services on our behalf, including: cloud hosting and infrastructure (Microsoft Azure); CRM management (Zoho Corporation); email communications (Microsoft 365 / Outlook); website analytics (Google LLC — GA4); advertising measurement (Meta Platforms, Inc. — Pixel & CAPI); mapping services (Stadia Maps); telephone and SMS services (Twilio Inc.); AI voice services (VAPI.ai); IoT device connectivity (YoLink / YS Technology); and payment processing. These providers are contractually obligated to protect your information and use it only for the purposes we specify.

We share hashed contact data and conversion event data with Meta for advertising measurement purposes. See Section 5 for full details. Meta is an independent data controller for data processed on their platforms.

If you arrive via a partner referral link or affiliate campaign, we may share your lead information (name, enquiry type, property location) with the relevant authorised partner for commission tracking and lead management purposes, subject to confidentiality obligations.

We may disclose personal information to law enforcement, regulators, courts, or other authorities where required by law, legal process, or where we reasonably believe disclosure is necessary to: protect the rights, property, or safety of Prodigy, our users, or others; detect, prevent, or address fraud or security issues; or comply with applicable legal obligations.

In connection with a merger, acquisition, financing, reorganisation, or sale of all or substantially all of our assets, personal information may be transferred to the acquiring entity, subject to appropriate confidentiality protections and, where required, notice to affected individuals.

• Data Processing Agreements (DPAs) with all key service providers that process personal information on our behalf, incorporating appropriate contractual protections and data security obligations.
• Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms where required by applicable law.
• Technical controls including encryption in transit (TLS/HTTPS) and at rest.
• Access controls limiting data access to authorised personnel with a legitimate need.

Our primary CRM is Zoho Bigin, provided by Zoho Corporation. Zoho operates data centres in multiple regions including the United States, Europe, India, and Australia. Canadian and Australian user data may be processed and stored in Zoho's US or India data centres depending on account configuration. We have entered into a Data Processing Agreement with Zoho Corporation that governs their processing of personal data on our behalf, incorporates Zoho's data protection obligations, and includes provisions for cross-border transfers. A summary of Zoho's data processing terms is available at zoho.com/privacy/dpa.html.

For transfers of personal information of Quebec residents outside Quebec (as required by Law 25 — Act respecting the protection of personal information in the private sector), we conduct Privacy Impact Assessments (PIAs) where required before initiating such transfers. If you are a Quebec resident and wish to obtain information about how your personal information is protected when transferred to a jurisdiction outside Quebec, contact our Privacy Officer at admin@prodigywildfire.com.

When we disclose personal information of Australian residents to overseas recipients, we take reasonable steps to ensure those recipients do not breach the Australian Privacy Principles. Where reasonably practicable, we obtain comparable contractual commitments from overseas recipients. By using our Platform, Australian residents consent to the overseas disclosure of their personal information in accordance with this Section and the Australian Privacy Principles (APP 8.2(a)).

You have the right to: access the personal information we hold about you; request correction of inaccurate or incomplete information; withdraw consent to collection, use, or disclosure (subject to legal and contractual restrictions); and challenge our compliance with PIPEDA or applicable provincial legislation by filing a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Quebec residents also have rights under Law 25, including the right to request de-indexation or cessation of dissemination of personal information in certain circumstances.

You have the right to: access personal information we hold about you; request correction of inaccurate, outdated, incomplete, irrelevant, or misleading personal information; and make a complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Where GDPR applies, you have the right to: access; rectification; erasure ("right to be forgotten"); restriction of processing; data portability (receive your data in a structured, machine-readable format); object to processing (including for direct marketing and profiling); automated decision-making review; and withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You may lodge a complaint with your local Data Protection Authority.

Quebec residents have the right to portability of personal information collected from them by automated means (Law 25, s. 27). Upon written request, we will provide your personal information in a technology-neutral, structured format within 30 days. Contact admin@prodigywildfire.com (Subject: "Portability Request — Quebec").

You may withdraw consent to receive commercial electronic messages (including email marketing and newsletters) from us at any time at no cost by: (a) clicking the "Unsubscribe" link in any marketing email; (b) replying STOP to any marketing SMS; or (c) contacting admin@prodigywildfire.com with the subject "Unsubscribe." We will process your opt-out within 10 business days. Withdrawal of consent does not affect transactional or service-related communications (e.g., account notices, security alerts, appointment reminders) which are exempt from CASL consent requirements.

We honour the Global Privacy Control (GPC) browser signal as a legally recognised opt-out of the sale and sharing of personal information under CPRA (Cal. Code Regs. tit. 11, § 7025). If your browser or browser extension transmits a GPC signal, we process it as a valid opt-out request for the sale/sharing of your personal information for cross-context behavioural advertising. This opt-out applies to Meta Pixel data sharing for targeted advertising. Technical implementation: our Platform detects the Sec-GPC: 1 request header and suppresses targeted advertising cookie placement and Pixel data sharing for advertising segmentation. Note: GPC does not affect strictly necessary cookies, server-side CAPI events for legal compliance, or operational data processing.

To submit a verifiable consumer request (VCR) under CCPA/CPRA: (1) contact us at admin@prodigywildfire.com or 778-968-1200; (2) provide your full name and the email address or phone number you used when interacting with our Platform; (3) describe your request specifically. We will verify your identity by matching the identifying information you provide against our records. For deletion requests involving sensitive information, we may require additional verification. We will not require you to create an account, pay a fee, or provide more information than reasonably necessary. We respond to all VCRs within 45 days and will notify you if we require a 45-day extension. You may designate an authorised agent to make requests on your behalf — the agent must provide written proof of authorisation signed by you.

We do not share personal information with third parties for their own direct marketing purposes. California residents may submit a request for information about any such sharing to admin@prodigywildfire.com (Subject: "Shine the Light Request").

Our Platform does not respond to browser "Do Not Track" (DNT) signals, as there is no uniform industry-standard protocol. We do, however, honour the Global Privacy Control (GPC) signal as described above. You can control tracking through our cookie consent banner and the mechanisms described throughout this Policy.

In the event of a security breach involving personal information that creates a real risk of significant harm, we will notify affected individuals and relevant regulators as follows:

• Canada (PIPEDA / provincial laws): As soon as feasible after determining a breach poses a real risk of significant harm. We will also report to the Office of the Privacy Commissioner of Canada. Quebec Law 25 requires notification to the Commission d'accès à l'information within 72 hours of becoming aware of a breach of confidentiality.
• United States (State laws — CA, TX, FL, VA, CO, CT, etc.): Notification to affected California residents within 72 hours of becoming aware (Cal. Civ. Code § 1798.82); other states within 30–60 days as required by applicable state law. We will notify the California Attorney General if a breach affects more than 500 California residents.
• Australia (Privacy Act 1988 — Notifiable Data Breaches Scheme): Within 30 days of becoming aware of an eligible data breach that is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals (Privacy Act s 26WK).
• GDPR (where applicable): Within 72 hours of becoming aware of a personal data breach that is likely to result in risk to individuals' rights and freedoms.

Breach notifications to individuals will include: description of the breach; types of personal information involved; steps taken to address the breach; and recommendations for affected individuals to protect themselves.

We maintain a version history of this Privacy Policy to support transparency and consent auditability. Previous versions are available upon written request to admin@prodigywildfire.com. Material changes that involve new categories of data collection, new third-party sharing relationships, or changes to your rights will be highlighted in any update notice and will not apply retroactively to personal information collected before the change took effect, to the extent applicable law requires.