Privacy Policy

1. Scope and Application

This Privacy Policy (the "Policy") describes how Wingman Agency Inc. ("Wingman," "we," "us," or "our"), a corporation duly incorporated under the laws of the Province of Ontario, collects, uses, discloses, retains, and otherwise processes Personal Information in the course of its commercial activities.

This Policy applies to Personal Information collected:

• through our website located at wingmanagency.ca (the "Site") and any subdomain, page, or related online property operated by Wingman;
• through our digital marketing, social media management, website design, and related services (collectively, the "Services"); and
• through our business communications and other interactions with prospective, current, and former clients, vendors, and other individuals who interact with Wingman.

This Policy is intended to comply with the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA"), Canada's Anti-Spam Legislation ("CASL"), and other applicable Canadian privacy and data protection laws, including substantially similar provincial legislation where it applies.

2. Definitions

3. Identity of the Controller and Contact Information

For the purposes of applicable Canadian privacy legislation, Wingman is the organization responsible for the Personal Information under its control. Wingman has designated a Privacy Officer who is accountable for our compliance with this Policy and applicable law.

You may contact our Privacy Officer at:

4. Legal Basis and Principles for Collection

Wingman is committed to complying with the ten fair information principles set out in Schedule 1 of PIPEDA: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance.

We collect, use, and disclose Personal Information only for purposes that a reasonable person would consider appropriate in the circumstances, and only with valid consent or where otherwise permitted or required by law.

5. Categories of Personal Information Collected

Depending on the nature of your interaction with Wingman, we may collect the following categories of Personal Information:

5.1 Information you provide directly to us

• Identification and contact data: first and last name, business name, email address, postal address, telephone number, job title, and similar identifiers;
• Business profile data: details about your business or organization, including industry, services offered, hours of operation, geographic service area, existing website (if any), social media account handles, and similar information you provide for the purpose of receiving quotes, scoping projects, or receiving the Services;
• Account access credentials: where you engage Wingman to manage or post on third-party platforms (including but not limited to Facebook, Instagram, and Google Business Profile) or to access your website hosting, the access credentials, tokens, or permissions you grant for that purpose;
• Content data: photographs, video, written copy, graphic assets, logos, customer testimonials, and other materials you submit to Wingman for use in delivering the Services;
• Billing data: billing name and address, taxation registration numbers (if applicable), and payment-related information. Full payment card information is collected and processed directly by our third-party payment processor and is not stored on Wingman's systems;
• Communications data: the content of emails, calendar bookings, text messages, voicemails, and other communications you direct to Wingman, together with the metadata of such communications.

5.2 Information collected automatically

• Device and technical data: Internet Protocol (IP) address, browser type and version, operating system, device identifiers, screen resolution, language preferences, and approximate geolocation derived from your IP address;
• Usage data: pages of the Site visited, time and duration of visits, referring URL, links and buttons interacted with, scroll depth, and similar behavioural data;
• Cookie and tracking data: data collected through cookies, web beacons, pixels, local storage, and similar technologies (see Section 10).

5.3 Information collected from third parties

From time to time, we may receive Personal Information about you from third-party sources, including: (i) referral sources who have introduced you to us; (ii) public business directories and public-facing social media; (iii) Service Providers, including analytics providers; and (iv) where applicable and with your consent, our sister company Dough Payments in connection with the Zero Cost Plan offering. We collect such information only where it is lawful and appropriate to do so.

6. Purposes of Collection, Use, and Disclosure

Wingman collects, uses, and discloses Personal Information only for the following identified purposes:

1. Service delivery: to provide the Services for which you have engaged us, including building and maintaining websites, drafting and publishing social media content, managing your Google Business Profile, and related activities;
2. Client communications: to respond to inquiries, send transactional communications (including booking confirmations, invoices, scope-of-work documents, and project status updates), and provide customer support;
3. Billing and collections: to invoice you, process payments, manage outstanding accounts, and comply with our tax and accounting obligations;
4. Marketing communications: where permitted by CASL (see Section 11), to send you commercial electronic messages about Wingman's Services and related resources;
5. Improvement of the Site and Services: to analyze use of the Site, diagnose technical issues, and improve our offerings;
6. Promotional use of work product: where you have not opted out, to feature deliverables produced for you (such as your finished website or social posts) as portfolio examples or case studies, including the use of your business name and website link;
7. Legal and regulatory compliance: to comply with applicable laws, respond to lawful requests from public authorities, and protect our legal rights and the rights of others;
8. Fraud prevention and security: to detect, prevent, and respond to fraud, abuse, security incidents, and unauthorized access;
9. Corporate transactions: in connection with a proposed or completed merger, acquisition, financing, reorganization, or sale of all or part of Wingman's business or assets.

We will not use or disclose Personal Information for any new purpose that has not been identified above without first obtaining your consent or otherwise complying with applicable law.

7. Consent

Wingman obtains your consent to the collection, use, and disclosure of your Personal Information at the time of collection or as otherwise permitted by law. Depending on the sensitivity of the information and the circumstances, consent may be express (for example, an electronic acknowledgement or signed agreement) or implied (for example, by your voluntary provision of Personal Information for an identified purpose).

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by contacting our Privacy Officer using the details in Section 20. Please be advised that the withdrawal of consent may prevent Wingman from providing certain Services to you or completing existing engagements.

8. Disclosure to Third Parties

Wingman does not sell, rent, or trade Personal Information. We disclose Personal Information only in the following circumstances:

1. To Service Providers: as described in Section 9;
2. To social media and online platforms: where you have engaged Wingman to manage your accounts on platforms including Facebook, Instagram, and Google Business Profile, we publish content and interact with those platforms using credentials and access you have authorized;
3. To our sister company, Dough Payments, only where you have inquired about, applied for, or enrolled in the Zero Cost Plan and only to the extent reasonably necessary to evaluate qualification, onboard you, and administer that program. Dough Payments is a separate legal entity and its handling of your Personal Information is governed by its own privacy policy;
4. To legal and regulatory authorities: where required by court order, subpoena, search warrant, statutory production order, or other valid legal process, or where otherwise required or permitted by law;
5. To our professional advisors: including legal counsel, accountants, auditors, and insurers, under appropriate confidentiality obligations;
6. In a business transaction: in connection with the sale, merger, financing, reorganization, dissolution, or similar transaction involving Wingman or its assets, in which case Personal Information may be transferred to the counterparty subject to appropriate protections;
7. To protect rights and safety: where we reasonably believe disclosure is necessary to investigate or prevent fraud, abuse, violations of our agreements, or threats to the rights, property, or safety of Wingman, our clients, or others.

9. Service Providers and Cross-Border Transfers

Wingman engages third-party Service Providers to assist with the operation of our business. These Service Providers may have access to Personal Information solely to perform their assigned functions, and only in accordance with Wingman's instructions and appropriate contractual safeguards regarding confidentiality and data protection. Categories of Service Providers currently include:

• Website hosting and infrastructure providers (including Netlify) used to host the Site and client websites;
• Productivity and email services (including Google Workspace) used for email, document storage, and internal collaboration;
• Customer relationship management and marketing automation platforms (including HighLevel) used for client communications, calendar bookings, SMS, and email automation;
• Payment processors used to charge clients for the Services;
• Analytics providers (such as Google Analytics) used to understand how the Site is used;
• Artificial intelligence and content tools (including platforms such as Anthropic's Claude API) used to assist with content drafting, reporting, and internal productivity. Wingman selects vendors whose terms prohibit the use of customer data for model training where reasonably available;
• Professional services providers including accountants, bookkeepers, and legal counsel.

Cross-border transfers. Some Service Providers may store or process Personal Information outside of Canada, including in the United States and other jurisdictions. While Personal Information is in another jurisdiction, it may be accessible to the courts, law enforcement, and national security authorities of that jurisdiction under the laws applicable there. Wingman uses commercially reasonable means to ensure that Service Providers provide a comparable level of protection to that required under Canadian law. You may contact our Privacy Officer for information about specific Service Providers or jurisdictions.

10. Cookies, Analytics, and Online Tracking

The Site uses cookies, web beacons, pixels, local storage, and similar technologies (collectively, "Cookies") for the following purposes:

• Strictly necessary Cookies required for the Site to function, including session management and security;
• Performance and analytics Cookies used to understand how visitors use the Site, including aggregate traffic statistics, page performance, and error reporting;
• Marketing and attribution Cookies used to measure the effectiveness of advertising campaigns and to remember whether a visitor arrived from a referral source.

Most web browsers allow you to control Cookies through your browser settings, including by blocking or deleting Cookies. If you disable or refuse Cookies, certain features or pages of the Site may not function as intended.

The Site honours "Do Not Track" signals where technically feasible. We do not respond to other web-based opt-out mechanisms that are not standardized.

11. Electronic Communications (CASL)

Where required under CASL, Wingman will obtain your express or implied consent before sending you a commercial electronic message ("CEM"). Each CEM sent by Wingman will:

• identify the sender;
• provide valid contact information for the sender; and
• include a functioning unsubscribe mechanism that allows you to withdraw consent at no cost.

You may unsubscribe from Wingman's marketing CEMs at any time by clicking the unsubscribe link in any such message, or by contacting our Privacy Officer. Even if you unsubscribe, we may continue to send you non-marketing transactional or service-related communications relating to an ongoing engagement.

12. Retention of Personal Information

Wingman retains Personal Information only for as long as is reasonably necessary to fulfill the purposes for which it was collected and to satisfy any applicable legal, regulatory, tax, accounting, or contractual obligations. Retention periods vary depending on the nature of the information and the purpose for which it was collected. Once Personal Information is no longer required, it will be securely destroyed, erased, or anonymized.

Notwithstanding the foregoing, Wingman may retain certain Personal Information for longer periods where required to: (i) comply with legal or regulatory obligations; (ii) defend or commence legal claims; or (iii) resolve disputes.

13. Security Safeguards

Wingman implements administrative, technical, and physical safeguards designed to protect Personal Information against loss, theft, and unauthorized access, disclosure, copying, use, modification, or destruction. These safeguards include, where appropriate to the sensitivity of the information:

• access controls and authentication on internal systems;
• encryption of Personal Information in transit using industry-standard protocols (such as TLS);
• contractual obligations on Service Providers requiring comparable safeguards;
• policies and training for personnel handling Personal Information; and
• secure disposal of records containing Personal Information when no longer required.

Despite these safeguards, no method of transmission over the internet or method of electronic storage is fully secure. Wingman cannot warrant the security of information transmitted to or from the Site, and any transmission is at your own risk.

14. Your Rights Under Applicable Law

Subject to applicable law and limited exceptions, you have the following rights with respect to your Personal Information held by Wingman:

• Right of access: to be informed of the existence, use, and disclosure of your Personal Information, and to be given access to it;
• Right of correction: to challenge the accuracy and completeness of the information and to have it amended as appropriate;
• Right to withdraw consent: as described in Section 7;
• Right to opt out of CEMs: as described in Section 11;
• Right to lodge a complaint: with Wingman's Privacy Officer or with the Office of the Privacy Commissioner of Canada at priv.gc.ca, or with the privacy regulator in your province of residence, if applicable.

15. How to Make an Access or Correction Request

You may make a written request for access to or correction of your Personal Information by contacting our Privacy Officer (see Section 20). To process your request, we may require you to:

1. provide sufficient information to verify your identity; and
2. specify with reasonable particularity the information you are requesting access to or correction of.

Wingman will respond to a valid access or correction request within thirty (30) days, or such longer period as may be permitted by applicable law. Access to Personal Information may be denied in limited circumstances as permitted by law, in which case we will provide a written explanation of the reasons for refusal and inform you of your right to challenge the denial.

16. Breach Notification

In the event of a breach of security safeguards involving Personal Information under Wingman's control where the breach creates a real risk of significant harm to an individual, Wingman will:

• notify the affected individual as soon as feasible after the breach is discovered;
• report the breach to the Office of the Privacy Commissioner of Canada as required under PIPEDA; and
• keep a record of the breach for the period required by law.

17. Minors and Children's Privacy

Wingman's Services are intended for use by adults engaged in commercial activity. We do not knowingly collect Personal Information from individuals under the age of majority in their province of residence. If you become aware that a minor has provided us with Personal Information, please contact our Privacy Officer and we will take reasonable steps to delete that information.

18. Third-Party Websites

The Site may contain links to third-party websites or services that are not operated or controlled by Wingman. This Policy does not apply to such third-party websites or services. We are not responsible for their content or their privacy practices, and we encourage you to read the privacy policies of any third-party site or service before providing them with Personal Information.

19. Changes to This Privacy Policy

Wingman may amend this Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we amend the Policy, we will update the "Effective" date at the top of this page. Where the change is material, we will provide additional notice (for example, by email to active clients or by a prominent notice on the Site) before the change takes effect. The amended Policy will apply prospectively from its effective date.

20. Contact: Privacy Officer

If you have any questions, concerns, complaints, or requests regarding this Policy or Wingman's handling of your Personal Information, please contact our Privacy Officer:

If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca, or with the privacy regulator in your province of residence, if applicable.

This Privacy Policy is effective as of May 12, 2026. © 2026 Wingman Agency Inc.. All rights reserved.