Privacy Policy

1. Privacy Officer

We have designated a Privacy Officer responsible for our compliance with privacy law and for handling your questions, access requests, and complaints.

• Privacy Officer: Billy Zhang, Director, 1585189 B.C. LTD.
• Email: growth@joincapitalclub.com

You may also request our postal address by email if you would prefer to write to us.

2. What We Collect

Information you give us

• Identity and contact — Name, email address, phone number, social media handles
• Application information — Investing experience, professional background, goals, and questionnaire or intake form responses
• Payment information — Billing name, billing address, and transaction history. We never see or store your full card number — payments are handled entirely by our payment processors
• Participation — Work and written analysis you submit, lesson and module completion, session attendance
• Communications — Emails, community messages, SMS, social media messages, form submissions, and support requests
• Recordings — Audio and video recordings of live sessions, workshops, and calls, including your voice, image, name, and anything you say or share

Information we collect automatically

Device and browser type, IP address, approximate location derived from IP address, pages visited, referring source, and activity within our website, course platform, and community, including logins and content accessed.

What we do not want

We do not request brokerage login credentials, brokerage account numbers, account statements, or detailed account holdings. Please do not send us these. If you send them anyway, we will delete them.

Our application and intake forms may ask general questions about your investing experience and the scale of capital you are working with. Answering is up to you, and we use those answers only to assess fit for a program and to pitch teaching at the right level.

3. Why We Collect It

We use your personal information to:

• Evaluate applications and decide on enrollment
• Provide the content, materials, research, community access, and sessions you have access to
• Process payments, manage payment plans, and keep billing and tax records
• Communicate with you about your purchase, schedule, and support requests
• Give you feedback on work you submit
• Verify participation where a guarantee claim is made under a program agreement
• Operate, secure, and improve our website, platforms, and educational content
• Understand which content and resources are useful to our members
• Send you marketing communications, where you have separately consented
• Meet our legal, tax, accounting, and regulatory obligations
• Establish, exercise, or defend legal claims, including disputed charges

We do not use your personal information for a purpose materially different from these without telling you and, where required, obtaining your consent.

Artificial intelligence tools

We use artificial intelligence tools to help draft, organize, and review educational content, and in some cases to help review work you submit. A person reviews the output before it reaches you.

We do not use artificial intelligence to make decisions about your enrollment, refunds, or access without human review. These tools are operated by third-party providers and are subject to their own terms, which may change. If you would prefer that your submitted work not be processed using these tools, tell us and we will accommodate that where it is practical to do so.

4. Consent

We collect, use, and disclose your personal information with your consent, except where the law permits or requires otherwise.

• By purchasing or enrolling, you consent to the collection and use described in this policy for the purpose of delivering what you bought.
• Marketing email and SMS require separate, express opt-in. Consenting to marketing is never a condition of purchase.
• You can withdraw consent at any time, subject to legal and contractual restrictions and on reasonable notice, by emailing our Privacy Officer. If you withdraw consent for information we need in order to deliver something you purchased, we may not be able to continue providing it, and withdrawal does not cancel your payment obligations under our Terms of Service or any program agreement.

5. Who We Share It With

We do not sell, rent, or trade your personal information. We share it in the following situations, and no others.

5.1 Service providers

We use third-party companies to operate the business. They may access your information only to perform services for us, only under contract, and only for that purpose. They are not permitted to use it for their own purposes.

We use service providers in the following categories:

• Membership hosting and checkout — Whop
• Payment processing — Stripe, PayPal
• Community platform — Discord
• Website hosting — Vercel
• Customer relationship management and sales pipeline — Close
• SMS delivery — Twilio
• Email delivery and marketing — Email service providers
• Forms, applications, and intake — Form and survey platforms
• Video calls and recording storage — Video conferencing and cloud storage providers
• Website and marketing analytics — Analytics and advertising platforms, including Google and Meta
• Artificial intelligence assistance — AI service providers

Our providers change from time to time as we improve how we operate. This policy describes the categories of provider we rely on; if you would like to know which specific companies are handling your information today, email our Privacy Officer and we will tell you.

5.2 Business transfers

If we are involved in a merger, acquisition, financing, or sale of all or part of the business, your information may be transferred as part of that transaction. We will require the recipient to protect it under terms consistent with this policy.

5.3 Legal and safety

We may disclose personal information where required by law, court order, subpoena, regulator, or lawful government request, or where reasonably necessary to investigate suspected fraud, enforce our Terms of Service, defend a legal claim or payment dispute, or protect the rights or safety of any person.

5.4 With your direction

Where you ask us to, or give us permission for a specific purpose. Testimonials and any public use of your name or your submitted work require your separate written permission.

6. Where Your Information Goes

Most of our service providers are located in the United States, and your personal information is stored and processed there. This matters. While your information is in another country, it is subject to that country's laws, and courts, law enforcement, regulators, and national security authorities in that country may be able to obtain access to it under their own legal processes, without notice to you.

We use providers who commit contractually to protect your information to a standard comparable to what Canadian law requires. We cannot, however, override foreign legal process.

If you would like more information about our cross-border practices, contact our Privacy Officer.

7. How Long We Keep It

We keep personal information only as long as we need it, then delete or anonymize it.

• Application information, where you did not enroll — 12 months from submission
• Account, enrollment, and participation records — Duration of your access, plus 12 months
• Payment and billing records — 7 years, as required by Canadian tax law
• Session recordings — 24 months after the session
• Work you submit and feedback given — Duration of your access, plus 12 months
• Marketing consent records — While you are subscribed, plus 3 years after withdrawal, to demonstrate consent under anti-spam law
• Community messages — Governed by the community platform's own retention practices
• Support correspondence — 3 years
• Breach records — 24 months, in line with PIPEDA

Where privacy law requires us to keep information that was used to make a decision about you so that you can request access to it, we keep it for at least one year.

8. Cookies, Analytics, and Advertising

Our website and marketing use cookies and similar technologies. There are three kinds.

Necessary. Required for the site and member areas to function — login sessions, security, fraud prevention, and saved preferences. These cannot be turned off.

Analytics. These tell us which pages people visit, where they arrived from, and how they move through the site. Information about your visit, including your IP address, is shared with the analytics provider.

Advertising and conversion tracking. We advertise our programs, and we use advertising and conversion tracking technologies provided by advertising platforms, including Google and Meta. These technologies share information about your visit — including your IP address, the pages you viewed, and actions such as submitting a form or completing a purchase — with the advertising platform. The platform may use that information to measure the performance of our advertising and to show advertising for our programs to you or to people with similar characteristics. This is a disclosure of information about you to a third party for advertising purposes. You can control cookies through your browser settings, and you can limit advertising cookies through your device settings or through the advertising platform's own privacy controls. Turning off necessary cookies may prevent parts of the site from working.

9. Recordings

Live sessions, workshops, and calls may be recorded, as set out in our Terms of Service and any applicable program agreement. By joining a session you consent to being recorded.

• Recordings are used for member replay access, quality assurance, and improving our teaching.
• Recordings of group sessions may be made available to other members of that group.
• Recordings are stored with our video conferencing and cloud storage providers and retained as set out in Section 7.
• If you do not want to appear in a recording, keep your camera and microphone off and submit questions in writing.
• We do not publish recordings publicly or use them in marketing without the separate written permission of everyone identifiable in them.

10. Marketing Communications

Email

We send marketing email only where you have given express consent, as required by Canada's anti-spam legislation. Every marketing message identifies us, includes contact information, and contains a working unsubscribe link. You can unsubscribe at any time and we will action it within 10 business days.

We will continue to send messages necessary to administer your purchase — receipts, schedules, access details, support replies — regardless of your marketing preferences. Those are not marketing.

SMS

• Program name: Capital Club
• Description: If you opt in, you may receive messages about your purchase or enrollment, including confirmations, onboarding steps, session and appointment reminders, and support communications.
• Frequency: Varies with your enrollment and activity.
• Opt out: Reply STOP. We send one confirmation and then stop.
• Help: Reply HELP, or email growth@joincapitalclub.com.
• Rates: Message and data rates may apply.
• Carriers: Carriers are not liable for delayed or undelivered messages.
• Your number: We do not sell, rent, or share your phone number or your SMS consent with third parties for their own marketing purposes. Service providers that help us operate our customer relationship

management, forms, enrollment systems, and messaging services may process your phone number on our behalf, under contract and only for that purpose. See Section 5.1.

• Consent to receive SMS is never a condition of purchase.

11. Your Rights

You have the right to:

• Access the personal information we hold about you, and be told how it has been used and who it has been disclosed to
• Correct information that is inaccurate or incomplete
• Withdraw consent for uses that are not required to deliver something you purchased
• Opt out of marketing at any time
• Request deletion of your information, subject to our legal, tax, and contractual retention obligations To exercise any of these, email growth@joincapitalclub.com. We may need to verify your identity first. We will respond within 30 business days. If we need more time, we will tell you why and when to expect a response. Access is free in most cases; if a request requires substantial effort we will give you a cost estimate before proceeding, and you can withdraw or narrow the request.

We may decline a request in the limited circumstances the law allows — for example where it would reveal another person's personal information, where the information is protected by solicitor-client privilege, or where it relates to an ongoing investigation. If we decline, we will tell you why.

12. If You Are Not Satisfied

Contact our Privacy Officer first. If we have not resolved your concern, you can complain to:

• Office of the Information and Privacy Commissioner for British Columbia — oipc.bc.ca,

1-800-663-7867

• Office of the Privacy Commissioner of Canada — priv.gc.ca, 1-800-282-1376

13. Security

We take reasonable steps to protect personal information against loss, theft, and unauthorized access, use, or disclosure. Our measures include:

• Encrypted transmission of data to and from our website
• Payment processing handled entirely by PCI-compliant third-party processors, so we never store card numbers
• Access to member information limited to the people who need it to do their work
• Use of established platforms that maintain their own security programs
• Prompt removal of access when someone stops working with us

No system is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your own login credentials confidential and for not sharing your access with others.

14. If There Is a Breach

If a breach of security safeguards involving your personal information creates a real risk of significant harm to you, we will:

• Notify you as soon as feasible, describing what happened, what information was involved, what we are doing about it, and what you can do to reduce your risk
• Notify applicable privacy regulators where required by law. Where reporting to the Office of the Information and Privacy Commissioner for British Columbia is not legally required, we may nevertheless report a significant breach as a matter of good practice
• Notify any other organization that may be able to reduce the risk of harm to you

Where a breach falls within the scope of PIPEDA, reporting to the Office of the Privacy Commissioner of Canada and notification to affected individuals is mandatory when the breach creates a real risk of significant harm.

We keep a record of every breach of security safeguards involving personal information, whether or not it meets the notification threshold, for 24 months.

15. Children

Our services are for adults 18 and over. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it promptly. If you believe a minor has given us personal information, contact our Privacy Officer.

16. No Financial Advice

Capital Club provides investing education only. Nothing in our content, communications, or community is personalized financial, investment, legal, or tax advice. Information we collect is used to deliver education and support, not to provide individualized investment recommendations or to assess whether any investment is suitable for you. See our Terms of Service.

17. Changes to This Policy

We may update this policy to reflect changes in our practices or the law. The "Last updated" date at the top shows the current version. If a change is significant, we will notify active members by email before it takes effect. Where a change would require your consent, we will ask for it rather than assume it.

18. Contact

• Privacy Officer, 1585189 B.C. LTD., carrying on business as Capital Club
• Email: growth@joincapitalclub.com
• Website: joincapitalclub.com

If you are writing about a privacy matter, please put "Privacy" in the subject line so it reaches our Privacy Officer promptly.

This Privacy Policy applies to all Capital Club services, including memberships, courses, research, group programs, and mentorship, operated by 1585189 B.C. LTD.