Privacy Policy

1.1 The Flockr Inc. is a company incorporated under the Canada Business Corporations Act (CBCA) that operates Koup, a verified student social platform for participating post-secondary institutions in Canada and the United States, currently including the University of British Columbia (Vancouver campus), Simon Fraser University and Purdue University. This Privacy Policy applies to all Personal Information that Koup collects through the Koup mobile application, the website at koup.ca, and all associated software, APIs, features, tools, and services (collectively, the "Platform").

1.2 This Privacy Policy applies to Personal Information about Users of the Platform, including Verified Students, guests, applicants for verification, campus ambassadors and partners, and individuals who contact us with enquiries. It does not apply to information collected by third parties whose services are linked to or integrated with the Platform, whose handling of your information is governed by their own privacy policies.

1.3 Koup is an independent private company. It is not affiliated with, endorsed by, or acting as an agent of any post-secondary institution. Verifying your student status using institutional email or domain-based eligibility checks does not create any data-sharing arrangement between Koup and your institution beyond what is described in this Policy or in any applicable institutional agreement.

1.4 In this Policy, "Personal Information" has the meaning given under PIPA and PIPEDA and generally means information about an identifiable individual. "Sensitive Personal Information" means Personal Information about race or ethnic origin, religious beliefs, political opinions, mental or physical health, sexual orientation or gender identity, financial circumstances, or other categories designated as sensitive under Applicable Law.

Koup collects, uses, and discloses Personal Information in accordance with:

• The Personal Information Protection Act (PIPA), S.B.C. 2003, c. 63, as amended, which is the primary statute applicable to our activities in British Columbia;
• The Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5, as amended, which applies to inter-provincial and cross-border data flows and to commercial activities not fully covered by PIPA;
• Canada's Anti-Spam Legislation (CASL), S.C. 2010, c. 23, in respect of commercial electronic messages;
• Any successor federal privacy legislation, including any successor to, or replacement of, PIPEDA and any equivalent federal privacy statute enacted from time to time; and
• All other Applicable Law relating to the protection of Personal Information and privacy. Where this Policy and the Terms and Conditions conflict on a matter concerning the collection, use, or disclosure of Personal Information, this Policy governs.

3.1 We collect the following categories of Personal Information, consistent with the categories described in the Terms and Conditions:

• Identity and verification information: your full legal name and institutional email address (verification is based on institutional email or domain-based eligibility checks);
• Alternative student verification information (only if you apply): if a participating campus offers the alternative student verification process described in Section 2.4 of the Terms and Conditions and you apply through it, we collect the email address you apply with, your full name, the campus you apply to, the institution you name, the reason you select, any messages you exchange with reviewers, and the supporting documents you upload (such as a letter of enrolment, a class schedule, or a student card), including each document's file name. We also create a digital fingerprint of each document, used to detect the same document being submitted in more than one application, and a keyed one-way fingerprint of your email address, used to recognize a repeat application after the address itself has been deleted. Supporting documents are stored in a private location that is never publicly accessible. They can be opened only by the administrators Koup has authorized to review applications for that campus and by Koup's platform administrators, each of whom must sign in with two-factor authentication to open them, and we record each time a document is opened. We do not send supporting documents to our automated content screening provider.
• Profile information you provide: biography, academic program, year of study, declared interests, profile photograph, and other optional profile fields;
• User Content: posts, messages, photographs, Market and Nest Finder listings, event submissions, reactions, reviews, and other content you create or make available through features including Spotlight, Market, Nest Finder, The Chirp, The Flock, FlyBy, Messages, and The Perch;
• Communications and messages sent through the Platform's messaging features, stored solely to deliver those messages and provide the messaging service;
• Audio and video recordings you create through the Platform, including voice notes and videos recorded and sent using the Messages feature;
• Device and technical information: IP address, operating system type and version, browser type and version, network type and carrier, device model, and screen resolution;
• Usage and behavioural data: features accessed, content viewed, session time and duration, interactions with other users and content, search queries, and in-app navigation patterns;
• Koup does not currently offer payment processing for in-app purchases, ticketing, or promotional boosts. If a payment feature is introduced in the future, we will process payment-related information only where that feature is available and enabled, and we will update this Policy accordingly;
• Communications you send us: support requests, feedback, reports, appeals, and survey or research responses; and
• Information received from third-party sources: student verification providers, social authentication services (if offered), and campus partner institutions.

3.2 We do not intentionally collect Sensitive Personal Information except where you voluntarily include it in your profile or User Content, or where it is strictly necessary and you have provided any additional consent required under Applicable Law. All Public Content, including your profile information, is visible to every Verified Student on the Platform, and we do not currently offer settings that restrict its visibility to particular users or groups. You are responsible for any Sensitive Personal Information you choose to disclose in your profile or Public Content.

3.3 The Chirp supports both anonymous and attributed posting. If a post is displayed without name attribution, it is shown anonymously to other users, but Koup retains internal records for moderation, safety, and legal compliance. Chirp posts are classified by category tags as described in the Community Guidelines. Anonymity within the Platform applies only to the display layer; it does not exempt you from legal obligations and does not prevent us from identifying you internally or in response to lawful legal process.

We collect and use your Personal Information for the following purposes:

• To create and maintain your Account and verify your eligibility and student status;
• To review, decide and communicate with you about an alternative student verification application, to let an approved email address create one Account on the campus it was approved for, and to detect fraudulent or repeated applications;
• To provide, operate, maintain, improve, and personalize the Platform and its features;
• To facilitate communications between users, including messages, notifications, and event invitations;
• To display and distribute your Public Content to other Verified Students, and to deliver your Private Content to the recipients you select, in accordance with the Terms and Conditions;
• To send you administrative communications, including account confirmations, password resets, and policy updates;
• To send you commercial electronic messages and marketing communications where you have consented, in accordance with CASL;
• To analyze Platform usage and conduct research for product development, feature improvement, and academic or industry research;
• To enforce the Terms and Conditions, Community Guidelines, and Applicable Law, including investigating complaints and taking enforcement action;
• To protect the safety, security, and integrity of the Platform and its users;
• To detect, prevent, and report content that sexually exploits or endangers a child, and to comply with our mandatory reporting and preservation obligations as described in Section 15A;
• To review content for safety, moderation, quality, and enforcement purposes, including through automated tools and third-party service providers as described in Section 8; and
• To comply with legal obligations, respond to legal processes, and cooperate with law enforcement and regulatory authorities.

5.1 By registering for and using the Platform, you consent to the collection, use, and disclosure of your Personal Information as described in this Policy. Where Applicable Law requires a higher standard of consent for a particular use, we obtain express consent for that use before it begins.

5.2 We rely on the form of consent appropriate to the sensitivity of the information and your reasonable expectations. In some cases, consent may be implied, for example, where you voluntarily provide information for an obvious purpose. Sensitive Personal Information, and any future use of your information for interest-based advertising, require a higher standard of consent.

5.3 You may withdraw your consent to certain uses or disclosures at any time, subject to legal and contractual restrictions and reasonable notice. We will inform you of the likely consequences of withdrawing consent before it takes effect. Withdrawing consent may limit or prevent your use of certain features. Withdrawal does not apply retroactively to processing already carried out and does not affect administrative or transactional communications necessary to operate your Account.

6.1 Advertising

The Platform is free to Verified Students and may display advertisements and sponsored content from campus organizations, local businesses and other advertisers. The only information we use to choose which ads you see is the campus you belong to; we do not use your activity, your profile or any other Personal Information to select ads, and we do not use device identifiers for advertising purposes. We do not share Personal Information that identifies you with advertisers. If you tap an ad, you leave the Platform, and the advertiser's own website and privacy policy apply to anything that happens there.

If Koup introduces interest-based advertising, or ads served through third-party advertising networks, we will update this Policy before doing so and will describe the categories of information used, the advertising partners involved, the standard of consent applicable to each use, and the controls available to you. Any use of your Personal Information for interest-based advertising will require your express consent, obtained in accordance with PIPA and PIPEDA. On iOS devices, any use of device identifiers for advertising purposes would additionally require your permission through Apple's App Tracking Transparency framework.

6.2 No Disclosure for Third-Party Marketing

Koup does not disclose Personal Information that identifies you to campus partners, advertisers, or other third parties for marketing purposes. Reports we provide to campus partners regarding Platform reach and engagement are compiled at a level of aggregation that does not permit identification of any individual user, and no such report describes a group of fewer than twenty-five users.

6.3 Cookies and Similar Technologies

We use cookies and similar technologies that are necessary for the Platform to function, and to remember your preferences. Strictly necessary cookies cannot be disabled, as the Platform cannot operate without them. Where technically feasible, we provide in-app controls allowing you to manage non-essential cookies and tracking preferences, and most web browsers allow you to control or block cookies through browser settings; blocking certain cookies may affect your ability to use some features.

We do not currently use advertising or targeting cookies, and we do not use tracking technologies that follow your activity across other websites or applications. If we introduce interest-based advertising or third-party advertising networks in the future, we will update this Policy and describe any such technologies and the controls available to you before they are used.

Because there is no industry standard for how platforms should respond to "Do Not Track" signals, we do not currently alter our data collection practices in response to them. We will revisit this position if a standardized approach is established.

Bot protection. The alternative student verification page uses Cloudflare Turnstile to distinguish people from automated scripts. It runs only on that page. To run the check, Cloudflare receives your IP address and basic information about your browser and device; it is not used for advertising or to track you across other websites. To limit abuse of the page, we also keep a one-way hash of your IP address for up to 2 days.

6.4 Device Permissions

With your consent, the Koup app may request access to certain device features to provide Platform functionality. You may grant or revoke each permission at any time through your device's operating-system settings; revoking a permission may disable the related feature. We use data obtained through these permissions only for the purposes described below and in this Policy:

• Camera: to take photos and videos that you choose to share, such as a photo you post to your campus FlyBy feed, where other students at your university can see it, or a photo or video you send in a direct message or group chat;
• Photo library: to let you choose photos and videos to share, such as a profile photo, a post to your campus feed or the Market, a photo or video you send in a chat, or a screenshot you attach to a support request; and to save photos and videos from your chats to your photo library when you ask us to;
• Notifications: to deliver push notifications you have enabled;
• Microphone: to record audio that you choose to send, such as a voice note in a chat or the sound of a video you record and send in a direct message or group chat, only while you are actively recording and only where you have granted permission; and
• Contacts: only if social-import features are introduced, and only where you grant permission.

7.1 Disclosures

We do not sell your Personal Information, and we do not disclose Personal Information that identifies you to advertisers or campus partners for marketing purposes. We disclose Personal Information only as described in this Policy, including to other Verified Students as described in the Terms and Conditions, to service providers acting on our behalf as described in Section 7.2, in connection with a business transaction as described in Section 7.4, and as required or permitted by Applicable Law, including where reporting is required under Section 15A.

7.2 Service Providers

We use third-party service providers to operate the Platform, including cloud hosting, analytics, customer support, email delivery, error monitoring (Sentry), bot protection (Cloudflare Turnstile, on the alternative student verification page), student verification, and automated content screening (OpenAI, L.L.C., which receives the text and images you post in order to classify them for safety before they become visible to other users). These providers are bound by contractual obligations to protect your Personal Information consistent with PIPA and PIPEDA and to use it only for the purposes we specify. Koup does not currently offer payment processing; if a payment feature is introduced in the future, any payment processing will be handled by a third-party payment processor and this Policy will be updated to describe it.

7.3 Cross-Border Transfers

Your Personal Information is stored outside Canada. Our main database and file storage, which hold your Account information, the content you post, your messages and any documents you upload, are hosted by our cloud hosting provider, Supabase, on Amazon Web Services servers in the United States (Oregon). Some of our other service providers also store or process Personal Information outside British Columbia or Canada. Where Personal Information is stored or processed outside Canada, we require contractual protections consistent with PIPA and PIPEDA. You acknowledge that Personal Information transferred outside Canada may be subject to the laws of the receiving jurisdiction, and that foreign governments, courts, or regulators may have lawful access to it. For a current list of our material third-party processors and their jurisdictions, contact privacy@koup.ca.

OpenAI, L.L.C., Sentry and KLIPY (KIKLIKO, Inc.) are located in the United States, and KLIPY operates a global content delivery network. Because your device connects to KLIPY directly rather than through our servers, the network information described in Section 7.5 is transmitted outside Canada at the time of each request, and we do not control the jurisdictions through which it is routed.

7.4 Business Transactions

If Koup is involved in a merger, amalgamation, acquisition, financing, reorganization, or sale of all or substantially all of its assets, Personal Information may be disclosed to or transferred to the counterparty as part of that transaction, subject to appropriate confidentiality protections and Applicable Law.

7.5 Third-Party Content Loaded Directly by Your Device

Some features load media from a third party's servers rather than from ours. The GIF picker in comments is provided by KLIPY (KIKLIKO, Inc.). When you open the GIF picker or search for a GIF, your device sends your search terms directly to KLIPY. When a GIF appears anywhere on the Platform, whether you posted it or another user did, your device loads that image directly from KLIPY's content delivery network.

Because these connections are made by your device and not by our servers, KLIPY receives your IP address, your browser or device User-Agent, and the date and time of each request, and may set or read its own cookies or similar identifiers under its own privacy policy. We do not send KLIPY your name, your email address, your student status, your Koup account identifier, or the text of your comments.

We do not copy, store, or re-host GIF images on our systems. When you post a GIF, we store only the image address returned by KLIPY, the image dimensions, and an identifier for the item you selected. KLIPY is not acting on our behalf as a service provider under Section 7.2, and the contractual protections described in that Section do not apply to information KLIPY collects directly from your device.

8.1 Aggregate Data

We may derive, compile, analyze, use, publish, license, and disclose aggregated, de-identified, or anonymized information derived from use of the Platform ("Aggregate Data"), provided it cannot reasonably be used, alone or in combination with other information, to identify any individual. Aggregate Data does not constitute Personal Information. We retain all rights in Aggregate Data and may use it for research and analytics, product development, industry benchmarking, campus partnership reports, monetization through data and insights services (subject to PIPEDA and PIPA), and academic or commercial publication. Where Aggregate Data is disclosed to a campus partner, advertiser, or other third party, it is compiled at a level of aggregation that does not permit identification of any individual user, and no such disclosure describes a group of fewer than twenty-five users.

8.2 Artificial Intelligence and Machine Learning

We do not use Personal Information that identifies you to train, fine-tune, or develop any artificial intelligence or machine learning model. Any use of your information for those purposes is limited to de-identified, aggregated, or anonymized data. We do not sell, license, or otherwise make available to any third party any model trained on User Content, and we do not disclose User Content to any third party for the purpose of training that party's models, without your express consent.

8.3 Automated Content Review

We use automated tools, and may use third-party service providers, to review content for safety, moderation, quality, and enforcement purposes, including automated screening and classification of user-generated content. This processing is used to operate the Platform and to reduce harmful or unlawful content. It is distinct from the training or sale of AI models described in Section 8.2. Where enforcement action is taken against you or your content solely on the basis of an automated determination, we will identify the action as automated and you may request review by a person, as described in the Terms and Conditions.

GIF images selected through the GIF picker are drawn from a third-party catalog with that provider's content filter applied at its most restrictive available setting, and are not separately screened by our automated tools before they appear. They remain subject to reporting and removal in the same way as any other User Content.

We retain Personal Information only for as long as reasonably necessary to fulfil the purposes for which it was collected, subject to longer periods required or permitted by Applicable Law. In general:

• Account information is retained for the duration of your active Account and for a defined period following deletion, as required for legal, compliance, and fraud-prevention purposes;
• User Content may be retained for a period following deletion where it exists in backups, has been shared with other users who have not deleted it, or must be retained for legal reasons;
• Transaction records are retained for the period required under applicable tax and financial-reporting laws;
• CASL consent records are retained for at least three (3) years following the end of the commercial relationship or withdrawal of consent, whichever is later;
• Alternative student verification records are kept on their own schedule. An application that is started but not submitted is deleted, with any uploaded documents, after 2 days without activity. If you withdraw an application, its documents and personal information are deleted within about a day. Otherwise, supporting documents are deleted 30 days after the application is decided or closed (an application closes if a request for more information goes unanswered for 30 days); your name, the email address you applied with, the institution you named and any messages are deleted 30 days after an approval is used to create an Account, and otherwise 90 days after the decision or closure; and the keyed fingerprint of your email address is deleted 12 months after the decision or closure. An approval expires 30 days after it is granted unless it is used or revoked first. We keep a minimal record of each application after that (the campus, the reason selected, the outcome, the relevant dates, and which administrators acted on it); if the application was approved and used, that record stays linked to the Account it created for as long as the Account exists. Deleting your Account does not extend any of these periods.
• Server logs and technical data are retained in accordance with standard operational and security practices. Upon deletion of your Account, we take commercially reasonable steps to delete or anonymize your Personal Information within 90 days, subject to the retention obligations above and to Section 9.1. Residual copies may persist in backup archives for a limited period and are overwritten through standard backup rotation. We remove Personal Information from active systems as soon as reasonably practicable following Account deletion, subject to legal retention obligations.

9.1 Legal Holds and Preservation Obligations

• Certain information is excluded from our standard deletion cycle where we are required or permitted by law to retain it. Information is placed under legal hold, and retained notwithstanding any deletion request or Account deletion, where:
• We have received a notice of claimed copyright infringement under sections 41.25 to 41.27 of the Copyright Act, in which case records permitting identification of the User responsible for the identified location are retained for six months from receipt of the notice, or one year where proceedings are commenced and we are notified before the end of that six-month period;
• We have received a report concerning a non-consensual intimate image, or an order made under the Intimate Images Protection Act, S.B.C. 2023, c. 11 or equivalent legislation;
• We are required to preserve data under An Act respecting the mandatory reporting of Internet child pornography by persons who provide an Internet service, S.C. 2011, c. 4;
• We are subject to a court order, search warrant, production order, preservation demand, or other lawful legal process; or
• Information is reasonably required in connection with an active investigation, a legal claim, or the enforcement of our Terms and Conditions.
• Information under legal hold is retained only for as long as the applicable obligation or process requires, and is deleted or anonymized once the hold ends, subject to any other applicable retention period.

The periods above are general maximums. We may retain information for shorter periods where possible, or longer where required by law, a legal hold, or an active investigation. When information is no longer needed, we securely delete or irreversibly anonymize it.

Subject to Applicable Law, you have the following rights with respect to your Personal Information:

• Right of Access: to confirm whether we hold Personal Information about you and to obtain access to it, information about how it is used, and the third parties to whom it has been disclosed;
• Right to Correction: to request correction of inaccurate, incomplete, or misleading Personal Information, with notice of corrections to third parties where we have disclosed the information to them;
• Right to Withdraw Consent: to withdraw consent to certain uses or disclosures, subject to legal and contractual restrictions and reasonable notice;
• Right to Deletion: to request deletion of your Personal Information, subject to our legal retention obligations and the rights of other users who have interacted with your content;
• Right to Data Portability: to request a copy of your Personal Information and User Content in a commonly used, machine-readable format, as described in Section 11;
• Right to Challenge Compliance (PIPEDA Principle 10): to challenge our compliance with the fair information principles; and
• Right to Complain to Regulators: to complain to the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) at www.oipc.bc.ca or the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca. To exercise any of these rights, contact our Privacy Officer at privacy@koup.ca. We will acknowledge your request promptly and respond substantively within 30 days of receipt, as required under PIPA. If we require more time, we will notify you of the delay, the reasons, and the expected response date. If we decline access or a correction, we will give reasons and advise you of your right to complain to the applicable regulator.

11.1

You may request a copy of the Personal Information and User Content associated with your Account by writing to privacy@koup.ca and including your full name, registered email address, Account username, and proof of identity satisfactory to us. We will provide a copy in a commonly used, machine-readable format (such as JSON or CSV) within 30 calendar days of a valid request, subject to permitted extensions. If you applied through alternative student verification and do not have an Account, you may make any request under Sections 10 and 11 using the email address you applied with, in place of an Account username.

11.2

An export will include, to the extent technically feasible, your profile information, User Content you have posted, a record of your Account activity, your privacy and notification preferences, and other Personal Information subject to access under PIPA. It will not include Private Content (messages) sent to you by other users where disclosure would violate their privacy rights, our internal operational or moderation records, derived data that is not Personal Information, or information we are legally prohibited from disclosing.

11.3

We may decline or limit a request that is manifestly unfounded or excessive (including by its repetitive character), that would adversely affect the rights of others, or that falls within a category we are not required to disclose. Where we decline or limit a request, we will explain why and advise you of your right to complain to the OIPC BC. We may charge a reasonable fee for manifestly excessive or repetitive requests, consistent with PIPA.

We implement and maintain commercially reasonable technical, organizational, and administrative safeguards designed to protect Personal Information from unauthorized access, use, disclosure, alteration, loss, or destruction. These safeguards are described in Section 16.1 of the Terms and Conditions. No security system is impenetrable, and we cannot guarantee absolute security. You are responsible for maintaining the security of your own device and Account credentials, and you provide Personal Information at your own risk.

If we become aware of a security breach involving Personal Information that, in our assessment, creates a real risk of significant harm to one or more individuals, we will notify affected individuals and the applicable regulator (OIPC BC and/or OPC) in accordance with PIPA and PIPEDA. Notification will be provided as soon as reasonably practicable after we confirm the breach and will include, to the extent known, a description of the breach, the categories and approximate number of individuals affected, the categories and approximate volume of Personal Information involved, the likely consequences, the measures taken or proposed to address it, and contact information for our Privacy Officer. We maintain records of all security breaches, including those that do not meet the notification threshold, as required under PIPA.

The Platform is designed exclusively for post-secondary students and is not directed at individuals under 17. We do not knowingly create Accounts for or collect Personal Information from individuals under 17. Student enrollment verification serves as our primary age-assurance mechanism. If we become aware that an Account holder does not meet the minimum age requirement, we will promptly suspend or terminate the Account and delete associated Personal Information in accordance with Applicable Law. If you are a parent or guardian who believes a minor has created an Account without authorization, contact privacy@koup.ca and we will investigate promptly. Separately from the age-assurance measures described above, we are subject to mandatory reporting obligations in respect of content that sexually exploits a child, regardless of the age of the person who posted it. Those obligations are described in Section 15A.1.

We disclose Personal Information to government authorities, law enforcement, courts, or regulators where compelled by a valid court order, search warrant, subpoena, production order, or other lawful process; where required by Applicable Law, including the reporting obligations described in Section 15A; where necessary to prevent or respond to an imminent threat to the life or safety of any individual; or where otherwise required or permitted under PIPA, PIPEDA, or other Applicable Law. Apart from the circumstances described above, we do not voluntarily disclose Personal Information to government authorities or law enforcement. We reserve the right to require that requests be made through proper legal channels and to challenge requests we believe are unlawful or overbroad. Where legally permitted, we will endeavour to notify you before disclosing your Personal Information so that you may seek legal advice. We may be prohibited from providing such notice, and will not provide notice where doing so is prohibited by Applicable Law or would compromise an investigation, including in the circumstances described in Section 15A.

15A.1 Child Sexual Exploitation

We are subject to An Act respecting the mandatory reporting of Internet child pornography by persons who provide an Internet service, S.C. 2011, c. 4. Where we are advised of an internet address at which child pornography may be available to the public, we report that address to the organization designated under that Act. Where we have reasonable grounds to believe that our service is being or has been used to commit a child pornography offence, we notify law enforcement and preserve the associated data for the period required by that Act.

Reporting and preservation under this Section are carried out regardless of any other provision of this Policy, including provisions relating to consent, notice, data retention, deletion, or the confidentiality of Private Content. We will not notify you of a report made under this Section where doing so is prohibited by Applicable Law or would compromise an investigation.

15A.2 Non-Consensual Intimate Images

The Intimate Images Protection Act, S.B.C. 2023, c. 11 provides an expedited process, available through the Civil Resolution Tribunal, for individuals seeking removal of intimate images distributed without their consent, and permits orders to be made against internet intermediaries such as Koup. We comply with orders made under that Act and retain the records necessary to identify, restrict, and remove reported content and to respond to such orders. Information about that process is available at takebackyourimages.gov.bc.ca.

Reports of non-consensual intimate images may be submitted through the in-app reporting tool or to safety@koup.ca and are prioritized ahead of other reports. You are not required to identify yourself to make such a report, and we will not disclose the identity of a reporting individual to the person reported except where required by Applicable Law.

15A.3 Imminent Risk to Safety

Where we have reasonable grounds to believe that there is an imminent risk to the life, health, or safety of any individual, we may disclose Personal Information to law enforcement, emergency services, or another person in a position to prevent or reduce that risk, as permitted under PIPA and PIPEDA. Such disclosure is limited to what is reasonably necessary in the circumstances.

Koup is not a public body under the Freedom of Information and Protection of Privacy Act (FIPPA), R.S.B.C. 1996, c. 165, and its own operations are governed by PIPA, not FIPPA. Student records, grades, enrollment data, and other educational records held by your institution remain subject to FIPPA and are the institution's responsibility. We do not access, collect, or store your academic records, grades, course enrolment, or other educational records held by your institution. We respond to requests from institutions only where you have provided express written consent, the institution provides a valid legal basis, or disclosure is necessary to prevent an imminent threat to campus safety. This does not apply to supporting documents you choose to upload in an alternative student verification application, such as a letter of enrolment or a class schedule, which we collect and delete as described in Sections 3.1 and 9.

17.1 Privacy Officer

We have designated a Privacy Officer who is accountable for our compliance with PIPA, PIPEDA, and this Policy. The Privacy Officer can be reached at privacy@koup.ca.

17.2 Openness

We make this Policy, the Terms and Conditions, and the Community Guidelines available within the Platform and on our website, provide updated versions promptly following material changes, and respond to enquiries about our privacy practices, including from individuals who do not hold an Account.

17.3 Complaints Procedure

If you have a privacy concern, we encourage you to follow our internal complaints procedure before contacting a regulator: (Step 1) submit your complaint in writing to privacy@koup.ca with your name, contact information, a description of your concern, and any supporting documentation; (Step 2) we acknowledge receipt within 5 business days and assign a qualified reviewer; (Step 3) we investigate impartially and in good faith; (Step 4) we provide a written response within 30 calendar days setting out our findings and any remedial steps; and (Step 5) if you are not satisfied, you may escalate to the OIPC BC (www.oipc.bc.ca) or the OPC (www.priv.gc.ca). We maintain a record of all privacy complaints and review them periodically to improve our practices.

We may amend this Privacy Policy from time to time to reflect changes in the Platform, Applicable Law, or our practices. When we make material changes, we will post the revised Policy with an updated "Last Updated" date and version number, and provide notice through one or more of an in-app notification, push notification, email to your registered address, or a notice on next login. Where required by Applicable Law, we will obtain fresh consent before the changes take effect. Your continued use of the Platform after the effective date of any change constitutes acceptance of the revised Policy.

For any question, concern, complaint, or request relating to this Privacy Policy or your Personal Information, please contact us:

• Privacy Officer & Data Requests: privacy@koup.ca
• Safety & Non-Consensual Image Reports: safety@koup.ca
• General Support & Inquiries: support@koup.ca
• Legal Notices: legal@koup.ca
• Website: www.koup.ca You may also contact the Office of the Information and Privacy Commissioner for British Columbia at www.oipc.bc.ca, or the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

U1. Application and Who Is Responsible for Your Information

U1.1 When Part U applies. This Part U applies to US Users, as defined in Part U of the Terms and Conditions, including students at Purdue University. The rest of this Policy continues to apply to US Users, as modified by this Part U. If anything in this Part U conflicts with another provision of this Policy, this Part U controls for US Users.

U1.2 Who is responsible. The Flockr Inc. is currently responsible for the Personal Information of US Users. The Flockr Inc. intends to transfer its agreement with US Users to a United States subsidiary, as described in Section U1.3 of the Terms and Conditions. From the effective date of that transfer, the subsidiary will be responsible for the Personal Information of US Users, and The Flockr Inc. will continue to process that information on the subsidiary's behalf under a written agreement that requires it to protect the information consistently with this Policy. We will notify you before the transfer takes effect. In this Part U, "Koup US" means the entity responsible for US Users' Personal Information at the relevant time.

U1.3 Applicable law. For US Users, references in this Policy to "Applicable Law" include applicable United States federal and state law. Provisions of this Policy that rely only on Canadian or British Columbia law, including the references to CASL, the Copyright Act (Canada), the Intimate Images Protection Act (BC), FIPPA and the federal Canadian mandatory reporting statute, apply to US Users only to the extent consistent with this Part U; where this Part U provides a United States equivalent, that equivalent applies instead.

U2. Where Your Information Is Stored and Processed

Koup is operated from Canada. If you are a US User, your Personal Information is stored in the United States, in our main database and file storage in Oregon described in Section 7.3. Koup's team accesses and manages it from Canada, and some of our service providers process it in other countries, as described in Sections 7.2, 7.3 and 7.5. Information accessed or processed in Canada is subject to Canadian law and may be accessible to Canadian courts, law enforcement and regulators under that law. We apply the protections described in this Policy to your Personal Information wherever it is stored or processed.

U3. Your Privacy Rights as a US User

U3.1 Rights available to you. Regardless of the state where you live, you may exercise the rights described in Sections 10 and 11, including the rights to access your Personal Information, to correct it, to delete it and to obtain a portable copy of it, subject to the limitations described in those Sections and in Section U6. To exercise these rights, contact privacy@koup.ca. We will respond within 30 days of receiving your request.

U3.2 Reconsideration. If we decline your request in whole or in part, we will explain why. You may ask us to reconsider by replying to our response within 30 days, and we will respond to that request within 30 days.

U3.3 No discrimination. We will not deny you access to the Platform, or provide a different level of service, because you exercised any of these rights, except where fulfilling a deletion request means we can no longer provide your Account.

U3.4 Complaints. For US Users, the references to the OIPC BC and the OPC in Sections 10, 11.3 and 17.3 do not apply. If you are not satisfied with our response to a privacy concern, you may contact the US Federal Trade Commission at reportfraud.ftc.gov or the attorney general of the state where you live (see Annex S).

U4. No Sale of Personal Information and No Targeted Advertising

We do not sell Personal Information, and we do not share it with third parties for cross-context behavioural or targeted advertising. We do not use Personal Information for profiling that produces legal or similarly significant effects on you. If this changes, we will update this Policy before doing so and will provide any opt-out or consent required by the law of your state.

U5. Emails and Text Messages

For US Users, the references to CASL in Sections 2, 4 and 9 are replaced as follows. Promotional emails we send to US Users comply with the CAN-SPAM Act, 15 U.S.C. § 7701 et seq., and contain a working unsubscribe link, and we process unsubscribe requests within 10 business days. We do not send marketing text messages. Administrative and transactional messages necessary to operate your Account continue to be sent while your Account is open.

U6. Additional Retention and Preservation Obligations

In addition to the legal holds in Section 9.1, information relating to US Users is retained, notwithstanding any deletion request or Account deletion, in the following circumstances:

• Copyright notices and counter-notices under the Digital Millennium Copyright Act, 17 U.S.C. § 512: the notice, any counter-notice and the identity of the User concerned are retained for as long as needed to administer the notice process and our repeat infringer policy, and for up to 3 years after the matter is closed;
• Removal requests under the TAKE IT DOWN Act, Public Law 119-12: request records, reference numbers, content identifiers and actions taken are retained for 24 months to demonstrate compliance. Reported content itself is removed;
• Reports to the National Center for Missing & Exploited Children under 18 U.S.C. § 2258A: the reported content and related Account information are preserved for at least one year after the report, as required by federal law, and may be preserved longer to help prevent child exploitation; and
• Preservation requests and legal process from US authorities, including requests under 18 U.S.C. § 2703(f): information is preserved for the period the request or process requires.

U7. Data Breach Notification

For US Users, Section 13 applies with the following modification. We do not collect your state of residence. If a security breach involves the Personal Information of US Users, we will use the information we hold, including each affected individual's campus, to determine which state laws apply, and we will notify affected individuals, state attorneys general and other authorities as required by the breach notification law of each state whose residents are affected (see Annex S for Indiana). Where we cannot determine an individual's state of residence, we will provide notice that meets the requirements of the state where their campus is located, within the shortest period required by any state law that may apply.

U8. Children

The Platform is not directed to children under 13, and we do not knowingly collect Personal Information from children under 13, consistent with the Children's Online Privacy Protection Act. As described in Section 14, the minimum age for any Account is 17. If you believe a child has provided us with Personal Information, contact privacy@koup.ca and we will delete it.

U9. Law Enforcement, Mandatory Reporting and Institutions

U9.1 US legal process. We respond to US legal process in accordance with applicable law, including the Stored Communications Act, 18 U.S.C. §§ 2701–2713, and may disclose information in an emergency involving danger of death or serious physical injury as permitted by 18 U.S.C. § 2702. Section 15 otherwise applies to US Users.

U9.2 Mandatory reporting. In addition to Section 15A.1, once we have registered with the National Center for Missing & Exploited Children, we will report apparent child sexual exploitation, child sex trafficking and enticement of a minor of which we become aware to its CyberTipline, as required by 18 U.S.C. § 2258A. For US Users, removal requests for intimate images shared without consent are handled under Section U5 of the Terms and Conditions, in place of the process described in Section 15A.2.

U9.3 Educational records. Koup is not a school and does not receive education records from any US Institution. The Family Educational Rights and Privacy Act does not apply to information we collect from you. For US Users, Section 16 applies only to the extent it describes our practice of not accessing educational records and of responding to institutional requests only with your consent, a valid legal basis or to prevent an imminent threat to safety.

U10. Contact for US Users

US Users may contact our Privacy Officer at privacy@koup.ca, or by mail at 1901-3487 Binning Rd, Vancouver, British Columbia V6S 0K8, Canada.

S.1 How this Annex works. This Annex adds terms for US Users who reside in the states listed below. If your state is not listed, Part U applies to you without additions.

S.2 Indiana

S.2.1 Breach notification. Where Indiana's breach notification law, Indiana Code 24-4.9, applies to a breach, we will notify affected Indiana residents without unreasonable delay and no later than 45 days after discovering the breach, and will notify the Indiana Attorney General.

S.2.2 Complaints. Indiana residents may contact the Consumer Protection Division of the Office of the Indiana Attorney General about any privacy concern.