Privacy Policy and Personal Information Protection

Last updated: August 19, 2026

1. Introduction

At Hōkū, operated by BRIGHT IMPACT GROUP INC., the confidentiality of your personal data is at the heart of our priorities. We believe that every user should be able to clearly understand what information we collect, how it is used and shared, and what rights are guaranteed to them under the various applicable laws in the countries where we operate. Our goal is to ensure complete transparency, protect your personal information through robust technical and organizational measures, and respect the highest international standards for privacy protection.

This policy describes in detail our practices concerning personal information collected on our Hōkū web and mobile applications (hereinafter "the Platform"). It covers obligations arising from the General Data Protection Regulation (GDPR) applicable in Europe, Law 25 and the Act respecting the protection of personal information in the private sector (Quebec and Canada), the American CCPA/CPRA and COPPA laws (for the protection of minors), as well as the Privacy Act in force in Australia and New Zealand.

By using the Platform, you acknowledge that you have read this policy and agree that we process your personal data in accordance with the terms described herein.

2. Data Controller

In accordance with applicable laws, Hōkū has designated a Personal Information Protection Officer (PIPO), also known as Data Protection Officer (DPO) in European jurisdictions. This person is specifically mandated to oversee the application of this policy, ensure compliance with legal obligations, manage any incidents related to confidentiality, and be your direct contact for any questions related to the protection of your data.

Company: BRIGHT IMPACT GROUP INC. Address: [Company address — placeholder: Marc to provide] Province: Quebec, Canada Officer Name: Lysa-Marie Morin Email: support@hokusound.com

If you wish to exercise your rights, make an access request, or file a complaint, you can contact the Officer directly at support@hokusound.com. All requests will be processed with diligence and within the timeframes prescribed by law.

3. Consent

We attach particular importance to the principle of consent, which is the cornerstone of data protection laws in all the territories where we operate. The processing of your personal information is based on your explicit, clear and informed agreement.

When you create an account on Hōkū, you agree that we collect and use your information according to the terms of this policy. This consent is always obtained voluntarily, never presumed or forced. We clearly explain the purposes of collection before you share your data.

You can withdraw your consent at any time by deleting your account or by contacting us. This withdrawal may limit your access to certain features, but will never compromise the legality of processing performed prior to withdrawal. In exceptional situations (for example to comply with a legal obligation, protect a user's safety, or respond to a medical emergency), we may process certain data without prior consent.

In accordance with Quebec's Law 25, Hōkū Sound applies privacy by default. All non-essential privacy settings (analytics, marketing, personalization, profiling) are set to the most restrictive configuration by default. Users must actively opt in to enable these features. Essential cookies and necessary account data collection cannot be disabled.

Finally, in accordance with Quebec's Law 25, parental consent is mandatory for users under 14, and in accordance with American COPPA, users under 13 cannot use the Platform without verifiable parental consent.

4. Legal Bases for Processing

In accordance with Article 6 of the GDPR, we process your personal data only when we have a valid lawful basis. The table below maps each processing activity to its lawful basis:

• Account creation and streaming services: Contract — Art. 6(1)(b) — Processing necessary for the performance of a contract to which you are a party
• Payment processing: Contract — Art. 6(1)(b) — Processing necessary to take steps at your request prior to entering into a contract, and for performance of the contract
• Analytics and usage tracking: Consent — Art. 6(1)(a) — Processing based on your explicit opt-in consent, which you can withdraw at any time
• Marketing communications: Consent — Art. 6(1)(a) — Processing based on your explicit opt-in consent for marketing emails and notifications
• Profiling and content recommendations: Consent — Art. 6(1)(a) — Processing based on your explicit opt-in consent for personalized recommendations and behavioral profiling
• Anti-fraud and platform security: Legitimate Interest — Art. 6(1)(f) — Processing necessary for our legitimate interests in protecting the security of the Platform and preventing fraud
• Legal compliance and tax obligations: Legal Obligation — Art. 6(1)(c) — Processing necessary to comply with our legal obligations, including tax reporting and regulatory requirements

5. Automated Decision-Making and Profiling

In accordance with GDPR Article 22 and Quebec's Law 25 (section 12.1), Hōkū Sound uses automated profiling to provide personalized content recommendations. This section discloses the nature, parameters, and your rights regarding this processing.

What we profile: We analyze your listening behavior to build a musical affinity profile that powers our recommendation engine. This is automated processing that does not involve human review of individual profiles.

Parameters used: The profiling system considers the following data points:

• Listening history (tracks played and completion rates)
• Skip behavior (tracks skipped before completion)
• Favorites and playlist additions
• States of mind selected during onboarding and in preferences
• Content type preferences (music, audiobooks, guided sessions)

Your rights:

• You have the right to object to automated profiling at any time
• You have the right to request human intervention in any decision based solely on automated processing
• You can disable profiling by toggling off the "Profiling" option in your Privacy Settings
• When profiling is disabled, all affinity data is purged and recommendations fall back to editorial curation

No significant effects: Hōkū Sound confirms that no automated decision produces legal or similarly significant effects on you. Profiling is used solely for content recommendation purposes and does not affect your access to the Platform, your subscription, or your legal rights.

6. Scope of the Policy

This policy applies to all services offered via the Hōkū web and mobile applications. It governs the collection, use, disclosure and retention of all personal data processed in connection with your use of the Platform.

It does not apply to third-party websites or services that you may access through external links from our Platform. In this case, the privacy practices of these services are entirely separate and we are not responsible for their policies or how they process their information.

7. Information We Collect

We collect different categories of information about you, depending on your use of the Platform.

7.1 Information Provided Directly by You

When you use Hōkū, you may provide personal information that allows us to identify you directly or indirectly, such as:

• Your first name
• Your last name
• Your display name
• Your email address
• Your country of residence
• Your date of birth (stored in a dedicated, access-controlled age verification record — see Section 7.5)
• Your personal preferences and listening preferences
• Your preferred language
• Your privacy choices
• User-generated content (playlists, favorites, comments)
• Privacy incident reports
• Support requests
• Your notification preferences
• Profile photo and biography (optional)

7.2 Automatically Collected Information

When you browse our Platform, certain information is collected automatically:

• Your IP address
• Technical identifiers
• Device type and operating system
• Web browser type
• Pages viewed and visit duration
• Content streamed and listening duration
• Completion status of audio content
• Approximate location data
• Your cookie consent preferences
• Number of requests made
• Device ID

7.3 Information from Third Parties

We may receive information about you from third parties, including:

• Authentication providers (Google, email login)
• Other users (reports, shared playlists)
• Partner service providers (Stripe, SendGrid, hosting services)

7.4 Forms and Interactivity

Personal information is collected through forms:

• Account registration form
• Profile update form
• Personal preferences form
• Playlist creation and management forms
• Privacy incident report form
• Support contact form
• Any other interactive form on the Platform

7.5 Age Verification Data

Your date of birth is collected solely for the purpose of verifying that you meet the minimum age requirement (14 years, in compliance with Quebec's Law 25). This data is stored in a dedicated, access-controlled age verification record that is separate from your main user profile. It cannot be modified directly through your account settings or profile forms — it can only be written through our server-side age validation process. You may request a copy of or deletion of this record at any time by exercising your rights under Section 12.

8. Use of Information

We use the information collected about you for the following purposes:

• Create and manage your account
• Provide audio streaming services
• Personalize your experience and provide content recommendations
• Display user-generated content (with consent)
• Improve and optimize our services
• Communicate with you about service updates and features
• Manage and respond to your requests
• Analyze your listening progress and preferences
• Manage your Premium subscription
• Process payments securely
• Ensure Platform security and prevent fraud
• Comply with our legal obligations
• Send you service-related updates and notifications
• Analyze usage trends to enhance user experience

9. Information Sharing

We never sell or rent your personal information to third parties for commercial purposes. We share your information only in the cases and with the parties described below.

9.1 Sharing with Other Users

Certain profile information is designed to be visible to other users:

• Your display name (if public)
• Your country (if public)
• Your listening preferences (if public)
• Public playlists and favorites
• Public testimonials and comments

9.2 Sharing with Third-Party Service Providers

We use third-party companies to support our operations:

• Hosting and infrastructure (AWS, Deno Deploy, Supabase)
• Payment processing (Stripe)
• Analytics (web analysis services)
• Security (anti-fraud tools)
• Communication (SendGrid for email services)

All service providers are bound by data protection agreements and process your information only as instructed by us.

9.3 Sharing Required by Law

We may disclose your information if required by law or to:

• Comply with a legal obligation
• Protect our rights or property
• Prevent wrongdoing or fraud
• Protect user safety
• Protect against legal liability
• Respond to lawful requests by public authorities

9.4 CCPA/CPRA Specifics

In accordance with CCPA/CPRA, we confirm that Hōkū does not sell or share your personal information to third parties for commercial purposes without your explicit consent. We do not sell personal information of minors under 16 years of age without affirmative authorization.

10. Information Security

We take the security of your information very seriously. Our measures include:

• Encryption of data in transit and at rest (SSL/TLS protocols)
• Strict access controls and authentication protocols
• Regular security audits and vulnerability assessments
• Ongoing staff training on privacy and security best practices
• Incident management and response procedures
• Monitoring and alerting systems for suspicious activities
• Secure data centers with physical security measures

Despite our efforts, no method of transmission over the Internet or electronic storage is completely secure. We are committed to maintaining best practices and industry standards to protect your data, and we respond quickly to any security incidents.

11. Data Retention and Destruction

We retain your information as long as necessary to:

• Provide requested services and maintain your account
• Comply with our legal obligations
• Meet required fiscal and regulatory periods
• Resolve disputes and enforce our agreements
• Support business operations and analytics

When your information is no longer needed for these purposes, it is securely destroyed or irreversibly anonymized in accordance with our data retention policies and applicable legal requirements.

Your age verification record (date of birth) is retained for the duration of your account and is permanently deleted when you delete your account. It is included in full in any data export you request.

After account deletion, we retain certain information for legal and legitimate business purposes, but your personal data is anonymized and cannot be used to identify you.

12. Your Rights

Depending on your location and applicable laws, you have the following rights:

• Right of access to your data: Request a copy of the personal information we hold about you
• Right to rectification: Correct inaccurate or incomplete personal data
• Right to erasure ("right to be forgotten"): Request deletion of your personal data
• Right to data portability: Receive your data in a structured, commonly used format
• Right to object: Object to certain processing activities
• Right to restrict processing: Limit how we use your data
• Right to withdraw consent: Withdraw consent for data processing at any time
• Right to file a complaint: Lodge a complaint with a data protection authority
• Right to non-discrimination: Not be discriminated against for exercising your privacy rights

To exercise these rights, contact our Personal Information Protection Officer at: support@hokusound.com

All requests will be processed promptly and within the timeframes required by applicable law (typically within 30 days for GDPR, 45 days for CCPA/CPRA).

Users may lodge a complaint with the following supervisory authorities:

• Quebec: Commission d'accès à l'information du Québec (CAI) — cai.gouv.qc.ca
• France: Commission nationale de l'informatique et des libertés (CNIL) — cnil.fr
• United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk
• European Union: Your local Data Protection Authority (see edpb.europa.eu)

13. International Transfers

Your data may be processed in different countries, including locations outside your country of residence. When such transfers occur, we implement all necessary safeguards to ensure your data remains protected:

• Standard Contractual Clauses (SCC): For GDPR compliance in European data transfers
• Privacy impact assessments: As required by Quebec's Law 25
• Compliance with CCPA/CPRA: For California residents' data
• Privacy Act compliance: For Australian and New Zealand data protection
• Encryption and robust security measures: Applied to all international data transfers
• Contractual safeguards: With all third-party processors handling your data

We ensure that any international transfer of your personal data complies with applicable data protection laws and that appropriate safeguards are in place.

14. Incident Management

Our comprehensive incident management plan includes:

• Detection: Continuous monitoring systems to identify potential breaches
• Containment and eradication: Immediate action to stop and remove threats
• Assessment: Evaluation of the scope and impact of incidents
• Notification: Prompt notification to users and authorities (within 72 hours if required by GDPR)
• Correction: Implementation of fixes and security enhancements
• Prevention: Measures to prevent future incidents
• Documentation: Detailed records of all incidents and responses

We comply with all legal notification obligations under GDPR, Law 25, PIPEDA, CCPA/CPRA, and other applicable laws. If a data breach occurs that may affect you, we will notify you promptly and provide information about the breach and steps you can take to protect yourself.

15. Confidentiality Incidents

Hōkū Sound maintains an internal Register of Confidentiality Incidents as required by Quebec's Law 25. In the event of a confidentiality incident involving a risk of serious injury (risque de préjudice sérieux) to affected individuals, Hōkū Sound will:

• Notify the Commission d'accès à l'information du Québec (CAI) as soon as possible
• Notify affected individuals in writing
• Record the incident in our internal register
• Take reasonable measures to reduce the risk of injury and prevent recurrence

For GDPR-covered incidents, notifications will be made to the relevant supervisory authority within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33.

Users may report a confidentiality incident through the Privacy section in their account settings. All reports are assigned a unique reference number and are reviewed by our privacy team.

16. Children's Privacy

The minimum age requirement for Hōkū is 14 years, in compliance with Quebec's Law 25.

• COPPA (USA): We do not knowingly collect information from children under 13 without verifiable parental consent
• Law 25 (Quebec): Parental consent is required for users under 14
• GDPR (Europe): Users under 16 may require parental consent depending on their country

Hōkū is not intended for children under the applicable minimum age. We do not knowingly collect personal data from anyone under that age. If you are a parent or guardian and believe your child has provided information without proper consent, please contact us immediately at support@hokusound.com, and we will promptly delete such information.

17. Cookies and Similar Technologies

We use cookies and similar tracking technologies for various purposes:

• Essential Cookies: Required for Platform operation (mandatory, cannot be disabled)
• Preference Cookies: Remember your choices and settings
• Analytics Cookies: Help us understand usage patterns (requires consent)
• Marketing Cookies: Enable relevant advertising and promotional content (requires consent)
• Profiling Cookies: Power our recommendation engine by analyzing your listening behavior (requires consent)

You can manage your cookie preferences via the consent banner displayed on your first visit or through your account settings. Disabling certain cookies may limit functionality of the Platform.

For more detailed information about our use of cookies, please refer to our separate Cookie Policy.

18. Policy Changes

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will inform you of significant changes by:

• Sending an email notification to your registered email address
• Displaying a prominent notice on the Platform
• Updating the "Last updated" date at the top of this policy

We encourage you to check this policy regularly to stay informed about how we protect your personal information. Continued use of the Platform after updates implies acceptance of the revised policy.

19. Contact

For any questions about this Privacy Policy or the protection of your personal data, please contact us at support@hokusound.com.