SLATE FINANCIAL TECHNOLOGIES INC.

DATA COLLECTION AND USE POLICY

Effective Date: October 1, 2025

Last Updated: February 6, 2026

Important Notice

This Data Collection and Use Policy explains how Slate Financial Technologies Inc. (“Slate,” “we,” “us,” or “our”) collects, uses, and discloses your personal information when you apply for and use our receivables purchase services. This Policy is provided in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws.

By submitting an application or using our services, you acknowledge that you have read, understood, and consent to the practices described in this Policy.

Nature of Our Services

Slate provides receivables purchase services, not loans. When you use our services, you sell a portion of your future receivables to Slate in exchange for immediate capital. This is a true sale of assets, not a debt or loan.

The terminology in this Policy (such as “underwriting” and “risk assessment”) refers to our evaluation of receivables quality and collectability, not creditworthiness for lending purposes. You are not borrowing money or incurring debt — you are selling future receivables at a discount.

1. What Personal Information We Collect

We collect the following categories of personal information:

Business Owner/Principal Information

• Full legal name, date of birth, and Social Insurance Number (SIN)
• Home address and contact information (phone, email)
• Government-issued identification (driver’s license, passport)
• Personal financial information (personal credit history, assets)
• Ownership percentage and role in the business

Business Information

• Legal business name, operating name, and business number
• Business address, phone number, and email
• Business bank account information
• Business financial records (bank statements, revenue data, tax returns)
• Payment processor data (Stripe, Square, etc.)
• Business credit history and trade references

Transaction Information

• Details about your receivables purchase agreement with Slate
• Remittance history and account activity
• Communications with Slate (emails, calls, messages)
• Technical information (IP address, device information, login data)

Third-Party Information

• Information from credit bureaus and reporting agencies
• Bank and payment processor verification data
• Information from Platform Partners who referred you to Slate
• Publicly available business information

2. How We Collect Your Information

We collect personal information through:

Direct Collection:

• Information you provide in your application form
• Documents you submit (bank statements, identification, tax records)
• Communications with our team (phone, email, chat)
• Your use of our platform and services

Automated Collection:

• Integration with your payment processor (Stripe, Square, etc.)
• Integration with your bank accounts via third-party services
• Cookies and tracking technologies on our website/platform
• System logs and usage analytics

Third-Party Sources:

• Credit bureaus (Equifax, TransUnion)
• Open banking and financial data providers
• Platform Partners who referred you to Slate
• Public business registries and databases
• Fraud prevention and identity verification services

3. How We Use Your Information

We collect and use your personal information for the following purposes:

Primary Purposes

(a) Application Processing and Underwriting

• Evaluating your eligibility for receivables purchase services
• Assessing business performance and revenue stability
• Verifying your identity and business information
• Conducting credit checks to assess receivables quality
• Making receivables purchase decisions

(b) Service Delivery and Account Management

• Setting up and managing your account
• Processing receivables purchase transactions
• Collecting remittances through automated systems
• Monitoring account performance and Agreement compliance
• Verifying requests for remittance adjustments under the Revenue Decline Adjustment provision
• Monitoring trust compliance (as Merchant holds Receivables in trust for Slate’s benefit under the Agreement)
• Providing customer support and communications

(c) Legal and Regulatory Compliance

• Complying with anti-money laundering (AML) regulations
• Meeting know-your-customer (KYC) requirements
• Fulfilling tax reporting obligations
• Responding to legal processes and government requests
• Maintaining records as required by law
• Filing protective registrations under the Personal Property Security Act (PPSA)

(d) Business Operations

• Detecting and preventing fraud
• Managing transaction and collection risk
• Improving our products and services
• Training staff and quality assurance
• Internal audits and compliance monitoring

Secondary Purposes

(e) Marketing and Communications (with your consent)

• Sending you information about new products and services
• Providing promotional offers and updates
• Conducting market research and surveys

(f) Analytics and Improvement

• Analyzing platform usage and performance
• Developing new features and services
• Creating anonymized data for research and reporting

4. Who We Share Your Information With

We may share your personal information with the following parties:

Service Providers

• Payment processors (Stripe, ACH providers, ZumRails)
• Banking and financial data aggregators
• Cloud hosting and data storage providers
• Identity verification and fraud prevention services (Veriff)
• Customer relationship management (CRM) systems
• Electronic signature platforms (HelloSign/Dropbox Sign)

Risk Assessment Services

• Credit bureaus (Equifax, TransUnion) — to assess receivables quality
• Third-party underwriting and risk assessment services
• Recovery agencies (only if Merchant breaches the Agreement)

Platform Partners

• The Platform Partner who referred you to Slate
• Limited information shared: application status, approval decision, transaction summaries
• Important: Platform Partners are not agents, brokers, or lenders. They do not make purchase decisions, do not have access to your full application data, and bear no responsibility for servicing, collection, or enforcement of your Agreement.

Affiliated Entities

• Dropp Labs, Inc. (our U.S. affiliated entity)
• Other Slate entities for business operations and support

Legal and Regulatory

• Government agencies and regulators (when required by law)
• Law enforcement (in response to valid legal requests)
• Legal counsel and advisors
• Courts and dispute resolution bodies
• Personal Property Security Act (PPSA) registries, where we may file financing statements as a protective measure

Business Transactions

• Potential buyers, investors, or merger partners (with appropriate safeguards)
• Successor entities in the event of a business sale or reorganization

We do not sell your personal information to third parties for marketing purposes.

5. Credit Checks and Reporting

By applying for our services, you authorize Slate to:

• Obtain your personal and business credit reports from credit bureaus (Equifax, TransUnion, and others)
• Share information about your account and remittance history with credit bureaus
• Conduct periodic credit checks throughout our relationship to monitor receivables quality
• Access your credit information as often as reasonably necessary for our business purposes

Important Context:

Credit information helps us assess the quality and collectability of your receivables. Unlike a loan application where credit determines your ability to repay debt, we use credit data to evaluate the risk profile of the receivables you are selling to us.

You acknowledge that:

• Credit inquiries may appear on your credit report
• We may use both "soft" and "hard" credit checks
• Credit checks may affect your credit score
• This authorization remains valid for the duration of our relationship

6. Automated Data Access

By using our services, you authorize Slate to:

• Access your business bank account information through third-party services (e.g., Plaid, Flinks)
• Access your payment processor data (Stripe, Square, etc.) to monitor revenue and collect remittances
• Automatically retrieve transaction data, revenue information, and account balances
• Continue accessing this information for the duration of your receivables purchase agreement

You acknowledge that:

• You will provide necessary credentials and authorizations
• Data access enables automated remittance collection and account monitoring
• Revoking access may affect our ability to service your Agreement, including our ability to process remittances, monitor account performance, and verify eligibility for Revenue Decline Adjustments. If you need to change or update your data access credentials, please contact Slate before making changes to ensure continuity of service.
• We use secure, industry-standard methods to access your data

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Policy, including:

During Active Relationship:

• For the full term of your receivables purchase agreement
• Plus any applicable cure or recovery periods

After Relationship Ends:

• Minimum 7 years from the date of your last transaction (to meet legal and regulatory requirements)
• Longer if required by law, court order, or ongoing legal proceedings
• Longer if necessary to protect our legal rights or defend claims

After Retention Period:

• Personal information is securely destroyed or permanently anonymized
• Some anonymized data may be retained indefinitely for analytics and research

8. Data Security

We implement appropriate security measures to protect your personal information, including:

• Encryption of data in transit and at rest
• Secure access controls and authentication
• Regular security audits and vulnerability assessments
• Employee training on privacy and security
• Secure data centers with physical access controls
• Incident response and breach notification procedures

However, no method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

9. International Data Transfers

Your personal information may be transferred to and processed in the United States through our affiliated entity Dropp Labs, Inc., or through U.S.-based service providers. When we transfer data outside Canada, we ensure appropriate safeguards are in place, including:

• Contractual protections requiring equivalent privacy standards
• Security measures to protect data in transit and storage
• Compliance with applicable cross-border data transfer regulations

By using our services, you consent to the transfer of your personal information to the United States and other jurisdictions where our service providers operate.

10. Your Privacy Rights

Under PIPEDA and applicable provincial privacy laws, you have the following rights:

Right to Access

• Request a copy of the personal information we hold about you
• We will respond within 30 days of receiving your request

Right to Correction

• Request correction of inaccurate or incomplete information
• We will correct or annotate your information as appropriate

Right to Withdraw Consent

• Withdraw your consent to certain uses of your personal information
• Note: Withdrawal may affect our ability to provide services to you

Right to Complain

• File a complaint with the Office of the Privacy Commissioner of Canada
• File a complaint with your provincial privacy commissioner

To exercise your rights, contact us at:

Email: admin@tryslatehq.com

Phone: (778) 653-9468

11. Withdrawing Your Consent

You may withdraw your consent to certain uses of your personal information at any time by contacting us. However, please note:

Consent for Core Services Cannot Be Withdrawn:

• If you withdraw consent for information necessary to provide our services, we may not be able to continue your receivables purchase agreement

Consent for Marketing Can Be Withdrawn:

• You can opt out of marketing communications at any time by clicking "unsubscribe" in our emails or contacting us
• This will not affect your receivables purchase services

Some Uses Don’t Require Consent:

• We may continue to use your information for legal compliance, fraud prevention, and enforcing our rights even if you withdraw consent

12. Updates to This Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. If we make material changes, we will notify you by:

• Email to your registered email address
• Notice on our website
• Notice in your account dashboard

The "Last Updated" date at the top of this page indicates when the Policy was last revised. Your continued use of our services after changes constitutes acceptance of the updated Policy.

13. Contact Us

If you have questions or concerns about this Policy or our privacy practices:

Slate Financial Technologies Inc.

1322 West Broadway St Unit 1006

Vancouver BC V6H 1H2

Canada

Email: admin@tryslatehq.com

Phone: (778) 653-9468

If you are not satisfied with our response, you may contact:

Office of the Privacy Commissioner of Canada

30 Victoria Street

Gatineau, Quebec K1A 1H3

Toll-free: 1-800-282-1376

Website: www.priv.gc.ca

Your Consent

By submitting an application to Slate, you acknowledge and consent to:

• The collection, use, and disclosure of your personal information as described in this Policy
• Credit checks and credit bureau reporting as described in Section 5
• Automated access to your bank and payment processor data as described in Section 6
• International transfer of your personal information as described in Section 9
• All other practices described in this Policy

If you do not consent to these practices, please do not submit an application or use our services.

For our general Privacy Policy covering website visitors, please visit: https://tryslatehq.com/privacy

Document Version: 2.1 (aligned with MCA Agreement v2.1)