Last Updated: August 2026

SoilFLO Inc. (“SoilFLO,” “we,” “us,” or “our”) is committed to protecting the privacy and personal information of all users and visitors to its websites (the “Sites”), and individuals and businesses (“Customers”) using its products and services, including its software for construction and environmental teams to track and manage excavated materials (the “Platform” and, collectively with any other products and services, the “Services”). This Privacy Policy explains how SoilFLO collects, uses, and shares Personal Information of its Customers and Authorized Users (as defined herein), and outlines the rights and obligations of parties with respect to Personal Information disclosed in the use of the Services and Sites.

A separate agreement governs delivery, access, and use of the Services (the “Customer Agreement”), including the processing of any files or other content submitted through the Services (collectively, “Customer Data”). The organization (e.g., your employer or another entity or person) that entered into the Customer Agreement (“Customer” or “Employer”) controls their instance of the Services (each, a “Customer Account”) and any associated Customer Data. If you have any questions specific to Customer Account settings and privacy practices, please contact the Customer whose Services you use.

In some cases, Customer Data may include personal information of third parties, such as subcontractors, suppliers, truck drivers, or other individuals, who interact with the Platform at the direction of the Customer. SoilFLO processes such personal information as a data processor on behalf of the Customer (as data controller). If you are such a third party and wish to exercise your privacy rights (including access, correction, or deletion), please contact the Customer organization that directed your use of or inclusion in the Platform, as they control the purposes and means of processing your personal information.

1. INFORMATION WE COLLECT AND RECEIVE

SoilFLO may collect and receive Customer Data and other information and data (“Other Information”) in a variety of ways and in different capacities. For all personal information included in Customer Data, we act as the “data processor” (or equivalent role under applicable law), carrying out processing activities on behalf of the “data controller,” meaning the Customer who controls the means and purposes of the processing. When we collect Other Information directly from you (for example, through our Sites), we act as the data controller.

Customers or individuals granted access to a Customer Account (“Authorized Users”) routinely submit Customer Data to SoilFLO when using the Services. Customer Data may include, without limitation, soil movement records, waste tracking data, load information, site details, consignment notes, project data, and personal information of Authorized Users and other individuals entered into the Platform by or on behalf of the Customer.

SoilFLO also collects, generates, and/or receives the following categories of Other Information:

(a) Customer Account and Profile Information. To create or update a Customer Account, you or your Employer supply SoilFLO with your name, email address, employee ID, hire date, job title, department, line of business, phone number, and/or similar account details.

(b) Usage Information.

Services Metadata: When an Authorized User interacts with the Services, metadata is generated that provides additional context about the way Authorized Users work. For example, SoilFLO logs activity audit records and usage statistics.

Log Data: As with most websites and technology services delivered over the Internet, our servers automatically collect information when you access or use our Sites or Services and record it in log files. This log data may include Internet Protocol (IP) address, the address of the web page visited before using the Sites or Services, browser type and settings, the date and time the Services were used, information about browser configuration and plugins, language preferences, and cookie data.

Device Information: SoilFLO collects information about devices accessing the Services, including type of browser or device, operating system, and unique device identifiers.

Location Information: We may receive information that helps us approximate your location, such as an IP address received from your browser or device. We do not collect precise geolocation data unless separately disclosed.

(c) Cookie Information. SoilFLO uses cookies and similar technologies in our Sites and Services that help us collect Other Information. For more information about our use of cookies, please see our Cookie Notice [if applicable, link].

(d) Additional Information Provided to SoilFLO. We receive Other Information when submitted to our Sites or if you participate in a focus group, contest, activity or event, apply for a job, request support, interact with our social media accounts, or otherwise communicate with SoilFLO.

Generally, no one is under a statutory or contractual obligation to provide any Customer Data or Other Information. However, certain information is collected automatically and, if some information (such as Customer Account setup details) is not provided, we may be unable to provide the Services.

2. HOW WE USE INFORMATION

Customer Data will be used by SoilFLO in accordance with Customer’s instructions, including any applicable terms in the Customer Agreement and as required by applicable law. SoilFLO is the data processor of Customer Data and Customer is the controller. Customer may, for example, use the Services to grant and remove access to a Customer Account, assign roles and configure settings, access, modify, export, share, and remove Customer Data, and otherwise apply its policies to the Services.

SoilFLO uses Other Information in furtherance of our legitimate interests in operating our Services, Sites, and business. More specifically, SoilFLO uses Other Information:

(a) To provide, update, maintain, and protect our Services, Sites, and business. This includes use of Other Information to support delivery of the Services under a Customer Agreement, prevent or address service errors, security or technical issues, and analyze and monitor usage, trends, and other activities.

(b) As required by applicable law, legal process, or regulation.

(c) To communicate with you by responding to your requests, comments, and questions. If you contact us, we may use your Other Information to respond.

(d) To send emails and other communications. We may send you service, technical, and other administrative emails, messages, and other types of communications. These communications are considered part of the Services and you may not opt out of them. In addition, we may contact you about new product features, promotional communications, or other news about SoilFLO. We will only send you commercial messages if you agree to receive them. You can opt out of commercial messages at any time by clicking the “unsubscribe” link or by emailing [email protected].

(e) To investigate and help prevent security issues and abuse.

(f) To de-identify and aggregate Other Information. If information is aggregated or de-identified so it is no longer reasonably associated with an identified or identifiable natural person, SoilFLO may use it for any business purpose, including marketing, benchmarking, analytics, and product development.

We do not share mobile contact information with third parties or affiliates for marketing or promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

SoilFLO does not “sell” personal information as defined under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), or under any other applicable US state privacy law. SoilFLO does not “share” personal information for cross-context behavioral advertising purposes.

3. DATA RETENTION

SoilFLO will retain Customer Data in accordance with a Customer’s instructions, including any applicable terms in the Customer Agreement and Customer’s use of Services functionality, and as required by applicable law.

SoilFLO may retain Other Information pertaining to you for as long as necessary for the purposes described in this Privacy Policy. This may include keeping your Other Information for the period of time needed for SoilFLO to pursue legitimate business interests, conduct audits, comply with (and demonstrate compliance with) legal obligations, resolve disputes, and enforce our agreements.

When personal information is no longer required for the purposes for which it was collected and there is no legal basis for its continued retention, SoilFLO will securely delete or anonymize it.

4. HOW WE SHARE AND DISCLOSE INFORMATION

This section describes how SoilFLO may share and disclose Information. Customers determine their own policies and practices for the sharing and disclosure of Information, and SoilFLO does not control how they choose to share or disclose Information.

(a) Customer’s Instructions. SoilFLO will share and disclose Customer Data solely in accordance with a Customer’s instructions, including any applicable terms in the Customer Agreement, and in compliance with applicable law and legal process.

(b) Customer Access. Administrators, Authorized Users, and other Customer representatives and personnel may be able to access, modify, or restrict access to Other Information.

(c) Subprocessors and Service Providers. We engage third-party companies and individuals as subprocessors or service providers to process Information and support our business. These may include cloud hosting providers, authentication services, analytics platforms, and business intelligence tools. SoilFLO maintains a current list of subprocessors, which is available upon written request to [email protected].

(d) Corporate Affiliates. SoilFLO may share Other Information with its corporate affiliates, parents, and/or subsidiaries.

(e) Aggregated or De-identified Data. We may share aggregated or de-identified Other Information for any purpose, including with prospects or partners for business or research purposes. For example, we may share aggregate platform statistics such as total number of customers, total loads tracked, or average platform usage metrics. We will not publicly disclose any usage data that identifies or is reasonably attributable to a specific Customer or individual without prior written consent.

(f) Comply with Laws. If we receive a request for information, we may disclose Other Information if we reasonably believe disclosure is in accordance with or required by any applicable law, regulation, or legal process.

(g) Business Transfers. In connection with a merger, acquisition, reorganization, or sale of all or substantially all of our assets, personal information may be transferred to the successor entity, subject to commitments consistent with this Privacy Policy.

(h) With Consent. SoilFLO may share Other Information with third parties when we have consent to do so.

5. INFORMATION SECURITY

SoilFLO maintains commercially reasonable administrative, physical, and technical safeguards designed to protect against security incidents involving unauthorized or accidental destruction, loss, alteration or damage, unauthorized disclosure of or access to, personal information. These safeguards include:

• Encryption of data at rest (AES-256) and in transit (TLS 1.2 or higher)
• Role-based access controls
• Firewalls, intrusion detection systems, and industry-standard malware protection
• Periodic internal security assessments
• Daily vulnerability scanning
• Annual penetration testing
• Testing of disaster recovery and business continuity plans

SoilFLO holds Cyber Essentials certification and is pursuing additional industry-standard certifications, including SOC 2 Type II. We limit access to personal information to those employees, contractors, and agents who have a legitimate business need to know and who are bound by confidentiality obligations.

No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect personal information, we cannot guarantee its absolute security.

In the event of a security incident involving personal information, SoilFLO will notify affected Customers without undue delay (and in any event within seventy-two (72) hours of becoming aware of the incident) in accordance with the applicable Customer Agreement. SoilFLO will cooperate with Customers in investigating and remediating any security incident and in fulfilling any notification obligations to individuals, regulators, or law enforcement as required by applicable law.

6. DATA RESIDENCY AND INTERNATIONAL TRANSFERS

Data protection laws in certain jurisdictions differentiate between the data controller and data processor of information. In the case of the Services, the Customer is the data controller and SoilFLO is the data processor.

Each Customer’s data is stored in their selected hosting region:

• North America: Canada
• Europe: United Kingdom
• Australia: Australia

SoilFLO will not migrate Customer Data to a different hosting region without the Customer’s prior written consent.

While Customer Data is stored in the region selected by the Customer, SoilFLO personnel and certain subprocessors may access Customer Data from other locations (including Canada and the United States) for the purposes of providing support, maintenance, and administration of the Services.

Where such access constitutes a restricted transfer under applicable data protection law (including the UK GDPR), SoilFLO relies on appropriate safeguards, which may include:

• The UK International Data Transfer Agreement (UK IDTA)
• EU Standard Contractual Clauses (with the UK Addendum, where applicable)
• Adequacy decisions issued by the relevant supervisory authority
• Such other approved transfer mechanisms as may be required by applicable law

For more information about the safeguards we use for international data transfers, please contact us at [email protected].

SoilFLO processes and stores personal information collected through its Sites using servers and third-party providers based in Canada and the United States. If you are located outside of Canada or the United States, your personal information collected through the Sites may be transferred to Canada or the United States for the purposes described in this Privacy Policy, subject to appropriate safeguards as described above.

7. INDIVIDUAL RIGHTS

Depending on your jurisdiction, you may have some or all of the following rights with respect to your personal information:

(a) Right of Access. You may request information about the personal information we hold about you and obtain a copy of that information.

(b) Right to Rectification. You may request that we correct inaccurate or incomplete personal information.

(c) Right to Erasure (Deletion). You may request that we delete your personal information, subject to certain exceptions (such as where retention is required by law or for the establishment, exercise, or defense of legal claims).

(d) Right to Restrict Processing. You may request that we restrict the processing of your personal information in certain circumstances.

(e) Right to Data Portability. You may request that we provide your personal information in a structured, commonly used, and machine-readable format.

(f) Right to Object. You may object to the processing of your personal information on the basis of our legitimate interests.

(g) Right to Withdraw Consent. Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

We will acknowledge your request within ten (10) business days and respond substantively within forty-five (45) calendar days. If additional time is required due to the complexity or volume of requests, we will notify you of the extension and the reasons for it. Extensions shall not exceed an additional forty-five (45) calendar days (ninety (90) calendar days total from receipt of the request).

To exercise any of these rights, please contact us at [email protected]. We may require you to verify your identity before responding to your request, as required by applicable law.

If you are an Authorized User or other individual whose personal information is included in Customer Data, please direct your request to the Customer (data controller) who directed your use of or inclusion in the Platform. SoilFLO will assist the Customer in fulfilling such requests in accordance with the applicable Customer Agreement.

Your withdrawal of consent is not retroactive; it will be applied on a go-forward basis.

8. CHILDREN’S PRIVACY

SoilFLO does not knowingly collect or solicit Personal Information from children under the age of 18, nor knowingly allow them to use or request information through the Sites without the consent of their parent or guardian. If you believe we have collected information from a child in error or have questions or concerns about our practices relating to children, please notify us at [email protected] and we will promptly respond.

9. FUTURE FEATURES AND PROCESSING ACTIVITIES

SoilFLO may from time to time introduce new features, modules, or capabilities to the Platform (such as offline functionality or artificial intelligence / machine learning features) that involve new or different processing of personal information. Where such features involve material changes to the processing described in this Privacy Policy, including the use of third-party models to process Customer Data or the local caching of Customer Data on user devices, SoilFLO will:

(a) Update this Privacy Policy to describe the new processing activities, purposes, and any new categories of data collected;

(b) Provide Customers with notice prior to enabling such features, including a description of the data processing involved; and

(c) Where required by applicable law or the Customer Agreement, obtain Customer’s affirmative consent (opt-in) before enabling features that materially alter the processing of Customer Data.

10. CHANGES TO THIS PRIVACY POLICY

SoilFLO may update this Privacy Policy from time to time. Laws, regulations, and industry standards evolve, which may make those changes necessary, or we may make changes to our business. We will post the updated policy to this page with a revised “Last Updated” date and encourage you to review our Privacy Policy periodically.

If we make changes that materially alter your privacy rights, SoilFLO will provide additional notice, such as via email or through the Services, at least thirty (30) days prior to the changes taking effect. If you disagree with the changes to this Privacy Policy, you should contact your Employer to deactivate your Services account.

11. CONTACT US

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or have a complaint about our handling of your personal information, please contact us at:

SoilFLO Inc.

102 Atlantic Avenue, 3rd Floor

Toronto, Ontario M6K 1X9

Canada

Attn: Privacy Officer

Email: [email protected]