CANIMA, INC.

PRIVACY POLICY

Effective Date: 03/12/2026

At Canima, Inc. ("Canima," "we," "us," or "our"), we are committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our website at https://canima.com, use our platform, or interact with our services.

By using our website or services, you consent to the data practices described in this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the website or use the services.

1. INFORMATION WE COLLECT

1.1 Personal Information You Provide. We may collect personally identifiable information that you voluntarily provide to us when you: register for an account; request a demo or trial; subscribe to our services; fill out a contact form; subscribe to our newsletter; or otherwise communicate with us. This information may include your name, email address, phone number, company name, job title, and billing information.

1.2 Information Collected Automatically. When you access our website or platform, we may automatically collect certain information about your device and usage, including: IP address; browser type and version; operating system; referring/exit pages; date/time stamps; clickstream data; and pages viewed. We may use cookies, web beacons, and similar tracking technologies to collect this information.

1.3 Information from the Service. In connection with providing our penetration testing services, we may process: IP addresses and network identifiers of systems within the authorized Testing Scope; vulnerability data and security findings; user account information and access logs; and other technical data necessary to provide the Service. The processing of this data is governed by our Master Subscription Agreement and Data Processing Addendum.

2. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes: to provide, operate, and maintain our website and services; to improve, personalize, and expand our website and services; to understand and analyze how you use our website and services; to develop new products, services, features, and functionality; to communicate with you, including for customer service, support, updates, and marketing purposes; to process transactions and send related information; to detect, prevent, and address technical issues, fraud, and security concerns; and to comply with legal obligations.

3. HOW WE SHARE YOUR INFORMATION

3.1 Service Providers. We may share your information with third-party service providers who perform services on our behalf, such as hosting, analytics, payment processing, and customer support. These providers are contractually obligated to use your information only as necessary to perform services for us.

3.2 Legal Requirements. We may disclose your information where required to do so by law, legal process, or governmental request, or where we believe disclosure is necessary to protect our rights, your safety or the safety of others, investigate fraud, or respond to a government request.

3.3 Business Transfers. In connection with any merger, acquisition, sale of company assets, or transition of service to another provider, your information may be transferred as part of such transaction.

3.4 Aggregated Data. We may share aggregated, de-identified, or anonymized data that cannot reasonably be used to identify you for any lawful business purpose.

4. DATA SECURITY AND RETENTION

We implement commercially reasonable technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or method of electronic storage is 100% secure. We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

5. YOUR RIGHTS AND CHOICES

5.1 Access and Correction. You may request access to, correction of, or deletion of your personal information by contacting us at [email protected].

5.2 Opt-Out. You may opt out of receiving marketing communications from us by following the unsubscribe instructions in any email we send or by contacting us directly.

5.3 Cookies. We ask for your choice about cookies the first time you visit our website. Until you answer, we do not store any cookie or other persistent identifier on your device. If you decline, we do not set analytics cookies at all. You can change your answer at any time using the Cookie Settings link in the footer of any page. Most web browsers are also set to accept cookies by default, and you can adjust your browser settings to remove or reject cookies, though this may affect your ability to use certain features of our website.

5.4 Analytics and Session Recording. We use PostHog to understand how visitors find and use our website. PostHog acts as a data processor on our behalf and stores this data in the United States. Unless and until you accept cookies, PostHog operates in a cookieless mode: nothing is written to your device, no cookie is set, and no identifier is stored in your browser.

In this cookieless mode your page views are still counted. To do so without storing anything on your device, PostHog derives a temporary reference from a one-way hash of your IP address, your browser's user agent string, the website address, and a secret value that changes daily. This hash cannot be reversed to recover your IP address, and because the secret changes every day the reference does not persist beyond that day. It is used only to avoid counting the same visit twice.

This applies whether you decline the cookie banner or simply do not answer it. Declining stops cookies, stops session recording, and means we never associate your browsing with your name or email address - but your visit is still included in our aggregate traffic counts by the cookieless method described above. If you would prefer not to be counted at all, most browsers offer a Do Not Track setting, which we honour.

If you accept cookies, we additionally enable session recording and heatmaps. Session recording captures your interactions with our website - pages viewed, mouse movement, clicks, and scrolling - so that we can diagnose usability problems. Heatmaps aggregate where visitors click and how far they scroll on each page. Session recordings capture text you type into forms on our website, including your name, work email address, and company name. Password fields are never recorded. If you decline, or if you have not yet answered the banner, neither session recording nor heatmap collection takes place.

Separately, and regardless of your cookie choice, we record technical details of errors that occur in your browser while using our website - the error message, the location in our code that produced it, and your browser type and version. We do this because a fault we cannot see is a fault we cannot fix, and an error in our contact form would otherwise cost you a response without either of us knowing. These reports describe our software rather than your behaviour, and are not linked to your name or email address.

When you submit a form to request a demo or partner information, we record that submission as a conversion event in PostHog together with the details you provided. Because this is a record of a request you deliberately made, rather than observation of your browsing, it is recorded whether or not you accepted cookies. The same details are sent to our customer relationship management system so that we can respond to your request.

6. CALIFORNIA PRIVACY RIGHTS

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information we collect, the right to request deletion, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination. We do not sell your personal information. To exercise your rights, contact us at [email protected].

7. EUROPEAN DATA SUBJECT RIGHTS

If you are a resident of the European Economic Area, United Kingdom, or Switzerland, you may have additional rights under the GDPR, including the right of access, rectification, erasure, restriction of processing, data portability, and the right to object. You also have the right to lodge a complaint with your local supervisory authority. To exercise your rights, contact us at [email protected].

8. CHILDREN’S PRIVACY

Our website and services are not directed to children under the age of 16. We do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will promptly delete that information.

9. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Effective Date" above. Your continued use of our website or services after any changes constitutes your acceptance of the updated Privacy Policy.

10. CONTACT US

If you have any questions about this Privacy Policy, please contact us at:

Canima, Inc.

Email: [email protected]

Website: https://canima.com