Privacy and Client Information Policy

Effective date: October 13, 2026

Ironstone Advisory is the operating name of a Canadian numbered company. We provide professional advisory, research, technology and software-development services to organizations in Canada and the United States.

Our work depends on trust. This policy explains how Ironstone Advisory ("Ironstone," "we," "us" or "our") collects, uses, protects, retains and discloses personal information and client information.

"Personal information" means information about an identifiable individual. "Client information" includes the information, documents, communications, data, code and other materials that a client or its authorized representatives provide to us, or that we create while performing an engagement. Client information may include personal information, confidential business information, or both.

1. Scope and accountability

This policy applies to Ironstone's website, business-development activities, client database, professional services and project work. It covers information held in email, calendars, cloud and local storage, client-management and accounting systems, software repositories, project files, reports, spreadsheet models, datasets and other working papers.

Rob Tyrie is responsible for Ironstone's privacy practices and serves as Privacy Officer. Questions, access requests and complaints may be sent to rob@ironstoneadvisory.com.

Where Ironstone processes information solely on behalf of a client, the client determines why and how the information is used. In those circumstances, Ironstone acts on the client's documented instructions and the client's privacy notice may also apply. We may direct an individual request to the relevant client when the client is responsible for responding.

If a client agreement imposes stricter confidentiality, security, retention or deletion requirements than this policy, we will follow the client agreement.

2. Information we collect

Depending on the relationship and engagement, we may collect or create:

• business contact information, including names, job titles, organizations, business email addresses, telephone numbers and professional profiles;

• inquiry, referral, proposal, contract, billing and payment-administration information;

• correspondence, email archives, calendar information, meeting notes, recordings or transcripts when participants have been informed, and records of decisions and approvals;

• information maintained in our client and relationship database, including engagement history, interests, introductions and follow-up activities;

• client-provided documents, databases, source material, instructions and other project information;

• project working papers, research, analyses, software, source code, repositories, reports, presentations, spreadsheet models, prompts and outputs, datasets, prototypes and final deliverables;

• technical information generated through our website and online services, such as Internet Protocol address, browser and device information, referring pages, access times and interactions; and

• security, access, version and audit records created by the systems we use.

Ironstone does not seek to collect health information. Clients and website visitors should not provide health information unless its collection has been expressly agreed in writing and appropriate safeguards have been established.

We ask clients not to provide personal information that is unnecessary for the engagement. If sensitive or regulated information may be involved, the scope, permitted uses and safeguards should be agreed before it is transferred to Ironstone.

3. How we obtain information

We may obtain information:

• directly from an individual;

• from a client, its personnel or an organization it authorizes;

• from referrals, business partners and professional contacts;

• from public and professional sources where use of the information is lawful and appropriate;

• automatically through our website and service providers; and

• through the work we perform, including research, analysis, software development and the creation of project records and deliverables.

4. Why we use information

We use personal and client information only for identified and appropriate purposes, including to:

• respond to inquiries and develop, administer and maintain professional relationships;

• evaluate, scope, contract for and deliver advisory, research, software and technology services;

• communicate, schedule meetings, collaborate and maintain a record of client instructions, decisions and approvals;

• create, test, support and deliver software, reports, presentations, spreadsheet models, datasets and other agreed work products;

• share work products and project information with organizations authorized by the client;

• manage our client database, engagements, invoicing, accounting and business records;

• secure, operate, troubleshoot, back up and improve our systems and services;

• comply with contracts, professional obligations and applicable law, and establish or defend legal claims;

• prevent or investigate fraud, misuse, security incidents or other unlawful activity; and

• create and retain generalized methods, templates, statistics, lessons and insights where client identities, personal information and client-confidential information have been removed.

We will seek consent or other authorization when required. If we want to use personal information for a materially new purpose, we will explain that purpose and obtain fresh consent when applicable law requires it.

5. Client information, deliverables and authorized sharing

Ironstone may receive client information and may create software, reports, spreadsheet models, datasets and other materials during an engagement. We use those materials to perform the engagement, meet our contractual and legal obligations, maintain appropriate business records, and support or defend the work performed.

We may provide client information or deliverables to the client and to other organizations the client authorizes. Authorization may be established in the engagement agreement, project instructions, an approval record or another documented communication. We take reasonable steps to use the intended recipient and an appropriate transfer method.

Ownership and permitted use of deliverables are governed by the applicable client agreement. Unless that agreement says otherwise, Ironstone may retain and reuse its general knowledge, skills, methods, templates and de-identified insights, but not the client's identity, personal information or confidential information.

We do not place personal information or client-confidential information in a public software repository unless the client has expressly authorized publication and the material has been reviewed for release. Private repositories may be used for approved project work and are subject to access controls and the applicable retention requirements.

6. Artificial intelligence and automated tools

Ironstone may use artificial-intelligence services and other automated tools for research, analysis, drafting, coding, modelling, data preparation and related project work only when the client has permitted their use or the engagement agreement expressly authorizes it.

When using an approved AI service, we will:

• follow the client's instructions and any contractual restrictions;

• limit the information submitted to what is reasonably necessary;

• remove or reduce direct identifiers where practical;

• select accounts, settings and providers appropriate to the sensitivity of the work;

• review outputs before relying on or delivering them; and

• remain responsible for Ironstone's work and decisions.

Ironstone does not knowingly authorize an AI provider to use client-confidential information or personal information for general model training unless the affected client has expressly approved that use. AI prompts and outputs may become part of the project working papers and will then be handled under this policy and the client agreement.

Unless expressly agreed for a particular engagement, Ironstone does not use AI to make a solely automated decision about an individual that produces legal or similarly significant effects.

7. When we disclose information

Ironstone does not sell, rent or trade personal information. We do not sell client databases or use personal information for cross-context behavioural advertising.

We may disclose information:

• to the client and organizations the client authorizes;

• to employees, independent professionals, subcontractors or advisors who need it for approved work and are subject to appropriate confidentiality obligations;

• to service providers that support email, productivity, document storage, local and cloud storage, client management, accounting, scheduling, website operation and analytics, software development, source-code hosting, cybersecurity, backups and approved AI-assisted work;

• with the knowledge or consent of the individual or client, as applicable;

• when required or permitted by law, legal process or a regulator;

• when reasonably necessary to protect rights, safety, systems or property, or to investigate suspected fraud, misuse or a security incident; or

• as part of a proposed financing, reorganization, sale or transfer of all or part of the business, subject to appropriate confidentiality and lawful-use restrictions.

We select and configure service providers with regard to the information involved. Where appropriate, we use provider terms, settings or agreements intended to limit processing to the services supplied to Ironstone and other purposes disclosed to the affected parties.

8. Service providers and cross-border processing

Ironstone uses business and technology providers that may include Google Workspace, Gmail, Google Drive, Google Calendar, website and analytics services, client-management and accounting systems, local storage, cloud hosting, GitHub, communications tools, Substack and AI services approved for a particular use.

Some providers process or store information outside Canada, including in the United States. As a result, information may be subject to the laws of the jurisdiction where it is processed and may be accessible to courts, law-enforcement authorities or regulators in that jurisdiction. Ironstone remains responsible for personal information under its control and uses contractual, administrative and technical measures appropriate to the information and the service involved.

9. Safeguards

We use administrative, technical and physical safeguards proportionate to the sensitivity of the information. Depending on the system and engagement, these may include:

• access limited to people who need the information for approved work;

• confidentiality obligations and client-specific handling instructions;

• password protection and multi-factor authentication where supported;

• encryption in transit and at rest where supported by the applicable service;

• managed permissions for shared files, private repositories and client systems;

• device protection, software updates, backups and recovery procedures; and

• review and response procedures for suspected privacy or security incidents.

No method of storage or transmission is completely secure. We therefore cannot guarantee absolute security. If an incident occurs, we will take reasonable steps to contain and investigate it, preserve required records, notify affected clients and individuals where appropriate, and report it to regulators when required by law.

10. Retention and deletion

Ironstone keeps identifiable personal information and client-confidential information only for as long as it is reasonably required for the purpose for which it was collected, an agreed archival purpose, or a legal, contractual, accounting, security or dispute-resolution requirement.

Unless a contract, legal hold or applicable law requires a different period, our default schedule is:

• Unsuccessful inquiries and prospective-client records: two years after the last substantive contact.

• Client database and relationship records: for the relationship and up to seven years after the last engagement or substantive client activity.

• Contracts, invoices, payment-administration and accounting records: seven years after the end of the fiscal year or engagement to which the record relates.

• Email, calendar records, project communications and working papers: for the engagement and up to seven years after it ends.

• Client-provided source material and Ironstone's retained copies of deliverables, code, repositories, models and datasets: as stated in the client agreement or, if the agreement is silent, up to seven years after the engagement ends.

• Website inquiry and routine technical records: up to two years, subject to the settings and required operational records of the applicable provider.

• Security, access and audit records: up to two years, unless they are needed longer to investigate an incident or meet a legal or contractual obligation.

• Backups: information deleted from active systems may remain in protected backups until it is overwritten or removed through the normal backup cycle. It is not restored for ordinary business use after a valid deletion request.

• De-identified knowledge and public materials: generalized methods, templates, statistics, de-identified insights, and materials authorized for public release may be kept indefinitely because they no longer contain personal or client-confidential information.

We may retain a record longer where a client authorizes a defined archival purpose, where the record is relevant to an unresolved dispute or investigation, or where law requires it. When information is no longer required, we delete, securely destroy, return or effectively de-identify it, as appropriate. Technical copies in backups and version histories may take additional time to age out.

11. Access, correction, withdrawal and deletion requests

Subject to applicable law and limited exceptions, an individual may ask us to:

• confirm whether we hold their personal information;

• explain how it has been used and disclosed;

• provide access to it;

• correct inaccurate or incomplete information;

• withdraw consent for future uses that depend on consent; or

• delete information that is no longer required.

Residents of jurisdictions that provide additional privacy rights may exercise those rights where they apply. Ironstone will not discriminate against an individual for making a privacy request.

We may need to verify identity before responding. We may also be unable to provide or delete some information where doing so would reveal another person's information, compromise security or confidential commercial information, interfere with a legal matter, conflict with a client instruction for information we process on the client's behalf, or violate a legal, accounting or contractual retention requirement. If we cannot fulfil a request, we will explain the reason where legally permitted.

Requests should be sent to rob@ironstoneadvisory.com. We will respond within the period required by applicable law. Where Ironstone holds information solely for a client, we may refer the request to that client and assist as required.

An individual may also challenge our compliance or complain about our handling of personal information. We will investigate and respond in good faith. If the concern is not resolved, the individual may contact the Office of the Privacy Commissioner of Canada, an applicable provincial privacy regulator, or the appropriate authority in the United States.

12. Website, communications and third-party services

Our website and linked or embedded services may use cookies or similar technologies and may collect technical information needed to operate, secure and understand use of those services. Ironstone uses this information for site operation, security and aggregate measurement, not to sell personal information.

The website may link to third-party services such as scheduling, publications, professional networks, software repositories or subscription platforms. A third party's own privacy policy applies when an individual uses that service directly. A link does not transfer control of the third party's practices to Ironstone.

People who receive optional marketing or publication emails may unsubscribe using the method provided in the message or by contacting rob@ironstoneadvisory.com. We may still send service, project, security or transactional communications that are necessary for an active relationship.

13. Children

Ironstone's website and services are intended for organizations and working professionals, not children. We do not knowingly collect personal information directly from children. Anyone who believes a child has provided personal information to us should contact the Privacy Officer.

14. Changes to this policy

We may update this policy as our services, technology or legal obligations change. The current version will be posted on our website with its effective date. If a change materially affects how we use information already collected, we will provide additional notice or obtain consent where required.

15. Contact

Rob Tyrie, Privacy Officer

Ironstone Advisory

Email: rob@ironstoneadvisory.com