PMA Privacy Notice

Free Beta Edition — Version 1.1 Effective date: September 26, 2026

Operator: Project Mad Adder Privacy Officer: admin@projectmadadder.com

1. Scope

This Privacy Notice explains how Project Mad Adder (“PMA”, “we”, “us”, or “our”) collects, uses, discloses, retains, and protects personal information when people visit PMA websites, create or use a PMA account, participate in the PMA beta, use our animal-management service, or contact us.

This notice applies to the PMA Free Beta Edition.

PMA is responsible for personal information under its control. Where a user or organization enters information about customers, employees, contractors, contacts, or other people into PMA, that user or organization is responsible for ensuring that it has appropriate authority to collect and use that information and for providing any notices or obtaining any consents required by applicable law.

2. Information We Collect

Depending on how PMA is used, we may collect or process the following categories of information.

Account and organization information

This may include:

• name;
• email address;
• authentication and account identifiers;
• organization or workspace membership;
• account roles and permissions;
• account settings and preferences; and
• information associated with beta access, invitations, or account administration.

Customer content

Users may enter or upload information such as:

• animal profiles;
• husbandry records;
• feeding, weight, shed, breeding, and health-related animal records;
• photographs and other media;
• notes;
• enclosure and equipment information;
• inventory records;
• business information;
• customer, supplier, employee, or other relationship records; and
• other information that users choose to store in PMA.

Some customer content may contain personal information relating to people other than the account holder.

Technical and security information

PMA and its service providers may automatically process technical information necessary to operate, secure, diagnose, and maintain the service. This may include:

• IP addresses;
• browser and device information;
• login and authentication events;
• timestamps;
• application pages, routes, or requests;
• security events;
• system and application logs;
• error and diagnostic information; and
• information reasonably necessary to detect misuse, investigate failures, or protect the service.

Communications and requests

We may retain information provided when a person:

• contacts PMA for support;
• submits feedback or a bug report;
• makes a privacy request;
• requests an account or organization export;
• requests account closure or deletion; or
• otherwise communicates with PMA.

Optional features, integrations, or device capabilities may require additional information. Where their use materially changes how personal information is handled, appropriate information will be provided when those features are introduced or used.

3. How We Use Information

PMA may use personal information as reasonably necessary to:

• create, authenticate, and administer accounts;
• provide and operate the PMA service;
• manage organizations, workspaces, permissions, and access;
• store, synchronize, display, and retrieve customer records;
• provide requested features and integrations;
• administer beta participation;
• provide customer support;
• process account, privacy, export, and deletion requests;
• diagnose errors and technical problems;
• maintain the security and integrity of PMA;
• prevent, investigate, or respond to fraud, misuse, unauthorized access, or violations of our Terms;
• communicate important account, security, service, or policy information;
• maintain and improve the reliability and operation of the service; and
• comply with applicable legal obligations.

We do not intentionally require personal information that is unrelated to a reasonable and identified purpose.

4. Customer Content and Ownership

Users retain their rights in content that they lawfully submit to PMA, subject to the rights reasonably necessary for PMA to host, process, transmit, back up, display, and otherwise handle that content in order to provide the service.

PMA does not sell private customer records.

PMA personnel may access customer information only where reasonably necessary for authorized purposes such as providing support, investigating security or technical problems, complying with legal requirements, or maintaining the service.

Users should avoid entering personal information about other people unless that information is reasonably necessary and they have appropriate authority to do so.

5. Artificial Intelligence Features

PMA does not use private customer content to train PMA or third-party general-purpose artificial intelligence models.

If PMA offers an optional feature that uses an artificial intelligence or machine-learning provider, information submitted to or required by that feature may need to be processed by that provider in order to generate the requested result.

Before private customer information is processed through an optional AI service, PMA will assess the relevant provider and data-handling arrangements and provide appropriate information or choices where required.

Users should not submit sensitive or unnecessary personal information to an AI-enabled feature unless the feature is expressly intended for that information.

6. Service Providers and International Processing

PMA relies on third-party service providers to operate the service.

Current core providers include:

• Vercel, for application hosting and delivery;
• Supabase, for database, authentication, and storage services; and
• Resend, for transactional email services where configured.

These providers may use their own infrastructure, affiliates, or subprocessors.

Personal information may therefore be processed or stored in Canada, the United States, or other jurisdictions in which PMA's service providers operate.

Information processed outside a user's country may be subject to the laws of the jurisdiction in which it is processed and may be accessible to courts, law-enforcement agencies, regulatory authorities, or other government authorities where permitted by applicable law.

PMA is responsible for assessing the service providers it uses and for taking reasonable contractual, technical, and organizational measures appropriate to the information being processed.

PMA may change or add service providers as the service develops. Where a change materially affects how personal information is collected, used, or disclosed, appropriate notice or consent will be provided where required by applicable law.

7. Disclosure of Information

PMA may disclose personal information:

• to service providers acting on our behalf where reasonably necessary to operate PMA;
• when a user intentionally directs PMA to share information through a feature or integration;
• where required or permitted by applicable law, regulation, legal process, or court order;
• where reasonably necessary to investigate fraud, security incidents, misuse, or unlawful activity;
• where reasonably necessary to protect the rights, safety, property, or security of PMA, our users, or others; or
• as permitted by law in connection with a reorganization, financing, merger, acquisition, sale, or transfer of all or part of the business.

PMA does not sell private customer records to advertisers, data brokers, or other third parties.

8. Security and Security Incidents

PMA uses administrative, technical, and organizational safeguards intended to protect personal information against unauthorized access, use, disclosure, alteration, loss, or destruction.

Safeguards are selected based on factors such as the nature and sensitivity of the information, how it is stored or transmitted, and reasonably foreseeable risks.

Access to customer information is intended to be limited to authorized users, authorized service providers, and authorized PMA personnel where access is reasonably necessary.

No internet-based service can guarantee absolute security.

Suspected unauthorized access, disclosure, loss, or other security incidents involving PMA should be reported promptly to:

admin@projectmadadder.com

PMA will investigate suspected privacy and security incidents and will notify affected individuals, regulators, or other parties where notification is required by applicable law.

PMA maintains records of security breaches where required by law.

9. Retention, Account Deletion, and Workspace Deletion

PMA retains personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, operate and secure the service, satisfy legitimate administrative requirements, resolve disputes, enforce agreements, and comply with applicable legal obligations.

Retention periods may differ depending on the type of information and why it is maintained.

PMA uses retention and destruction procedures appropriate to the categories of personal information it handles.

When an account or information is deleted, personal information that is no longer reasonably required will be deleted, erased, or anonymized in accordance with PMA's applicable retention procedures and legal obligations.

Some information may need to be retained after an account is closed or a deletion request is made where retention is reasonably necessary for purposes such as:

• complying with legal obligations;
• maintaining required security or breach records;
• preventing fraud or abuse;
• resolving disputes;
• enforcing agreements;
• maintaining financial, transactional, or administrative records where applicable; or
• establishing, exercising, or defending legal claims.

Information removed from active systems may remain temporarily in backups, system logs, security records, or other residual systems until those records expire, are overwritten, or are deleted through normal retention processes.

Account deletion and workspace deletion are separate processes. Deleting an individual user's account does not necessarily authorize that user to delete records belonging to an organization or workspace with other authorized users.

Similarly, deleting or changing an account does not automatically require deletion of records that PMA or another authorized organization must legitimately retain.

PMA may require reasonable verification of identity and, where applicable, organization or workspace authority before processing an export, access, correction, or deletion request.

10. Cookies, Browser Storage, and Similar Technologies

PMA may use cookies, browser storage, session storage, or similar technologies where reasonably necessary for:

• authentication;
• account sessions;
• security;
• application functionality;
• preferences; and
• maintaining the operation of the service.

If PMA introduces optional analytics, advertising, or marketing technologies that require additional disclosure or consent, appropriate information and consent choices will be provided where required.

11. Email and Other Communications

PMA may send communications that are reasonably necessary to provide the service, including:

• account and authentication messages;
• password-reset messages;
• security notices;
• invitations;
• support communications;
• requested exports;
• important service announcements; and
• material policy or account notices.

Marketing communications are optional and are not a condition of accepting PMA's Terms or creating an account.

Where PMA sends marketing communications, recipients will be provided with an appropriate method of withdrawing consent or unsubscribing as required by applicable law.

12. Age Requirement

PMA is intended for users who are at least 18 years old.

You must be at least 18 years old to create or maintain a PMA account.

PMA does not knowingly permit people under 18 to create or maintain accounts.

If we become aware that an account is being maintained by a person under 18, PMA may suspend or close the account and take reasonable steps to delete associated personal information, subject to applicable legal and operational retention requirements.

13. Access, Correction, Export, Deletion, and Other Privacy Rights

Depending on applicable law, individuals may have rights relating to their personal information, including rights to:

• request access to personal information held about them;
• request correction of inaccurate or incomplete personal information;
• request a copy or export of certain information;
• withdraw consent to certain processing, subject to legal or contractual restrictions and reasonable notice;
• request deletion of information where applicable;
• ask questions about how personal information is handled; and
• make a complaint regarding PMA's privacy practices.

Requests may be made using available PMA account controls or by contacting:

Privacy Officer Project Mad Adder admin@projectmadadder.com

PMA may request information reasonably necessary to verify the identity and authority of the person making a request.

Requests will be handled within the time periods required by applicable law.

Certain requests may be limited or refused where permitted or required by law. Where appropriate, PMA will explain the reason for the limitation.

Individuals may also have the right to make a complaint to an applicable privacy regulator. In Canada, this may include the Office of the Privacy Commissioner of Canada.

14. International Users

PMA is operated from Canada.

Privacy, consumer-protection, and data-protection requirements may differ between jurisdictions. The availability of PMA in a particular country does not mean that every feature has been specifically designed for every local regulatory regime.

PMA may restrict access to the service or particular features where reasonably necessary to comply with applicable legal requirements.

Where additional notices, rights, disclosures, or consent mechanisms are required for a jurisdiction in which PMA intentionally offers services, PMA may provide supplementary privacy information applicable to users in that jurisdiction.

15. Changes to This Privacy Notice

PMA may update this Privacy Notice as the service, our practices, or applicable legal requirements change.

The updated notice will identify its effective date.

Material changes will be communicated in an appropriate manner based on the nature of the change.

Where applicable law requires new consent for a materially different collection, use, or disclosure of personal information, PMA will not rely solely on acceptance of an earlier version of this Privacy Notice or PMA's Terms as consent to the new purpose.

16. Contact

Questions, concerns, complaints, or requests concerning this Privacy Notice or PMA's handling of personal information may be directed to:

Privacy Officer Project Mad Adder admin@projectmadadder.com