Last updated: March 11, 2026

Roshan Water Solutions Inc. ("Roshan Water", "we", "us", or "our") operates the aQRate™ platform, including the Cloud Portal at aqrate.ca and the aQRate™ Mobile Application (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have regarding your information.

By accessing or using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the Service.

1. Information We Collect

1.1 Account & Registration Data

When you create an aQRate™ account, we collect:

• Full name and email address
• Organization name and role
• Password (stored as a one-way cryptographic hash — never in plain text)
• Billing and payment information (processed securely by our payment provider; we do not store full card numbers)

1.2 Field & Form Data

aQRate™ is a data-collection platform. The content of any form submissions, chain-of-custody records, sample data, photos, sketches, digital signatures, annotations, and custom fields you enter into the Service ("Field Data") is stored on our servers. This data belongs to you (or your organization). We process it solely to deliver the Service.

1.3 Location Data

The Mobile App optionally captures GPS coordinates when you submit a form, scan a QR code, or take a photo — if you have granted location permission. You can revoke location access at any time through your device settings. Without location permission, the app continues to function; GPS fields will simply remain empty.

1.4 Device & Usage Data

We automatically collect certain technical information, including:

• Device type, operating system, and app version
• IP address and approximate geographic region
• Pages visited, features used, and session duration on the Cloud Portal
• Crash reports and diagnostic logs

This information is used to improve reliability, fix bugs, and understand how the Service is used.

1.5 Communications

If you contact us via email, the contact form, or support channels, we retain those messages to respond to you and improve our support processes.

2. How We Use Your Information

We use the information we collect to:

• Provide and operate the Service — account management, form processing, report generation, data synchronization, and cloud storage.
• Authenticate and secure accounts — role-based access control, audit trails, and session management.
• Send transactional communications — password resets, data-sync confirmations, submission alerts, and billing receipts.
• Send service updates — important notices about changes to the platform or this policy. You cannot opt out of these messages while your account is active.
• Send optional product communications — feature announcements and newsletters, only if you have opted in. You may unsubscribe at any time.
• Improve and develop the Service — analyzing aggregated, anonymized usage patterns to guide product decisions.
• Comply with legal obligations — responding to lawful requests from regulatory authorities.

We do not sell your personal information or Field Data to third parties. We do not use your Field Data to train AI or machine learning models without your explicit consent.

3. Data Sharing & Disclosure

We share information only in the following circumstances:

3.1 Within Your Organization

Users within the same organization account can access shared Field Data according to the role-based permissions configured by your account administrator.

3.2 Service Providers

We engage trusted third-party vendors to help operate the Service (e.g., cloud infrastructure, payment processing, error monitoring). These vendors access your data only to perform services on our behalf and are contractually bound to maintain its confidentiality and security.

3.3 Legal Requirements

We may disclose information if required by applicable law, court order, or government authority, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

3.4 Business Transfers

In the event of a merger, acquisition, or sale of substantially all of our assets, your information may be transferred as part of that transaction. We will notify you before your data becomes subject to a materially different privacy policy.

4. Data Retention

We retain your account data and Field Data for as long as your account is active or as needed to provide the Service. Upon account termination, we will delete or anonymize your personal data within 90 days, unless we are required by law to retain it longer. Backups may persist for up to an additional 30 days before being purged from all systems.

You may request deletion of your data at any time by contacting us at privacy@roshanwater.com.

5. Data Security

We implement industry-standard safeguards to protect your information:

• Encryption in transit — all data is transmitted over TLS 1.2 or higher.
• Encryption at rest — Field Data and account information are encrypted in our cloud storage.
• Access controls — role-based permissions, multi-factor authentication support, and full audit logging.
• Penetration testing & monitoring — regular security reviews and real-time anomaly detection.

No system is 100% secure. In the event of a data breach that affects your personal information, we will notify you in accordance with applicable law.

6. Mobile App Permissions

The aQRate™ Mobile App may request the following device permissions:

Permission	Purpose	Required?
Camera	Photo capture and QR code scanning for form submissions	Optional
Location (GPS)	Automatic GPS tagging on submissions and sample records	Optional
Storage / Files	Saving offline data locally until sync is available	Required
Network Access	Syncing data to the Cloud Portal	Required
Notifications	Receiving sync-complete and alert notifications	Optional

You can manage each permission individually in your device's Settings app at any time.

7. Cookies & Tracking Technologies

The Cloud Portal uses cookies and similar technologies to:

• Keep you signed in across sessions (authentication cookies)
• Remember your UI preferences (functional cookies)
• Analyze aggregate usage patterns (analytics cookies — anonymized)

You may disable cookies through your browser settings. Disabling authentication cookies will prevent you from staying logged in. We do not use third-party advertising cookies or cross-site tracking.

8. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access — request a copy of the personal data we hold about you.
• Correction — request that inaccurate or incomplete data be corrected.
• Deletion — request that your personal data be deleted ("right to be forgotten").
• Portability — receive your data in a structured, machine-readable format.
• Restriction / Objection — object to or request restriction of certain processing activities.
• Withdraw Consent — where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at privacy@roshanwater.com. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

aQRate™ is operated from Canada and complies with the Personal Information Protection and Electronic Documents Act (PIPEDA). If you are located in the European Economic Area, we also comply with the General Data Protection Regulation (GDPR).

9. International Data Transfers

Our servers are located in Canada. If you access the Service from outside Canada, your data may be transferred to and processed in Canada, where privacy laws may differ from those in your jurisdiction. By using the Service, you consent to this transfer.

10. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at privacy@roshanwater.com and we will delete it promptly.

11. Third-Party Links

The Service may contain links to third-party websites or integrations (e.g., LIMS systems, export destinations). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before sharing any personal information with them.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, for material changes, notify you by email or via a prominent notice within the Service. Your continued use of the Service after any changes constitutes your acceptance of the revised policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: