Privacy Charter

This Privacy Charter governs the collection, processing, and protection of personal data across the Zomee Ecosystem Suite (Video Meetings, Zomee Forms, MyHomeTree, and MyCard Studio), operated under Pelican Fleet ERP Cloud Services (Dubai Silicon Oasis, DDP, Dubai, United Arab Emirates). We are committed to transparency, minimization, and privacy-by-design principles across desktop, mobile applications, and web browsers.

We collect only the minimum personal data required to deliver reliable real-time services across our application suite: • Account & Identity Information: User full name, email address, profile avatar, and unique Firebase user identifier (UID) provided during Google Single Sign-On (OAuth 2.0) or email registration. • Video Meetings Metadata: Session identifier (Room ID), meeting title, host identifier, entry/exit timestamps, and attendee display names. Utilized exclusively to generate host attendance rosters. • Zomee Forms Submissions: Data entered into form fields by respondents, optional file upload attachments, and submission timestamps. Stored in encrypted Firestore collections associated with the form creator. • MyHomeTree Profiles: Public display name, bio description, chosen template theme, avatar, and outbound links configured by the creator. • MyCard Studio Deliveries: Greeting card title, message text, attached photos, voice recording notes, recipient email address, and scheduled dispatch timestamps. • Hardware & Technical Diagnostics: Ephemeral technical metrics including local IP address (negotiated via WebRTC ICE candidates), browser client version, audio input level indicators, camera resolution capabilities, and network round-trip time (RTT). Processed in real time and never retained permanently.

Zomee operates on an advanced Selective Forwarding Unit (SFU) architecture powered by LiveKit WebRTC: • Encrypted Media in Transit: Audio and video streams are encrypted using DTLS (Datagram Transport Layer Security) and SRTP (Secure Real-time Transport Protocol) with 256-bit AES encryption. • Ephemeral Memory Routing: Media packets entering our SFU edge servers are routed strictly through volatile system memory (RAM) and immediately forwarded to authorized room participants. Our media relays never write raw audio or video to server hard drives or cloud databases. • Direct P2P File Drop Vault: When sharing documents in the meeting vault, data is streamed in direct 16KB binary chunks over WebRTC Data Channels directly from sender to recipient memory. No central cloud storage repository is involved.

• End-to-End Submission Security: All form responses and uploaded attachments are transmitted via TLS 1.3 encryption and stored in private cloud buckets accessible exclusively by the authenticated form creator. • Responder Anonymity & Consent: Form creators can configure forms to collect email addresses or allow anonymous responses. Respondents are clearly notified of data collection purposes prior to submission. • Data Retention & Deletion: When a form creator deletes a form or specific response, all associated metadata and uploaded files are permanently purged from database indexes.

• Public Profile Transparency: Information published on your MyHomeTree profile is intentionally public. We advise creators not to post confidential personal identification numbers or sensitive financial data. • Visitor Privacy: Visitors who browse public MyHomeTree profiles are never tracked with invasive third-party cross-site cookies. We compute aggregate view counts and link click metrics with zero visitor fingerprinting.

• Private Access Tokens: Every card created in MyCard Studio is assigned a cryptographically random, unguessable card identifier. Only individuals in possession of the private card URL or recipient email receive access. • Voice Notes & Media Storage: Personal voice notes and memory photos are stored securely in cloud storage buckets and streamed exclusively to authorized card viewers. • Scheduled Email Queue Confidentiality: Scheduled greeting emails and recipient addresses are processed by automated secure cron tasks and never shared with advertising networks.

• Client-Side Local Recordings: When a meeting host initiates recording, video and audio streams are composited and encoded client-side inside the user's browser using HTML5 Canvas and MediaRecorder APIs. The resulting MP4/WebM file is saved directly to the user's local downloads folder with zero server involvement. • Cloud Recording Vault (Pro Feature): For Pro subscribers utilizing cloud backup, recordings are encrypted in transit and stored in private cloud buckets protected by signed, time-limited access tokens. Cloud recordings auto-purge after 30 days unless deleted earlier by the account owner.

Zomee integrates Google Gemini AI models to provide speech-to-text live transcription and executive meeting summaries: • On-Demand Transcription: AI transcription operates strictly when activated by the meeting host. Spoken audio is converted to text tokens in temporary memory. • Zero Training on Your Data: Under our enterprise API terms with Google Cloud, customer meeting audio, transcripts, and summaries are NEVER used to train, retrain, or improve foundational machine learning models. • Retention & Deletion: AI-generated summaries, key decisions, and action item checklists are stored in your private dashboard vault and automatically purged after 30 days. Hosts can permanently delete any summary at any time with 1 click.

• Multi-Gateway Compliance: Zomee Pro subscriptions and services are billed via Stripe, PayPal, and LemonSqueezy, all certified PCI-DSS Level 1 service providers. • Zero Raw Card Storage: Zomee servers NEVER receive, transmit, or store raw 16-digit credit card numbers (PAN) or security codes (CVV). We store only cryptographically signed customer tokens, billing cycle intervals, and transaction IDs.

• Functional Cookies: We utilize strictly necessary local storage cookies to preserve user preferences (microphone and camera toggles, dark theme settings, and authentication state). • Google AdSense: To support our free tier, third-party vendor Google displays advertisements across public pages (Publisher ID: ca-pub-8360641964971659). Google uses cookies (including the DoubleClick DART cookie) to serve ads based on prior visits to our website and other sites. Users may opt out of personalized advertising by visiting Google Ad Settings (www.google.com/settings/ads) or through www.aboutads.info.

Zomee complies with global data privacy frameworks including the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA/CPRA), and UAE Personal Data Protection Law (Federal Decree Law No. 45 of 2021): • Right to Access & Data Portability: You may request an export of your meeting logs, form responses, and profile data in JSON, PDF, or CSV format at any time. • Right to Rectification & Erasure: You may update your profile or delete your account, meetings, forms, cards, and billing history through Account Settings or by contacting our Data Protection Officer. • Zero Sale of Personal Data: Zomee does not sell, rent, trade, or monetize personal user data to third-party data brokers.

For privacy inquiries, GDPR data requests, or compliance auditing, please contact our dedicated Data Protection Officer: Pelican Fleet ERP Cloud Services — Information Security Division DPO: Saeed Ansar Address: Dubai Silicon Oasis, DDP Building A2, Dubai, United Arab Emirates Official Support Email: saeed@aleazazdelivery.ae Direct Hotline & Botim Support: +971588346500