Privacy Policy

1. Who We Are and What This Policy Does

1.1 Cashcows Labs Ltd. ("CashCows", "we", "us") operates the CashCows platform at cash-cows.com and app.cash-cows.com. We are the organisation that decides why and how your personal information is handled. In Canadian law we are the organisation responsible for that information; in European law we are the data controller.

1.2 This Privacy Policy explains what personal information we collect, why we collect it, who we give it to, how long we keep it, and what you can ask us to do with it. It forms part of our Terms and Conditions and should be read alongside our Cookie Policy.

1.3 We hold ourselves to the standard of the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada, Quebec's Law 25 where it applies, and the EU and UK General Data Protection Regulation where we serve users in those territories. Where a local law gives you stronger rights than this policy, that local law applies.

1.4 Questions about this policy, or any request concerning your information, should be sent to support@cash-cows.com. We route privacy matters to our Privacy Officer.

2. Scope and Application

2.1 This policy applies to everyone who visits our website, creates an account, buys or holds a Bufala Interest, holds $CASHCOWS through our platform, watches our farm livestream, contacts our support team, or interacts with our marketing.

2.2 It does not apply to third-party services you reach through our platform. Wallet infrastructure providers, payment processors, blockchain explorers, exchanges, social networks and video platforms operate under their own privacy policies. We encourage you to read them.

2.3 It also does not apply to information that is not personal — for example aggregate herd statistics, total milk volumes, or anonymised platform metrics that cannot be linked back to an identifiable person.

3. Personal Information We Collect

3.1 We collect the categories of information set out below. Not every category applies to every user; what we hold depends on how you use the platform.

3.2 We do not deliberately collect special-category information such as health data, religious belief, political opinion or trade union membership. Where a biometric template is generated during identity verification, it is created and held by our verification provider for the sole purpose of confirming your identity, and we ask that it be deleted once verification is complete.

4. How We Collect It

4.1 Directly from you — when you register, complete verification, make a purchase, contact support, enter the Ranch World, or fill in a form.

4.2 Automatically — through cookies, pixels, software development kits and server logs when you use our website or applications. Section 15 and our Cookie Policy explain this in detail.

4.3 From public blockchains — we read the Solana ledger to confirm balances, verify transfers and monitor for illicit activity. This information is public by design and we do not create it.

4.4 From third parties — identity verification providers, sanctions and politically-exposed-person data providers, blockchain analytics providers, payment processors, fraud prevention services, and advertising and analytics partners.

4.5 If you refuse to provide information we need to meet a legal obligation or to deliver the service, we may be unable to open your account, process a transaction, or pay a distribution to you.

5. Why We Use It

5.1 We will not use your personal information for a materially different purpose without first telling you and, where the law requires it, obtaining your consent.

6. Legal Bases for Processing

6.1 Under Canadian law we rely on your consent, which may be express or implied by the circumstances, together with the statutory exceptions that permit processing without consent — notably where processing is required to comply with a subpoena, warrant or court order, to detect fraud, or to meet an obligation under money-laundering legislation.

6.2 Under the GDPR, where it applies to you, we rely on the following bases:

• Performance of a contract — to give you the account, the Bufala Interest and the distributions you have contracted for.
• Legal obligation — for identity verification, sanctions screening, transaction reporting, tax reporting and record keeping.
• Legitimate interests — for fraud prevention, platform security, service improvement, analytics and the defence of legal claims. We balance those interests against your rights and you may object at any time under section 12.
• Consent — for non-essential cookies, marketing communications and any optional feature that asks for it. You may withdraw consent at any time, without affecting processing already carried out.

7. Who We Disclose It To

7.1 We do not sell your personal information. We disclose it only to the following recipients, and only to the extent each needs it.

7.2 Every supplier that processes personal information on our behalf is bound by a written agreement requiring them to act only on our instructions, to keep the information secure, and to delete or return it when the engagement ends.

8. International Transfers

8.1 CashCows operates between Toronto, Canada and Apure, Bolivarian Republic of Venezuela, and uses suppliers located in Canada, the United States, the European Union and the United Kingdom. Your personal information will therefore be stored and processed outside your country of residence.

8.2 You should be aware that when personal information is held in another country it is subject to the laws of that country, and may be accessible to the courts, law enforcement agencies and national security authorities of that country.

8.3 Where we transfer personal information out of the European Economic Area or the United Kingdom, we rely on an adequacy decision where one exists, or otherwise on the European Commission's Standard Contractual Clauses together with a transfer risk assessment and, where appropriate, additional technical measures such as encryption and pseudonymisation.

8.4 Transfers to Venezuela are limited to operational herd information. We do not transfer identity, financial or compliance information to Venezuela.

9. Blockchain Data and the Limits of Erasure

9.1 Bufala Interests and $CASHCOWS exist on the Solana public blockchain. Wallet addresses, token mints, transfers and balances are recorded on that ledger permanently and are visible to anyone in the world.

9.2 Because the ledger is distributed across independent validators worldwide, no participant — including CashCows — can alter, redact or delete anything written to it. A blockchain address may amount to personal information where it can be linked to you.

WHAT THIS MEANS FOR YOUR RIGHTS

A request to erase, correct or restrict personal information cannot be given effect in respect of data already recorded on the blockchain. We will honour such a request in respect of the off-chain records we control — including by deleting or de-identifying the link between you and your wallet address in our own systems — but the on-chain record itself will remain. Please consider this carefully before transacting.

9.3 If this consequence is unacceptable to you, do not acquire a Bufala Interest or $CASHCOWS. We disclose this openly rather than promise a deletion we cannot deliver.

10. Retention Periods

10.1 We keep personal information only as long as we need it for the purposes described in this policy, and for the period any law requires afterwards.

10.2 Where a legal claim, investigation or regulatory request is live, we retain the relevant information until the matter is concluded, even if a retention period would otherwise have expired.

10.3 At the end of a retention period we securely delete the information, or irreversibly anonymise it so that it can no longer be connected to you.

11. Security Measures

11.1 We protect personal information with organisational, technical and physical safeguards proportionate to its sensitivity. These include encryption of data in transit and at rest, role-based access control on a least-privilege basis, multi-factor authentication for staff, network segregation, logging and monitoring, vendor security review, staff confidentiality obligations, and a documented incident response process.

11.2 No system is perfectly secure. We cannot guarantee that our safeguards will never be defeated, and we ask you to play your part by using a strong unique password, enabling every authentication factor we offer, and never sharing your credentials, recovery phrase or private keys with anyone — including anyone claiming to be CashCows staff. We will never ask you for your recovery phrase or private keys.

12. Your Rights and How to Exercise Them

12.1 Subject to the law that applies to you, you may exercise the following rights:

• Access — obtain confirmation that we hold information about you, and a copy of it.
• Correction — have inaccurate or incomplete information corrected.
• Erasure — have information deleted where we no longer have a lawful reason to keep it, subject to section 9.
• Restriction — ask us to limit how we use your information while a dispute about it is resolved.
• Objection — object to processing carried out on the basis of legitimate interests, and to direct marketing at any time.
• Portability — receive information you gave us in a structured, commonly used, machine-readable format, or have it sent to another organisation.
• Withdrawal of consent — withdraw any consent you have given, at any time.
• Human review — request that a decision produced by automated means be reviewed by a person, as described in section 14.

12.2 Send requests to support@cash-cows.com. We will verify your identity before acting, to make sure we do not disclose your information to somebody else. We respond within thirty (30) days, and will tell you if we need longer and why.

12.3 We do not charge for responding to a request. If a request is manifestly unfounded, excessive or repetitive we may charge a reasonable fee or decline it, and we will explain our reasons in writing.

12.4 We may refuse a request in whole or in part where the law requires or permits us to — for example where disclosure would reveal information about another person, prejudice an ongoing investigation, breach legal privilege, or conflict with our money-laundering obligations. Where we refuse, we will tell you why and how to challenge that decision.

13. Marketing and Communications

13.1 We send two kinds of messages. Service messages — security alerts, distribution notices, verification requests, changes to terms and account notifications — are part of the service and you cannot opt out of them while your account is open.

13.2 Marketing messages about new features, promotions and community activity are sent only where you have agreed, or where the law allows us to contact an existing customer about a similar service. Every marketing message contains an unsubscribe link and we act on unsubscribes promptly.

13.3 We comply with Canada's Anti-Spam Legislation (CASL) and keep records of the consent we rely on. Withdrawing marketing consent does not affect your account or your Bufala Interests.

14. Automated Processing and Profiling

14.1 We use automated systems to screen against sanctions and politically-exposed-person lists, to score account and transaction risk, to detect fraud and multiple-account abuse, and to calculate your fee tier and distributions.

14.2 Some of these produce decisions with a real effect on you — for example declining an account, holding a transaction, or suspending access. Where an automated decision significantly affects you, you may ask for it to be reviewed by a person, explain your circumstances, and contest the outcome. Write to support@cash-cows.com.

14.3 We do not use automated processing to make decisions about you based on special-category information, and we do not sell profiles or scores to third parties.

15. Cookies and Similar Technologies

15.1 We use cookies, local storage, pixels and software development kits on our website and applications. Strictly necessary technologies are used without consent because the service cannot run without them. Analytics, functional and marketing technologies are used only with your consent, which you may change at any time.

15.2 Full detail — including the categories we use, the specific purposes, the third parties involved, retention periods and how to change your choices — is set out in our Cookie Policy, which forms part of this policy.

16. Children

16.1 The platform is not intended for anyone under eighteen (18) years of age, or under the age of majority where that is higher, and we do not knowingly collect their personal information.

16.2 If we discover that we hold information about a person below that age, we will close the account and delete the information, other than any record we are legally required to retain. If you believe a minor has provided us with information, contact support@cash-cows.com.

17. Breach Notification

17.1 We maintain an incident response process covering detection, containment, assessment, notification and remediation, and we keep a record of every breach of security safeguards, whether or not it is notifiable.

17.2 Where a breach creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible. Where the GDPR applies, we will notify the competent supervisory authority within 72 hours of becoming aware, and notify affected individuals without undue delay where the risk to their rights is high.

17.3 Our notification will describe what happened, what information was involved, what we have done, what we recommend you do, and how to reach us.

18. Complaints, Changes and Contact

18.1 If you are unhappy with how we have handled your information, contact us first at support@cash-cows.com. We acknowledge complaints within five (5) business days and respond substantively within thirty (30) days.

18.2 If we do not resolve the matter to your satisfaction, you may complain to the Office of the Privacy Commissioner of Canada, to the Commission d'accès à l'information du Québec if you are in Quebec, or to the supervisory authority in your country of residence or place of the alleged infringement if you are in the European Economic Area or the United Kingdom.

18.3 We may update this policy. Material changes take effect on not less than thirty (30) days' notice given by e-mail and in the platform. Non-material changes and changes required by law may take effect immediately. The effective date at the top of this document always shows the current version, and we keep previous versions available on request.

ISSUED BY

Cashcows Labs Ltd. — operator of the CashCows platform, treasury and token, operating between Toronto, Ontario, Canada, and Apure, Bolivarian Republic of Venezuela. This Privacy Policy is effective from 12 August 2026.