Ocean AID Privacy Policy & Cookie Policy

Effective date: August 21, 2026 (supersedes the version dated July 4, 2026) Governed by: Province of British Columbia, Canada

Our promise. We believe your data is yours. We collect only what we need to make our products work well, keep it secure, and never sell it. This document explains what we collect, why, and what rights you have over it.

1. Who We Are

Cyphersoft Inc., operating as Ocean AID ("Ocean AID," "we," "us," or "our"), is a Canadian marine technology company headquartered in Victoria, British Columbia. We design and manufacture the Marlin line of edge computing devices: rugged, onboard AI systems that help vessel operators make smarter, safer decisions using data from their existing marine sensors.

This Privacy Policy applies to:

our Marlin hardware and bundled software;

our Ocean Hub cloud platform (hub.oceanaid.ai);

our website (oceanaid.ca);

our Ocean AID Marlin Connect mobile app for iOS and Android; and

all related business interactions.

Use of Ocean Hub is additionally governed by the Ocean Hub Terms of Service.

2. What We Collect

In accordance with PIPEDA Principle 3 (Consent), we collect, use, and disclose your personal information only with your knowledge and consent, except where permitted or required by law.

2.1 Device & Operational Data (Marlin Hardware)

Your Marlin device processes sensor data entirely on your vessel; it does not transmit data to Ocean AID or any cloud service unless you explicitly connect it to Ocean Hub. On-device, your Marlin may process:

Vessel telemetry (GPS location, speed, and heading)

Environmental sensor data (sonar type, depth, water temperature, and sonar image returns)

Target detection outputs (size, class, image, confidence, depth, location)

System performance logs and diagnostic data for troubleshooting

This data stays on your device. We only receive it if you choose to share it via Ocean Hub.

2.2 Account & Business Contact Information

When you purchase a Marlin device, create an Ocean Hub account, or contact our support team, we collect:

Name and company name

Username and account sign-in details

Email address and phone number

Billing and shipping address

Transaction and order records

2.3 Website & Cloud Usage Data

When you visit oceanaid.ca or use Ocean Hub (hub.oceanaid.ai), our servers automatically record standard technical logs:

IP address and approximate location (country/region level)

Browser or device type and version

The pages requested, and when

We use these logs for security, troubleshooting, and reliability — not for advertising or behavioural profiling. The cookies we set are described in Section 8.

2.4 Mobile App Data (Ocean AID Marlin Connect)

The Ocean AID Marlin Connect app is designed to store as little as possible on your phone. The app keeps:

Connection logs — records of when the app connects to and disconnects from your Marlin device, used to troubleshoot connection issues

Session data — a sign-in credential passed to the app by your Marlin device so you stay signed in (see Section 8.7)

The app does not use advertising or third-party analytics tools. Operational and sensor data is stored on your Marlin device — not on your phone — as described in Section 2.1.

3. How We Use Your Information

We use the information we collect to:

Provide, operate, and improve our Products and services

Fulfil your orders and honour warranty and support obligations

Process payments and maintain transaction records

Communicate with you about your account, orders, and product updates

Maintain the security and integrity of our systems

Comply with legal and regulatory obligations

Develop aggregated, de-identified insights to improve model accuracy and product performance

We do not sell your personal information to any third party, ever.

4. Your Data Ownership

You own your operational data. Unless we agree otherwise in writing, raw data generated through your use of Marlin Products belongs to you. Where we process data on your behalf, we act as a service provider — not a co-owner.

We may use aggregated and fully de-identified data (data that cannot be linked back to you or your vessel) for research, model improvement, and industry analysis. This de-identified data is not personal information.

We will never attempt to re-identify de-identified data, and we contractually prohibit our service providers and research partners from doing so. Because location traces can be identifying on their own, de-identification of operational data includes removing or coarsening precise coordinates, timestamps, and vessel identifiers before any research or analytical use.

5. Who We Share Information With

We share information only where necessary and always under appropriate confidentiality and security obligations. Recipients may include:

Payment processors: Stripe (to process transactions securely)

Logistics and shipping partners: Purolator (to fulfil orders)

Cloud infrastructure provider: AWS (to host Ocean Hub)

We do not share your precise vessel location or fishing data with any third party in identifiable form. We do not share your information with government authorities except where required by law.

5.1 International Data Transfers

Ocean AID is headquartered in Victoria, British Columbia, Canada. However, when you use Ocean Hub, your data is stored and processed on cloud infrastructure located in the United States.

This means that personal information you share through Ocean Hub — including account information, vessel telemetry, and any operational data you choose to upload — may be transferred to, stored in, and processed in the United States by our cloud infrastructure provider (AWS).

How we protect your data across borders. Under PIPEDA's transfer accountability principle, Ocean AID remains responsible for your personal information even when it is processed by a third party in another jurisdiction. We protect your data through the following measures:

We require our U.S.-based cloud provider to enter into a binding data processing agreement that obligates them to protect your information with safeguards comparable to those required under Canadian privacy law. These agreements include restrictions on how your data may be used (only on our instructions and for the purposes we specify), confidentiality obligations for all personnel with access to your data, technical and organisational security measures including encryption in transit and at rest, and prompt notification to Ocean AID in the event of any security breach affecting your information.

We have assessed our cloud provider's privacy and security practices and are satisfied that they provide a level of protection comparable to that required under PIPEDA and BC PIPA.

Important consideration. Because your data is stored in the United States, it may be accessible to U.S. law enforcement or government agencies under U.S. laws, including the USA PATRIOT Act and the CLOUD Act. Ocean AID cannot prevent lawful access requests made under foreign law, but we will notify you of any such request to the extent we are legally permitted to do so.

Your Marlin device data stays local. This section applies only to data you choose to upload to Ocean Hub. Data processed on your Marlin device remains stored locally on the device and is never transmitted outside your vessel unless you explicitly connect to Ocean Hub.

If you have questions about how your data is handled across borders, please contact us at contact@oceanaid.ca.

5.2 Location & Fishing Data

Fishing locations are among the most sensitive information our users generate. When you share catch reports or activity to Ocean Hub, precise coordinates are generalised to a broader area by default, and you control whether exact locations are stored or displayed through your account settings. We never sell fishing locations, and we never disclose your precise fishing locations to any third party in identifiable form.

5.3 What Other Ocean Hub Users Can See

Ocean Hub is a community platform. Content you choose to publish — including catch reports, photos, activity logs, and profile details — is visible to other Ocean Hub users according to your visibility settings. Information you share publicly may be viewed and re-shared by others, so please consider carefully before posting precise locations or personal details. You can change the visibility of your content or delete it at any time from your account.

5.4 Conservation & Research Data Sharing

With your opt-in consent, we may share anonymised, aggregated data — for example, ghost gear detections or generalised fish enumeration data — with ocean research and conservation partners. Shared datasets never include your identity, your vessel, or precise fishing locations. Participation is optional and can be withdrawn at any time in your account settings.

6. How Long We Keep Your Information

We retain personal information only for as long as necessary to fulfil the purposes described in this policy, comply with our legal obligations, resolve disputes, and enforce agreements.

Account and transaction data: retained for the duration of our relationship plus 7 years as required for financial and tax compliance.

Support correspondence: retained for 3 years after resolution.

Operational data shared via Ocean Hub: retention governed by your account settings or any applicable customer agreement.

Aggregated and de-identified data: may be retained indefinitely for research and product development.

7. Your Privacy Rights

Subject to applicable law (including PIPEDA federally and BC PIPA provincially), you have the right to:

Access the personal information we hold about you

Request correction of inaccurate or incomplete information

Request deletion of your personal information (subject to legal retention obligations)

Withdraw consent where processing is based on your consent

Lodge a complaint with Canada's Office of the Privacy Commissioner

If you are a British Columbia resident, lodge a complaint with the BC Office of the Information and Privacy Commissioner

To exercise any of these rights, please contact us at contact@oceanaid.ca. We will respond within 30 days.

7.1 Users Outside British Columbia and Canada

We apply the protections in this policy to everyone who uses our Products and services, wherever they are located.

Elsewhere in Canada: PIPEDA applies to our handling of your personal information. If you are in a province with its own private-sector privacy law, you may have additional rights under that law. Québec residents may have additional rights under Québec's private-sector privacy legislation (Law 25) and may lodge a complaint with the Commission d'accès à l'information du Québec.

Outside Canada: your information is processed in Canada and the United States as described in Section 5.1. Local law may give you additional rights, and nothing in this policy limits them. We honour access, correction, and deletion requests from all users regardless of location, subject to legal retention obligations.

8. Cookie Policy

This section explains the cookies and similar browser technologies used by Ocean Hub (hub.oceanaid.ai) and our website (oceanaid.ca), and how sign-in sessions work in the Ocean AID Marlin Connect app (Section 8.7).

The short version: every cookie we set exists to make the service work. We do not use advertising, analytics, or tracking cookies of any kind.

8.1 What Are Cookies?

Cookies are small text files placed on your device by a website. They help websites remember your preferences, keep you signed in, and deliver content you are allowed to access. Cookies do not give us access to your device or any personal information beyond what you choose to share.

8.2 Cookies Ocean Hub Uses

Signing in and staying signed in

Cookie What it holds How long it lasts

access_token Proof that you are signed in Set by the sign-in service, usually up to 24 hours

id_token Your identity, used when talking to the payment service Same as above

refresh_token Lets us sign you back in without asking for your password again 1 year, extended each time you use the app

These cookies are limited to oceanaid.ai and its subdomains and are sent only over encrypted connections. id_token and refresh_token cannot be read by page scripts; access_token can be, because the app needs to attach it to each request. All three are deleted when you sign out.

Viewing map tiles

Cookie What it holds How long it lasts

CloudFront-Policy Which map images you are allowed to load, and until when 24 hours

CloudFront-Signature A signature proving the above was issued by us 24 hours

CloudFront-Key-Pair-Id Which key signed it 24 hours

These let your browser load map imagery from tiles.oceanaid.ai. Without them, maps would not display. They are deleted when you sign out.

Signing up

Cookie What it holds How long it lasts

pending_legal_agreements Which versions of the EULA, Terms of Service, and this policy you accepted during signup 24 hours

This cookie exists because you agree to our legal documents before your account is confirmed; it is deleted as soon as your agreement is recorded on your account.

Staff only

Our internal admin interface sets its own session and security cookies (sessionid, csrftoken) for Ocean AID staff. Customers never receive these.

8.3 Other Browser Storage

Ocean Hub also stores display preferences in your browser — such as light or dark mode, your preferred units, how you arranged your dashboard, and which notifications you have already seen. These are not cookies: they never leave your device and are never sent to us.

8.4 Our Website (oceanaid.ca)

Our marketing website does not use advertising or analytics cookies.

8.5 What We Do Not Use

No advertising cookies.

No analytics or tracking cookies — no Google Analytics, no advertising pixels, and no similar services.

No third-party payment cookies. Payment happens on Stripe's own website, so any cookies Stripe sets there belong to Stripe and are governed by Stripe's privacy policy.

8.6 Managing Cookies

Because every cookie we set is necessary for the service to function, Ocean Hub does not display a cookie consent banner. You accept this Cookie Policy when you create your account, and if it changes materially you will be asked to review it again at your next sign-in.

You can block or delete cookies at any time through your browser settings, but Ocean Hub will not work properly without its essential cookies. Signing out deletes your session cookies.

8.7 The Marlin Connect App & Your Marlin Device

The Ocean AID Marlin Connect app does not use browser cookies or tracking cookies. When you sign in to your Marlin device through the app, the device passes a session cookie to the app so you stay signed in. This session data:

is exchanged directly between your phone and your Marlin device;

is stored on the Marlin device itself, with only the sign-in credential kept in the app; and

expires automatically after a set time, and is also invalidated when the device PIN is reset.

No cookie or session data from the app is sent to Ocean AID.

9. Security

We implement reasonable technical and organisational safeguards to protect your information from unauthorised access, disclosure, alteration, or destruction. These include encrypted data transmission (HTTPS), access controls, and secure storage practices.

In the event of a data breach that poses a real risk of significant harm, we will notify you and the Office of the Privacy Commissioner as required by PIPEDA.

No system can guarantee absolute security. If you become aware of a security concern related to our services, please notify us promptly at contact@oceanaid.ca.

10. Children's Privacy

Our Products and services are designed for use by adults operating marine vessels and are not directed at children under the age of 16. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our products, practices, or applicable law. When we make material changes, we will post the updated policy at oceanaid.ca, on Ocean Hub, and in our mobile app, with a revised effective date. For significant changes, we may also notify you by email. If you have an Ocean Hub account, you will also be asked to review and accept material changes the next time you sign in.

Continued use of our Products or services after the updated policy takes effect constitutes your acceptance of the revised terms.

12. Contact Us

Our designated Privacy Officer, Ian Schoeddert, is accountable for Ocean AID's compliance with PIPEDA and BC PIPA. For privacy-specific requests — including access, correction, deletion, and consent withdrawal — you can reach the Privacy Officer directly at contact@oceanaid.ca.

Company Cyphersoft Inc., operating as Ocean AID

Address BioInnovation Hub, 3542 Blanshard St #206, Victoria, BC V8X 2W8, Canada

Email contact@oceanaid.ca

Website oceanaid.ca

Made and designed in Canada.

Ocean AID respectfully acknowledges working on the traditional unceded territories of the ləkʷəŋən and W̱SÁNEĆ peoples.