YCLT Privacy Policy

Mobile Application, Website, and Beta Testing

This Privacy Policy covers the YCLT mobile application, yclt.app, beta testing, accounts, subscriptions, support, and related communications. It describes YCLT's information-handling practices for the Services in effect as of the effective date.

1 About this policy

This Privacy Policy explains how TaBS Rest Inc. ("TaBS Rest," "YCLT," "we," "us," or "our") collects, uses, discloses, retains, and protects personal information when individuals use the YCLT mobile application, the website at https://yclt.app, our beta testing program, and related products, communications, and services (collectively, the "Services").

TaBS Rest Inc. is responsible for personal information under its control. Privacy questions, requests, and complaints may be directed to the contact listed in Section 19.

2 Scope and roles

This Policy applies to trainers and coaches who use the Services, people whose information a trainer enters as a client record, prospective users, beta testers, website visitors, and other individuals who communicate with YCLT. The current mobile application provides trainer accounts only. Clients, gyms, schools, certifying bodies, and other organizations do not currently receive their own login or platform access.

YCLT determines how it uses trainer account information, website and waitlist information, subscription records, support communications, beta information, and operational or security data. For those activities, YCLT acts as the organization responsible for the information, which may be called a controller, business, or accountable organization under applicable law.

A trainer independently decides which clients to record, what client and training information to enter, and how to use that information in the trainer's business. For that activity, the trainer, or the gym or other organization for which the trainer acts, may be the controller or accountable organization. YCLT generally processes that information to provide the Services on the trainer's instructions and may be described as a processor or service provider. YCLT may also use limited related information for its own security, legal compliance, billing, and service-integrity purposes as described in this Policy.

Trainers and organizations remain responsible for their independent collection, use, disclosure, and retention of client information, including giving any required privacy notice and obtaining any required consent. Their own privacy notices may apply in addition to this Policy. Questions about a trainer's professional services or independent privacy practices should be directed to that trainer or organization. These separate responsibilities do not remove YCLT's responsibility for information under YCLT's control.

3 Personal information we collect

We collect personal information that is reasonably necessary for the purposes described in this Policy. The information collected depends on how a person interacts with the Services.

3.1 Account and contact information

For account registration and administration, we collect first, middle, and last name, email address, and, where provided, a username and telephone number.
We also process an authentication subject, internal and external account identifiers, a registered-device identifier, account status, and account creation and update timestamps.
Authentication is provided through WorkOS. We receive the authentication information and tokens needed to establish and maintain a signed-in session, but we do not receive or store the password a user provides to WorkOS.
The current mobile application is designed for trainer accounts. The released code does not currently collect a profile photograph, biography, professional credentials, certifications, occupation, specialties, mailing address, city, country, time zone, or preferred language as account-profile fields.

3.2 Fitness and client information

Trainers may create client records containing a client's first and last name, email address, and optional telephone number. We also process identifiers, timestamps, and trainer-client relationship information needed to associate these records with the trainer's account.
The Services process training-program and workout information, including programs and program versions, session records and status, scheduling and time-slot information, exercise selections and order, sets, rounds, dropsets, supersets, and session history.
For an exercise or training session, the Services may process measurement definitions and values entered by a trainer, including weight, time or duration, and repetitions.
The current application does not access Apple Health, HealthKit, motion or fitness APIs, connected wearable devices, or medical records. It does not currently provide fields for injuries, symptoms, medical conditions, medications, accessibility needs, nutrition, body measurements, progress photographs, or uploaded assessments.
The current version of YCLT does not provide free-form note-taking fields for trainers or clients. YCLT therefore does not intentionally collect information about injuries, symptoms, medical conditions, medications, nutrition, dietary information or similar health information through a notes feature.

We use client, program, session, exercise, scheduling, and measurement information to provide the training-management features requested by the trainer. We do not use this information for advertising or unrelated profiling.

3.3 Communications and user content

If a user contacts us for support or otherwise communicates with us, we collect the contact information and the content of the request, correspondence, or feedback, together with any information the user chooses to provide.
The current version of YCLT does not provide in-app direct messaging, comments, or free-form trainer or client notes. Accordingly, YCLT does not collect or store user-generated free-form notes through the Services.
The current version also does not provide functionality for users to upload photos, videos, audio recordings, documents, assessments or reports.

3.4 Transactions and subscriptions

If you purchase a subscription through the Apple App Store, Apple processes your payment. We use RevenueCat to manage subscriptions, verify purchases, and provide access to subscription features. We may receive purchase and subscription status, transaction and receipt identifiers, product information, purchase and expiration dates, renewal status, and limited billing-related information from Apple and RevenueCat.

YCLT does not receive or store your full payment-card number, card verification code, or other complete payment-card credentials for purchases processed through the Apple App Store. Apple’s handling of your payment information is governed by Apple’s own terms and privacy policy.

If you purchase a subscription through Google Play, Google processes your payment. We use RevenueCat to manage subscriptions, verify purchases, and provide access to subscription features. We may receive purchase and subscription status, transaction and purchase-token identifiers, product information, purchase and expiration dates, renewal status, and limited billing-related information from Google and RevenueCat.

YCLT does not receive or store your full payment-card number, card verification code, or other complete payment-card credentials for purchases processed through Google Play. Google’s handling of your payment information is governed by Google’s own terms and privacy policy.

3.5 Device usage and diagnostic information

The app creates and uses a unique device identifier to register the device, authenticate the account, and synchronize data between the device and the Services.
When the app communicates with our servers, we may automatically receive standard connection and request information, including IP address, request date and time, requested endpoint, response status, and related network or protocol information. We do not use IP addresses to derive an approximate location for app analytics.
We process operational and error logs needed to authenticate users, synchronize data, secure the Services, diagnose failures, and maintain performance. The current application and server use OpenTelemetry-based operational logging. The current mobile code does not include a third-party crash-reporting or product-analytics SDK.
The current application does not collect product-analytics events, advertising identifiers, referral data, push-notification tokens, or notification preferences.

3.6 Device permissions

The current application does not request runtime access to the camera, photo library, microphone, precise or approximate location, contacts, motion and fitness information, HealthKit, or notifications.

If a future feature requires access to a protected device capability, the app will request permission through the device operating system before accessing it, and we will update this Policy when required.

3.7 Cookies and local storage technologies

The current mobile application does not include Google Analytics, advertising cookies, or targeted-advertising technology. To maintain an authenticated server session, the Services use an essential cookie named "session". In production, this cookie is configured as Secure, HttpOnly, persistent, and SameSite=Lax, with a maximum lifetime of 365 days and a shorter inactivity timeout set by the service configuration. The app also uses secure device storage for account identifiers and WatermelonDB local storage for app data that is synchronized with the Services. WorkOS, Apple, Google, and other external pages opened by the app may use cookies or similar technologies under their own privacy notices.

3.8 Beta testing information

When a user participates in beta testing through Apple TestFlight or a Google Play testing track, we and the applicable platform provider may process the tester's email address or platform account, invitation or opt-in status, app version and build, installation activity, device and operating-system information, crashes, application-not-responding events, diagnostics, and feedback. Feedback may include comments or screenshots that the tester chooses to submit. TestFlight public-link testers may appear anonymously to us unless they provide an email address with feedback. The current application does not include additional beta-analytics, session-replay, screen-recording, interview-recording, or user-research SDKs. Information processed by Apple or Google is also governed by that provider's privacy notice.

4 How we collect information

We collect personal information from the following sources:

Directly from trainers when they create or manage an account, enter client and training information, use app features, make selections, or contact us for support.
Directly from website visitors when they join the waitlist or submit a contact form. The current waitlist requests an email address, name, city, and other responses selected or entered by the visitor.
From trainers who enter information about their clients. A trainer is responsible for having authority to provide that information and for giving any notice or obtaining any consent required by law.
Automatically from the mobile app and our servers, including device identifiers, IP address, session and request information, synchronization records, and operational or security logs.
Automatically from the website through Webflow and Google Analytics, including cookies or similar identifiers, IP address, browser and device information, referral information, and website interactions.
From WorkOS for authentication; from Apple, Google, and RevenueCat for purchases and subscriptions; and from Apple TestFlight or Google Play testing services when a user participates in a beta test.

5 How we use personal information

Create, authenticate and manage trainer accounts;
Create and manage trainer-entered client records;
Create, schedule and manage training programs, exercises and sessions;
Record and synchronize workout and performance information, including exercises, sets, repetitions, weight, duration and workout history;
Store and synchronize information between supported devices, the Services, and our systems;
Process and manage subscriptions, purchases and entitlements;
Provide customer support and respond to inquiries;
Maintain the security, integrity and reliability of the Services;
Diagnose technical issues and monitor service performance;
Administer beta testing and collect beta feedback;
Operate our website, waitlist and permitted website analytics;
Communicate with users about the Services, including service-related communications and, where permitted, product updates, surveys and marketing communications; and
Comply with applicable legal obligations and establish, exercise or defend legal claims.

YCLT does not use personal information for targeted advertising or cross-app tracking and does not use personal information to make solely automated decisions that produce legal or similarly significant effects.

6 Consent and other legal bases

YCLT collects, uses, and discloses personal information only for the purposes described in this Privacy Policy and as permitted by applicable law.

Where consent is required, YCLT seeks consent appropriate to the nature and sensitivity of the information and the purposes for which it is collected, used, or disclosed. Consent may be withdrawn where permitted by law, subject to legal, contractual, or operational restrictions and reasonable notice.

Certain processing may also be carried out without consent where permitted or required by applicable law, including where necessary to provide requested Services, protect the security and integrity of the Services, comply with legal obligations, prevent fraud or abuse, or establish, exercise, or defend legal claims.

Trainers and other organizations that independently determine how client information is collected and used are responsible for obtaining any consent or other legal authority required for their own activities.

7 How information is disclosed

We do not sell personal information for money. The current mobile app does not use personal information for targeted advertising or track users across apps or websites owned by other companies.

Google Analytics may receive website identifiers and usage information for audience and website-performance measurement. Depending on the law that applies, this activity may be treated as sharing or tracking even though YCLT does not sell the information for money.

7.1 Trainers, clients, and organizations

The current mobile app is designed for trainers. A trainer can view and manage the client, program, session, scheduling, exercise, and measurement information associated with that trainer's account. Clients do not currently have app login access, and gyms, schools, certifying bodies, and other organizations do not receive access through the current Services.

A trainer independently determines what client information to enter and how to use it in the trainer's business. The trainer may therefore have separate privacy obligations and should provide clients with any privacy notice required for the trainer's own collection and use.

Authorized YCLT personnel may access personal information only as needed for their work. The development team handles technical support, security, and troubleshooting. The business team manages the website waitlist, inquiries, and permitted marketing communications.

7.2 Service providers and integrated services

YCLT uses third-party service providers to operate, support, secure, distribute, and administer the Services. These providers may process personal information on YCLT's behalf or receive information necessary to provide their services.

Current service providers include:

Amazon Web Services (AWS) — production cloud infrastructure and hosting for YCLT's application services. YCLT's production application infrastructure is currently hosted in the United States.
WorkOS — authentication, account identity, login, and session-management services. Information processed through WorkOS may include account identifiers, authentication information, email address, name, and information necessary to establish and maintain authentication sessions.
RevenueCat — subscription management, purchase verification, and entitlement management. Information processed through RevenueCat may include YCLT account or customer identifiers, subscription and entitlement information, transaction or purchase identifiers, product information, subscription status, and related purchase information. YCLT does not receive full payment-card information through RevenueCat.
Apple — distribution of the YCLT application, TestFlight beta testing, Apple account or authentication services where used, and processing of purchases made through Apple's platforms. Apple may process information associated with application distribution, beta participation, devices, diagnostics, accounts, and purchases in accordance with its own privacy practices.
Google — distribution of the YCLT application and beta testing through Google Play and processing of purchases made through Google's platforms when those services are used. Google may process information associated with application distribution, beta participation, devices, diagnostics, accounts, and purchases in accordance with its own privacy practices.
Webflow — hosting and operation of YCLT's public website and website forms. Information submitted through YCLT's website, including waitlist or contact-form information, may be processed through Webflow.
Google Analytics — analytics for YCLT's public website. Google Analytics may process information about website visits and interactions, such as device and browser information, IP address, referral information, pages or content viewed, and interactions with the website. Google Analytics is not currently used as an in-app product-analytics service in the YCLT mobile application.
Google Workspace — business email, documents, communications, and related administrative operations. Personal information may be processed through Google Workspace when an individual communicates with YCLT or when YCLT maintains business records relating to that individual.

These providers process information according to their respective roles and services. YCLT does not provide every category of personal information described in this Privacy Policy to every service provider.

Where a service provider processes personal information on YCLT's behalf, YCLT uses contractual and other appropriate measures designed to require protection of the information consistent with applicable law and the commitments described in this Privacy Policy.

Some service providers may process information in the United States or other jurisdictions. See Section 11 for additional information about international processing.

7.3 Legal and organizational disclosures

We may disclose personal information when reasonably necessary to comply with applicable law, a court order, subpoena, or other lawful process; respond to authorized requests from regulators, law enforcement, or public authorities; protect the rights, safety, and security of users, YCLT, or others; investigate fraud, abuse, or violations of our terms; or establish, exercise, or defend legal claims.

We may also disclose information to professional advisers, auditors, insurers, lenders, investors, or transaction participants when reasonably necessary for financing, due diligence, a merger, reorganization, sale, or transfer of all or part of our business. Where appropriate, we limit the disclosure and require confidentiality or other protections.

7.4 Third-party services and links

The Services may link to or open Apple, Google, WorkOS, or other third-party websites, stores, or services. Those third parties process information under their own terms and privacy notices. This Policy does not govern a third party's independent collection or use of information, even when YCLT provides a link or integration. Users should review the third party's notice before providing information directly to it.

8 Fitness and potentially sensitive information

The current application does not access Apple Health, HealthKit, motion or fitness APIs, connected wearable devices, or medical records. It does not currently provide fields for injuries, symptoms, medical conditions, medications, accessibility needs, nutrition, body measurements, progress photographs, or uploaded assessments. Trainers should not enter medical or other sensitive information into fields that are not designed for that purpose.

YCLT is a training-management service. The current version of YCLT processes fitness and exercise information as part of providing its training-management functionality, including programs, exercises, sessions, workout history, and performance information.

YCLT does not currently collect information from Apple HealthKit, Health Connect, wearable devices, electronic medical records, or similar health-data sources.

YCLT does not use fitness information for targeted advertising or automated decision-making.

9 Artificial intelligence and automated features

The current Services do not send user information, workouts, client records, images, messages, support content, or other personal information to an artificial-intelligence or machine-learning provider. YCLT does not currently use automated decision-making to determine access, pricing, eligibility, trainer credentials, or other decisions with legal or similarly significant effects.

If YCLT introduces an artificial-intelligence feature, we will assess the information sent to the provider, retention and model-training practices, human review, user choices, and legal requirements before launch, and we will update this Policy when required.

10 Website Analytics, Cookies and Marketing

10.1 Website Analytics and Cookies

YCLT's website may use cookies and similar technologies that are necessary for the website to function and to understand how visitors use the website.

YCLT currently uses Google Analytics on its public website to help understand website traffic and interactions. Google Analytics may process information such as IP address, device and browser information, referral information, pages or content viewed, approximate geographic information derived from technical information such as an IP address, and interactions with the website.

YCLT uses this information to understand website usage, evaluate website performance, identify technical issues, and improve the website and its content.

Where applicable law requires consent before using non-essential analytics cookies or similar technologies, YCLT will request that consent before using those technologies.

YCLT does not currently use Google Analytics as an in-app product analytics service in the YCLT mobile application.

YCLT does not currently use advertising cookies or similar technologies on its website for cross-site behavioral advertising or targeted advertising.

You may be able to control or disable cookies through your browser settings and, where provided, through cookie controls available on the website. Disabling certain cookies may affect some website functionality.

10.2 Marketing Communications

YCLT may use contact information provided through its website, waitlist, beta programs, or other interactions to send product updates, beta invitations, surveys, newsletters, and other communications where permitted by applicable law.

Marketing emails include a method to unsubscribe. You may also contact YCLT using the information in Section 19 to request that marketing communications stop.

Service-related communications concerning an account, security, privacy, purchases, or operation of the Services may still be sent where necessary even if you unsubscribe from marketing communications.

11 International processing

YCLT is operated by TaBS Rest Inc., a Canadian company. Personal information may be processed or stored outside the province, state, or country in which an individual resides.

YCLT uses service providers to operate and support the Services, including providers for cloud hosting, authentication, subscription and purchase management, application distribution, website hosting and forms, analytics, email, productivity, customer communications, and related business operations. These providers may process personal information in Canada, the United States, and other jurisdictions in which they or their subprocessors operate.

YCLT's production application infrastructure is currently hosted using Amazon Web Services in the United States. Other service providers, including those identified in Section 7, may also process or store personal information outside Canada depending on the services being used.

When personal information is processed outside an individual's jurisdiction, it may be subject to the laws of the jurisdiction in which it is processed and may be accessible to courts, law-enforcement agencies, regulators, or other government authorities in accordance with applicable law.

YCLT uses contractual, organizational, and technical measures appropriate to the nature of the information and the services provided when engaging service providers that process personal information on our behalf.

For additional information about the service providers YCLT uses and their purposes, see Section 7.

12 Retention and deletion

YCLT retains personal information only for as long as reasonably necessary to provide and secure the Services, maintain required business and transaction records, comply with legal and contractual obligations, resolve disputes, prevent fraud or abuse, and enforce our agreements.

When a YCLT account is active, we retain the account, client, program, session, scheduling, exercise, measurement, subscription, device, and operational information reasonably necessary to provide the Services.

When an account deletion request is completed, YCLT deletes, removes, or de-identifies personal information that is no longer required for an applicable legal, security, financial, fraud-prevention, dispute-resolution, audit, or similar purpose.

Certain technical, training, operational, historical, or relational records may be retained after account deletion where necessary to maintain system integrity, transaction records, security records, or historical data. Where such information is retained without an ongoing need to identify the individual, YCLT removes or de-identifies identifying information so that the retained information no longer reasonably identifies or can reasonably be reconnected to the individual.

Information is not considered de-identified or anonymous if YCLT or another party can reasonably reconnect it to an identifiable individual.

Some information may remain temporarily in protected backups or other systems that cannot reasonably be modified immediately. Such information will remain protected from ordinary use and will be deleted, overwritten, or de-identified according to the applicable backup or system lifecycle.

YCLT may retain records for longer where required or permitted by applicable law, including for financial, legal, security, fraud-prevention, dispute-resolution, or regulatory purposes.

Information entered by a trainer about a client may also be subject to the trainer's or another responsible organization's retention obligations. Where YCLT processes that information on their behalf, YCLT will handle applicable deletion or retention requests in accordance with its obligations and the instructions of the responsible organization.

13 Account and information deletion

You may request access to or correction of your personal information, or request deletion of your YCLT account, by contacting info@tabsrest.com. This email option may be used even if you no longer have access to the application. For account deletion requests, please include “Delete My Account” in the subject line and provide the name and email address associated with your account. We may take reasonable steps to verify your identity before completing the request.

You can also submit an account deletion request through our Delete Account page.

The YCLT application also includes a Settings > Privacy > Delete Account control that allows users to initiate deletion of their account.

When you request account deletion, YCLT will terminate access to your account and delete or de-identify personal information associated with the account that YCLT is not required or otherwise permitted to retain. The deletion process may take up to 30 days to complete, and YCLT will provide confirmation when the deletion process has been completed. Deleting a YCLT account does not automatically cancel an active subscription billed through Apple or Google; subscriptions must be managed through the applicable app-store account.

YCLT may retain information where reasonably necessary or permitted for legal, fraud-prevention, dispute-resolution, financial-record, security, audit or similar legitimate purposes. YCLT may also retain information that has been aggregated or de-identified so that it no longer reasonably identifies you. Information is not considered de-identified if YCLT can reasonably reconnect it to you.

Deletion will also address applicable account information maintained by YCLT's service providers in accordance with YCLT's arrangements with those providers and applicable retention requirements.

14 Security

YCLT uses administrative, technical, and organizational safeguards designed to protect personal information against loss, theft, unauthorized access, disclosure, copying, use, or modification. These safeguards are selected based on factors such as the sensitivity and amount of information, how it is used and stored, and the risks associated with its processing.

Our safeguards may include authentication and session controls, access controls, encrypted network communications, restrictions on personnel access, logging and monitoring, and security measures provided through our hosting and service providers.

No method of electronic transmission, storage, or security is completely secure. While YCLT takes reasonable measures to protect personal information, we cannot guarantee absolute security.

If YCLT becomes aware of a security or privacy incident involving personal information, we will investigate and respond to the incident and take reasonable steps to contain and remediate it. Where required by applicable law, YCLT will notify affected individuals, privacy regulators, or other appropriate parties.

YCLT maintains records of privacy and security incidents as required by applicable law.

15 Individual rights and choices

Depending on where you reside and the law that applies, you may have rights concerning your personal information, including the right to request access to or correction of personal information, withdraw consent where applicable, request deletion, or exercise other privacy rights provided by applicable law. Certain rights may be subject to identity verification and legal exceptions.

You may exercise applicable privacy rights by contacting YCLT at info@tabsrest.com. We may take reasonable steps to verify your identity before completing a request. We will respond within the period required by applicable law.

You may also exercise the following choices:

Account deletion: You may initiate deletion through Settings > Privacy > Delete Account or contact info@tabsrest.com. See Section 13 for additional information about account deletion and retention.
Marketing communications: You may unsubscribe from marketing emails using the unsubscribe link included in those communications or by contacting us.
Website cookies: You may control or disable cookies through your browser settings and, where available, through cookie controls provided on the YCLT website.

If YCLT processes personal information about a client on behalf of a trainer or another responsible organization, the trainer or organization may be responsible for responding to the request. In those circumstances, YCLT may direct the individual to the appropriate trainer or organization and will provide assistance where required by applicable law or our contractual obligations.

Additional information about rights that may apply in particular regions is provided in Section 17.

16 Children and age requirements

YCLT accounts are intended for trainers and coaches who are at least 18 years of age. Individuals under 18 may not create or hold a YCLT account.

YCLT is not directed to children and does not knowingly permit individuals under 18 to register as account holders. If we learn that an individual under 18 has created an account, we may terminate the account and handle the associated personal information in accordance with this Privacy Policy and applicable law.

A trainer may enter information about a client who is a minor as part of the trainer's professional services. The trainer, gym, or other organization for which the trainer acts is responsible for having the appropriate authority to collect and use that information, providing any required privacy notice, and obtaining any consent or authorization required by applicable law, including from a parent or guardian where required.

Trainers should only enter information about a minor that is reasonably necessary for providing their training services.

Requests concerning information about a minor entered by a trainer may be directed to the trainer or responsible organization. Where YCLT processes that information on their behalf, YCLT may assist them in responding to access, correction, or deletion requests as required by applicable law or YCLT's contractual obligations.

17 Regional information

17.1 Canada

Canadian residents may contact YCLT's Privacy Officer to request access to or correction of their personal information, withdraw consent where applicable, or raise a question or complaint about YCLT's privacy practices.

Applicable rights and requirements may vary depending on the individual's province or territory, the nature of the organization involved, and the activity in question.

If YCLT does not resolve a privacy concern to your satisfaction, you may have the right to contact the Office of the Privacy Commissioner of Canada or an applicable provincial privacy authority.

17.2 European Economic Area and United Kingdom

YCLT is based in Canada and does not currently intentionally offer or market the Services to individuals in the European Economic Area or United Kingdom.

Before intentionally expanding the Services into those regions, YCLT will assess and implement the privacy, data-protection, international-transfer, contractual, and other requirements applicable to that expansion.

If European Union or United Kingdom data-protection law applies to a particular processing activity despite YCLT not intentionally offering the Services in those regions, YCLT will handle the applicable personal information and privacy requests in accordance with applicable law.

17.3 United States and other regions

Depending on where you reside and the laws applicable to YCLT's activities, you may have privacy rights concerning your personal information. These may include rights to request access to, correction of, deletion of, or a copy of certain personal information, and rights relating to certain uses or disclosures of personal information.

YCLT does not sell personal information for monetary consideration and does not use personal information for targeted advertising or cross-app behavioral advertising.

The current version of YCLT processes fitness and exercise information used to provide its training-management functionality, including information about exercises, programs, sessions, sets, repetitions, weight, duration and workout history. The current version does not provide free-form trainer or client notes and is not designed to collect injuries, symptoms, medical conditions, medications, nutrition, dietary information or similar health information through a notes feature.

Certain U.S. state laws may provide additional rights or impose additional requirements for particular categories of information, including information that may be considered consumer health data under applicable law. Where such laws apply to YCLT's processing activities, we will process the applicable information and respond to requests in accordance with those requirements.

To submit a privacy request or ask a question about your privacy rights, contact the Privacy Officer using the information in Section 19. We may take reasonable steps to verify your identity before completing a request. Where applicable law permits an authorized agent to submit a request on your behalf, we may request information necessary to verify the authorization.

We will not unlawfully discriminate against you for exercising an applicable privacy right.

18 Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to the Services, our information-handling practices, service providers, or applicable legal requirements.

When we update this Privacy Policy, we will post the revised version and update the effective date.

If we make a significant change to how we collect, use, or disclose personal information, we will provide additional notice and obtain consent where required by applicable law. Notice may be provided through the YCLT application, website, email, or another appropriate method.

19 Contact and complaints

Questions, requests, and complaints may be directed to:

YeounJun Park, Privacy Officer

TaBS Rest Inc.

Email: info@tabsrest.com

Telephone: (226) 989-2504

4789 Yonge St., Unit 801, North York, Ontario M2N 0G3, Canada

If you have a concern about YCLT's privacy practices, we encourage you to contact our Privacy Officer first so that we can review and address the concern.

If your concern is not resolved to your satisfaction, you may have the right to contact the Office of the Privacy Commissioner of Canada or an applicable provincial privacy authority.

Effective date: September 23, 2026