Introduction
Collart (hereinafter referred to as “Collart”, “we” or “us”) takes your privacy very seriously, and we are committed to protecting and respecting your privacy. That value powers all of the decisions we make, including how we collect, use, share, store and respect your personal information. Please read this Privacy Policy carefully so that you can make appropriate decisions on an informed and freely given basis.

Children Under 16
WE DO NOT knowingly collect or store any personally identifiable information from children under 16. If parents believe that we have unintentionally collected their children’s’ personal information, please contact us to delay the information via appropriate means as set forth in “Contact Us” Section of this Privacy Policy.

Scope
This Privacy Policy applies to users of our services anywhere in the world, including users of our applications, official websites or other services (“the Service”), unless covered by a separate privacy policy or additional terms of this policy. It is important that you read this Privacy Policy with any other privacy policy or fair processing policy we may provide on specific occasions, so that you are fully aware of when, why and how we collect and process your personal information. This Privacy Policy supplements other notices and privacy policies and is not intended to override them.
By using our Apps or accepting our services, including without limitation accessing our applications, you acknowledge the terms of this Privacy Policy. If you object to anything described in this Privacy Policy, please do not use our websites or our Apps.
We may amend this Privacy Policy from time to time, and we will notify you about such changes by posting the amended version on our websites or application. Please check back periodically to ensure that you are aware of any changes, and your continued use of our services will be deemed your acceptance of these changes.
Unless otherwise prescribed in the Privacy Policy, the terms in the Privacy Policy shall have the same implications with the terms in the Terms of Service.

PLEASE NOTE THAT, this Privacy Policy does not apply to the following cases:

• Any information or personal information collected by any third-party services, products, applications, websites and/or platforms, such as Instagram, regardless whether they are accessible through our applications and/or websites; or
• Any information or personal information collected by other companies or institutions that provide advertising services through our applications and/or websites.

In such circumstances, you should refer directly to privacy policies for the relevant third party.

Data Controller and Data Processor
Collart is both the data controller and data processor, who determine the purposes and methods of the data processing with respect to your personal information collected by us, and responsible for the data processing with respect to your use of our services. You can contact us in the following ways:
Email address: DPO@collart.app

Personal Information We Collect
Personal information, or personal data, means any information that identifies (whether directly or indirectly) a particular natural person, such as the name, email address, phone number, the identification number, location data, or an online identifier, etc. It does not include data where the identity has been removed (anonymous data).

We may collect your personal information as follows:

• Contact Details. If you contact us and provide us with your personal information, we may collect such name and email address for responding products feedback, complaints, bug reports, or any other service related questions;
• Transaction Records. We provide in-app purchase to our users, and such purchase will be made through Apple Store or other third-party service providers. To provide you with the corresponding products, we may receive transaction records from third-party service providers, but you cannot be identified from those transaction records；
• Technical Information. WE WILL NOT collect technical information about the device(s) and/or browsers (including without limitation your IP address, browsing type, mobile model, operating systems, network type and other browser settings/preference) you may use. However, we may use such pseudonymization technical information provided by Google Analytics (to know how Google Analytics collect and process with your personal information when you use any websites and/or applications have established partnership with Google, please refer to this link)；
• Data Related to The Service. We collect abstracted data related to your use of our applications. This includes your country and your internet service provider. You cannot be identified from those abstracted data；

WE DO NOT and will never collect your personal information without notifying you and obtaining your permission.

If You Fail to Provide Personal Information
If you fail to provide the personal information as requested where we need to collect such personal information by law, under the terms of a contract we have with you, to enter into a contract with you, or to provide you with the services, we may not be able to perform the contract we have or are trying to enter into with you, or to provide you with, in part or in a whole, certain features or the services that you request.

How We Use Your Personal Information
We will use the personal information we collect about you in accordance with the laws of applicable jurisdictions in the following ways:

• To enter into and to perform our contract with you, or to perform any steps you require from us before entering into a contract with you;
• To communicate with you, including but not limited to respond to your request for any help with our services or for exercising your rights with respect to your personal information;
• To provide support and security for our applications or any other services you request;
• To comply with our legal obligations under relevant laws, regulations, and orders (including subpoenas), injunctions, or any other legal documents issued by the court or competent governmental or regulatory authorities.
• To pursue our legitimate interests (or those of a third party) as we deem fit and necessary, where your interests and fundamental rights do not override those legitimate interests of ours (or ang third party’s), such as:
  • to understand, improve, optimize and develop our services;
  • to conduct research and monitor the quality of our services;
  • to enforce our Terms Agreement; or
  • to respond to complaints, hearings, arbitrations, law suits or other governmental or regulatory proceedings.

PLEASE NOTE THAT, WE DO NOT sell or share your personal information with any third parties for their direct marketing, but those third parties who provide us with SDKs may collect your personal information directly, please refer to “How We Share Your Personal Information” Section for detailed information.
WE WILL NOT use in-depth processing of your personal information to obtain your biometric information.

How We Share Your Personal Information
We may share your information with our vendors that perform support and other services in connection with our Services as follows:

• with advertising service providers and advertising partners that enable us to conduct and display advertising on our applications, websites, and third-party sites, applications, or social media platforms;
• with third parties for collaborative offerings, legal and safety purposes, in connection with the sale or transfer of a business or asset, for use in aggregate or anonymous form, and for other purposes with your permission.

Where We Store Your Personal Information
Generally, we only store your edited contents on Firebase, and remotely access to such contents via Firebase instead of storing on our server. Also, we may collect and use your personal information to the extent for responding your request, but such data will not be stored in our local device or server. To be specific, if you contact us for feedback, complaints, bug reports, or questions regarding your personal information, we may collect and use your technical information about the device(s) and/or browsers (including without limitation your IP address, browsing type, mobile model, operating systems, network type and other browser settings/preference) you may use, and we will only retain such data and your contact details (such as email address) on Google Sheet, instead of our local device and/or server.
PLEASE NOTE THAT any of your personal information stored by us will not be transmitted outside of Singapore, and we will take reasonable technological and organizational measures to safeguard your personal information during the entire time of the storage of your personal information.

How Long We Store Your Personal Information
Generally, WE DO NOT store your personal information unless we otherwise expressed in this Privacy Policy. In the case we need to retain your personal information for the purposes stated in this Privacy Policy, such retention will be limited to the necessary period which permitted by applicable laws and regulations. For example, when you contact us for feedback, complaints, bug reports, or questions regarding your personal information, we will store such data and your personal contact details (such as email address) to the extent for responding your request, and then immediately delete the same properly, EXCEPT THAT we have other legitimate basis (such as complying with our legal obligations, resolving disputes, and enforcing our agreements) for keeping such data.

Security of Personal Information
The security, integrity, and confidentiality of your personal information are extremely important to us. We will use various technologies and administrative measures to protect your personal information which have been collected and/or stored by us from being lost, being misused, unauthorized accessed or leaking. In addition, all processing by our staff are based on their work assignments and bound by confidentiality obligations.
PLEASE NOTE THAT, despite our best efforts to provide security protections for your personal information, due to limit of technology as well as various possible malicious means in the internet industry, no security measures are perfect or impenetrable. We will regularly review our security procedures to consider appropriate new technology and methods.

Your Rights and Controls
You have rights under applicable data protection law in relation to our use of your personal information, including:

• Data Access. You have the right to request access to your personal information;
• Rectification. You have the right to update or amend your personal information if it is inaccurate or incomplete;
• Objection. You have the right to object to certain uses of your personal information, including direct marketing, processing based on legitimate interests, and processing for purposes of scientific or historical research and statistics, on grounds relating to your particular situation;
• Erasure. You have the right to request the deletion of your personal information, or restrict its use, in certain circumstances (for example you can request that we erase your personal information where it is no longer necessary for the purpose for which it was collected unless certain exceptions apply);
• Portability. You have the right to request certain copies of your personal information you have provided to us, to use for your own purposes (often called the right to data portability). PLEASE NOTE THAT we may not able to provide any copy of your personal information since we usually not store any of your personal information;
• Withdrawing Consent. If we are processing your personal information based on your consent you can withdraw your consent at any time by changing “Settings” on the APP or by sending a communication to us specifying which consent you are withdrawing. PLEASE NOTE THAT the withdrawal of your consent does not affect the lawfulness of any processing activities based on such consent before its withdrawal; and
• Lodging Complaints. You have the right to lodge complaints about our data processing activities by filing a complaint with our Data Officer who can be reached by the “Contact Us” section above or lodge a complaint with the relevant supervisory authority or bring a legal action.

If you have any question about these rights or you would like exercise any of them, please contact us via appropriate means as set forth in “Contact Us” Section of this Privacy Policy. Before we can respond to a request to exercise one or more of the rights listed above, you may be required to verify your identity or your account details. PLEASE NOTE THAT your ability to access or control your personal information will be limited in some cases, as required or permitted by applicable law.
PLEASE NOTE THAT, if you decide not to provide the personal information we request (such as your contact detail to communicate with you) we may not be able to timely or adequately respond to your needs or proposals with respect to your rights as set forth above.
You may exercise your data protection rights by “Settings” on the APP as follows:

• If you have created an account, you can delete your account information (e.g. subscription information, payment information, contact details) through “Settings”.
• If you want to access or control personal information collected and processed by us, which is not available by “Settings” on the APP, you can contact the “Data Officer” on “Settings” or contact us via the methods we provide in the “Contact Us” Section hereinafter.

AI Photo Generation Feature
By using the Collart AILab, including the AI filter feature, AI templates feature, or text to image/headshot feature, We will analyze the photos you uploaded and find out the facial key points (like eyes, nose, and mouth points) of the face in the photos for face processing purposes. PLEASE NOTE THAT WE DO NOT collect any face data. After the analyzing process ends all data will be deleted within 7 days, no data will be saved permanently.

Specially, in order to provide an AI Generation feature, the complete AI generate process is:

1. You input the prompt content about the style you wish to generate;
2. You agree to transfer a photo to our server；
3. Our server detects a face in your photo;
4. Find required facial key points (the set of points varies with the effect);
5. Depends on your prompt content and apply the effect to your photo based on the detected key points.

PLEASE NOTE THAT AFTER THE GENERATE PROCESS IS COMPLETED, THE PHOTOS YOU UPLOADED WILL BE AUTOMATICALLY DELETED WITHIN 7 DAYS.

Advertising
WE WILL NOT send you any promotional information by email, SMS, physical or telephone. PLEASE NOTE THAT, we use Google AdMob and Applovin as advertising providers, any advertising on our applications are published and controlled by them instead of us, and therefore, if you click those advertising link to any third party, you shall read their privacy policies carefully, and you shall understand that their privacy policies are not controlled or covered by us.

Supplemental Terms

Additionally, the following SDK providers may collect and use your personal information:

• Google AdMob. We use Google AdMob as advertising provider, and it may tack your browsing history for online behavioral advertising purposes, such as your visits to the contents and ads on third party websites, applications and platforms, and collect your Advertising ID, in order for you to receive relevant interest-based advertising when you use any websites and/or applications have established partnership with Google (to know how Google AdMob collect and process with your personal information when you use any websites and/or applications have established partnership with Google AdMob, please refer to this link);
• Applovin. We use Applovin as advertising provider, and it may tack your browsing history for online behavioral advertising purposes, such as your name and properties of our Service through which as a consumer interacts with Applovin, and the advertising and tracking preferences and restrictions you set. To know how Applovin collect and process with your personal information when you use any websites and/or applications have established partnership with Applovin, please refer to this link);
• Google Analytics. We use Google Analytics to understand the functionality of our APP, which may collect technical information about the device(s) and/or browsers (including without limitation your IP address, browsing type, mobile model, operating systems, network type and other browser settings/preference) you may use (to know how Google Analytics collect and process with your personal information when you use any websites and/or applications have established partnership with Google Analytics, please refer to this link);
• Firebase. We use Firebase for statistics service as follows:
  • Firebase Crashlytics: which may collect and use your Crash Trace data to associate crashes with a project, send email alerts to project members and display them in the Firebase Console, and help Firebase customers debug crashes; uses Crashlytics Installation UUIDs to measure the number of users impacted by a crash and minidump data to process NDK crashes; and the minidump data is stored while the crash session is being processed and then discarded.
  • Firebase Remote Config: which may collect and use your Firebase installation IDs to select configuration values to return to end-user devices.

To know how Firebase collect and process with your personal information when you use any websites and/or applications have established partnership with Firebase, please refer to this link.

California Consumer Privacy Act (“CCPA”)

If you are a California resident, the supplemental terms in this section may apply to you. PLEASE NOTE THAT we may request proof of California residency before responding to requests made under this section.
Right to Opt-out. WE DO NOT sell your personal information or share, exchange your personal information with any third party. Therefore, WE DO NOT offer an opt-out to the sale of personal information as required by CCPA.
Right to know. You may submit a verifiable request for us to provide the following information, which we may be able to provide you for no more than twice in a 12-month period with free of charge:

• The specific pieces of personal information we have about you;
• The categories of personal information we collected, sold, or disclosed for a business purpose about you within the last 12 months;
• The categories of sources from which the personal information was collected;
• The purposes for which the information was collected or sold; and
• The categories of third parties to whom the information was sold, disclosed for a business purpose, or otherwise shared.

If possible, we will provide this information to you in a readily usable format that allows transmission to another entity.
Right to Data Portability. You have the right to request certain copies of your personal information you have provided to us, to move data from one company to another (often called the right to data portability). PLEASE NOTE THAT we may not able to provide any copy of your personal information since we usually not store any of your personal information; and
Right to Delete. You may submit a verifiable request for us to delete the personal information we have collected about you. We may retain personal information necessary to: (i) protect our business, systems, and users from fraudulent activity; (ii) comply with law enforcement requests pursuant to lawful process; or (iii) for scientific or historical research.
YOU WIll NOT be discriminated (such as price discrimination) for exercising your rights under CCPA.
Please contact us via appropriate means as set forth in “Contact Details” Section of this Privacy Policy if you would like to exercise your rights under this section.

General Data Protection Regulation (“GDPR”)

If you are a resident in the EEA, Switzerland or the UK (the “European Region”), supplemental terms in this section may apply to you:

International data transfers
If you normally reside in the European Region, the personal information that we collect from you will be further transferred to, and stored at, a destination outside of the European Region (for instance, to our service providers and partners). These transfers are made pursuant to appropriate safeguards, such as standard data protection clauses adopted by the European Commission.

You have the following rights:

• The right to request free of charge (i) confirmation of whether we process your personal information and (ii) access to a copy of the personal information retained;
• The right to request proper rectification or removal of your personal information or restriction of the processing of your personal information;
• Where processing of your personal information is either based on your consent or necessary for the performance of a contract with you and processing is carried out by automated means, the right to receive the personal information concerning you in a structured, commonly used and machine-readable format or to have your personal information transmitted directly to another company, where technically feasible (data portability);
• Where the processing of your personal information is based on your consent, the right to withdraw your consent at any time (withdrawal will not impact the lawfulness of data processing activities that have taken place before such withdrawal);
• The right not to be subject to any automatic individual decisions, including profiling, which produces legal effects on you or similarly significantly affects you unless we have your consent, this is authorised by Union or Member State law or this is necessary for the performance of a contract;
• The right to object to processing if we are processing your personal information on the basis of our legitimate interest unless we can demonstrate compelling legitimate grounds which may override your right. If you object to such processing, we ask you to state the grounds of your objection in order for us to examine the processing of your personal information and to balance our legitimate interest in processing and your objection to this processing;
• The right to object to processing your personal information for direct marketing purposes; and
• The right to lodge complaints before the competent data protection regulator.

Before we can respond to a request to exercise one or more of the rights listed above, you may be required to verify your identity or your account details.
Please send an e-mail to us if you would like to exercise any of your rights .

Contact Us
If you have any questions about this Privacy Policy or our privacy practices, or if you wish to exercise your rights in respect of your personal information, please contact us in the following ways:
Email address: support@collart.app