Privacy Policy

2.1 Persona is operated by [[LEGAL ENTITY]], [[ENTITY TYPE]], of [[REGISTERED ADDRESS]], company number [[COMPANY NUMBER]]. For data protection law, we are the controller of the personal information described in this policy.

2.2 Contact us about privacy at privacy@[[DOMAIN]], or in writing at the address above. We answer privacy requests at that address, including requests to access, correct, export or delete your information.

2.3 Our representative in the European Union under Article 27 of the GDPR is [[EU REPRESENTATIVE]]. Our representative in the United Kingdom under Article 27 of the UK GDPR is [[UK REPRESENTATIVE]].

3.1 This policy covers the Persona app, the web pages we operate, and the back-end services behind them.

3.2 It does not cover:

• (a) the Apple App Store or Google Play, which have their own policies and which handle your purchases of digital items;
• (b) a website or service you reach through a link in Persona;
• (c) Stripe's own relationship with you when you set up a payout account, which is governed by Stripe's own terms and privacy policy; or
• (d) what another user does with something you have made public.

3.3 Where a third party acts as a controller in its own right rather than as our processor - Apple, Google, Meta and Stripe do, in parts of what they do - their own policy governs that processing, and we link to it in Section 10.

4.2 WE DO NOT COLLECT: precise geolocation; your contacts; your calendar; your health or fitness data; your browsing on other apps or websites; any advertising identifier; or biometric identifiers used to identify you. Persona contains no advertising SDK, no analytics SDK that profiles you across services, no attribution SDK configured for tracking, and does not ask for App Tracking Transparency permission because it does not track you across other companies' apps and websites.

5.1 Persona asks for camera and photo library permission only when you use a feature that needs it. You can refuse, and the rest of the app keeps working.

5.2 WHAT WE ASK FOR AND WHY:

5.3 We access only the specific images you choose. We do not scan or index your photo library.

5.4 A PHOTOGRAPH YOU ATTACH TO AN ORDER PROBLEM is stored with the support case, shared with our fulfilment partner where the claim needs their review, and kept with the case record.

5.5 AN IMAGE YOU PUT INTO A DESIGN becomes part of that design. If you publish the design, the image is published with it. Do not put a photograph of yourself, of another person, or of anything private into a design you intend to publish unless you mean it to be public.

6.1 WHAT THE FEATURE DOES. Virtual try-on lets you upload or take a photograph of yourself and generates images approximating how a product might look on you. It is optional, it is off unless you turn it on, and it is private to your account.

6.2 WHAT WE COLLECT FOR IT:

• (a) the photograph you upload or take ("your try-on photograph");
• (b) a derived image our system produces from it in order to place garments on it ("your derived avatar");
• (c) the generated try-on images; and
• (d) the job record: which product, which provider, when, how many credits, and whether it succeeded.

6.3 WHY WE COLLECT IT. For one purpose only: to produce the try-on images you asked for, and to let you generate further try-on images without uploading your photograph again.

6.4 WE DO NOT USE IT TO IDENTIFY YOU. We do not use your try-on photograph, your derived avatar or the generated images to identify you, to verify you, to match you against any other image, to estimate your age, to infer any characteristic about you, or to build any profile of you. We do not run face recognition. We do not use it for advertising. We do not sell it, lease it, trade it, or otherwise profit from it.

6.5 YOUR CONSENT. We ask for your permission in the app before the feature runs, and the feature does not run without it. By choosing to use virtual try-on you consent to us and to the AI providers named in Section 10 collecting and processing your try-on photograph, your derived avatar and the generated images for the purpose in 6.3. YOU MAY WITHDRAW THIS CONSENT AT ANY TIME by deleting your try-on profile in the app; see 6.8.

6.6 WHO IT IS DISCLOSED TO. Your try-on photograph and the product image are transmitted to the AI infrastructure provider that runs the try-on model, for the sole purpose of generating your result. They are stored by us in our own cloud storage, in a location readable only by your account. They are not published, not attached to any product, not attached to any order, not visible to any other user, and not disclosed to our fulfilment partner. We do not disclose them to anyone else except where we are required to by law or by a valid warrant, subpoena or court order.

6.7 RETENTION SCHEDULE AND DESTRUCTION GUIDELINES. We permanently destroy your try-on photograph, your derived avatar and your generated try-on images at the EARLIEST of:

• (a) when you delete your try-on profile in the app - destruction is immediate;
• (b) when you replace your try-on photograph with a new one - the previous photograph and its derived avatar are destroyed as part of the replacement;
• (c) when you delete your Persona account;
• (d) when the purpose in 6.3 has been satisfied and you have not used the feature for a period of time - in any event no later than THREE YEARS after your last interaction with Persona; or
• (e) where a shorter period is required by the law of your state or country - for example, within one year after the purpose expires, for residents of Texas.

Destruction means the image files are deleted from our storage. Where a job record is retained for billing reconciliation, the image, the model input and the output URLs are removed from it first, leaving only the non-image fields.

6.8 HOW TO DELETE IT. In the app, open the try-on feature and delete your try-on profile. This deletes your photograph, your derived avatar, any retired versions of them, and redacts the associated job records. You can also email privacy@[[DOMAIN]] and we will do it for you.

6.9 ONLY UPLOAD A PHOTOGRAPH OF YOURSELF. Our Terms prohibit uploading a photograph of anyone else, and prohibit uploading a photograph of anyone under 18. If you upload someone else's photograph you may be breaking the law in your state or country as well as our Terms.

6.10 SPECIAL CATEGORY DATA. If you are in the EEA, the UK or Switzerland, a photograph of your face may be special category data under Article 9 of the GDPR when it is processed by technical means for the purpose of uniquely identifying you. We do not process it for that purpose. To the extent Article 9 applies, our basis is your explicit consent under Article 9(2)(a), which you may withdraw at any time as described in 6.8.

7.1 Persona lets you describe a design out loud instead of typing it.

7.2 When you use it, your device's operating system converts your speech to text. On iOS this uses Apple's speech recognition, which may process audio on Apple's servers under Apple's own privacy policy. On Android it uses the device's speech service.

7.3 What Persona receives is the resulting TEXT, not an audio recording. We do not record, store or transmit your voice audio, and we do not keep a voiceprint.

7.4 The resulting text is treated exactly like a typed prompt - see Section 8.

7.5 Microphone permission is requested only when you use this feature and can be refused or revoked in your device settings at any time.

8.1 Persona uses machine-learning models for product mockup generation, in-editor image editing and upscaling, generating a design from a description, virtual try-on, and automated artwork screening.

8.2 WHAT WE SEND, AND TO WHOM:

8.3 WHAT WE DO NOT SEND. We do not send your name, email address, delivery address, payment information, balance, messages, comments, followers, or any account identifier that would let a provider connect a request to you as a person. A provider receives the content needed to do the job and the technical metadata of the request.

8.4 WHAT PROVIDERS MAY DO WITH IT. Providers process what we send in order to return a result to us, and may retain it for a short period for operational, abuse-prevention and safety purposes under their own terms. Their policies are linked in Section 10. WE DO NOT AUTHORISE ANY PROVIDER TO USE YOUR CONTENT TO TRAIN ITS MODELS FOR ITS OWN PURPOSES, and where a provider offers a contractual term or an account setting that excludes training on customer content, we use it. Their own policies govern what they do, and we cannot guarantee a provider's compliance with its own terms.

8.5 WE DO NOT TRAIN OUR OWN MODELS ON YOUR CONTENT. Persona does not train machine-learning models on your designs, your photographs, your prompts, your messages or your purchases.

8.6 RESULTS. Generated images are stored in your account alongside the job record so you can use them. You can delete them. Failed and expired jobs, and outputs you never promoted into a design, are removed by a periodic clean-up.

8.7 AUTOMATED ARTWORK SCREENING. Before artwork leaves the design studio we send the flattened print file to Google Cloud Vision's SafeSearch service, which returns likelihood scores across several categories plus descriptive labels. We act on the adult, violence and racy scores to block artwork. The remaining scores and the labels are kept for the audit trail and are not used to block. If the service is unreachable, the check is recorded as "not run" and you are let through - a safety check that cannot run must not become an outage. Screening does not look at intellectual property and does not detect hate symbols; that is what the report system is for.

9.1 WE DO NOT SELL YOUR PERSONAL INFORMATION, and we have not sold it in the preceding twelve months. We do not sell the personal information of anyone under 16.

9.2 WE DO NOT SHARE YOUR PERSONAL INFORMATION FOR CROSS-CONTEXT BEHAVIOURAL ADVERTISING, as those terms are defined in California law, and we have not done so in the preceding twelve months.

9.3 WE DO NOT USE THIRD-PARTY ADVERTISING TRACKERS. The app carries no advertising SDK and no advertising identifier.

9.4 WE DO NOT TRACK YOU ACROSS OTHER COMPANIES' APPS AND WEBSITES. That is why the app does not ask for App Tracking Transparency permission.

9.5 WE DO NOT SEE YOUR CARD NUMBER, its security code, or your bank credentials.

9.6 WE DO NOT USE YOUR CONTENT TO TRAIN MODELS (Section 8.5).

9.7 WE DO NOT MAKE DECISIONS WITH LEGAL OR SIMILARLY SIGNIFICANT EFFECTS ABOUT YOU BY AUTOMATED MEANS ALONE. See Section 24.

10.1 We share personal information only with the service providers that make Persona work, and only what each one needs.

10.2 OTHER USERS. Your public profile and everything you publish is shared with other users by design, and with anyone who opens a share link. A direct message is shared with its recipient. A comment is public.

10.3 CREATORS DO NOT RECEIVE BUYER DETAILS. A creator whose design you buy sees that a sale happened and the amount they earned. They do not receive your name, email address, delivery address or payment information.

10.4 LEGAL AND SAFETY. We may disclose information where we believe in good faith that it is necessary to comply with a law, a regulation, legal process or an enforceable governmental request; to enforce our Terms; to detect, prevent or address fraud, security or technical problems; or to protect the rights, property or safety of Persona, our users or the public. We will tell you about a legal request for your information unless we are prohibited from doing so or believe telling you would create a risk of harm.

10.5 BUSINESS TRANSFERS. If we are involved in a merger, acquisition, financing, reorganisation, bankruptcy or sale of assets, your information may be transferred as part of that transaction. We will tell you, and the recipient will be bound by commitments no less protective than this policy or you will be given a choice.

10.6 WITH YOUR DIRECTION. We share information as you direct - for example when you use the system share sheet to send a product to another app.

10.7 AGGREGATED AND DE-IDENTIFIED INFORMATION. We may create and use aggregated or de-identified information that cannot reasonably be used to identify you. We maintain it in de-identified form and do not attempt to re-identify it, except to test that our de-identification works.

11.1 Persona's databases, file storage and server functions run in Google Cloud in the UNITED STATES (region us-central1, Iowa). Your information is therefore processed in the United States regardless of where you live.

11.2 Our providers may process information in other countries. Our fulfilment partner operates a network of print facilities worldwide and will route your order to a facility that can produce it, which may be in a different country from you; your delivery address is transferred to that facility.

11.3 IF YOU ARE IN THE EEA, THE UK OR SWITZERLAND, your personal information is transferred outside your country. We rely on:

• (a) the European Commission's Standard Contractual Clauses, and the UK International Data Transfer Addendum, in our contracts with providers that do not benefit from an adequacy decision;
• (b) an adequacy decision, including the EU-US Data Privacy Framework and its UK Extension and Swiss Extension, where the provider is certified under it; and
• (c) where necessary, the derogation in Article 49(1)(b) - the transfer being necessary to perform the contract we have with you, for example sending your delivery address to the facility that will print and post your order.

11.4 You may ask us for a copy of the transfer safeguards we rely on by writing to privacy@[[DOMAIN]].

12.1 We keep personal information only as long as we need it for the purpose we collected it for, or as long as the law requires.

12.2 WHY WE KEEP TRANSACTION RECORDS AFTER YOU LEAVE. Tax and accounting law requires a seller to keep records of what it sold, to whom and for how much. A refund or a chargeback can arrive months after a sale. And the other party to a sale - the creator whose design you bought, or the buyer who bought yours - has their own record of it, which we cannot destroy on one side only. These records are not used to contact you and are not used to rebuild a profile.

13.1 We take reasonable and appropriate technical and organisational measures to protect personal information, including:

• (a) encryption in transit (TLS) and at rest;
• (b) database and storage rules that make private information - email address, date of birth, phone number, delivery addresses, balances, payout identifiers, messages, drafts and try-on images - readable only by the account that owns it;
• (c) financial state that only the server can write, so a client cannot alter a balance, a price or an entitlement;
• (d) secrets held in a managed secret store rather than in the app;
• (e) verification of the signatures on incoming payment and fulfilment webhooks;
• (f) restricting access to production data to the people who operate the service; and
• (g) collecting the minimum we need.

13.2 NO SYSTEM IS PERFECTLY SECURE. We cannot guarantee absolute security, and you send information to us at your own risk. Use a strong, unique password, do not reuse it elsewhere, and tell us immediately if you think your account has been accessed by someone else.

13.3 IF YOU FIND A VULNERABILITY, report it to legal@[[DOMAIN]]. Do not exploit it, do not access data that is not yours, and give us a reasonable period to fix it before disclosing it.

15.1 Depending on where you live, you may have some or all of these rights:

15.2 HOW TO EXERCISE THEM. Email privacy@[[DOMAIN]] from the address on your account, or use the in-app tools in Section 14 and Section 21. Tell us what you want. If you write from a different address we will ask you to verify that you control the account, because handing your data to someone impersonating you would be worse than a delay.

15.3 HOW LONG WE TAKE. We respond within 30 days, or within 45 days where United States state law allows, and we may extend once where the request is complex - we will tell you if we do.

15.4 COST. Free. We may charge a reasonable fee, or refuse, only where a request is manifestly unfounded, excessive or repetitive, and we will explain why.

15.5 AN AUTHORISED AGENT may make a request on your behalf where the law allows it. We will ask for proof of your authorisation and may ask you to confirm it directly.

15.6 WHAT WE CANNOT ALWAYS DELETE. Some requests conflict with a legal obligation - see Section 12.2. Where we cannot delete something, we tell you which category it is and why.

16.1 CONTROLLER. [[LEGAL ENTITY]], [[REGISTERED ADDRESS]].

16.2 REPRESENTATIVE. Our Article 27 representative in the EU is [[EU REPRESENTATIVE]]. In the UK it is [[UK REPRESENTATIVE]]. You may contact them on any matter relating to our processing of your personal data.

16.3 LEGAL BASES. Set out per category in Section 4. In summary we rely on:

16.4 AUTOMATED DECISION-MAKING. See Section 24.

16.5 YOUR RIGHT TO COMPLAIN. You may lodge a complaint with the supervisory authority in the EEA or UK country where you live, work, or where you think an infringement occurred. In the UK that is the Information Commissioner's Office, ico.org.uk. We would rather you told us first, at privacy@[[DOMAIN]], so we can fix it.

16.6 If you do not provide information we need to perform our contract with you - an email address, a delivery address - we cannot provide the corresponding part of the service.

17.1 NOTICE AT COLLECTION. The categories of personal information we collect, the purposes, the sources, the categories of third parties we disclose to and the retention periods are set out in Sections 4, 10 and 12.

17.2 CATEGORIES WE COLLECT, in CCPA terms:

17.3 SOURCES. You; your device; our service providers (payment, store, fulfilment); and the platforms you sign in with.

17.4 SENSITIVE PERSONAL INFORMATION. We collect account credentials (a password, held only as a hash by our authentication provider) and, where you use virtual try-on, information that may be treated as biometric information. WE USE SENSITIVE PERSONAL INFORMATION ONLY FOR THE PURPOSES PERMITTED BY SECTION 1798.121(a) AND ITS REGULATIONS - to perform the service you asked for, to secure your account, and to detect and prevent fraud. We do not use or disclose it to infer characteristics about you. Because of that, we are not required to offer, and do not offer, a separate "Limit the Use of My Sensitive Personal Information" control.

17.5 SALE AND SHARING. WE DO NOT SELL PERSONAL INFORMATION AND WE DO NOT SHARE IT FOR CROSS-CONTEXT BEHAVIOURAL ADVERTISING. We have not done either in the preceding twelve months, including for consumers under 16. Because we do not, we do not provide a "Do Not Sell or Share My Personal Information" link; if that ever changes, we will add one and update this policy first.

17.6 DISCLOSURES FOR A BUSINESS PURPOSE. In the preceding twelve months we disclosed the categories in 17.2 to the categories of recipients listed in Section 10, for the business purposes described there.

17.7 YOUR CALIFORNIA RIGHTS. To know, to access a copy, to know the specific pieces, to delete, to correct, to opt out of sale or sharing (not applicable - see 17.5), to limit the use of sensitive personal information (not applicable - see 17.4), and not to be retaliated against for exercising any of them. Exercise them as in Section 15.2. We will not deny you goods or services, charge you a different price, or give you a lower quality of service because you exercised a right.

17.8 SHINE THE LIGHT. California Civil Code Section 1798.83 lets California residents ask about disclosures of personal information to third parties for their own direct marketing purposes. We make no such disclosures.

17.9 CALIFORNIA MINORS. If you are a California resident under 18 and a registered user, you may ask us to remove content you posted publicly, by writing to privacy@[[DOMAIN]]. Removal may not be complete or comprehensive - for example where the content has been copied by someone else or where the law requires us to keep it.

18.1 If you live in Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island or another state with a comprehensive consumer privacy law, you have rights to confirm whether we process your personal data, to access it, to correct it, to delete it, to obtain a portable copy, and to opt out of targeted advertising, sale, and profiling in furtherance of decisions producing legal or similarly significant effects.

18.2 WE DO NOT ENGAGE IN targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects, so those opt-outs have nothing to apply to. If that changes we will update this policy and provide the mechanism, including recognition of universal opt-out signals where the law requires it.

18.3 SENSITIVE DATA CONSENT. Where your state requires opt-in consent before processing sensitive data - which in several states expressly includes biometric data - we obtain it in the app before the feature runs. See Section 6.5.

18.4 APPEALS. If we refuse a request, you may appeal by replying to our decision or writing to privacy@[[DOMAIN]] with "Privacy Appeal" in the subject. We will respond within 45 days with a written explanation. If we deny your appeal, you may contact your state Attorney General, and we will tell you how.

18.5 WASHINGTON AND NEVADA. We do not collect or process "consumer health data" as defined by the Washington My Health My Data Act or Nevada SB 370, and we do not sell it. Try-on photographs are used only as described in Section 6 and are not used to infer any health condition, body measurement, or physical characteristic about you.

19.1 CANADA. We handle personal information in accordance with PIPEDA and applicable provincial law, including Quebec's Law 25. You may access and correct your information and complain to the Office of the Privacy Commissioner of Canada. Your information is stored and processed outside Canada, in the United States, where it may be accessible to courts and authorities of that country.

19.2 AUSTRALIA AND NEW ZEALAND. We handle personal information in accordance with the Australian Privacy Principles and the New Zealand Privacy Act 2020. You may request access and correction, and complain to the OAIC or to the New Zealand Privacy Commissioner. We disclose personal information to overseas recipients, principally in the United States.

19.3 BRAZIL. We process personal data in accordance with the LGPD. You have rights of confirmation, access, correction, anonymisation, portability, deletion, information about sharing, and revocation of consent. Contact privacy@[[DOMAIN]].

19.4 INDIA. We process personal data in accordance with the Digital Personal Data Protection Act, 2023. You have rights of access, correction, erasure, grievance redressal and nomination. For grievances, contact privacy@[[DOMAIN]]; we will respond within the period the law requires.

19.5 ELSEWHERE. Wherever you live, you may write to privacy@[[DOMAIN]] and we will do our best to give you the same rights, whether or not your local law requires it.

20.1 PERSONA IS NOT FOR CHILDREN UNDER 13. We do not knowingly collect personal information from anyone under 13. Our sign-up asks for a date of birth and refuses to create an account for anyone under 13.

20.2 IF WE LEARN that we have collected personal information from a child under 13, we will delete it and close the account promptly. If you believe a child has given us information, write to privacy@[[DOMAIN]] and we will act.

20.3 TEENAGERS. Persona limits what younger accounts can do:

20.4 We do not serve behavioural advertising to anyone, of any age, and we do not sell or share the personal information of anyone under 16.

20.5 PARENTS AND GUARDIANS may contact privacy@[[DOMAIN]] to review, correct or delete their child's information, or to close the account. We will verify the relationship before acting.

21.1 TWO WAYS, AND THE FIRST IS IMMEDIATE.

21.2 WHAT IS DELETED:

- your profile: display name, username, biography, photo, links - your username, released back to the registry - your designs and drafts, and every product you published is taken down - your uploaded files, including try-on photographs, derived avatars and generated try-on images - saved items, collections, likes and comment likes - your direct messages, your follows and your followers - your credit wallet and its ledger - your AI job records and generated outputs - your push tokens - your sign-in credentials

21.3 WHAT IS KEPT, AND WHY:

ORDERS, INVOICES, PAYMENT AND REFUND RECORDS, THE EARNINGS LEDGER AND PAYOUT RECORDS - de-identified where we can. Tax, accounting, consumer protection and anti-fraud law requires a seller to keep them, and the other party to a sale has their own record of the transaction which we cannot destroy on one side only.

LEGAL ACCEPTANCE RECORDS - which version of the Terms and this policy you accepted, and when. This is contractual evidence.

MODERATION AND ENFORCEMENT RECORDS where they are needed to operate our repeat-infringer policy or to answer a legal claim.

These are the only categories kept, they are not used to contact you, and they are not used to rebuild a profile.

21.4 WHAT WE CANNOT REACH:

- a message you sent to someone else, in their copy of the conversation, where the law requires us to leave their record intact; - a product someone has already bought or lawfully remixed; - anything you or someone else shared outside Persona; - a copy in an encrypted backup, until that backup rolls off.

21.5 WHEN DELETION IS BLOCKED. The app will not let you complete deletion while you hold an unpaid balance, owe us an amount, have a payout in transit, or have an order still being made or delivered. Deleting at that moment would destroy your claim to money or goods. Withdraw or wait, then delete. If you are stuck, write to support@[[DOMAIN]].

21.6 SIGNING OUT IS NOT DELETING. Signing out removes your push token from your account and nothing else.

22.1 THE MOBILE APP does not use cookies. It stores data on your device to work: your sign-in session, cached images, your preferences, and a small amount of state the app needs between launches. You can clear all of it by deleting the app.

22.2 OUR WEB PAGES - the legal pages, the share preview pages, and the hosted design editor loaded inside the app - use only what is strictly necessary to serve the page and keep it secure. WE DO NOT USE ADVERTISING COOKIES, ANALYTICS COOKIES, OR THIRD-PARTY TRACKING PIXELS ON THEM.

22.3 The hosted design editor stores your work in progress locally in the browser view so that a dropped connection does not lose your design.

22.4 Because we use no non-essential cookies, we do not show a cookie consent banner. If that changes, we will implement consent before setting any non-essential cookie.

23.1 TRANSACTIONAL MESSAGES. We send you emails and push notifications that the service requires: order confirmations, production and shipping updates, delivery notices, earnings releases, payout results, security alerts, changes to these documents, and replies to your support cases. You cannot opt out of these while you have an account, because they are part of the service. You can turn PUSH off in your device settings and still receive the email.

23.2 ACTIVITY NOTIFICATIONS. Follows, likes, comments, messages, remix activity. Control these in your device notification settings.

23.3 MARKETING. If we send marketing emails, we will ask for your consent where the law requires it, every message will carry an unsubscribe link, and unsubscribing will take effect promptly. We do not share your email address with anyone for their own marketing.

23.4 PUSH TOKENS. Your push token is stored with your account so we can reach your device, is removed when you sign out, and is deleted when the notification service tells us the token is dead.

24.1 WE USE AUTOMATED SYSTEMS to:

• (a) rank and recommend products and creators in feeds, search and discovery, using signals including engagement, recency, relevance and your own activity;
• (b) screen artwork for adult, violent and racy content before it leaves the design studio;
• (c) detect spam, manipulation of metrics, and payment fraud; and
• (d) determine which features your age band may use.

24.2 WE DO NOT MAKE DECISIONS THAT PRODUCE LEGAL EFFECTS CONCERNING YOU, OR SIMILARLY SIGNIFICANTLY AFFECT YOU, SOLELY BY AUTOMATED MEANS. Where an automated signal would lead to a serious outcome - removing a product, suspending or closing an account, withholding a payout - a person reviews it before it becomes permanent, and you can appeal to a person as described in the Terms.

24.3 The age gate is an automated check against the date of birth you supplied and, where available, the platform's age signal. If you believe it has the wrong result, write to support@[[DOMAIN]].

24.4 You may ask us for information about the logic involved in an automated decision affecting you, express your point of view and contest it, by writing to privacy@[[DOMAIN]].

25.1 We maintain procedures for detecting, investigating and responding to a personal data breach.

25.2 If a breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it where the GDPR applies, and will notify you without undue delay where the risk is high.

25.3 Where United States state law requires notification, we will notify you and the relevant authorities in the time and manner that law requires.

26.1 We may update this policy. When we do we change the version and date at the top and publish the new text at the same address.

26.2 Where a change is material we will tell you in the app before it takes effect, and where the law requires consent we will ask for it.

26.3 We keep the version and hash of every published version, and your acceptance record identifies the exact text you agreed to.