This Privacy Policy describes the data protection practices of PiñataFarms, Inc. and owned apps including but not limited to "StoryMe," "PictureMe," "Sketch2Wow," "WeLookCute," "Skin AI" (“PiñataFarms,” "StoryMe," "Sketch2Wow", "PictureMe," "WeLookCute," "Skin AI", “we,” “us,” or “our”). This Privacy Policy applies to information that we collect and use about you when you access or use the PiñataFarms website, mobile application, other mobile applications owned by PinataFarms, and other related online or mobile services that link to or otherwise present this Privacy Policy to you (collectively, the “Services”). Capitalized terms such as Uploads, Creations, Inputs, Usage Data, and De-identified Data have the meanings given in our Terms of Service.

PLEASE READ THIS PRIVACY POLICY CAREFULLY TO UNDERSTAND HOW WE HANDLE YOUR INFORMATION. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, PLEASE DO NOT USE THE SERVICES.

This Privacy Policy contains the following sections:

• Information We Collect

• How We Use Your Information

• Cookies and Similar Technologies

• Online Analytics and Advertising

• How We Disclose Your Information

• Retention of Your Information

• How We Protect Your Information

• Third Party Links and Features

• Children’s Privacy

• Marketing Choices

• International Users

• Privacy Notice for California Residents

• Privacy Notice for Nevada Residents

• Changes to Our Privacy Policy

• PiñataFarms Contact Information

INFORMATION WE COLLECT

We collect information about you through the means discussed below. Please note that we need certain types of information so that we can provide the Services to you. If you do not provide us with such information, you may no longer be able to access or use our Services.

Information You Provide to Us. We collect a variety of information that you provide directly to us. For example, we collect information from you through:

• Account registration and administration of your account

• Requests or questions you submit to us via online forms, email, text message, or otherwise

• Your participation in sweepstakes, contests, or surveys

• Uploads or posts to the Services

• The text and choices you enter to make content;

• Requests for customer support and technical assistance

Information about you. The types of data we collect directly from you includes:

• Email address

• Name

• Phone number

• Above including through Sign in with Apple

• Log-in credentials, when you create a PiñataFarms account, StoryMe account, PictureMe Account, Sketch2Wow account, Skin AI account or a WeLookCute account.

• Information about your customer service interactions with us.

• Demographic information such as your age or gender or other information you choose to provide as part of your PiñataFarms profile (such as a bio), and your answer to “How did you hear about us?”, your StoryMe book order, your PictureMe avatar order, your Skin AI analysis order, your WeLookCute avatar order, or Sketch2Wow drawings. 

• Uploads: user-generated content you provide to us, such as when you upload images, videos, headpacks, items, and template submissions, drawings and items, comment on content on the Services, respond to a survey request, or participate in the public forums, which may include video or images of your face and facial features.

• Inputs: the text and selections you provide to make content — dialogue, plots, captions, prompts, search queries, the templates you choose, where you place items, edits, template-request titles and notes, and whether and where you save or share a Creation.

• Creations: the videos and images you make, whether or not you save or share them.

• Purchase history and subscription status as reported to us by Apple. We do not receive your payment card details.

• Image information (as described below), which in some jurisdictions may be deemed “biometric information” or a “biometric identifier.”

• Any other information you choose to directly provide to us in connection with your use of the Services.

Information about others. If you post content or items that contain images or video of other individuals, we will also collect that information. It is your responsibility to determine whether you have permission to upload images or video content of other people, and our Terms of Service require it. If you grant permission to integrate your account with your device contact list to find and communicate with friends on the Services, we will collect your friends' information contained in your contact list.

Information We Collect Through Automated Means. When you use our Services, we and our vendors and service providers (which are third party companies that work on our behalf) may use a variety of technologies, including cookies, software development kits (SDKs), and similar tools, to collect information that tells us more about how you use the Services.

This information may include: your IP address, browser types, browser language, operating system, version, software and hardware attributes (including device IDs), domain names, referring and exit pages and URLs, Internet service provider, the number of clicks, content viewed and the order such viewing, date and time of use, general location information (e.g., city/state or postal code information derived from your IP address) total minutes watched, error logs, creation events (which templates you view, open, abandon, or complete; which features you use; how long each step takes; and the destination you choose when saving or sharing), and other similar information about how you use the Services (together, “Usage Data”). With your permission, we may also collect precise, GPS location information, and if so, you can disable the collection of this information through your device settings.

We derive information from content you upload, which may include information about the general position and shape of faces, people, or objects, to process and create your Piñatas and other Creations, your StoryMe book orders, your PictureMe avatar orders, your Skin AI orders, or your WeLookCute avatar orders.

Information We Collect from Others. We may receive additional information such as demographic and statistical information from third parties, such as business partners, marketers, researchers, analysts, and other parties that we may attribute to you based on your assignment to certain statistical groups. We use this information to supplement the information that we collect directly from you in order to derive your possible interests and to provide more relevant experiences for you and improve our products, analytics, and advertising.If another user of the Services chooses to integrate their device contact list with the Services, we may collect information about you from the contact list, and process it in accordance with this Privacy Policy. We may also combine it with other information we have collected from and about you.

HOW WE USE YOUR INFORMATION

We use your information for various purposes depending on the types of information we have collected from and about you, in order to:

• Provide the Services you have requested, including generating the content you ask for

• Respond to your requests for information and provide you with customer service

• Contact you by email, app notification, postal mail, or phone regarding PiñataFarms, StoryMe, PictureMe, Sketch2Wow, WeLookCute, Skin AI, and third-party products, services, surveys, research studies, promotions, special events and other subjects that we think may be of interest to you

• Customize the advertising and content you see on the Services

• Help us better understand your interests and needs, and improve the Services, including through research and reports, and test and create new products, features, and services

• Develop, train, fine-tune, evaluate, and improve machine-learning models and artificial-intelligence systems, including models that learn from what people create, write, and choose to share, whether operated by us, our affiliates, or our successors or licensees

• Create De-identified Data and datasets from Uploads, Creations, Inputs, and Usage Data, which we may use and disclose for any purpose, including licensing to third parties

• Measure and attribute the performance of our marketing, including app installs and purchases

• Secure our websites and applications, and resolve app crashes and other issues being reported

• Comply with any procedures, laws, and regulations which apply to us where it is necessary for our legitimate interests or the legitimate interests of others

• Establish, exercise, or defend our legal rights where it is necessary for our legitimate interests or the legitimate interests of others

AI Features and Image Information. To create Piñatas and other Creations, StoryMe Books, PictureMe Avatars, Skin AI analysis, and WeLookCute Avatars, we process images included in your Uploads on your device, on our servers, and — for AI Videos, AI Photos, face swap, and similar features — through service providers that operate image and video generation models on our behalf. From those images we derive facial keypoints, the existence and location of an image of a face, general facial attributes (e.g., happy, angry, sad), head pose, segmentation masks, and information about the general position and shape of people or objects in the images, if applicable. You may also be prompted to scan your face using your device’s camera to generate information about your facial appearance. We collect this information to apply the most appropriate images to each StoryMe book order, PictureMe avatar order, Skin AI analysis orders or WeLookCute avatar orders, or Piñata video frame to enable special effects, to improve the models that perform these tasks, and for other services you request. We do not use this information to personally identify you across different images and we do not disclose it to third parties. In some jurisdictions, some of this information may be deemed “biometric information” or “biometric identifiers” (as defined by applicable law).

Visibility settings. Settings such as Private, Public, or sharing only with people you choose control who can see your content within the Services. They do not change how we collect, use, or retain the information described in this Policy.

Generated outputs. AI Videos, AI Photos, and similar Creations are produced by automated systems from your Inputs and Uploads. Your Inputs and the resulting outputs are retained and used in this Privacy Policy.

Combined Information. For the purposes discussed in this Privacy Policy, we may combine the information that we collect through the Services with information that we receive from other sources, both online and offline, and use such combined information in accordance with this Privacy Policy.

Aggregate/De-Identified Information. We may aggregate and/or de-identify any information collected through the Services so that such information can no longer be linked to you or your device. We may use such information for any purpose, including without limitation for research, model development, and marketing purposes, and may also disclose such information to any third parties, including advertisers, promotional partners, research and technology partners, and sponsors. We maintain and use De-identified Data only in de-identified form, we do not attempt to re-identify it, and we contractually require any recipient to commit to the same.

BIOMETRIC INFORMATION NOTICE
This Section is our written policy on biometric information, made publicly available as required by law.

What we collect and why. When you create a headpack, use face swap, or use certain AI Camera features, we derive face geometry (keypoints, pose, and related measurements) from the image you provide (“biometric information”). We use it only to detect, segment, and place your face or the face you have permission to use in content you make, to improve the models that perform those tasks, and to keep the Services secure.

Consent. We collect biometric information only after you provide your separate written consent through the consent screen presented before you first use those features. If you do not consent, you can still use features that do not require it.

Retention and destruction. We retain biometric information for as long as your account exists and the headpack or item it was derived from has not been deleted, because it is needed to provide, maintain, secure, and improve the features you use it with. We permanently destroy it within [60] days after you delete the item or your account or withdraw consent, and in all cases no later than three (3) years after your last interaction with the Services (any use of the app or website), whichever occurs first — unless we must keep it to comply with law, a legal hold, or to resolve a dispute, in which case we destroy it when that need ends. Copies in encrypted backups are overwritten in the ordinary course within [90] days. This schedule applies to biometric information itself; it does not apply to models or de-identified data that cannot be used to identify you.

No sale. We do not sell, lease, trade, or otherwise profit from your biometric information, and we disclose it only to service providers processing it on our behalf under contract, with your consent, or as required by law.

COOKIES AND SIMILAR TECHNOLOGIES

To collect the information in the “Information We Collect Through Automated Means” section above, we and our vendors and service providers use Internet server logs, cookies, tracking pixels, and other similar tracking technologies. We use these technologies in order to offer you a more tailored experience in the future, by understanding and remembering your particular browsing preferences. Cookies are small text files that are placed on your computer or mobile device when you visit a site that enable us to: (i) recognize your computer; (ii) store your preferences and settings; (iii) understand the web pages of the Services you have visited; (iv) enhance your user experience by delivering and measuring the effectiveness of content and advertising tailored to your interests; (v) perform searches and analytics; and (vi) assist with security and administrative functions. Some cookies are placed in your browser cache while those associated with Flash technologies are stored with your Adobe Flash Player files.

As we adopt additional technologies, we may also gather information through other methods. Please note that you can change your settings to notify you when a cookie is being set or updated or to block cookies altogether. Please consult the “Help” section of your browser for more information (e.g., Internet Explorer; Google Chrome; Mozilla Firefox; or Apple Safari). You can also manage the use of Flash technologies, including flash cookies and local storage objects, with the Flash management tools available at Adobe's website. Please note that by blocking, disabling, or managing any or all cookies, you may not have access to certain features or offerings of the Services.

ONLINE ANALYTICS

We may use third-party web analytics services (such as those of Google Analytics and Mixpanel) on our Services to collect and analyze usage information through cookies and similar tools; engage in auditing, research, or reporting; assist with fraud prevention; and provide certain features to you. To prevent Google Analytics from using your information for analytics, you may install the Google Analytics Opt-out Browser Add-on. For other analytics activities, please see the information in the Cookies section above about how to disable cookies.

If you receive email from us, we may use certain analytics tools, such as clear GIFs to capture data such as when you open our message or click on any links or banners our email contains. This data allows us to gauge the effectiveness of our communications and marketing campaigns.

Notice Concerning Do Not Track. Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. We are committed to providing you with meaningful choices about the information collected on our website for third party purposes, and that is why we provide the variety of opt-out mechanisms listed above. However, we do not currently recognize or respond to browser-initiated DNT signals. To learn more about Do Not Track, you can do so here.

HOW WE DISCLOSE YOUR INFORMATION

PiñataFarms will disclose your information in the following ways:

Affiliates and Subsidiaries. We may disclose information we collect within the PiñataFarms family of companies to deliver services to you, ensure a consistent level of service, and enhance our products, services, and your customer experience.

Service Providers and Vendors. We provide access to or disclose your information to select third parties who perform services on our behalf. They have access to perform these services but are prohibited from using your information for other purposes. They provide a variety of services to us, including image and video generation (operators of the AI models that generate AI Videos, AI Photos, and similar content from your Inputs and Uploads), cloud hosting, marketing, product content and features, advertising, analytics, research, customer service, data storage, security, fraud prevention, payment processing, and legal services.

Protection of PiñataFarms and Others. By using the Services, you acknowledge and agree that we may access, retain and disclose the information we collect and maintain about you if required to do so by law or in a good faith belief that such access, retention or disclosure is reasonably necessary to: (a) comply with legal process (e.g. a subpoena or court order); (b) enforce our Terms of Service, this Privacy Policy, or other contracts with you, including investigation of potential violations thereof; (c) respond to claims that any content violates the rights of third parties; (d) respond to your requests for customer service; and/or (e) protect the rights, property or personal safety of PiñataFarms, its agents and affiliates, its users and/or the public. This includes exchanging information with other companies and organizations for fraud protection, and spam/malware prevention, and similar purposes.

Business Transfers. As we continue to develop our business, we may buy, merge, or partner with other companies. In such transactions (including in contemplation of such transactions), user information may be among the transferred assets. If a portion or all of our assets are sold or transferred to a third-party, your information — including your account information, Uploads, Creations, Inputs, Usage Data, De-identified Data, and any consents you have given — would likely be among the transferred business assets, and the successor may use it under this Privacy Policy until it notifies you of any change. If such transfer is subject to additional mandatory restrictions under applicable laws, we will comply with such restrictions.

Public Forums and Messaging Services. Certain features of our Services make it possible for you to post comments and Creations either publicly or privately with other users. Any information that you submit publicly is not confidential, and we may use it for any purpose (including in testimonials or other marketing materials). Any information you exchange privately with other users can be used and disclosed by such other users, and we may need to access and use such information if necessary for analyzing use of our services or for legal or safety purposes. Accordingly, please take care when using these features.

Aggregate/De-Identified Information. From time to time, we may disclose Aggregate/De-Identified Information about use of the Services, and De-identified Data derived from Uploads, Creations, Inputs, and Usage Data, and the disclosure of such data is unrestricted, subject to the no-re-identification commitment in this Privacy Policy.

RETENTION OF YOUR INFORMATION
Information and how long we keep it:
- Account Information: While your account exists, plus up to [90] days in backups after deletion
- Uploads, Creations, Inputs: While your account exists or until you delete them, plus up to [90] days in backups; copies incorporated into De-identified Data or trained models are retained as described below
- Usage Data: For as long as your account exists, and in de-identified form thereafter.
- De-identified Data and trained models: Indefinitely; they are no longer linked to you and models cannot be untrained
- Biometric information: Per the Biometric Information Notice
- Purchase and support records: As required by tax, accounting, and consumer-protection law

Deleting a Creation removes it from your profile and from surfaces visible to other users. To delete your account, use Settings or email privacy@pinatafarm.com.

• For the PictureMe and WeLookCute mobile applications: Your original photos that you upload to generate PictureMe and WeLookCute Avatars are deleted immediately after successful Avatars generation.  At the same time, your Avatars (not face data) are stored on our servers (provided by Google Cloud Platform and, or, Amazon Web Services) to be available to you at any time from any device until you decide to delete them (e.g., within the app or via a request you send us at privacy@pinatafarm.com.)

HOW WE PROTECT YOUR INFORMATION

PiñataFarms takes technical and organizational security measures to protect the information provided via the Services from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, no Internet or email transmission is ever fully secure or error-free. Please keep this in mind when disclosing any information to PiñataFarms or our family of apps via the Internet.

THIRD PARTY LINKS AND FEATURES

The Services may contain links to third-party websites such as social media sites, and also contain third-party plug-ins (such as social media share buttons and the device share sheet). If you choose to use these sites or features, you may disclose your information not just to those third parties, but also to their users and the public more generally depending on how their services function. We are not responsible for the content or practices of those websites or services. The collection, use, and disclosure of your information will be subject to the privacy policies of the third-party websites or services, and not this Privacy Policy. We urge you to read the privacy and security policies of these third parties.

CHILDREN’S PRIVACY

The Services are intended for general audiences and not for children under the age of 13. If we become aware that we have inadvertently collected “personal information” (as defined by the United States Children’s Online Privacy Protection Act) from children under the age of 13 without valid parental consent, we will take reasonable steps to delete it as soon as possible. We do not knowingly sell or share the personal information of users under 16, and we do not serve targeted advertising to users we know to be under 18. We also comply with other age restrictions and requirements in accordance with applicable local laws.

MARKETING CHOICES

You may instruct us not to use your contact information to contact you by email, postal mail, or phone regarding services, promotions and special events that might appeal to your interests by contacting us using the information below. In commercial email messages, you can also opt out by following the instructions located at the bottom of such emails. Please note that, regardless of your request, we may still use and share certain information as permitted by applicable law. For example, you may not opt out of certain operational emails, such as service or registration notifications, legal updates, or password reset communications.

PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS

If you are a California resident, California law requires us to provide you with some additional information regarding how we collect, use, and share your "personal information" (as defined in the California Consumer Privacy Act ("CCPA")).

Categories of personal information we collect. Throughout this Privacy Policy, we discuss in detail how we collect, use, and disclose personal information about our users. Under the CCPA, we are also required to provide you with the relevant "categories" of personal information we collect. The categories we collect include: identifiers (such as name, username, online identifier, internet protocol address, email address, or other similar identifiers); internet or other network or device activity (such as browsing history and information on interaction with the Services, including creation events); geolocation data (general location information at an IP-based or city/state/zip level or precise location); demographic information (such as age and gender); commercial information (purchase and subscription history); physical characteristics or description (such as photos and videos of you); biometric information (face geometry used to place your face in content); audio, electronic, or visual information (Uploads and Creations); the text you enter (Inputs); and inferences drawn from the above (such as template recommendations); and other information that identifies or can be reasonably associated with you (e.g., information you voluntarily provide as you use the PiñataFarms services or our any of our family of apps, such as additional profile information or user-generated content). Some of this information (i.e., precise location and biometric information) are deemed “sensitive personal information” under the CCPA.

The sources from which the categories of personal information are collected and uses. We collect the personal information from the following categories of sources: directly from you and the information you provide to us; indirectly from our affiliates, service providers, and third parties with whom you have a direct relationship; other users that may post content containing your image; and indirectly through your use of the Services.

Use and disclosure of categories of personal information. For information about how we use and disclose the information we collect from and about you, see the “How We Use Your Information” and “How We Disclose Your Information” sections above. We disclose personal information to service providers, including operators of AI models that generate content on our behalf, and we disclose De-identified Data to third parties. Please note that the CCPA sets forth certain obligations for businesses that “sell” or “share” personal information to/with third parties. We do not engage in such activities.

Sensitive personal information. We use biometric information only to provide the features you request, to improve the models that perform those tasks, and for security. To the extent the CCPA gives you the right to limit our use of sensitive personal information, you may exercise it by emailing privacy@pinatafarm.com.

Your California privacy rights. If you are a California resident, the CCPA allows you to make certain requests about your personal information. Specifically, the CCPA allows you to request us to:

• Inform you about the categories of personal information we collect or disclose about you and the categories of sources of such information;

• Inform you about the business or commercial purpose for collecting, “selling,” or “sharing” personal information, the categories of third parties to whom we disclose or “sell” or with whom we “share” personal information, and the categories of personal information we “sell” or “share”;

• Provide you with the specific pieces of personal information we collect about you;

• Correct inaccurate personal information we have about you; and

• Delete personal information we have about you.

Please note that certain information may be exempt from such requests under California law. For example, we need certain information in order to provide the Services to you. You may only make such a request twice within a twelve-month period. Requests are generally free; however, we may charge a reasonable fee or deny your request if it is manifestly unfounded, excessive, or repetitive.

To make a CCPA request, please email us at privacy@pinatafarm.com. We will request information, which at a minimum will include your name and email address, to verify your identity. We may request additional information to verify your identity before responding to a request. Under the CCPA, you may have an authorized agent submit a request on your behalf, and we will collect certain authorization and verification information from the agent and you in such circumstances. De-identified Data is not personal information; we commit to maintaining it in de-identified form and not attempting to re-identify it.

The CCPA provides you with the right to receive information about the financial incentives that we offer to you, if any, and the right not to be discriminated against for exercising your rights under applicable law (as set forth in California law). The CCPA also allows you to limit the use or disclosure of your “sensitive personal information” (as defined in the CCPA) if your “sensitive personal information” is used for certain purposes. Please note that we do not use or disclose “sensitive personal information” other than for purposes for which you cannot exercise the right to limit under the CCPA.

Shine the Light Disclosure. The California “Shine the Light” law gives residents of California the right under certain circumstances to request information from us regarding the manner in which we disclose certain categories of “personal information” (as defined in the Shine the Light law) to third parties for their direct marketing purposes. We do not disclose your personal information to third parties for their own direct marketing purposes.

PRIVACY INFORMATION FOR NEVADA RESIDENTS

Under Nevada law, certain Nevada consumers may opt out of the sale of "personally identifiable information" for monetary consideration (as such terms are defined under Nevada law) to a person for that person to license or sell such information to additional persons. We do not engage in such activity; however, if you are a Nevada resident who has purchased services from us, you may submit a request to opt out of any potential future sales under Nevada law by contacting us at privacy@pinatafarm.com. Please note we will take reasonable steps to verify your identity and the authenticity of the request. Once verified, we will maintain your request in the event our practices change.

CHANGES TO OUR PRIVACY POLICY

We reserve the right to amend this Privacy Policy at any time to reflect changes in the law, our data collection and use practices, the features of our Services, or advances in technology. We will make the revised Privacy Policy accessible through the Services, so you should review the Privacy Policy periodically. You can know if the Privacy Policy has changed since the last time you reviewed it by checking the “Effective Date" included at the beginning of the document. By continuing to use the Services, you are confirming that you have read and understood the latest version of this Privacy Policy. Depending on the type of changes we make, we may provide you with additional notice or choices under applicable law.

INTERNATIONAL USERS

The information discussed in this Policy is processed in the United States by Piñata Farms, and in the United States and elsewhere by our service providers. If you are located outside the United States, please note that you are transferring information to a country and jurisdiction that may not have the same data protection laws as your jurisdiction; where required, we rely on Standard Contractual Clauses or other approved transfer mechanisms.

Lawful bases (EEA/UK/Switzerland). We process your information to perform our contract with you (providing the Services and generating the content you request); with your consent (biometric information, precise location, marketing where required); to comply with legal obligations; and for our legitimate interests, including securing and improving the Services, measuring our marketing, and developing and training machine-learning models from what people create, write, and share, balanced against your rights. You may object to processing based on legitimate interests, including model training, by emailing privacy@pinatafarm.com; we will stop unless we have compelling grounds. You also have rights to access, rectify, erase, restrict, and port your information, to withdraw consent at any time, and to lodge a complaint with your supervisory authority.

CONTACT INFORMATION

Please feel free to contact us if you have any questions about PiñataFarms' Privacy Policy or the information practices of the Services. You can email us at privacy@pinatafarm.com.