Effective : Nov. 1st, 2023
Last [Updated/Reviewed]: Nov. 1st, 2023
This California Consumer Privacy Statement supplements the CONCEPT Privacy Policy and applies solely to all visitors, users, and others who reside in the State of California (“consumers” or “you”). This Statement does not apply to workforce-related personal information collected from California-based employees, job applicants, contractors, or similar individuals.
This California Consumer Privacy Statement uses certain terms that have the meaning given to them in the California Consumer Privacy Act of 2018 and its implementing regulations (the “CCPA”).
0. (Summary) About data for AI Photo Generation
This section is the summary of privacy policy, especially dealing with facial data.
Concept AI analyzes your photos(3-5 photos) including face to create AI-generated images featuring you. The photos you send us are securely stored for the production of future AI photos and are only used to create additional albums. Stored facial data can be deleted at any time through the 'Settings > Manage Face Data' menu. Or the data will be permanently deleted one year after the last request to generate AI results.
The photos you provide will be uploaded to an AWS server(South Korea region) for storage. They will be utilized to create albums via AI generation, processed by our AI model operating on AWS's GPU cloud infrastructure(South Korea region).
The summary of information, use period, deletion, third-party sharing and etc. is below.
•
Categories of personal information to be collected: User face photos, gender
•
Purpose of collection and use
◦
Creation of AI-generated results
◦
Creation of additional AI-generated results without uploading facial photos again
•
Retention and use period
◦
User face photos, gender: Until the user requests deletion( users can delete at “Settings > Manage Face Data”) or one year after the last request to generate AI results
◦
AI-generated results: Until the user requests deletion
•
Data Storage
We store the information safely, as encrypted data. For the purpose of providing better services, the domestic personal information trustee entrusted by the Company is as follows:
◦
Amazon Seb Services(South Korea region)
▪
Entrusted tasks: Operation of infrastructure where personal information is stored
▪
Entrusted information: Personal information processed for the provision of services
▪
Retention period: For the duration mentioned in ‘Retention and use period’ above.
•
About third-party sharing
The Company does not provide, sell, or share any of the data mentioned above to third parties, except the AWS cloud service mentioned above.
The user's consent will be maintained until the end of the AI service, and the user has the right to refuse consent for the collection and use of personal information.
However, if you refuse consent, you will not be able to use the AI service.
1. Notice of Collection and Use of Personal Information
We may collect the following categories of personal information about you:
•
Identifiers: identifiers such as a real name, alias, postal address, unique personal identifier (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology; customer number, unique pseudonym, or user alias; telephone number and other forms of persistent or probabilistic identifiers), online identifier, Internet Protocol address, email address, account name, and other similar identifiers
•
Protected Classifications: characteristics of protected classifications under California or federal law, such as age and gender. While users are not asked to provide this information to use the Application, facial recognition metadata generated from your user content (estimated age, gender, etc.) is maintained on your device to provide you with more suitable filters and better photo effects when the Application processes your photos.
•
Commercial Information: commercial information, including records of products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies.
•
Online Activity: Internet and other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding your interaction with websites, applications or advertisements
•
Geolocation Data: physical location or movements
•
Sensory Information: audio, electronic, visual, and similar information
•
Inferences: inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
•
Facial Data(photos) & Gender
•
Sensitive Personal Information: personal information that reveals a consumer’s:
◦
account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account;
◦
precise geolocation
We may use the categories of personal information listed above for the purposes described in the CONCEPT Privacy Policy. In addition, we may use these categories of personal information for certain business purposes specified in the CCPA, as described in this table:
Purposes | Categories of Personal Information |
Performing services, including creating, maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing targeted advertising or marketing services (with your consent, where required by law), providing analytics services, or providing similar services | · Identifiers
· Commercial Information
· Online Activity
· Geolocation Data
· Sensory Information
· Inferences
· Sensitive Personal Information |
Auditing related to a current interaction with you and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance | · Identifiers
· Protected Classifications
· Commercial Information
· Online Activity
· Geolocation Data
· Sensory Information
· Inferences
· Sensitive Personal Information |
Short-term, transient use, including, but not limited to, using facial recognition technology to provide filters and photo effects and the contextual customization of ads shown as part of the same interaction | · Identifiers
· Protected Classifications
· Commercial Information
· Online Activity
· Geolocation Data
· Sensory Information
· Inferences
· Sensitive Personal Information |
Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity | · Identifiers
· Protected Classifications
· Commercial Information
· Online Activity
· Geolocation Data
· Sensory Information
· Inferences
· Sensitive Personal Information |
Debugging to identify and repair errors that impair existing intended functionality | · Identifiers
· Commercial Information
· Online Activity
· Geolocation Data
· Sensory Information |
Undertaking internal research for product development and demonstration | · Identifiers
· Commercial Information
· Online Activity
· Geolocation Data
· Sensory Information |
Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us | · Identifiers
· Commercial Information
· Online Activity
· Geolocation Data
· Sensory Information
· Inferences |
Make a AI photos | · Facial Data(photos)
· Gender |
2. Our Prior Collection, Use, and Disclosure of Personal Information
We may have collected and used your personal information, as described in Section 1 of this Statement, during the 12-month period prior to the effective date of the Statement. For the personal information collected during that timeframe, we describe below: (a) the categories of sources from which we may have obtained the personal information, (b) the categories of third parties with whom we may have shared the information, (c) the categories of personal information we may have sold, and (d) the categories of personal information we may have disclosed for a business purpose.
Sources of Personal Information
We may have obtained personal information about you from various sources, as described below.
Categories of Sources of Data Collection | Categories of Personal Information |
Directly from you | · Identifiers
· Commercial Information
· Online Activity
· Geolocation Data
· Sensory Information
· Inferences
· Facial Data(photos) & Gender
· Sensitive Personal Information |
From your devices | · Identifiers
· Commercial Information
· Online Activity
· Geolocation Data
· Sensory Information |
Our affiliates | · Identifiers
· Online Activity
· Geolocation Data
· Sensory Information |
Social Networking Service | · Inferences |
Vendors who provide services on our behalf | · Identifiers
· Commercial Information
· Online Activity
· Geolocation Data
· Sensory Information
· Inferences |
Sharing of Personal Information
We may have shared your personal information with certain categories of third parties, as described below.
Categories of Third Parties | Categories of Personal Information |
Our affiliates | · Identifiers
· Commercial Information
· Online Activity
· Geolocation Data
· Sensory Information |
Vendors who provide services on our behalf | · Identifiers
· Commercial Information
· Online Activity
· Sensory Information
· Inferences |
Professional services organizations, such as auditors and law firms | · Identifiers
· Commercial Information
· Online Activity
· Sensory Information |
Our UNBOXERS Partners | · Identifiers
· Commercial Information
· Online Activity
· Sensory Information |
Advertising networks | · Identifiers
· Online Activity
· Geolocation Data
· Inferences |
Data analytics providers | · Identifiers
· Commercial Information
· Online Activity
· Geolocation Data
· Sensory Information
· Inferences |
Disclosure of Personal Information for a Business Purpose
We may have disclosed to third parties for a business purpose the following categories of personal information:
•
Identifiers
•
Online Activity
•
Sensory Information
•
Inferences
3. California Consumer Privacy Rights
You have certain choices regarding your personal information, as described below.
Right to Know: You have the right to request, twice in a 12-month period, that we disclose to you the personal information we have collected, used, disclosed and sold about you during the past 12 months. Once we receive your request and confirm your identity, we will disclose to you:
•
The categories of personal information we collected about you.
•
The categories of sources for the personal information we collected about you.
•
Our business or commercial purpose for collecting or selling that personal information.
•
The categories of third parties with whom we share that personal information.
•
If we sold or disclosed your personal information for a business purpose, two separate lists disclosing:
◦
sales, identifying the personal information categories that each category of recipient purchased; and
◦
disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.
•
The specific pieces of personal information we collected about you (also called a data portability request).
Right to Delete: You have the right to request that we delete certain personal information we have collected from you. Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the information applies. We may deny your deletion request if retaining the information is necessary for us or our service providers to:
1.
Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you.
2.
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
3.
Debug products to identify and repair errors that impair existing intended functionality.
4.
Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
5.
Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et seq.).
6.
Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
7.
Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
8.
Comply with a legal obligation.
9.
Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
We will delete or deidentify personal information not subject to one of these exceptions from our records and will direct our service providers to take similar action.
Right to Opt Out of Sale: You have the right to opt out of the sale of your personal information. Consumers who opt in to personal information sales may opt out of future sales at any time. We do not sell the personal information of consumers we actually know are less than 16 years old.
To opt out of the sale of your personal information, please email us at help@con.cept.ai or follow the steps below depending on your device type:
iOS: In iOS version 13 and earlier only, enable the “Limit Ad Tracking” setting in your iOS settings (precise directions may be different on different iOS versions).
Android: In the Google Ads settings within your Android settings, toggle the “Opt out of Ads Personalization” switch on (precise directions and name of the switch may be different on different Android versions and OEM Android variants).
When you have opted out using your device settings, advertisers will not use in-app information collected from that device to infer your interests or serve ads to that device that are targeted based on your inferred interests. Please note, however, that opting out will not block general advertisements that are sent at random and not tied to the perceived interest of the User of a particular device.
Once you make an opt out request, you may change your mind and opt back in to personal information sales at any time.
You do not need to create an account with us to exercise your opt-out rights. We will only use personal information provided in an opt-out request to review and comply with the request.
You may learn more about personalized and behavioral advertising and how to opt out of this type of advertising from the Digital Advertising Alliance at www.aboutads.info and Networking Advertising Initiative at www.networkadvertising.org/choices/
How to Submit a Request to Know or Delete. To exercise your rights to know or delete described above, email us at help@con.cept.ai. Your request to know or delete must:
•
Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
•
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.
You do not need to create an account with us to submit a request to know or delete. We will only use personal information provided in the request to verify the requestor’s identity or authority to make it.
Only you, or someone legally authorized to act on your behalf (an “authorized agent”), may make a request to know, delete, or correct related to your personal information. To designate an authorized agent, please provide us with your contact information, the contact information of your authorized agent, and a description of how and when your authorized agent will be reaching out to us (to the extent known).
We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day timeframe, please email us at help@con.cept.ai.
We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing.
Additional Information. If you choose to exercise any of your rights under the CCPA, you have the right to not receive discriminatory treatment by us. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request. This Statement is available in alternative formats upon request. Please contact help@con.cept.ai to request this Statement in an alternative format.