PRIVACY POLICY

This “Privacy Policy” describes how Cardinal Blue Software (“Cardinal Blue”, “we”, “us”, or “our”) protects your privacy when you use the PicCollage mobile app and the piccollage.com website (each, a “PicCollage Service” and collectively, the “PicCollage Services”). The “PicCollage EDU” application has a dedicated privacy policy, and all other mobile phone and web applications developed by Cardinal Blue Software are governed by a separate privacy policy.

PLEASE READ THIS PRIVACY POLICY CAREFULLY. BY ACCESSING OR USING THE PICCOLLAGE SERVICES, YOU AGREE TO BE BOUND BY THE TERMS AND CONDITIONS DESCRIBED HEREIN AND ALL TERMS AND CONDITIONS INCORPORATED BY REFERENCE. IF YOU DO NOT AGREE TO ALL OF THE TERMS AND CONDITIONS SET FORTH BELOW, YOU MAY NOT USE THE PICCOLLAGE SERVICES.

This Privacy Policy applies to information (including Personal Information) collected through the PicCollage Services. For the purpose of this Privacy Policy, “Personal Information” means information that identifies you personally, either alone or in combination with other information available to us, all as more fully described in the section “What Data We Collect & How”. Personal Information does not include technical, device, or usage information that cannot be used to identify you personally even if we combine it with other data about you, nor does it include “aggregate” information, which is data we collect about the use of the PicCollage Services or about a group or category of services or users, from which individual identities or other Personal Information have been removed. This Privacy Policy in no way restricts or limits our collection and use of aggregate and non-personal information, and we may share such data about our users with third parties for various purposes. This Privacy Policy is part of and incorporated into PicCollage's Terms of Service (“Terms of Service”).

Last Updated: September 24th, 2025

DATA PRIVACY

Our Basis to Collect Your Personal Information

You are about to enter into a contract with us where we provide PicCollage Services and you agree to our Terms of Service. Our lawful bases for processing your Personal Information include (a) where you have provided consent for one or more specific purposes, (b) where processing is necessary for the performance of a contract with you, (c) where processing is necessary to comply with a legal obligation, and (d) where processing is necessary in furtherance of our legitimate interests, or those of a third-party, provided that the protection of your interests and fundamental rights and freedoms do not conflict with our or such third-party interests. PicCollage Services are not directed at children under the age of 13, and we do not knowingly (i) collect any information that would be deemed personal information under the U.S. Children's Privacy Protection Act from children under 13 or (ii) allow children under 13 to use the app without verifiable parental consent. If we become aware that we have inadvertently collected personal information from a child under 13 without proper consent, we will delete that information promptly. We do not knowingly “sell,” as that term is defined under the California Consumer Privacy Act (the “CCPA”), the Personal Information of minors under 16 years old who are California residents.

Your Rights as Data Subject

As the data subject, you have the right to grant or decline consent to our terms and policies. The following are the rights you can exercise regarding your information:

1. The right of access. As the data subject, you have the right to know how your data is being processed, and you can also request access to your data.

2. The right to be informed. You have the right to be informed by Cardinal Blue Software of the changes we make regarding the collection and processing of your information.

3. The right to rectification. As the data subject, you can obtain rectification of inaccurate Personal Information from us in a timely manner.

4. The right to erasure. As the data subject, you have the right to have your data erased under the following circumstances:

   1. the Personal Information is no longer necessary (for example, in the case that a user deletes their account);
   2. when you withdraw consent to our terms and policies; and
   3. when your Personal Information has been unlawfully processed.

5. The right to restriction of processing. You have the right to restrict our processing of your data when the accuracy of the data is contested by you, the data subject.

6. The right to portability. As the data subject, you can request that we transfer any of your data held by us to another company.

7. The right to object. As the data subject, you have the right to ask us to stop processing your data.

8. The right not to be subject to automated individual decision-making, including profiling.

9. The right to withdraw your consent at any time —where we rely on your consent as the legal basis for processing your Personal Information.

What Data We Collect & How

1. Usage Information. The information we collect from you includes the country you set your device to, the language you use on your device, the type and version of the operating system of your device, and your device model. If you make any in-app purchases, we will also collect the product IDs of the items you purchase.

   • We collect this information from you to improve our app's overall performance and the service we provide as well as to show you ads that are personalized for you. We analyze this information with tools provided by third-party companies. These companies include:

     • These companies include Google and Amplitude.
     • You can learn more about the information they collect and analyze to ensure that PicCollage Services provides an optimum user experience by clicking on the links above.

2. Content you create. We receive the content of your creations while you are using the app in order to provide services to you. This may include photos and videos you are using as part of your designs, the order and structure that you are placing them in your designs, as well as their attached metadata. If you upload photos that include children under the age of 13, you must obtain permission from a parent or legal guardian before submitting such content.

   • This content will sometimes contain raw user-uploaded images or videos with visible facial features. We do not create any derivative or transformed outputs such as numeric encodings, text embeddings, or other representations generated from the original image that would be used to identify a person. We do not utilize these kinds of facial identification algorithm and do not seek to identify any person visible in user photos or videos; as such, these uses are not covered in our Privacy Policy. Any data containing visible facial features (“Face Data”) is used solely for the purpose of generating stylized images and other visual transformations offered by our app. We do not use Face Data for identity recognition, advertising, biometric profiling, or any unrelated purposes.
   • These uploaded images and the generated outputs created by us and/or our trusted third-party partners (e.g., stylized and/or transformed results) may be stored on our servers in order to provide users with a persistent history of their creations. Images uploaded to our trusted third-party partners are deleted automatically according to each such partner's data retention policies (see more info in Data Retention and Deletion). This enables users to:
     • View past creations when logged into their account.
     • Sync their history across multiple devices.
     • Re-download content even after switching devices.
   • Users can manually delete individual images or results within the app at any time. Additionally, users can delete their entire account, which will permanently remove all associated data from our systems.

3. Information you provide us.

   • Account Information: PicCollage will collect your username and email address when you consent to create an account in the app.
   • Device Library. We may access your devices photo library only with your explicit permission when prompted within the application.

4. Information from third-party sources. If you connect PicCollage Services to other social media platforms such as Facebook, we will collect further information from you.

   • Facebook Authentication: prior to October 2024, if you had previously logged in using Facebook, authentication data as specified in the Facebook privacy policy which included username, email, locale, and identifier, would have been collected. This login method is no longer in the app and would not have been accessible to versions of the app downloaded after October 2024.
   • Zendesk: to provide users with an efficient way to communicate with Cardinal Blue Software (about the usage of PicCollage Services), we use Zendesk, a customer service platform, to receive your feedback and offer timely responses to any questions you have. Please note we will receive your IP address and email address when you try to contact us through Zendesk.

5. Cookies. We automatically collect certain information through the use of “cookies”. Cookies are small data files that are stored on your device by a PicCollage Service. Among other things, the use of cookies helps us to improve the PicCollage Services and your experience using them. We use cookies to see which areas and features of the PicCollage Services are most popular, to count the number of devices accessing the PicCollage website, to personalize your experience and to remember your preferences. If your browser or device is set not to accept cookies or if you reject a cookie, you may not be able to access certain features of the PicCollage Services.

6. TrueDepth Camera Data. Our app does not collect, store, or utilize TrueDepth camera data or Apple's Face ID-related depth and facial mapping data. We do not use any ARKit or Vision-based facial tracking APIs, nor do we access any system-level facial geometry data derived from Apple's TrueDepth camera.

Device Information

We collect information from and about certain web-connected devices on which you use the PicCollage Services (such as mobile phones and computers that utilize a version of the iOS that is older than iOS 14) and combine this information across different devices. For example, we use information collected about your use of the PicCollage Services on your phone to better personalize the content (including ads) or features you see when you use the PicCollage Services on another device, such as your laptop, or to measure whether you took an action in response to an ad we showed you on your phone on a different device.

How We Use Your Personal Information

We use Personal Information collected through the PicCollage Services with your permission:

1. to provide you with the PicCollage Services. This includes allowing you to login using your data, access your designs and to be provided with the services included in the applications.
2. to communicate with you or third parties. We may use your contact information to send communications about critical elements of the PicCollage Services such as technical issues or security alerts.
3. to process your requests and transactions. We will use your data to ensure that transactions and requests made by you stay connected to your account.
4. to improve the PicCollage Services.
5. to customize the services and/or products we provide to you. We may use elements of your usage information and other information we collect to customize the app experience and make it more tailored to you.
6. to perform marketing activities. This includes providing you with marketing communications, including offers and feedback-related opportunities.
7. to provide relevant advertising such as showing you ads that are tailored for you. The advertisements are provided by Google. Please click on the link to learn more about the information we share with them and how they process it to serve you personalized content.

With Whom We Share Your Personal Information

Personal Information (and non-personal information) collected through the PicCollage Services may be shared with companies and organizations that perform services on our behalf (for example, companies that provide data management or other support services to us such as Heroku). We may share your Personal Information (and non-personal information) with third-party advertising services (including Google) to serve you relevant advertising and market our products, but we won't sell your Personal Information. We may also share the content you are creating in the app with trusted third-party partners to provide you with services within the app, such as OpenAI for image and video processing. Also, we may disclose the Personal Information we collect through the PicCollage Services to government authorities, industry peers or other third parties when we, in good faith, believe (i) there has been a violation of our terms, policies, or the law or (ii) disclosure is required to:

1. comply with a legal obligation;
2. protect and defend our rights or property;
3. detect, investigate or prevent fraud or other illegal activity;
4. protect the safety, security, and integrity of our products, employees, users, or the public;
5. protect against legal liability;

6. provide you with services in the app. We may upload your visual data (content you are creating in the app that may include raw Face Data) to trusted third-party services that we partner with for processing. These providers are contractually obligated to handle user data in accordance with applicable privacy laws and industry standards. Please review their privacy policies to understand how they store and use your data.

   • OpenAI. Privacy Policy: https://openai.com/privacy
   • Google Gemini. Privacy Policy: https://support.google.com/gemini/answer/13594961
   • Replicate. Privacy Policy: https://replicate.com/privacy
   • Flux. Privacy Policy: https://flux1.ai/privacy
7. enforce the Terms of Service or other agreements that govern your use of the PicCollage Services and/or any of our other services;
8. protect the rights, property or safety of us, our users or others; or
9. protect your vital interests.

If we are going to release your information in response to a legal process, our policy is to provide you with reasonable advance notice under the circumstances unless we are prohibited from doing so by law or court order (e.g., an order under 18 U.S.C. § 2705(b)). We may disclose your information without giving you prior notice if we believe it is necessary to prevent imminent and serious bodily harm to a person. Nothing in this Privacy Policy is intended to limit any legal objections or defenses you might have to efforts by third parties to compel disclosure of your information, including legal orders from the government. Your Personal Information and other data collected by us may be transferred to another company that has acquired our stock or assets, for example, as a result of a sale, merger, reorganization, dissolution or liquidation. If such a transfer occurs, the acquiring company's use of your Personal Information will still be subject to this Privacy Policy.

How To Modify or Delete Your Data History

We respect your right to make choices about the ways we collect, use and disclose your Personal Information. You may update or modify your information or change your privacy preferences at any time by emailing us at support@cardinalblue.com or, in some instances, via the PicCollage Services. You may opt out of receiving promotional communications from us, including, but not limited to, promotional emails, by emailing us at support@cardinalblue.com. Transactional service communications (such as messages about your registration) are not subject to the foregoing opt-out procedures. Requests to disable your account or reset your password should be sent to support@cardinalblue.com for faster processing. Note, though, that we may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect. You may also delete any Personal Information that you have provided to us by emailing us at support@cardinalblue.com. However, we cannot delete your Personal Information except by also deleting your user account. Also, information that others have shared about you is not part of your account and will not be deleted. If you would like to delete your account to remove all data history, please follow the instructions below. If you contact us at support@cardinalblue.comand request we delete your data, and provided that you have an account with us, you may also request that we facilitate deletion of any data stored on third-party services that could be connected to your account. These third parties may include:

• Amazon Web Services, where we operate cloud storage services
• Meta/Facebook, only if you have previously logged into Facebook through PicCollage Services
• Google, who we partner with to provide in app ads

For more information, please see Data Retention and Deletion

From the PicCollage Website

• Tap the “≡” menu button in the top right corner
• Select Login and sign in to your PicCollage account
• Click the dropdown in the upper right corner and select Settings
• Click Delete Account
• Follow the instructions to delete all of your data on our server

From the PicCollage App (iOS and Android)

• Tap the “=“ menu button in the top left corner
• Tap the Settings button
• Log in to your PicCollage account
• Tap your username button
• Scroll to the bottom of the page and tap “Delete Account”
• Follow the instructions to delete all of your data on our server

Data Retention and Deletion

The content you create (original uploads and generated results) may be retained on our servers for only as long as we require in order to provide the PicCollage Services to you, or to fulfill other legitimate business purposes such as resolving disputes, ensuring safety and security of our products, employees, users, or the public, or complying with our legal obligations. How long we retain Personal Information will depend on a number of factors, including:

• Our purpose for processing the Personal Information;
• The amount, nature, and sensitivity of the Personal Information;
• The potential risk of harm from unauthorized use or disclosure of the Personal Information;
• Any related legal requirements to which we are subject.

However:

• You can delete your data or account stored on our servers at any time following the steps in How To Modify or Delete Your Data History to delete your account. Once you have g your Personal Information include (a) where you have provided consent for one or more specific purposes, (b) where processing is necessary for the performance of a contract with you, (c) where processing is necessary to comply with a legal obligation, and (d) where processing is necessary in furtherance of our legitifollowed the data deletion process above, all data stored on our server will be deleted, including any device information, content information and associated data we are storing.

• Temporarily processed data on any third-party service is deleted automatically according to the relevant third-party service data retention policy.

  • Replicate: User data is automatically deleted 1 hour after the service is used. See more details in the company's privacy policy: https://replicate.com/privacy
  • OpenAI: User data is automatically deleted 30 days after the service is used. See more details in the company's privacy policy: https://openai.com/privacy

We will delete your Personal Information immediately upon request unless we are required to retain your data for legal reasons or for any of the other reasons listed for disclosure in “With Whom We Share Your Personal Information” above. When you request deletion of your data, our team will delete all:

• collages backed up or stored on our server;
• user records, including any email or device identifiers and avatars;
• activity logs;
• avatars, comments, or PicCollage Services related social activity we have stored from now-defunct PicCollage Social platform; and

• data stored by us on third-party services we use, such as

  • Google Cloud
  • Amazon Web Services

In some instances we also use Google Admob to show you advertising in the app. On Apple devices we do not allow Google to collect your identifying data. If you are using an Android device, you may request deletion or reset your advertising ID. This will delete any data in Google Admob that could be connected to your device via our services. To do this:

1. On your Android device, go to Settings.
2. For those on Pixel devices: Tap Privacy > Ads (sometimes Ads can appear in Advanced drop-down menu)
3. For those on Samsung devices: Tap Google > All Services > Ads
4. Tap Reset Advertising ID and confirm your changes.

DATA STORAGE AND TRANSFER

Your information as outlined in this Privacy Policy is stored, processed and transferred to the United States, Taiwan and any other country or jurisdiction where Cardinal Blue Software, its subsidiaries, service providers and affiliates maintain facilities or employ staff. By agreeing to the terms in this Privacy Policy and by using PicCollage Services, you agree to these transfers of data taking place.

If you reside in the European Economic Area (the “EEA”), the United Kingdom, or Switzerland, your Personal Information may be processed on servers located outside these regions for the purposes set out in this Privacy Policy. This includes processing and storage in our facilities and servers in the United States and Taiwan. Although data protection laws vary by country and may not provide the same level of protection as in your home country, we apply the safeguards described in this Policy to your information regardless of where it is processed. When transferring information outside the EEA, the UK, or Switzerland, we rely on the following transfer mechanisms to comply with applicable data protection laws:

1. We rely on the European Commission's adequacy decisions pursuant to Article 45(1) GDPR when transferring your information to any country that has been considered to provide an adequate level of protection.
2. For other jurisdictions, we rely on the Standard Contractual Clauses as approved by the European Commission pursuant to Article 46(2)(c) of the GDPR and on the UK Data Transfer Addendum.

For more information or to obtain a copy of the appropriate safeguards we have in place when transferring your information, please contact us using the information found at the bottom of this document.

SECURITY OF YOUR PERSONAL INFORMATION

We take reasonable security and organizational measures to protect your Personal Information (including preventing the loss, misuse, unauthorized access, disclosure, alteration and destruction of your Personal Information) in accordance with the laws that govern the jurisdiction in which you are located. For example, we use industry standard encryption when transferring your data in and out of the PicCollage Services. However, we cannot guarantee that unauthorized third parties will not be able to defeat our security measures. If you use a password on the PicCollage Services, you are responsible for keeping it confidential. Do not share it with any other person. If you believe your password has been misused or your account compromised, please advise us immediately.

A NOTE TO CALIFORNIA RESIDENTS

If you are a California resident, please see our Terms of Service to learn about your rights and access to data under the CCPA. Additionally, California Civil Code Section 1798.83 permits you to request information regarding the disclosure of your Personal Information (if any) by Cardinal Blue Software to third parties for the third parties' direct marketing purposes. To make this request, please email support@cardinalblue.com or contact us using this address: Cardinal Blue Software, P.O. Box 390677, Mountain View, CA 94039. If you are a California resident under the age of 18, and a registered user of any site where this Privacy Policy is posted, California Business and Professions Code Section 22581 permits you to request and obtain removal of content or information you have publicly posted. To make such a request, please send an email with a detailed description of the specific content or information to support@cardinalblue.com. Please be aware that such a request does not ensure complete or comprehensive removal of the content or information you have posted and that there may be circumstances in which the law does not require or allow removal even if requested.

A NOTE FOR EU RESIDENTS

If you are in the EU and have concerns about our data practices, you have the right to lodge a complaint with your local supervisory authority.

CHANGES TO THIS PRIVACY POLICY

We may change this Privacy Policy from time to time. If we make any changes to this Privacy Policy that we think materially alter your rights, then we will post the latest policy to this site and change the “Last Updated” date above. We encourage you to review this Privacy Policy whenever you visit the PicCollage Services to understand how your personal information is used.

QUESTIONS

If you have any questions about this Privacy Policy, please contact us:

By email:
support@cardinalblue.com

By mail:
P.O. Box 390677, Mountain View, CA 94039, USA