Privacy Policy for Cosnap LLC

1. Notice of Biometric Data Collection

This section serves as our formal disclosure under the Illinois Biometric Information Privacy Act (BIPA), California Consumer Privacy Act (CCPA/CPRA), Texas CUBI, and Washington My Health My Data Act.

• Biometric Identifiers: When you enable facial recognition, we derive mathematical representations of facial features called "embeddings" or "biometric identifiers".

• Purpose: This biometric data is used exclusively to match event photos uploaded by photographers to registered users.

• Storage and Consent: By enabling facial recognition and uploading photos, you provide express written consent for Cosnap LLC to capture and store these identifiers. These identifiers are processed using Amazon Web Services (AWS).

• Policy on Sales: We do not sell, rent, or trade your biometric identifiers or personal information to any third party.

2. Information We Collect

• 2.1 Account and Profile Information — When you register, we collect: Name and Email address. Encrypted password. Optional data: Country, Date of Birth, and Phone Number.

• 2.2 User Content — Photos: Photos you upload, capture, or that photographers upload to events you are registered for. Metadata: Timestamps, file information, and geolocation data (if provided) associated with photos.

• 2.3 Usage and Device Data — When you access the Services, we collect: IP address and unique device identifiers. Device type, model, and operating system version. App usage patterns, time spent on pages, and diagnostic error reports.

• 2.4 Payment Information — Subscriptions are processed by third-party payment processors (Apple In-App Purchase). We do not directly collect or store your credit card or payment details.

3. How We Use Your Information

We use your data for the following purposes:

• Service Delivery: To process facial images and embeddings to match event photos to registered users and deliver them to your account.

• Communication: To send you notifications about matched photos, account updates, and service-related messages.

• Improvement: To analyze usage patterns to improve app functionality and fix technical issues.

• Security & Compliance: To protect the rights and safety of Cosnap and our users, and to comply with legal obligations.

4. Data Sharing and Disclosure

We share your information only in limited circumstances:

• Service Providers: We use Amazon Web Services (AWS) for cloud storage and infrastructure. AWS is contractually bound to process data only as instructed by us and does not use your biometric data for its own purposes.

• Legal Requirements: We may disclose data to comply with court orders, subpoenas, or valid government requests.

• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the new entity.

5. Data Storage and Security

• Location: All data, including facial images and embeddings, is stored on AWS servers located in the United States.

• Encryption at Rest: All facial images and embeddings are stored in encrypted AWS S3 buckets using AES-256 encryption.

• Encryption in Transit: Data transmitted between your device and our servers uses TLS/SSL encryption.

• Access Control: We implement strict access controls that limit data access to only necessary app functions and authorized personnel.

6. Data Retention and Deletion

• 6.1 Retention Schedule — Facial Images: Original facial images are stored temporarily and retained only as long as necessary to complete the matching process. Facial Embeddings: These are stored persistently while your account is active to enable ongoing photo matching at events. Inactivity: Per biometric privacy standards, identifiers are purged when the initial purpose for collection has been satisfied or within a defined period of inactivity.

• 6.2 Account Deletion — You can delete your account and all associated data at any time through the app settings. Active Systems: Facial embeddings, matched photos, and account information are immediately flagged for deletion and removed from active systems within 30 days. Backups: Backup copies in disaster recovery systems may persist for up to 90 days before being permanently purged.

7. Your Rights and Choices

Depending on your location, you may have the following rights:

• Right to Access/Portability: Request a copy of the personal data we hold about you in a structured, machine-readable format.

• Right to Deletion: Request the deletion of your personal data.

• Right to Opt-Out: You can disable facial recognition at any time in your account settings.

• Global Privacy Control: We do not share personal information for cross-context behavioral advertising and respect signals indicating a preference to opt-out of such tracking.

8. Additional Disclosures

• 8.1 Children’s Privacy — Cosnap is not intended for children under the age of 13. We do not knowingly collect personal information from children.

• 8.2 International Transfers — If you are located outside the United States, your information will be transferred to and processed in the U.S. where our servers are located. By using our Services, you consent to this transfer.

• 8.3 Third-Party Links — Our Services may contain links to third-party platforms. We are not responsible for the privacy practices or content of those external entities.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy in the app, updating the "Last Updated" date, or sending an email notification. Your continued use of the Services after changes become effective constitutes acceptance of the revised policy.

10. Contact Us

If you have questions, concerns, or wish to exercise your data rights, please contact us: Cosnap LLC / info@cosnap.ai / https://cosnap.ai / Subject Line for Privacy Requests: "Privacy Request"