imagines — Privacy Policy (United States)
BRND CREATIVE INC. (hereinafter, the "Company") has established this Privacy Policy in order to inform users about the personal data we process, as well as users' rights and interests in their personal data, in connection with imagines, the imagines mobile application, the website available at "https://imagines.app", and all related services operated by the Company (collectively, the "Service").
Table of Contents
- Article 1. Notice on the Collection and Use of Personal Data
- Article 2. Processing of Sensitive Data
- Article 3. How We Use Personal Data
- Article 4. Processing of Pseudonymized Data
- Article 5. Retention and Use Period of Personal Data and Destruction
- Article 6. Sharing of Personal Data
- Article 7. Measures to Ensure the Security of Personal Data
- Article 8. Rights of Users and Methods of Exercising Such Rights
- Article 9. Children's Privacy Notice
- Article 10. Privacy Officer
- Article 11. Amendments to this Privacy Policy
Article 1 (Notice on the Collection and Use of Personal Data)
The Company collects personal data in different ways. For example, we collect data:
- Directly from you. This includes when you create an account, use the Service, purchase Ink (the Service's credits), or contact us.
- Automatically. This includes through cookies, server logs, and other tools on our website, apps, or Service.
- From other sources. These can include our affiliates, vendors, publicly available sources, and other companies.
We process your personal data as follows:
① Personal Data Collected for Membership Registration
The Company provides and manages all Services using a single, integrated login and data management system.
| Category | Service | Purpose of Collection and Use | Items of Personal Data Collected |
|---|---|---|---|
| Common / General | Common (membership registration and provision of basic services) | To assist with finding a user's ID and resetting a user's password, to register members and identify users for the provision of common services, and to handle inquiries and complaints | Email address, password, nickname |
② Personal Data Collected Separately During Use of the Service
The Company may collect additional personal data in order to provide various services. The specific personal data processed will depend on the Service used and how you choose to use the Service.
| Category | Service | Purpose of Collection and Use | Items of Personal Data Collected |
|---|---|---|---|
| imagines | Common | To provide the imagines Service (AI character conversations, story and character creation) and to improve service performance and quality | AI conversation information (conversation content including uploaded text and images) / service usage behavior information (input data and outputs) / inferred information based on your interaction with the Service |
| imagines | Common | To respond to feedback or support requests you send us | Email address, contact information, any information you submit through the contact channel |
| imagines | Image creation | To generate images using AI services | Uploaded images, entered prompts, and generated outputs |
| imagines | Personalized services | To improve recommendation quality in connection with the provision of the imagines Service | Date of birth, content preferences |
| imagines | Ink purchase | To process payments for paid services and manage payment history | Payment history and purchased product information |
| imagines | Age-restricted content | To verify that a user satisfies the age requirements applicable to age-restricted content and features, as required by applicable law | Date of birth, age verification result or status provided by the verification method designated by the Company |
| imagines | Community features | To provide the ability to interact through community features, publish your works, and view recommended works based on the creators and story categories you follow | Input data including posts, comments, and responses, and any other information provided; service usage behavior information. Where applicable, the inputs may include personal data of individuals under 18. |
③ Personal Data Collected for Marketing Purposes
The Company may collect the following types of data to provide optional marketing services.
| Category | Service | Purpose of Collection and Use | Items of Personal Data Collected |
|---|---|---|---|
| Common / General | Common | To deliver information regarding the Service and events of the Company and partner companies and benefits, and to deliver updates and information related to the Service | Email address |
| Common / General | Common | To learn how you engage with our Service, such as which links you click or what you type into the Service, in order to improve the Service | Information such as IP address, referral URL, device information, usage information (such as pages visited, duration of visit, and click-stream data), browser information, inferred information based on your interactions with the Service |
Article 2 (Processing of Sensitive Data)
We may collect the following types of sensitive information when you interact with the Service. Note that we do not use such data for any purposes that are not identified within Cal. Civ. Code § 1798.121. We do not "sell" sensitive personal information.
- Your account log-in and password (as defined under California law). We collect this data to provide you with account-related services.
- We may collect any other sensitive information you choose to provide to us through the Services. This may include where you provide sensitive information through your conversations with, or other interactions on, the Service. You should not provide sensitive personal data in conversations using the Service.
Where we have your consent, we may use any sensitive information you choose to provide for the purposes disclosed at the time of collection.
Article 3 (How We Use Personal Data)
In addition to the disclosures above, the Company may also use personal data to:
- Identify you when you visit the Service.
- Complete transactions.
- Improve or create services and products.
- Streamline checkouts.
- Conduct analytics.
- Connect with you (e.g., addressing your requests, inquiries, issues, or feedback).
- Market our products or services.
- Market the products or services of our business partners.
- Find and prevent malicious, deceptive, fraudulent, or illegal activity.
- Find and prevent security incidents.
- Enforce our policies and agreements.
- Debug, find, and fix errors that impair our website and services.
- Comply with legal or regulatory obligations.
- Establish or exercise our rights.
- Defend against legal claims.
- Manage our relationships.
- For other reasons with your consent.
Article 4 (Processing of Pseudonymized Data)
The Company may process pseudonymized data. "Pseudonymized data" means information that cannot identify a specific individual without the use or combination of additional information required to restore personal data to its original state. The Company does not provide pseudonymized data to any third party, nor does it outsource the processing of pseudonymized data to any third party. The Company will not try to reidentify the information, except to test our deidentification methods. If we share pseudonymized data, we will obligate the recipient not to try to reidentify the data.
Article 5 (Retention and Use Period of Personal Data and Destruction)
Retention of Personal Data
The Company retains personal data for only as long as necessary to fulfil the purposes in this Privacy Policy, unless a longer retention period is required or permitted by law. This includes the purposes of satisfying legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, the Company considers the amount, nature, and sensitivity of the personal data. The Company also weighs the potential risk of harm from unauthorized use or disclosure of the personal data, the purposes for which we obtained the personal data and whether the Company can meet those purposes through other means, as well as applicable legal requirements.
Destruction Methods
With respect to personal data recorded and stored in electronic file form, the Company destroys such personal data in a manner that prevents the records from being reproduced. With respect to personal data recorded and stored in paper documents, the Company destroys such personal data using irreversible methods, such as by shredding or incineration.
Article 6 (Sharing of Personal Data)
In addition to the specific situations discussed elsewhere in this Privacy Policy, the Company may share personal data in the following situations:
- Affiliates and Acquisitions. With our affiliates (e.g., parent company, sister companies, subsidiaries, joint ventures, or other companies under common control). If a company acquires, or enters negotiations to acquire, our company, business, or assets, the Company may share personal data with that company.
- Other Disclosures without Your Consent. To cooperate with law enforcement, participate in a legal process, or for legal compliance. The Company may share your personal data to establish or exercise our rights, to defend against legal claims, to investigate, prevent, or act on possible illegal activities, threats to safety of person or property, or a violation of our policies.
- Professional Services. With our professional service providers, such as auditors or lawyers.
- Public. We share your username (nickname) and profile picture with the general public. Depending on how you interact with the Service, we may also share the following information with the public: published characters and stories, and replies and comments posted through community features. The public does not need to be signed into the Services to view certain content.
- Other Disclosures with Your Consent. With other third parties when you consent or direct us to.
- Service Providers. We may share information, including information from those under 18, with service providers. Among other things, service providers may help us to host and operate the Service, process payments, provide AI features, and provide technical support. Our service providers include:
| Service Provider | Outsourced Tasks |
|---|---|
| Stripe, Inc. | Payment processing and management of payment history |
| Amazon Web Services, Inc. | Data storage, content delivery, and operation and management of IT systems |
| Google LLC (Google Cloud / Gemini API) | Provision of generative AI features using user-entered text and images |
| Anthropic, PBC | Provision of generative AI conversation features using user-entered text |
| OpenAI, L.L.C. | Provision of generative AI features using user-entered text |
The Company contractually requires that AI service providers listed above do not use your conversation content, prompts, or outputs to train their models.
Where the Company designates a third-party identity or age verification provider for access to age-restricted content, the information you submit to that provider for verification is processed by that provider in accordance with its own privacy policy, and the Company receives only the verification result or status.
Information Provided to Third Parties
The Company provides personal data to the following third parties (i) as needed to provide the Services, or (ii) where your separate prior consent is obtained.
| Recipient | Purpose of Collection and Use | Items Provided |
|---|---|---|
| Google LLC (Gemini API) | AI text and image generation for the provision of the Service | Entered prompts, conversation context, uploaded images, and generated outputs |
| Anthropic, PBC | AI conversation generation for the provision of the Service | Entered prompts, conversation context, and generated outputs |
| OpenAI, L.L.C. | AI features for the provision of the Service | Entered prompts and generated outputs |
| Stripe, Inc. | Payment processing | Payer name, payment method information, payment amount, and transaction records |
Additional State Disclosures
Some states require us to disclose whether the following categories of personal data are collected, shared with third parties for a "business purpose," or "sold," or transferred for "valuable consideration." The table below indicates the categories of personal data we collect and transfer in a variety of contexts. We do not "sell" your personal data for money. We do not disclose personal data for purposes of behavioral advertising about anyone we know is under the age of 18.
| Category of Personal Data | Category of Recipients (Disclosures for a Business Purpose) | Sharing for Advertising |
|---|---|---|
| Identifiers — this may include things like name, alias, unique personal identifier, online identifier, email address, or account name | Affiliates or subsidiaries. Internet service providers. Operating systems and platforms. Other service providers. Payment processors and financial institutions. Professional services organizations, this may include auditors and law firms | None |
| Financial Information — this may include payment card information and other financial information processed by our payment processor | Affiliates or subsidiaries. Other service providers. Payment processors and financial institutions. Professional services organizations, this may include auditors and law firms | None |
| Characteristics of protected classifications — this may include age. We only collect this to enforce age requirements | Affiliates or subsidiaries. Other service providers. Professional services organizations, this may include auditors and law firms | None |
| Commercial information — this may include information about products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies | Affiliates or subsidiaries. Internet service providers. Operating systems and platforms. Other service providers. Payment processors and financial institutions. Professional services organizations, this may include auditors and law firms | None |
| Internet or other electronic network activity information — this may include browsing history, search history, and information regarding an individual's interaction with an internet website, app, or ad | Affiliates or subsidiaries. Internet service providers. Operating systems and platforms. Other service providers. Professional services organizations, this may include auditors and law firms | None |
| Audio, electronic, visual, or similar information — this may include images you upload and content you generate | Affiliates or subsidiaries. Internet service providers. Operating systems and platforms. Other service providers (including AI service providers). Professional services organizations, this may include auditors and law firms | None |
| Inferences drawn from any of the information listed above | Affiliates or subsidiaries. Other service providers. Professional services organizations, this may include auditors and law firms | None |
Article 7 (Measures to Ensure the Security of Personal Data)
No method of internet transmission or electronic storage is fully secure. While the Company uses reasonable efforts to protect personal data, we cannot guarantee its security. If the Company is required to inform you about a security incident, we will do so electronically, in writing, or by phone, as the law permits.
The Service may allow you to create an account. You are responsible for selecting a unique and complex password and keeping it confidential. You are responsible for any access to or use of your account by someone who has obtained your password, whether or not you approved of such access or use. Notify us of unauthorized use of your password or account immediately.
In addition, the Company implements technical, administrative, and physical measures appropriate to the sensitivity of the personal data processed, including:
- Minimization of Personnel Handling Personal Data — The Company minimizes the number of personnel who handle personal data.
- Encryption of Personal Data — Passwords and other credentials are stored and managed in encrypted or hashed form, and personal data is transmitted over encrypted connections.
- Technical Measures Against Hacking — The Company operates security controls to prevent the leakage and damage of personal data due to hacking or computer viruses, monitors access, and restricts external access to systems that store personal data.
- Access Control Restrictions for Personal Data — The Company controls access to personal data by granting, changing, or revoking access rights to the systems that process personal data, and retains access records.
Article 8 (Rights of Users and Methods of Exercising Such Rights)
Some jurisdictions give you a right to make the following choices.
Users' Rights and Methods of Exercising Such Rights
- Access. You may request access to your personal data or confirmation that the Company has data about you. In certain limited cases, you may ask to receive access to your data in a portable, machine-readable form. You can generally access your personal data through your account settings in the Service. If you need additional assistance with your request, you can contact the Company using the information provided below.
- Membership Withdrawal. You may cancel your membership with us at any time through the account deletion procedure available in your account settings.
- Change. You can generally update your personal data through your account settings in the Service. If you need additional assistance with your request, you can contact the Company using the information provided below. We may keep historical data in our backup files as permitted by law.
- Deletion. You may ask the Company to delete your personal data. If required by law, the Company will grant such a request, but note that in many cases, we must keep your personal data to comply with legal obligations, resolve disputes, enforce agreements, or for other business purposes.
- List of Third-Party Recipients. In some states, you may have the right to obtain a list of specific third parties to which we have disclosed personal information. For a list of the specific third parties to whom we have disclosed personal information, please refer to the "Sharing of Personal Data" section of this Privacy Policy, or contact us using the information below.
- Global Privacy Control. We recognize Global Privacy Control (GPC) signals broadcast from web browsers as a valid opt-out request where required by applicable law. Please note that the GPC will apply only to your current browser. The Company does not recognize the "Do Not Track" signal. If there is a conflict between the GPC signal and a manual choice that you have made on the Service, the Company will honor your manual choice.
- Limit the Use of Sensitive Data. You may request that we limit the use of your sensitive personal data to that which is necessary to provide the imagines Services by contacting us using the information below.
- Promotional Emails. You may provide the Company with your email address to allow us to send newsletters, surveys, offers, or other promotional content. You can stop receiving such emails by following the unsubscribe instructions at the bottom of those emails. If you choose not to receive such emails, we may still send you service-related communications.
- Revocation of Consent. Where the Company processes your personal data based upon consent, you may revoke consent. Note, if you revoke consent for processing personal data, we may no longer be able to provide you some types of services.
- California Shine the Light. If you would like more information on the categories of personal data (if any) the Company shares with third parties or affiliates for those parties to use for direct marketing, submit a written request using the information in the Contact Information section.
Not all the rights above are absolute, and they do not apply in all circumstances. The Company may limit or deny a request because the law permits or requires us to. We will not discriminate against individuals who exercise a privacy right.
Submitting Requests
You may exercise the above rights by contacting us via the contact information below. If you disagree with our denial of a request, you may appeal our decision by contacting us with the subject line "Appeal."
- Department: Privacy Team
- Contact: seojin.kim@brnd.bio
The Company will require you to prove your identity when making most types of requests. We may verify your identity by email. Depending on your request, we will ask for information such as your name, account email address, or the last purchase you made from us. Depending on your request, we may also ask you to send us a signed declaration confirming your identity.
Rights of Legal Representatives and Methods of Exercising Such Rights
Where a user's legal representative, an authorized agent, or any other representative exercises the user's rights, such representative must submit either a written and signed document giving the agent permission to act on the individual's behalf or a power of attorney.
Article 9 (Children)
The Services are not directed to, and are not intended for use by, children under the age of thirteen (13). Individuals under the age of thirteen (13) may not use the Services under any circumstances, including with the consent of a parent or legal guardian. The Company does not knowingly collect personal data from children under the age of thirteen (13). If you have reason to believe that a child under thirteen (13) has provided personal data to the Company through the Services, please contact us at seojin.kim@brnd.bio. Upon receiving such notice, we will investigate the matter and, if appropriate, delete the relevant personal data from our systems in accordance with applicable law.
Article 10 (Privacy Officer)
The Company designates a privacy officer as follows to take overall responsibility for tasks relating to personal data processing, and to handle rights requests and complaints in connection with personal data processing.
- Name: Seojin Kim
- Title: Chief Executive Officer
- Contact: seojin.kim@brnd.bio
You may contact the privacy officer regarding any matters related to personal data protection arising in the course of using the Service, including inquiries and complaint handling.
Article 11 (Amendments to this Privacy Policy)
This Privacy Policy shall apply from the effective date. Where there are any additions, deletions, or corrections to the amendments in accordance with applicable laws and regulations and the Company's policies, the Company will publish a new Privacy Policy and update the Effective Date.
BRND Creative Inc. 131 Continental Dr, Suite 305, Newark, DE 19713, United States Email: seojin.kim@brnd.bio · Website: https://www.brnd.bio/