PRIVACY POLICY

1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include:

• Names, business email addresses, and account authentication credentials (passwords stored as secure salted hashes)
• Organization or company name, business role, and event planning preferences
• Billing details, invoicing addresses, and transaction records
• Event configuration blueprints, visual overlay templates, stage layout choices, and prompt guidelines

Sensitive Information

We do not process sensitive personal information (such as racial or ethnic origin, religious beliefs, genetic or biometric data for identification purposes, or health information) from users of our web application.

Payment Data

We collect data necessary to process your payment if you make purchases, such as your payment instrument number and associated security details. All payment data is handled and stored directly by our payment processor, Stripe. You may find their privacy policy at https://stripe.com/privacy. Requiremints LTD does not retain raw credit card credentials on its servers.

Social Media Login Data

We may provide you with the option to register or sign in with us using your existing third-party account details, such as Google OAuth. If you choose to authenticate in this way, we receive verified basic profile details (your name and verified email address) solely to provision and secure your account.

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but includes device and usage data such as your IP address, browser type, hardware model, operating system, language preferences, referring URLs, country/location, and activity timestamps. This data is required to maintain platform security, prevent unauthorized account access, and troubleshoot system performance.

2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

We process your personal information for various reasons, including:

• To facilitate account creation and authentication: Managing user sessions, authenticating organizational roles, and maintaining multi-user organization accounts.
• To deliver and facilitate delivery of services: Synthesizing requested AI portrait transformations, hosting live stage displays, and dispatching digital keepsake download links.
• To respond to user inquiries and offer support: Troubleshooting event setup issues and addressing support inquiries.
• To send administrative information: Sending platform alerts, billing receipts, security updates, and changes to our legal terms.
• To protect our Services: Monitoring abuse, preventing malicious prompt injection attacks, enforcing rate limits, and securing tenant data isolation.
• To comply with statutory legal obligations: Retaining mandatory financial transaction records and responding to lawful regulatory requests.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?

In Short: We only process your personal information when we have a valid legal reason under applicable law (e.g., GDPR, UK GDPR, and Canadian PIPEDA).

If you are located in the European Union (EU) or United Kingdom (UK), we rely on the following valid legal bases:

• Performance of a Contract: When processing is necessary to fulfill our contractual obligations to you under our Terms of Use.
• Legitimate Interests: When reasonably necessary to achieve legitimate business interests that do not override your fundamental rights (e.g. securing our SaaS platform, diagnosing errors, and preventing fraud).
• Legal Obligations: When necessary for compliance with applicable laws, accounting requirements, and court orders.
• Consent: Where affirmative consent is requested under applicable local laws. You may withdraw consent at any time.

Data Controller vs. Data Processor Role: Under European data protection laws, Requiremints LTD is the Data Controller for personal data of web application users, customers, and website visitors. For event attendee photos and lead capture submitted via the mobile portal (/e/[slug]), our customer (the event organizer) is the Data Controller, and Requiremints LTD processes attendee data strictly as a Data Processor.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We share information in specific situations and strictly with vetted service providers. We never sell personal data.

We share data with third-party vendors and contractors who perform critical operational services for us under strict data processing agreements:

• Cloud Computing & Database Hosting: Supabase and Amazon Web Services (AWS) in European Union data centers.
• Payment Processing: Stripe Inc., for secure credit card billing and invoicing.
• AI Model Inference APIs: Specialized private cloud inference providers (such as fal.ai and Replicate). Images processed through our inference pipelines are not used to train global public foundation models.
• Transactional Communications: Resend / Postmark for delivering attendee high-resolution portrait download links and administrative security alerts.

We may also disclose information in connection with business transfers (such as a merger, sale of corporate assets, or acquisition) or where required by law enforcement or competent judicial authorities.

5. WHAT IS OUR STANCE ON THIRD-PARTY WEBSITES?

In Short: We are not responsible for the safety of any information that you share with third parties linked on our Services.

The Services may link to third-party websites or services. We do not control and cannot be responsible for the content, privacy practices, or security policies of any third parties. We encourage you to review their independent policies directly.

6. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: We may use cookies and other tracking technologies to collect and store your information.

We use strictly necessary session cookies and local storage tokens to preserve user authentication state, secure active admin sessions, and remember your studio preferences. You may configure your web browser to reject or delete cookies, though this may prevent you from logging into your account.

7. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short: If you choose to register or log in using a third-party account, we may receive basic profile information.

When you register or log in using third-party social or identity providers (such as Google OAuth), we receive your basic profile information (name and email address). We use this information only for authentication, user management, and service communications.

8. IS YOUR INFORMATION TRANSFERRED INTERNATIONALLY?

In Short: We may transfer, store, and process your information in countries other than your own.

Our primary databases and servers are located in European Union (EU) data centers. If you access the Services from outside the EU, please note that your information may be processed across borders. For any cross-border transfers involving the EEA or UK, Requiremints LTD implements the European Commission’s Standard Contractual Clauses (SCCs) and relevant international safeguards to guarantee that your personal data receives equivalent protection.

9. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this notice unless otherwise required by law.

• Organizer Account Records: Retained for the duration of your active subscription and account. Upon account deletion, account credentials are deleted or anonymized within 90 days, except for statutory financial and tax records retained up to 7 years.
• Event Attendee Photographs & AI Syntheses: Maintained temporarily during the live event. Attendee photos are scheduled for automatic purge 30 days following the conclusion of an event, unless an alternate retention timeline is configured by the event organizer.

10. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We aim to protect your personal information through a system of organizational and technical security measures.

We have implemented reasonable technical and organizational safeguards including TLS 1.3 encryption in transit, AES-256 encryption at rest, multi-tenant database Row-Level Security (RLS), and principle of least privilege. However, no electronic transmission over the internet or storage system can be guaranteed to be 100% impenetrable; transmission of personal data is at your own risk.

11. DO WE COLLECT INFORMATION FROM MINORS?

In Short: We do not knowingly collect data from or market to children under 18 years of age.

By registering for an account, you represent that you are at least 18 years old. If an event organizer deploys an interactive photo station at an event where minors may participate, the event organizer is solely responsible for obtaining prior verifiable parental or guardian consent in accordance with applicable laws before capturing any image.

12. WHAT ARE YOUR PRIVACY RIGHTS?

In Short: In some regions (EEA, UK, Switzerland, Canada), you have rights that allow you greater access to and control over your personal information.

You may have the right to request access to and receive a copy of your personal data, request correction or erasure, restrict processing, or request data portability. To exercise these rights, please email us at ask-us@requiremints.com or use our Contact Form. We will act upon your request in accordance with applicable data protection laws.

13. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers include a Do-Not-Track (“DNT”) setting. Because no uniform technology standard for recognizing DNT signals has been established, our Services do not currently respond to automated DNT browser signals.

14. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

In Short: Yes, if you are a resident of California, you are granted specific rights regarding access to your personal information under the CCPA/CPRA.

We have collected the following categories of personal information in the preceding twelve (12) months:

Requiremints LTD has not sold or shared personal information to third parties in the preceding twelve (12) months. California residents may exercise their rights to know, delete, or correct personal information without discrimination by emailing ask-us@requiremints.com.

15. DO VIRGINIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

Under the Virginia Consumer Data Protection Act (CDPA), Virginia residents have the right to know whether we process their personal data, access such data, correct inaccuracies, request deletion, and obtain a copy in a portable format. Upon receiving a verified request, we will respond within forty-five (45) days. Appeals may be submitted to ask-us@requiremints.com.

16. DO WE MAKE UPDATES TO THIS POLICY?

In Short: Yes, we will update this policy as necessary to stay compliant with relevant laws.

We may update this privacy policy periodically. The updated version will be indicated by the "Last updated" date at the top of this document and will take effect as soon as published.

17. HOW CAN YOU CONTACT US ABOUT THIS POLICY?

If you have questions or comments about this policy, you may contact our Privacy & Data Protection Team:

18. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, change that information, or delete it. To request to review, update, or delete your personal information, please submit your request to ask-us@requiremints.com or visit our Contact Form.