Privacy policy
Please read this Privacy Policy carefully to understand our policies and practices regarding your information and how we will treat it.
WHO ARE WE?
Viral Vision LTD ("Viral Vision", "Controller", "we") is a technology-driven company offering the service for creating the ad and social creatives.
You may find our contacts below (Section 17).
If you have a question concerning the processing of your Personal data or other data, you may contact us any time via
[email protected]The purpose of this privacy policy ("Privacy Policy") is to inform you of the steps we take regarding the collection, processing, and use of the Personal data and other data you provide to us when (i) using the website https://cremo.ai ("Website"), (ii) installing and using our mobile applications that can be downloaded from the App Store or Google Play ("Mobile apps"); and (iii) using our Free Services and Services.
We have tried to do our best to make this Privacy Policy easy for you to understand and to enable you to navigate easily through its contents.
GENERAL PROVISIONS & SERVICE
This Privacy Policy is applicable to the processing of Personal data of the data subjects located in the European Union ("EU") and the European Economic Area ("EEA") by Controller in respect of the following: Website, Mobile apps and constant improvements and all other future services to be delivered by Controller to its Users inside the EU and the EEA.
From time to time, we may develop new or offer additional services. They'll also be subject to this Privacy Policy unless stated otherwise when we introduce them.
This Privacy Policy is not the Terms available at https://instories.com/terms-and-conditions, which is a separate document. The Terms outline the legal contract between you and Controller for using the Services.
This Privacy Policy is also applicable to the processing of Personal data of US residents. We have included further information about rights and disclosures as required under the California Consumer Privacy Act ("CCPA").
DEFINITIONS AND INTERPRETATION
The following definitions apply to this Privacy Policy: Data subject, User, "you" or "your" means:
visitors to our Website;
Users to Free Services or Services we offer through our Website or Mobile apps;
Representatives mean, in relation to a party, its employees, officers, contractors, subcontractors, representatives, and, advisers;
Controller means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal data; where the purposes and means of such processing are determined by EU or Member State law, the controller or the specific criteria for its nomination may be provided for by EU or Member State law;
Processor means a natural or legal person, public authority, agency, or other body which processes Personal data on behalf of the controller;
Personal data means any information relating to an identified or identifiable person (data subject) from which that person can be directly or indirectly identified such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological etс. It does not include data where the identity has been removed (anonymous data);
Member States mean all European Union member states, plus Iceland, Lichtenstein, Norway — which are part of the European Economic Area;
The above definition and other terms under this Privacy Policy include, where applicable, the definitions included in the General Data Protection Regulation (EU 2016/679) ("GDPR").
The following rules of interpretation will apply unless otherwise stipulated by Privacy Policy:
unless the context otherwise requires, words in the singular shall include the plural and, in the plural, shall include the singular;
unless the context otherwise requires, a reference to one gender shall include a reference to the other gender.
PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA
When processing Personal data, we comply with the following principles:
Personal data are processed lawfully, fairly, and transparently in relation to the Data subject ("lawfulness, fairness and transparency");
Personal data are collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes, or for statistical purposes shall not be considered incompatible with the original purposes ("purpose limitation");
Personal data are adequate, relevant, and limited to what is necessary for relation to the purposes for which they are processed ("data minimisation");
For our part, we make sure that Personal data is accurate and, where necessary, they are kept up to date; we take all reasonable steps to ensure that any Personal data that are inaccurate, having regard to the purposes for which they are processed, erased or rectified without delay ("accuracy");
Personal data are kept in a form that permits identification of Data subjects for no longer than is necessary for the purposes for which the Personal data are processed; Personal data may be stored for longer periods insofar as the Personal data will be processed solely for archiving purposes in the
public interest, scientific or historical research purposes or statistical purposes, taking into account the implementation of appropriate technical and organisational measures required by the GDPR to safeguard the rights and freedoms of the Data subject ("storage limitation");
Personal data are processed in a manner that ensures appropriate security of Personal data, including protection against unauthorised, or unlawful processing and accidental loss, destruction, or damage, using appropriate technical or organisational measures ("integrity and confidentiality").
We take all necessary measures to comply with the above principles.
INFORMATION WE COLLECT AND HOW WE COLLECT IT
We may collect several types of information, including but not limited to Personal data, from and about you:
Data received from Users : when you engage with us, you may provide us with (1) certain Personal data like email address, the email address of the potential Users (invited persons), place of work (company name); (2) your User Content. Such data may be provided to us directly by you or by your representatives.
Technical data automatically collected or generated : when you visit or interact with our Website, Mobile Apps and Free Services or Services, we may collect, record, or generate certain technical data about you including the following:
Online identifiers. Online identifiers are unique identifiers, including IDFA or AAID, IP address, device ID, etc. When you use the Mobile Apps, we, or our third-party partners, identify you through online identifiers (hereinafter – "Online identifiers").
cookies (for more details, see here https://instories.com/cookie-policy);
Device data. Data about the devices you use to access Website or Mobile apps like manufacturer, model, operator etc., and data about your device usage and activity;
Metadata of images or videos. We may collect the metadata linked to your User Content. For example, your images may be accompanied by additional content like comments or a geotag;
Location data. We receive information from you, the relevant User and other third-parties that helps us approximate your location. We may, for example, use an IP address received from your browser or device to determine approximate location. Viral Vision may also collect location information from devices in accordance with the consent provided by your device.
Information from App store and Google play : If you create an account to use our services through Apple, Google with your permission, we collect information from those accounts ( your email, Apple ID, User ID, Device ID and other public profile information depending on the privacy settings you chose) to authenticate you within our Free Services and Services.
WHAT PERSONAL DATA, FOR WHAT PURPOSES, HOW LONG, AND BASED ON WHAT GROUNDS DO WE PROCESS AS A CONTROLLER?
Viral Vision determines the purposes and means of the processing of Personal data in respect of the Services inside the EEA and the EU and therefore acts as a Сontroller in the sense of the GDPR.
Purpose of Processing
Data Subjects: Categories of data
Storage Period
Legal Basis
to offer access to the Mobile apps, Website and provide Free Services and Services
our Users and/or Usersʼ Representatives: email addresses / Information from App store and Google play
until the termination of a contract (Terms)
processing is necessary for the performance of a contract (Terms) to which you are the party
to offer access to the Website and provide Free Services and Service
our Users and/or Usersʼ Representatives: email addresses
until the termination of a contract (Terms)
processing is necessary for the performance of a contract (Terms) to which you are the party
to fulfill our obligations to you under the contract with our Users
Users and/or Usersʼ Representatives: email addresses / Information from App store and Google play, cookies, company name (in case of using invoice)
until the termination of a contract
processing is necessary for the performance of a contract (Terms of Service) to which you are the party
to send emails or important Services- related notices, and other marketing communications about our Free Services and Services
Users and/or Usersʼ Representatives: email addresses / Information from App store and Google play
subscribers to our newsletter: email addresses / Information from App store and Google play
until you withdraw your consent or until the end of the campaign whichever happened earlier
your consent to receive our newsletter. You may withdraw your consent at any time by clicking the “unsubscribe” link in the email communications we send to you
As for important Services- related notices, We consider these communications as part of our Services or Free Services to you
to monitor, study and analyze the use of our Free Services and Services with the aim to provide a more convenient experience to you, to analyze which pages you visit
Users and/or Usersʼ Representatives: Online identifiers*, cookies
When associated with an Online Identifier it will be treated as Personal Data, otherwise, if the usage data is aggregated, anonymized or de- identified, it will not be considered as Personal Data.
5 years or until you withdraw your consent whichever happened earlier
When the processing is for tracking, the lawful basis would be your consent to store cookies in your browser and Online identifiers. You may withdraw your consent at any time.
When the processing of Personal Data is for operations and providing the Mobile app or Website functionalities, the lawful basis would the necessity for the performance of a contract (Terms) to which you are the Party
to measure advertising and promotional effectiveness
Users and/or Usersʼ Representatives: Online identifiers*, cookies
When associated with an Online Identifier it will be treated as Personal Data, otherwise, if the usage data is aggregated, anonymized or de- identified, it will not be considered as Personal Data.
5 years or until you withdraw your consent whichever happened earlier
your consent to store cookies in your browser and Online identifiers. You may withdraw your consent at any time.
If you reside or are using the Free Services and Services in a territory governed by privacy laws under which “consent” is the only or most appropriate legal basis for the processing of personal data or other
data as described herein (in general, or specifically with respect to the types of personal data you expect or elect to process or have processed by us or via the Services, or due to nature of such processing), your acceptance of our Terms of Service and this Privacy Policy will be deemed as your consent to the processing of your personal data and other data for all purposes detailed in this Privacy Policy, unless applicable law requires a different form of consent. If you wish to revoke such consent, please contact us at
[email protected]WHO DO WE SHARE YOUR DATA WITH?
Acting as a Controller we share your data with the following Processors:
Purpose of processing
Processors, their location and the link to the Privacy policy / Website if applicable
Safeguards for restricted transfers (outside the EEA and ‘adequateʼ jurisdictions)
to fulfill our obligations to you under the Terms with our Users
Amazon Web Services, Inc. (the USA), Privacy Policy and AWS Service Terms (and applicable Addendum)
We transfer your data according to the AWS Service Terms AWS Service Terms (and applicable Addendum) between us and Amazon Web Service
to better understand your preferences, to help you navigate our Website and/or Mobile apps, to personalize and provide a more convenient experience to you, to analyze which pages you visit, and to measure advertising and promotional effectiveness, cloud hosting
Google LLC (Google Analytics) (the USA), Privacy Policy
We transfer your data according to the Model Contract Clauses between us and Google
AppsFlyer UK Ltd (UK), Privacy Policy
We transfer your data according to the Data Processing Addendum between us and AppsFlyer
Amplitude, Inc. (USA), Privacy Policy
We transfer your data according to the Data Processing Addendum between us and Amplitude
to deliver targeted advertisements to individuals who visit our Website
Facebook Inc. (Facebook Custom Audiences) (the USA), Privacy Policy
SECURITY OF DATA
We are ensuring the confidentiality of the processed Personal data and other data on behalf of our Users, under the procedure provided by applicable legislation. Protection of Personal data and other data is supported by the implementation of legal, organisational, and technical measures necessary and sufficient to ensure that the requirements of the applicable data protection legislation are met. However, be aware that no system is ever completely secure from unauthorized access to information, its disclosure, alteration or destruction.
AUTOMATED DECISIONS
We do not make any automated decisions about you or with your Personal Data that would result in legal or other similarly significant effects on you.
REQUEST FOR ADDITIONAL INFORMATION TO IDENTIFY THE DATA SUBJECT
During the processing of your data, we may ask you to provide us with additional information to enable us to identify you.
On our part, we endeavour to obtain a minimum of additional information in order to be able to carry out such identification. If you do not provide us with said additional information upon our request, we will not be able to exercise your rights.
YOUR RIGHTS AS A USER
You have the following rights under the GDPR with respect to Personal data:
the right to access to information held about you; the right to rectification of the processed data; the right of erasure ('the right to be forgotten'); the right to restriction of processing; the right to data portability; the right to object and automated individual decision-making; the right to withdraw consent;
the right to lodge a complaint.
To exercise these rights, please contact us via email
[email protected] Viral Vision should respond without delay and within one month of receipt of the request.
Viral Vision may extend the time limit by a further two months if the request is complex or if Viral Vision receives a number of requests from the individual.
THE RIGHT OF ACCESS TO INFORMATION HELD ABOUT YOU
The Data subject has the right to obtain from the Controller confirmation as to whether or not Personal data concerning him or her are being processed and, if so, access to the data, as well as other information, namely:
information about the purposes for which the Personal data are processed;
information on the categories of Personal data concerned;
information on the recipients or categories of recipients to whom the Personal data have been or will be disclosed, including recipients in third countries (outside EU and EEA) or international organisations;
information on the envisaged period for which the Personal data will be stored, or, if not possible, the criteria used to determine that period;
information on the existence of the right of rectification or the right to erasure or the right to object to processing of Personal data concerning the data subject or to object to such processing;
if the data are not collected from you, any available information on the source of the data; information on the right to lodge a complaint with a supervisory authority;
information on the guarantees of data transfer to third countries (outside the EU and EEA) or to international organisations, where such transfer will take place;
information about the availability of automated decision-making, including profiling, and, where available, information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.
THE RIGHT TO RECTIFICATION OF PROCESSED DATA
We take all measures to detect any inaccurate, incomplete, or outdated Personal data.
You have the right to rectify your Personal data without undue delay if it is inaccurate, incomplete, or out of date.
Once we have rectified your Personal data, we will promptly provide you with an appropriate notification.
THE RIGHT OF ERASURE
You have the right to request the erasure of your Personal data, and this will be done without undue delay.
If we cannot erase your Personal data, we will anonymise it in a way that you are not identified. Once your Personal data has been erased or anonymised, you will be notified.
We cannot exercise the right to the erasure of your Personal data in particular if your Personal data is processed:
in order to exercise the right to freedom of expression and information;
in order to comply with a legal obligation that requires the processing of data in accordance with the provisions of Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest, or in the exercise of official authority vested in the controller;
for reasons of public interest in the area of public health;
for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes;
for the establishment, exercise, or defence of legal claims.
THE RIGHT TO RESTRICTION OF PROCESSING
Where the processing is restricted, we will store your Personal data, but we will not process it further until the restrictions are removed. Restrictions on processing can be removed at any time upon request.
The right to restrict data processing can only be exercised in the following cases:
the accuracy of the Personal data will be contested by you for a period of time that allows us to verify the accuracy of the Personal data;
the processing of your Personal data is unlawful and you oppose the erasure of the Personal data and request the restriction of their use instead;
where we no longer need the Personal data for the purposes of the processing, but they are required by you for the establishment, exercise, or defense of legal claims;
you object to the processing pending verification of whether the legitimate grounds indicated by the controller override the grounds indicated by you.
Exceptions to this right. Once we have restricted the processing of your Personal data, we may continue processing in the following cases:
with the data subject's consent, in order to establish, exercise or defend against legal claims; in order to protect the rights of another natural or legal person; for reasons of important public interest of the Union or a Member State.
THE RIGHT TO DATA PORTABILITY
You have the right to receive the Personal data that you have provided to us in a structured, commonly used, and machine-readable format and the right to transmit this data to another controller, as far as this is technically possible.
You can exercise the aforementioned right if the data are subject to processing on the basis of your consent or a contract signed with you and the data are processed electronically.
THE RIGHT TO OBJECT
You have the right, at any time, to object to the processing of Personal data based on your particular situation:
in relation to the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
in relation to the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by interests or fundamental rights and freedoms of the data subject, which require protection of personal data, in particular where the data subject is a child.
We will no longer process your Personal data unless we identify compelling legitimate grounds for the processing.
You have the right at any time to object to the processing of your Personal data for direct marketing purposes.
THE AUTOMATED INDIVIDUAL DECISION-MAKING INCLUDING PROFILING
You have the right not to be subject to decisions based solely on automated processing, including profiling, which produces legal effects on you or has a similar significant impact on you.
Exceptions to this right:
it is necessary for the entering into or performance of a contract between the Data subject and the Controller;
it arises from a provision of EU or Member State law to which the Controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests;
it is based on the explicit consent given by the Data subject.
THE RIGHT TO WITHDRAW CONSENT
If you have consented to the processing of your Personal data or other data, you have the right to withdraw such consent at any time.
We process your Personal data on the basis of consent for processing, mailing, push notifications, and cookie processing.
We process other data on the basis of consent for the performance of a contract (Terms of Service) to which you are the party (for further details, see Sections 5 and 6).
We provide you with the possibility to withdraw your consent in a simple way, i.e:
You can withdraw your consent to receive emails by clicking on the "unsubscribe" link that is available in every email communication;
You have the option to manage your marketing preferences for push notifications using your browser or phone settings, or by contacting us;
You can withdraw your consent to the processing of cookies through any of our websites using the cookie control tool.
You can withdraw your consent to process other data by contacting us (see Section 17).
THE RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY
You have the right to lodge a complaint with the supervisory authority of your own country if you have concerns about the manner in, which we process your Personal data and about the protection and exercise of your rights.
You can find the contact details of your country's supervisory authority on the website of the European Data Protection Board here: https://edpb.europa.eu/about-edpb/board/members_en
CONDITIONS UNDER WHICH WE PROVIDE YOU WITH INFORMATION RELATED TO YOUR RIGHTS
Information related to your rights is provided free of charge. Where the data subject's requests are manifestly unfounded or excessive, in particular, because of their repetitive character, we may charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the requested action, or refusing to act on the request.
CONDITIONS UNDER WHICH WE PROVIDE YOU WITH INFORMATION RELATED TO YOUR RIGHTS
We will not store or collect your payment card details or any other relevant valid, up-to-date, and complete contact and billing details. We use the third-party service Stripe for payment processing (e.g. payment processors).
The payment card details or any other relevant valid, up-to-date, and complete contact and billing details are provided directly to our third-party payment processor Stripe whose use of your personal information is governed by Stripe's privacy policy.
We may ask you to provide information to facilitate this transaction and verify your identity.
DO NOT TRACK
"Do Not Track" is a privacy preference that you can set in certain web browsers. We do not change our practices in response to a "Do Not Track" signal in the HTTP header from a browser or mobile application, you can manage your cookies preferences, including whether or not to accept them and how to remove them, through your browser settings. Please bear in mind that disabling cookies may complicate or even prevent you from using the Free Services or Services.
CHANGES TO THIS PRIVACY POLICY
We may occasionally make changes to this Privacy Policy.
When we make material changes to this Privacy Policy, we'll provide you with prominent notice as appropriate under the circumstances. For example, we may display a prominent notice within the Free Service or Service or send you an email, and we will update the "Last updated date" above to indicate when those changes were made.
HOW TO CONTACT US
If you have any questions about this Policy, complaints, or claims, please contact us via e-mail: Address: Spyrou Araouzou 165, Office 401, 4th floor, Lordos Waterfront Court, Limassol 3036, Cyprus. e-mail:
[email protected]ADDENDUM CALIFORNIA PRIVACY DISCLOSURES
This Addendum reflects the partiesʼ agreement on the processing of User Personal Data in connection with the California Consumer Privacy Act of 2018 (“CCPA”).
Viral Vision and the User have entered into the Addendum Privacy Policy which supplements the Privacy Policy (the “Addendum”).
Beginning 1 January 2020, the California Consumer Privacy Act ("CCPA") gives California residents certain rights with respect to the processing of Personal Data (known as "personal information" under the CCPA). We provide this statement to USA residents ("you") in accordance with requirements under the CCPA to make certain disclosures about the collection and processing of their personal information.
For information about how weʼve extended the CCPA core rights to control personal information to all of our users in the United States, please see our provisions of the Privacy Policy.
This supplement provides additional privacy disclosures and details additional rights and should be read in conjunction with our Privacy Policy.
PERSONAL INFORMATION
Section 6 of our Privacy Policy sets forth the categories of personal information (categories of data) that Viral Vision collects and processes about you, the purpose of the processing of each category, and the storage period.
REQUESTS TO EXERCISE YOUR RIGHTS
RIGHT TO KNOW REQUEST
Under the CCPA, you have a right to request information about our collection, use, and disclosure of your personal information over the prior 12 months, and ask that we provide you with the following information:
Categories of and specific pieces of personal information we have collected about you; Categories of sources from which we collect personal information; Purposes for collecting personal information; Categories of third parties with whom we share personal information (please see Section 7); Categories of personal information disclosed about you for a business purpose;
If applicable, categories of personal information sold about you and the categories of third parties to which the personal information was sold, by category or categories of personal information for each third party to which the personal information was sold.
To make a verifiable request for information about the personal information we have collected about you, please email us at
[email protected]RIGHT TO DELETE REQUEST
You also have a right to request that we delete personal information, subject to certain exceptions. You may exercise your right to delete via email
[email protected]HOUSEHOLD REQUESTS
Viral Vision currently does not collect household data.
SALE OF PERSONAL INFORMATION
Viral Vision does not sell personal information. We have taken substantial steps to identify and remediate any data sharing arrangements that could constitute a "sale" under the CCPA.
