Privacy Policy

Update on the date of [June 30 , 2025]

This Privacy Policy describes the personal information we collect, use, and disclose about you and how we handle it when you use our website and other online products and services (collectively, the “Services”), interact with us in other ways, or use our desktop, mobile, or cloud software—including Evoto Instant (collectively, the “Software”).

Evoto Instant is a cloud-based application that enables photographers to share photos with others via the internet so that these photos can be remotely accessed and reviewed.

EVOTO is another AI image processing software service product owned by us (Truesight Pte. Ltd. ). The AI Culling and AI Editing feature used in Evoto Instant is provided by EVOTO . When you use those features, you must agree to EVOTO’s Terms of Use. If you do not agree, please stop using those features immediately.

1. Definitions:

In this Privacy Policy, when we refer to “Customers” we mean users of the Truesight Pte. Ltd. (“Truesight”) website, software, and services. For example, “Customers” may include professional photographers who use Truesight’s software products to upload, process, and sell their photographic works to their own end users (“End Users”).

“End Users” are the users, visitors, or purchasers who interact with our Customers’ activities. For example, “End Users” may be individuals photographed by a Customer or its representative, whose contact information is collected, or individuals who browse or make purchases through a retail or information website facilitated by Evoto Instant.

“Evoto Instant Services” refers to the full suite of features and services provided by Evoto Instant and Truesight, Inc. (and our third-party service providers), including but not limited to: event creation, use of tablets and applications, online registration, online retail, facial recognition services, image hosting, and account management.

2. Scope

This Privacy Policy explains how we collect and use personal information for our own purposes (i.e., when we act as a data controller), such as your account information and information about how you use and interact with the Evoto Instant Services, including information you submit to our customer support team, as well as specific information about your End Users.

We use cookies and similar technologies and also host and process “Customer Content” on behalf of our Customers.

If you are an End User of an event hosted by one of our Customers and wish to understand how that Customer processes your personal information, you should contact the Customer directly (where applicable). To learn more about how we handle your information on behalf of our Customers, please continue reading below.

3. Personal Information We Collect

If you are an End User of a Truesight Customer who uses the Evoto Instant Services, Truesight collects and processes your personal information on behalf of that Customer. In this case, Truesight acts as a data processor and processes End Users’ personal information in accordance with the Customer’s instructions.

The Customer is primarily responsible for ensuring the legality of the personal data provided by End Users. Therefore, if you are an End User with concerns or questions about data processing, you should contact the Customer directly or refer to the Customer’s separately provided privacy policy.

As this Privacy Policy is primarily directed at Truesight Customers (not End Users), unless otherwise stated, references to “you” or “your” in this policy refer to Truesight Customers.

The following are types of personal information Truesight typically collects through the Services on behalf of its Customers:

• Information provided to create an Evoto Instant account (e.g., email address, first and last name). If receiving payouts from Evoto Instant, banking details are also required at account setup.
• Emails and other communications you send to us (e.g., customer support inquiries).
• Information shared when you participate in surveys, contests, or promotions.
• Information generated when you use Evoto Instant Services or participate in a Customer’s event, including IP address, preferences, web pages visited before accessing a retail site, browser information, network and device data (e.g., browser version, operating system, ISP, device ID, language and regional settings), and interaction data with the Services (e.g., timestamps, clicks, scrolling, session length, searches, transaction history, load times, and error logs).
• Other information you submit directly to us.

4. How We Collect Personal Information

We collect personal information from multiple sources, primarily through the following means:

• Directly from you (the Customer), for example when creating an Evoto Instant account.
• Automatically through your use of the Evoto Instant Services or participation in an event.
• From third parties (e.g., through app stores or connected platforms).

More details below:

• Information You Provide
• When Customers use Evoto Instant Services, we collect information in several ways. For example, we request names and email addresses to register and manage accounts. We also retain marketing preferences and communication records (e.g., support requests). Customers may also provide information by participating in surveys, attending Customer events as End Users, completing forms, or taking part in promotions.
• We may require certain information due to contractual or legal obligations. If such information is not provided, we may be unable to offer the relevant service.
• Information Collected Through Use of Evoto Instant Services
• When you use Evoto Instant Services, we collect records of your activity and interactions on the platform, such as IP address, device and browser type, referring websites, pages visited and time spent, device identifiers, etc. If permitted, we may collect your location data through the app.
• If you are an End User in a Customer’s event, we may collect data about your interaction with the event. However, such data is used only in anonymized, aggregated, or pseudonymized form and is not linked to you personally. This data helps evaluate, improve, and develop the Services.
• Some of this information is collected automatically through cookies or similar technologies and may come from your browser or device.
• Information from Other Sources
• If you use third-party services to access Evoto Instant Services, the third party may provide us with information such as your name and email address (we do not collect or store passwords used for logging into third-party services). You can control what is shared via the privacy settings of the third-party service. We recommend reviewing their privacy policies and adjusting your settings as needed.

5. How We Use Personal Information

We use the personal information we collect from you for the following purposes:

• Providing Evoto Instant Services: To create and manage your Evoto Instant account, process payments, and respond to your inquiries. This may also include enabling third-party services. Please note that how third-party services collect, store, and disclose your information is governed entirely by their own policies. Evoto Instant is not responsible for the privacy practices or any other actions of such third-party services enabled through our platform.
• Communicating with You: To communicate with you, including sending emails about your transactions and announcements related to Evoto Instant services.
• Surveys and Events: To manage surveys, sweepstakes, and other promotional campaigns.
• Marketing: To promote Evoto Instant services and send you personalized marketing messages and information about products, services, offers, and events based on your photography market segment or other information we hold about you, and to measure the effectiveness of these promotional efforts.
• Improving Evoto Instant Services: To analyze and understand how Evoto Instant services are used, to assess and improve our services (including developing new products and features and managing our communications), and to monitor and evaluate the effectiveness of advertisements. This is generally done using anonymized, pseudonymized, or aggregated data and not targeted at individuals.
• Security: To ensure the security and integrity of the Evoto Instant services.
• Policy Enforcement: To enforce our Privacy Policy and other applicable legal terms and policies.
• Protecting Rights: To protect our rights, property, and the rights, property, and safety of others (e.g., to prevent misuse of Evoto Instant or harm to our customers and end users).
• Legal Compliance: To comply with applicable legal requirements, such as tax or regulatory obligations, industry standards, contractual obligations, or requests from law enforcement or other governmental authorities.

We process your personal information under the following conditions:

• With Your Consent: When you have given your consent for us to use your personal information in a specific way.
• Contract Performance: When we need to use your personal information to provide the products and services you have requested or to respond to your inquiries. In other words, we process your information to fulfill our contract with you or to take steps at your request before entering into a contract (e.g., we need your email address to allow you to log in to your Evoto Instant account).
• Legal Obligations: When we are legally required to use your information, for example for tax or regulatory reasons or by court order.
• Legitimate Interests: When we have a legitimate interest in using your information, particularly in the following situations:
• To operate the Evoto Instant business and send personalized messages to grow and promote our business;
• To analyze and improve the security of our services;
• To provide and enhance personalized services;
• To comply with court orders or law enforcement requests;
• To use anonymized information;
• To protect your vital interests or those of others;
• For the legitimate interests of third parties (such as our Customers), for example, to ensure events run safely and effectively and to analyze usage to improve services.

In accordance with data protection laws, including the General Data Protection Regulation (GDPR), the use of our Software and certain services may require us to transfer your personal information and data across borders to countries or regions where we or our partners operate. This may include, but is not limited to, Oregon, United States. The data protection and government access laws in these jurisdictions may differ from those in your own. We will transfer your personal data in compliance with applicable laws and will take appropriate measures to ensure your personal information remains adequately protected.

6. How We Share Personal Information

We do not sell your personal information to third parties, but we may share it in the following ways:

• In response to information requests from authorities or other third parties if we believe that disclosure is required by applicable laws;
• With your consent or at your direction;
• Among Evoto Instant and our current and future parent companies, subsidiaries, and other affiliates under common control and ownership;
• In the course of providing services by third-party service providers who require access to your personal information to perform those services for us. For more details about third-party processors, please refer to Section 16: “Third-Party Services.”

We may also share aggregated or otherwise anonymized information that cannot reasonably be used to identify you.

Our services may offer social sharing features and other integrated tools that allow you to share your activities on our services with other media, and vice versa. The use of such features enables the sharing of information with your friends or the public, depending on the settings you establish with the entity that provides the social sharing feature. For more information about the purpose and scope of data collection and processing in connection with social sharing features, please refer to the privacy policies of the entities that provide these features.

7. Your Rights and Choices

Under applicable laws and subject to certain exceptions, you may have the right to access, update, modify, or delete your personal information.

You can update, modify, or delete your (or your end users’) personal information directly through your account or by emailing us at contactus@evoto.ai You may also use this email to exercise other rights, including requesting account deletion. We may need to verify your identity. If you are unable to log in to your account, you may be asked to provide additional information (such as a government-issued ID). Even if you are able to log in, we may still request supplemental information to ensure identity verification. If verification is unsuccessful, we may be legally unable to fulfill your request.

Please note that, due to technical reasons, the deletion of your data may be delayed. We may also retain certain information to comply with legal obligations, protect our rights, resolve disputes, or enforce our terms, as permitted by applicable laws.

You also have the right to restrict or object to our processing of your information or to exercise your data portability rights, as permitted by law. In addition, you have the right to lodge a complaint with a regulatory authority (if applicable).

When you register for an account, subscribe, place an order, sign up for offers or emails, or otherwise contact us, you may opt out of marketing communications at any time by clicking the “unsubscribe” link in our emails or by writing to contactus@evoto.ai.

8. How We Protect Personal Information

While no service can be completely secure, we have a dedicated team focused on protecting your information. We maintain administrative, technical, and physical safeguards designed to prevent accidental or unlawful destruction, loss, alteration, disclosure, access, misuse, or other unlawful processing of data.

Our security measures include firewalls, intrusion prevention, system redundancy (e.g., backup servers in case of server failure), and regular vulnerability scanning and network protection.

9. How We Retain Personal Information

We retain personal information associated with you or your use of Evoto Instant services for as long as your account remains active or for as long as necessary to provide the services. We may also retain information as needed to fulfill the purposes described in this Privacy Policy (e.g., compliance with legal obligations, dispute resolution, enforcement of contracts, or protection of rights).

Retention periods vary based on the type and use of the information. We consider factors such as legal minimum retention periods, limitation periods for complaints, whether the information is pseudonymized or aggregated, and other relevant considerations. For example, how long we keep your email address may depend on whether your account is still active, while customer support messages are retained based on the most recent communication date.

Because many customers have seasonal needs or may return after deactivating their accounts, we do not delete data immediately upon account inactivity. Instead, we retain it for a reasonable period in case of future use.

You may request account deletion by emailing contactus@evoto.ai. Evoto Instant will delete the personal information it holds about you unless retention is required under this policy.

Additionally, to provide Evoto Instant services, we collect and retain anonymized and de-identified data, which may be stored indefinitely.

10. End Users’ Personal Information

Customers who use Evoto Instant to create events are fully responsible for the personal information of end users collected directly or via Evoto Instant. Sections 10 through 13 below apply specifically to such end users.

If you are our customer, you may collect personal information about your end users. For example, when using the self-check-in feature, you may request end users to provide their name, email address, and phone number to deliver their photo gallery.

Customers are solely responsible for complying with all applicable laws and regulations regarding the collection and use of end user information, including personal data collected through Evoto Instant or its services.

Customers must publish and adhere to their own privacy policies. We are not responsible for the relationship between customers and their end users or how customers collect and use end user data, even if such data is obtained through Evoto Instant tools, services, or features. We also do not provide legal advice regarding these practices.

We are not responsible for the use of end user or other personal contact information obtained by customers outside of our provided data collection systems. If a customer imports contact information that was independently acquired or purchased into our system, it is the customer’s sole responsibility to ensure they have the legal right to market to those individuals.

We do not retain any biometric data related to photos uploaded by customers or end users to Evoto Instant.

SMS Data: Evoto Instant does not share, sell, or distribute end users’ SMS data to third parties. Your data is only used for communication related to our services. If you have any questions regarding our data or policies, please contact us.

11. Access, Objection, Correction, and Deletion Rights

In certain jurisdictions, end users have the right to confirm whether their personal data is being processed, to understand the purposes of processing, and to know the recipients of their data. End users may also have the right to request a copy of the data they provided and/or request its deletion.

Truesight’s customers are responsible for responding to access or correction requests made by end users regarding personal data submitted to Truesight on their behalf. However, if you are an end user and have questions about your rights, feel free to contact us at contactus@evoto.ai.

12. End User Privacy Rights in California and Other States

Important: As noted, the personal information collected by Truesight is primarily for the purpose of providing Evoto Instant services as a service provider under contract with our customers. If you are an end user providing information to one of our customers, please contact that customer directly for questions regarding your consumer privacy rights in California or other states.

If you are a resident of California, Colorado, Connecticut, or Virginia, you have the following privacy rights:

• Right to Know: You have the right to know what personal information we have collected, used, disclosed, or sold. You can submit a request to support or authorize an agent to do so.
• Right to Correct: You have the right to request correction of personal data we have collected, used, disclosed, or sold. You may also authorize an agent to make the request on your behalf.
• Right to Delete: You have the right to request deletion of personal data we have collected. This request can also be made through an authorized agent.

When submitting such requests, we will verify your identity (or your agent’s identity and authorization), which may include requesting your email address, phone number, details of your contract with Truesight, or the last four digits of a credit or debit card used with us.

Exercising these rights will not negatively affect the price or quality of the products or services you receive.

In the 12 months prior to the publication of this Privacy Policy, Truesight has not sold any personal information related to its customers or their end users, nor does it plan to do so.

In addition to the above rights, California law allows residents to request disclosure of whether we share personal information with third parties for their direct marketing purposes. Truesight does not share California residents’ personal data with third parties for their own marketing use. If you have questions, please contact contactus@evoto.ai.

13. Biometric Information Retention Policy

This Biometric Information Retention Policy is established in accordance with applicable law and outlines the purposes for which biometric data may be collected, the retention periods, and the criteria for permanent destruction.

Purpose of Collection:

• In the course of providing Evoto Instant services, Truesight may access or collect your biometric identifiers and/or biometric information (collectively, “Biometric Data”); however, Truesight does not directly collect such data from you. At a customer’s instruction, Truesight may enable the customer to use a facial recognition tool to process end user photos. This tool uses AI to analyze facial features in photos and detect if the same person appears in other photos. During this process, the tool may briefly collect a facial geometry scan (i.e., Biometric Data), which is deleted immediately after processing. Where required by law, Truesight customers must obtain explicit consent from the end user in advance. Truesight does not sell, rent, trade, or otherwise profit from end users’ biometric information.

Data Retention:

• Biometric Data must be permanently destroyed within three years of the last interaction with you or once the purpose of collection has been fulfilled, whichever comes first. Truesight will comply with applicable law to destroy such data when no longer necessary. Specifically, we will destroy data (if we possess it) in the following scenarios:
• The purpose for collection has been fulfilled;
• Three years have passed since your last interaction with our customer.

Per customer instructions, if we possess such data, Truesight will retain it only for the duration necessary to use the facial recognition tool and will permanently destroy it within approximately 90 days.

14. Withdrawal of Consent

You may withdraw any consent you have given at any time, and we will stop processing your personal data accordingly. For clarity, withdrawing your consent may limit or revoke your access to our software and services. Withdrawal of consent does not affect the legality of processing based on consent before its withdrawal. If you wish to withdraw consent, please contact us at contactus@evoto.ai.

15. Additional Terms on Cloud File Transfers

Based on our business needs and legitimate interests, we may use automated technologies to analyze your content and its characteristics in the following scenarios:

• Operational Use: Our services and software may access content that you upload to our servers or generate using our cloud services (“Cloud Content”) to ensure proper functioning of the services and software.
• Illegal or Abusive Cloud Content: Cloud Content may be automatically scanned to ensure we do not host illegal or abusive content, such as child sexual abuse material. If your Cloud Content is flagged or reported as illegal or abusive, it may be subject to human review.
• Public and Shared Cloud Content: All publicly shared or distributed Cloud Content is subject to review for intellectual property concerns and safety risks (e.g., violent or explicit content). If you choose to share your Cloud Content via our software or services, we may automatically review that content for potential abuse. Additional human review may occur when Cloud Content is shared or made public.

If legitimate interest is not a valid legal basis in a particular jurisdiction, we will rely on another lawful basis available under the applicable jurisdiction to process the above activities.

16. Third-Party Services

Unless otherwise stated in this policy, we do not share your personal information with any entities other than Truesight, its affiliates, partners, or solution providers without your consent. In particular, we do not sell, rent, or otherwise distribute your information. If you become aware of any theft, unauthorized sale, or storage of personal information, please report it to us and provide as many details as possible to assist our investigation.

You may choose to share information with us about how you use our products. This information is linked to your account and helps us deliver a more personalized experience in future updates. Additionally, it helps us improve the quality and functionality of our products. You may update your sharing preferences at any time. Rest assured that all data will remain anonymous and confidential. The specific information is as follows:

• Data Sharing Recipient: Tableau and Metabase
• Purpose: (i) To understand users’ full behavioral journey across the Evoto Instant website and software; (ii) To analyze user activity levels, churn rates, and feature usage patterns and preferences.
• Data Sharing Recipient: Facebook, TikTok, ShareASale
• Purpose: (i) To understand users’ full behavioral journey across the Evoto Instant website and software; (ii) To analyze user activity levels, churn rates, and feature usage patterns and preferences.
• Data Sharing Recipient: Facebook, TikTok, ShareASale, Apple
• Purpose: To track the effectiveness of advertising campaigns and analyze ad impact. By tracking user behavior and engagement, these data help identify which ads are most effective, which platforms drive the most conversions, and which audiences respond best to different types of ads. Ultimately, this information is used to optimize advertising and messaging for better outcomes in future campaigns.
• Data Sharing Recipient: Infobip (a third-party identity verification provider)
• Purpose: To ensure the verification of your real identity.
• Shared Information: Your phone number (as necessary to perform the verification service).
• Commitment: We have received a commitment from Infobip that they will strictly comply with our privacy policy. The shared phone number will be deleted as soon as the verification process is completed, unless otherwise required by law.
• Data Sharing Recipient: AWS (a third-party cloud service provider)
• Purpose: To support cloud-based analysis, processing, transmission, and storage of data uploaded by users.

17. Protection of Minors’ Information

We do not knowingly collect any information from children under the age of 16 or the minimum age required by local laws, and we comply with all applicable privacy laws when collecting personal information from minors. If you have concerns about this website, would like to know whether your child has accessed our services, or wish to request the deletion of your child’s personal data from our servers, please email us at contactus@evoto.ai. If we learn that a child under the age of 16 or the applicable minimum legal age has provided personal information to us, we will take steps to delete such information in accordance with applicable laws.

18. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in technology, law, operations, or for other necessary or appropriate reasons. When we make changes, we will revise the “Last Material Revision” date at the top of the page and post the updated version on our website. If there are material changes or substantial alterations in how we process personal data, we will notify you either through a notice on our website or directly (e.g., via email).

We encourage you to review this Privacy Policy periodically to stay informed about your relationship with us and how we handle your personal information.

19. Language

This Privacy Policy was originally written in English. If this policy is translated into other languages and there is any conflict or inconsistency between the English version and a translated version, the English version shall prevail and be legally binding.