PRIVACY POLICY - READ THROUGH THE DATA WE COLLECT, STORE AND SHARE

1. We refer to our website/mobile applications, mentioned above as (“Itsy”, “us” or “we”).
2. “User” refers to any user of Itsy (also referred as “you” or “customer”), whether a host or a participant defined below.
3. “Room” is a major service we provide, which is an educational, charitable or entertaining digital conference held at Itsy. Entry to each room can be either free of cost or priced. Each room might have a limit of participants (amount of users who enroll in the room). Each room has a set of its own rules that a user agrees to, upon enrollment.
4. “Host” refers to any user who created the room or “co-host” (a user who is invited to the room) of the room. Itsy host should be at least 18 years old, or have a parent's permission to proceed creating rooms. Each host needs to have the following sections of terms of service agreements read in full beforehosting a room: payments, fees, taxes and restrictions.
5. “Participant” refers to every other user of Itsy, who are not hosts.

Itsy International Limited, (referred as “Itsy”) is a platform where users can engage with their favorite role models. This Privacy Policy applies to hosts and all users of our platform, and is part of our Terms of Service.

Itsy is a product of international use. By using our platform, you agree that your personal information that you provide directly to us, or that we collect through your use of the platform, may be transferred to and stored/processed in the United Kingdom, the European Union and the United States and handled as described in this Policy.

This is information that you provide to us through text/media fields, such as your email or profile picture. The additional information is collected for hosts.

Every user:

1. Profile fields: email, profile identifier called “itsy tag”, birthday and profile media such as profile picture and profile cover picture.
2. You also have the option to add more information to your public profile, such as a location, social media links and a description section, which we store along with any comments or messages you submit on Itsy.
3. We collect and process information about your engagement with hosts, the level at which you interact with them and what benefits you receive.
4. We may collect information automatically as you navigate the website or mobile application through our or third-party analytics providers. We may store usage information such as the type of device you use to access Itsy, your operating system, browser type, IP address, device ID, the pages you visit or request, links clicked, referring sites, user interactions and your search terms. We may also derive your location from your self-disclosed country and your IP address.
5. When interacting with other users we collect chat requests you make and direct messages, emojis, links or other digital content that you exchange with other users.
6. When you create and/or participate in a room, we collect the room fields (room name, picture, moderator users, rules, enrollment fee, participant limit and other additional fields), messages, how many times users visits the room, the activity on the site, with whom they've communicated, and possibly an IP address and from which location the user was last logged in. We use 100ms to help us stream and operate our Rooms, meaning that they may access your content from cameras to help provide the streams. You can find their privacy policies hyperlinked above.

Every host:

1. We may store: personal ID numbers, content through verification camera feature, social medias, full name.
2. Additional information we may need to store for tax purposes: full name, address, social security number or employer identification number, country of citizenship, foreign tax identification number, your nonprofit registration number, phone number, additional information we may be asked from bank to complete payout, automatically collected information.

We do not collect any sensitive, or PCI-compliant payment data, instead our frontend client (web or mobile application) interacts with Stripe, PCI Level 1 Service Provider, through Stripe sdk to pass encrypted data (credit/debit card number, expiration date and security code) directly. Stripe exposes Payment Method Object ids, which have been created on Stripe. Fetching these Payment Method Objects only returns non-PCI-compliant data, such as last four digits of a card, expiration date and type of the card, therefore none of your sensitive payment data is exposed to Itsy backend/server.

From time to time, we may solicit your participation in user surveys. In order to better understand and serve our user base, we may ask you for demographic information, including information related to your gender, ethnicity, race, age, sexual orientation, earnings and accessibility, which you may choose to share or not. We collect such information to ensure we provide fair and equal access to our services and to showcase hosts to users for greater discoverability. We will store your survey responses as and when you participate in the surveys.

We may collect and store your email address, your comments and your profile information from our Itsy website to better understand your interests and improve our services to you.

We use Cookies on our website that collect session token signed information for automated authentication.

We use social media Share button features on Itsy. Through this feature we do not collect any personal data, although through logs we will identify the amount of times the share button domain was accessed. This feature is either hosted by a third party or directly by Itsy.

1. Verify your identity, when needed, to comply with the UK, the European union or the US federal, state, and international laws
2. Allow you to sign in to your account
3. Allow you to consume features on Itsy
4. Process room payments and payouts
5. Send you emails relevant to your usage, as controlled by your email preferences
6. Reply to your questions
7. Provide to you existing and enhanced services related to your Itsy account
8. Promote your Itsy account for greater discoverability
9. Spotlight and celebrate hosts
10. Market Itsy products and services to you or to audiences similar to you based on your networks and common factors that others have with you, unless you opt out, as controlled by your email preferences
11. Understand how you use the service and create better tools for hosts to serve users
12. Conduct research and development to improve Itsy and develop future products
13. Prevent fraud and abuse on Itsy

Users agree share following information with the hosts whose rooms they join:

1. Your profile identifier, and other public profile information you've provided
2. Any messages you send through that specific room, visible to every participant of the room including host

We never sell your information to third parties. We will only share data with third parties, under the following circumstances:

With our service providers, who are companies that are contractually engaged with us to provide us with services, such as, authentication order fulfillment, stream engine provider, email management, analyzing data trends, credit card processing, multi-currency settlement solutions, increasing our brand awareness and user engagement with marketing initiatives, and fraud detection and prevention. These companies may have access to your data to perform their services, and are obligated by contract to safeguard any of your data they receive from us to the same extent that Itsy protects it.

To protect the security or integrity of Itsy as well as to protect the rights, property and safety of Itsy, its employees and users, we believe that data disclosure might be necessary to legal institutions to comply with laws, regulations or other valid legal processes (e.g. subpoenas or warrants served on Itsy). If we are going to release your data, we will do our best to promptly notify you by email unless we are prohibited by law from doing so.

In connection with the sale, merger, bankruptcy, sale of assets or reorganization of our company. We will notify you if a different company receives your data. The promises in this privacy policy apply to any data transferred to a new entity.

The following information is publicly accessible:

1. Your profile and your social media links and content under profile description field
2. Overview of rooms you create
3. Any room messages only within other room participants
4. Your aggregated or anonymised usage data in blog posts, press releases or in other ways to share information about user's usage. Aggregated or anonymised data cannot be linked back to any individual Itsy user
5. Number of room participants for corresponding room, only within Itsy community

The Settings link is located by clicking on your avatar or profile, after your log into your Itsy account. Settings lets you see your account preferences. You can see and adjust your settings by viewing your preferences and, if you wish, by changing your selections.

By agreeing to our terms of service, you expressly agree that Itsy may:

1. Provide you with information about your service, service enhancements or new Itsy products while you are on our website or using our apps.
2. Send you messages regarding your existing service or enhancements related to your existing service when you are off our platform via email or via text if you have signed up for a service or event notification that uses text messages.
3. Send you messages related to services we provide which are separate from your existing service via email, which you may opt out of.
4. Market Itsy to you and audiences similar to you based on your networks and common factors that others have with you unless you opt out.
5. Send you marketing emails or texts if you don't have Itsy account but have consented to receiving such messages, which you may opt out of.
6. Ask for demographic information to spotlight and celebrate hosts.
7. Promote your account for greater discoverability.

You may object to the use of your data for marketing purposes at any time, free of charge, when we collect your personal information and in every marketing communication. You may also object to the use of your data for marketing upon creation of your account or anytime thereafter by opting out here.

Opting out will stop marketing emails. Please allow up to 30 days for your opt-out request to be processed. If you have an account with Itsy, you will continue to receive service-related emails and texts if you have opted into receiving texts. You will also continue to receive service-related shipments of benefits to the designated delivery address.

We will never sell your information to third parties for marketing purposes without your prior consent.

You can access and update certain information associated with your account on the settings pages.

You may self-initiate a deletion of your account directly from settings, under “Security.” Please be aware that this action is final and cannot be reversed. Below you will find what data will be destroyed or retained.

The data to be erased (Meaning that the data is destroyed and not recoverable):

1. User account credentials
2. User profile fields
3. User interactions with other users: follows, bans, chat requests, direct messages, moderator invitations, etc.
4. User profile rating

Anonymized data (Meaning that the data remains, since destruction of that data will result in destruction of the data of other users. However the source of this data will no longer exist, in other words, the source of this data will no longer be traceable):

1. Room messages
2. Group messages
3. Room instances
4. Room fields
5. Room activity, meaning rooms joined
6. Rooms moderated
7. Transaction models
8. Feedbacks
9. User activity (likes, views and etc.) Used for other profile's content statistics

You can change your email notifications in your email settings. While this allows you to stop many notification emails, we will still send some critical service emails.

If you download the Itsy App you may also receive notifications on your mobile device. These can be disabled in the App settings.

Users maintain password-protected accounts with Itsy. In case you are willing to exercise your privacy rights, then you have to submit a request to Itsy support from your authorized and authenticated account. Every unauthorized user's request will be denied.

Itsy International Limited headquarters are located in the United Kingdom, therefore first and foremost we comply with UK laws. United Kingdom citizens have following rights over their data in compliance with the UK Data Protection Act (2018):

1. To request information about how your personal data is processed, and to request a copy of that personal data;
2. To request that any inaccuracies in your personal data are rectified without delay;
3. To request that any incomplete instances of personal data are completed, including by means of a supplementary statement;
4. To request that your personal data is erased if there is no longer a justification for it to be processed;
5. In certain circumstances (for example, where accuracy is contested), to request that the processing of your personal data is restricted;
6. To object to the processing of your personal data where it is processed for direct marketing purposes, or any other reason and that we will then consider; and
7. To request a copy of any personal data you have provided, and for this to be provided in a structured, commonly used and machine-readable format.

Rights of European Union citizens:

1. The right to be informed: Right to be informed about how companies collect and use their personal data, how long they plan to keep that data, and who they'll share it with
2. The right of access: Right to know exactly what information companies have collected, how they're storing and processing that data, and what they're going to do with it.
3. The right to rectification (correction): Right to correct incomplete data
4. The right to erasure: Right to request to have data forgotten/deleted, except for data which is used for statistical purposes, or when it interferes with company legal obligations
5. The right to restrict processing: Right to make the personal data unavailable to users, or temporarily removing published data from a website. In automated filing systems, the restriction cannot be applied if it is subject to further internal operations, which cannot be changed. If the processing of personal data is restricted, it will be indicated in the system.
6. The right to data portability: Right to have the personal data transmitted directly from one controller (in this case us) to another, where technically feasible, in machine readable format.
7. The right to object: Right to restrict the data processing for direct marketing purposes, in such cases, we will longer process the personal data unless there are legitimate grounds for the processing, which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
8. The right to not be subject to automated decision making: Right not to be subjected to decisions based solely on automated processing, such as profiling. As long as this data is not necessary for entry into the contract with us.

Effective 1 January 2020, the California Consumer Privacy Act (CCPA) allows California residents to request access to the specific pieces and categories of personal information that the business has collected about the participant, the categories of sources for that information, the business or commercial purposes for collecting the information, and the categories of third parties with which the information was shared.

Rights of California residents:

1. The right to notice: Right to be informed about our practices regarding the collection of the data, how we use, sell (which we do not) or share the personal information.
2. The right to know: Right to request a summary of the personal information we have collected about you, and a copy of that data.
3. The right to delete: Right to request that we delete the personal information of yours we have collected. You can only make a request twice in every 12 months. Although some of requests might be denied if:
   
   
   1. The data is needed to perform obligations under a contract
   2. We ensure maintaining security
   3. The data is needed for debugging
   4. Exercising or defending free speech and other legal rights
   5. We are complying with the California Electronic Communications Privacy Act: Penal Code, Part 2, Title 12, Chapter 3.6.
   6. We are engaged in and conduct scientific, historical or statistical research in the public interest
   7. We are using it for solely our internal and reasonable purposes, which may be electronic backups of data, so that user's information is not lost or logs, such data might be retained.
   8. Complying with a legal obligation
   9. Using it for other internal purposes, where data is collected in a lawful manner and is reasonable considering the context in which you have provided it.
4. The right to opt out: Right to opt out if we decide to sell your data and again we do not sell your data.
5. The right to non-discrimination: Itsy is all against discrimination, thus unless CCPA requires us, we will not:
   
   
   1. Denie goods or services
   2. Charge different prices
   3. Provide with a different level or quality of goods or services
   4. Any of above

You may designate an authorized agent to make a request on your behalf. In order to designate an authorized agent to make a request on your behalf, you must provide a valid power of attorney, the requester's valid government ID and the authorized agent's valid government ID. Please contact privacy@itsy.dev with your request. To protect your information from account takeover, we may decline access to at our discretion.

We do not discriminate against users who exercise their privacy rights.

We retain your account information for ten years after your account is last active unless you delete, or you request that we delete, your account. We continue to retain some information even after you delete your account, the identity of the owner of such data is anonymized.

The security of your personal information is important to us, therefore we have appropriate organizational, physical or technical safeguards in place to ensure protection confidentiality, integrity and availability of your personal information.

We are trying our best to protect your personal data, however the fact is that no safeguard is able to fully guarantee the protection of the data. In addition, the internet data transfer is not always secure, thus we cannot guarantee that the data you transfer to us is or will always be secure.

Itsy is not intended for children under the age of 13 and children may not create an account or otherwise use Itsy.

We may sometimes make changes to this policy. If we make material changes that adversely affect your rights under this policy, we will let you know by posting an announcement on the site or sending you an email in advance of the changes coming into effect. Continuing to use Itsy after a change to this policy means you accept the new policy. If you have any questions, please email privacy@itsy.dev