Mixbook Privacy Policy

Welcome to Mixbook’s Privacy Policy. Mixbook respects your privacy and we are committed to protecting your personal information.

We at Interactive Memories, Inc., more commonly known as “Mixbook” (also "we”, “us”, or “our”), are committed to respecting your privacy and to the security of the information that you entrust to us. This Privacy Policy describes the personal information that we collect and explains how we handle personal information that we collect through and in connection with our website located at www.mixbook.com and other websites and mobile applications this Privacy Policy is linked to, and all of our related services (collectively, the "Service” or “Services”). Before using the Services or submitting any personal information, whether from you or others, to us, please review this Privacy Policy carefully.

In some cases, at the time of collecting your personal information, we may provide you with additional information regarding the processing of your personal information. We may also, in certain circumstances, obtain your specific consent to the collection, use or sharing of your personal information, including where required by law.

1. What is “personal information”?

In this Privacy Policy, “personal information” refers to any information which could be used alone or in combination with other information to identify an individual. This may include, for example, your name, contact information, home address and email address. It may also include more technical information, such as your IP address, browser settings and device ID, but only when this information can identify you as an individual. Information that is anonymized (i.e., where all direct and indirect identifiers have been permanently and irreversibly removed) is not considered to be personal information under certain privacy and data protection laws.

2. Personal Information We Collect

We limit the collection of personal information to what is necessary to fulfill the purposes identified in this Privacy Policy. We may collect the following categories of personal information about you:

Information you provide to us:

• Contact information, such as your first and last name, email, phone number, and other contact data.
• Account information, such as the email and password you use to “Login” or “Sign Up” to access our Services.
• Photo, video, and project information, such as photos, videos, drawings, text, event dates, addresses, favorite themes, project designs, and other user-generated content that you upload or otherwise provide through the Services. Through our AI-powered features, we may also generate information derived from your content.
• User generated information, such as contextual information you provide about visual information you upload, including captions, responses to our Service’s prompts, descriptions, annotations, and metadata associated with your content and other information embedded in your files.
• Facial recognition information. We may use facial recognition technology to help you organize and manage your photos. This may involve processing certain biometric information, such as facial features, patterns, face match identifiers, and embeddings, from the photos you upload. Please see Section 2 (Facial Recognition and Biometric Information) and our Biometric Notice and Consent for additional information about how we handle biometric data.
• Demographic information. Through optional surveys, we may collect demographic information about you, such as your age and income ranges. Through events you create, we may also collect your birthdate.
• Transaction data, such as a record of the transactions you enter into with us, including which products you purchase, billing address, shipping address, shipping speed, item quantity, and payment information when you place an order. We do not collect or store full credit card numbers. If you elect to associate a payment method with your account, that payment method will be collected, processed and (if you elect) stored by a payment service provider under contract with us and will be subject to the payment service provider's privacy policies.
• Communications that we exchange with you, including when you contact us with questions, feedback, or otherwise.
• Other information not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Information you provide to us about others: Where you provide us with the personal information of third parties, such as your family, friends or other contacts via the Services, it is your responsibility to (1) inform them about our processing of their personal information in accordance with this Privacy Policy and (2) confirm that they have given you their permission to allow us to collect, use and disclose their personal information as provided in this Privacy Policy.

Automatic data collection. With your consent where required under applicable law, we and our service providers may automatically log and combine information about you, your computer or mobile device, and your interactions over time with the Services, online resources, and our communications, such as:

• Device data, including your computer’s or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, device type (e.g., phone, tablet), IP address, unique identifiers, language settings, and general location information such as city, state, or geographic area.
• Location Information: Depending on the choices you make on our Services, we may also collect and maintain a history of your precise location information using WiFi and Bluetooth technologies, as well as your device identifiers and GPS coordinates (e.g. latitude/longitude). We also derive a rough estimate of your location based on your IP address. Additionally, from your user content, we may derive the approximate location a photo or video was taken, as well as other technical information recorded by your camera or smartphone, often referred to as "metadata," which is typically embedded in digital images. If you're concerned about sharing this type of information, you can modify your device's settings to limit the metadata stored with your content. If you want to prevent the collection of your device’s location information, please adjust your settings in your mobile device to limit the mobile application’s access to your location information.
• Usage data, including pages, screens and/or features you viewed, accessed and/or used, how long you spent on a page, screen and/or feature, crash and performance data, the website you visited before browsing to the Services, navigation paths between pages or screens, information about your activity on a page, screen and/or feature, access times, duration of access, and whether you have opened or otherwise engaged with our communications, such as our marketing emails, or clicked links or files within them.

We may use a combination of our own and third-party tools for automatic data collection. To learn more about our automatic data collection and your choices, please see our Cookie Policy here.

Information we obtain from other sources:

• Other users. Other users may upload photos and videos that identify you with your consent. Depending on information that other users contribute (for example, identifying an image as “sister”), we may also obtain or infer information about you from the content provided by third parties.
• Third-party login information. When you link, connect, or log in to our Services with a third-party service (e.g., Google or Apple), you may direct the service to send us information controlled by that service or as authorized by you via your privacy settings on that service. We do not use data derived from our Google or Apple integrations to develop, improve, or train generalized or non-personalized artificial intelligence (“AI”) and/or machine learning (“ML”) models.
• Social media. We may maintain pages on social media platforms, such as LinkedIn, Instagram, and other third-party platforms. When you visit or interact with our pages on those platforms, you or the platforms may provide us with information through the platform, and we will treat such information in accordance with this Privacy Policy.
• Other sources. We may obtain personal information from other third parties, such as marketing partners, publicly available sources, and data providers.

There may be certain types of personal information that you do not need to provide us. For example, it is generally within your control how much user generated information you choose to provide to us. However, for many types of personal information described above, we may not be able to provide you with all or part of our Services if you do not provide us with the personal information that we seek in doing so.

3. Facial Recognition and Biometric Information

Our Services include features that use facial recognition technology to help you organize, enhance, and tell stories with your photos and videos. When you upload images, we may process certain “biometric” information, such as facial features, patterns, face match identifiers, and embeddings, to identify when the same person appears across different photos and videos in your collection. This supports functionality such as grouping similar photos, suggesting tags, identifying individuals in memory stories, and enabling personalized artwork and storytelling experiences. These features are designed to work entirely within your use of the Service. We do not use facial data or other biometric information for any form of advertising, surveillance, identity verification, authentication, or public search. The use of facial and biometric data is limited to enhancing your personal experience within the Services.

Our facial recognition features are only activated with your explicit permission. You may disable facial recognition in your account settings or request deletion of all facial and biometric data associated with your account at any time. Subject to our legal and compliance obligations, if you delete your account or withdraw your consent for facial recognition, we permanently delete all facial and biometric data from our systems, including all associated embeddings and face collections. Please note that deleting facial and biometric data does not automatically delete the content within your account that was organized or created using such information. This content will remain in your account unless you separately choose to delete it. If you wish to delete both your facial/biometric information and all content associated with facial recognition, you may do so by deleting all of your personal information or your account, as described in “Your Privacy Rights and Choices” section below. For more information about how we handle biometric data and your options, please see our Biometric Notice and Consent.

4. How We Use Personal Information

We collect, hold, use and disclose personal information for the following purposes or as otherwise described at the time of collection:

• To provide our Services. We use your personal information to perform our contractual obligations towards you, or when it’s in our legitimate business interests to do so where permitted by applicable law, to provide you with the Services. This includes:
• Processing, manufacturing, and shipping orders you place through the Services;
• Processing your content to create customized memories, powered by your unique context;
• Administering, hosting, and operating our Services;
• Communicating with you and responding to any inquiries you may have;
• Analyzing your use of our Services to allow us to evaluate and improve the Services;
• Sending invitations to view, edit, or collaborate on your projects at your request; and
• Verifying your identity when you log in to the Services.
• For research, development, benchmarking, and improving our Services. We may use personal information where it is permitted by law (which may include where it is in our legitimate business interests to do so), to analyze and improve the Services, troubleshoot and fix problems you may be experiencing, improve security, identify trends, and operate and expand our business activities. We may also create aggregated, anonymized, or other de-identified data, which we may use and disclose for lawful business purposes in accordance with applicable law, including for analytics, forecasting, and strategic planning.
• For marketing and advertising. We may conduct marketing and advertising activities where permitted by law. In some cases, we will ask for your explicit consent before contacting you for marketing purposes. In others, we may rely on our legitimate interests to promote our business and the products or services we offer. When we do engage in marketing activities, we will use your personal information to send you information and offers about products or services that may be relevant to you. You may opt out of receiving promotional emails by following the instructions contained in each promotional email we send you. If you have an account, you can also control the marketing emails and/or text messages you receive by updating your settings through your account. If you unsubscribe from our marketing lists, you will no longer receive marketing communications, but we will continue to contact you regarding your orders, management of your account, other administrative matters, and to respond to your requests. We may share data with third parties in connection with advertising, retargeting, and analytics on our behalf. Under no circumstances do we rent, trade, or share your address or email address with any other company for their own marketing purposes without your consent.
• For compliance and protection. We may use personal information to comply with our legal obligations and to defend against legal claims or disputes where it is in our legitimate business interests to so do, including to:
• Comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas, warrants, court orders or requests from government authorities.
• Audit our internal processes for compliance with legal and contractual requirements and internal policies.
• Enforce the terms and conditions that govern our Services.
• Where we have a legitimate interest and in accordance with applicable law, to prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity, including cyberattacks and identity theft.
• Where we have a legitimate interest and in accordance with applicable law, to protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims).
• For other lawful purposes. We may also use personal information as otherwise permitted or required by applicable law.

5. How We Disclose Personal Information

We may disclose personal information to the following individuals or entities and as otherwise described in this Privacy Policy or at the time of collection:

• Other users. When it comes to other users, we only disclose your personal information to users who are part of your “Connections”. Connections are user-formed groups where you can share your photos, videos, and thoughts with other Connections members. For example, if you and your friends form a Connection and take pictures at a concert, our Service will create shared memories representing the Connection’s collective experiences. Connections are on an opt-in basis, and you can adjust your Connections in your account settings.
• School and bulk orders. If you use the Services to order products (such as yearbooks) to be shipped to a school or other organization as a bulk order for distribution to buyers, we may share personal information we have collected from you to identify you and/or your child or children as a product buyer and facilitate the school's or other organization's distribution of products to buyers.
• Service providers. Companies and individuals that provide services on our behalf or help us operate the Services or our business (hosting, artificial intelligence, information technology, customer support, email delivery, payment processing, printing, shipping, and analytics services). For example, when you place an order, your billing information may be transmitted to a third-party payment processor and your shipping information may be transmitted to a third-party printer or carrier for production and delivery. If you elect to permit your payment information to be saved, that information will be stored by such third-party payment processor for the purpose of completing future purchases. If you interact with a chatbot, any information you provide may be shared with the chatbot vendor to formulate a response, which may occur using AI. We require any chatbot vendor to agree not to use any such user information to train their AI models or to provide responses to any other users. Where we utilize third parties for the processing of any personal information, we implement reasonable contractual and technical protections limiting the use of that data to our specified purposes.
• Professional advisors. Professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us.
• Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above, or as otherwise permitted or required by law.
• Business transferees. Acquirers and other relevant participants in business transactions (or negotiations for such transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, our business (including, in connection with a bankruptcy or similar proceedings).

6. International Data Transfers

You will provide personal information directly to us in the United States. We may also transfer personal information to our affiliates and service providers in the United States and other jurisdictions. Please note that such jurisdictions may not provide the same protections as the data protection laws in your home country and your personal information may be accessible without notice to you by the courts, law enforcement and national security authorities of that jurisdiction.

When we engage in cross-border data transfers, we will ensure that relevant safeguards are in place to afford adequate protection for personal information and we will comply with applicable data protection laws, in particular by relying on contractual protections for the transfer of personal information. For more information about how we transfer personal information internationally and our policies and practices with respect to the use of international service providers, please contact us as set out in the “How to Contact Us” section below.

7. Your Privacy Rights and Choices

Depending on where you live, you may have the following privacy rights and choices:

Access or update your information. If you have registered for an account with us, you may review and update certain personal information in your account profile by logging into the account.

Opt out of marketing communications. You may opt out of marketing-related communications – both emails and texts – by following the opt-out or unsubscribe instructions in the communications you receive from us or by contacting us as provided in the “How to Contact Us” section below. You may continue to receive Services-related and other non-marketing communications.

Changing your cookie preferences. When you first visit our Services, you are presented with a pop-up banner that allows you to make choices regarding your cookie preferences. Depending on where you are, by default, only necessary cookies may be activated on the website. You can choose to enable or disable some or all of these cookies, but disabling some of them may affect your browsing experience or limit certain website features.

Personal information requests. We offer you choices that affect how we handle your personal information. Depending on your location and the nature of your interactions with our Services, you may request the following in relation to personal information. Your authorized agent may also submit requests on your behalf in the same manner. Once we receive your request, we will verify your identity by sending an email to the email address you provide to us.

• Information about how we have collected and used personal information. We have made this information available to you without having to request it by including it in this Privacy Policy.
• Access to a copy of the personal information that we have collected about you. Where applicable, we will provide the information in a portable, machine-readable, readily usable format.
• Correction of personal information that is inaccurate or out of date.
• Deletion of personal information that we no longer need to provide the Services or for other lawful purposes.
• Appeal our denial of your personal information request by contacting us as set out in the “How to Contact Us” section below.
• Where we rely on your consent, you may withdraw your consent at any time. Please note that withdrawing your consent to the processing of your personal information may limit certain/all of the features of the Services available to you.

To make a request, please email us or write to us as provided in the “How to Contact Us” section below. We may ask for specific information from you to help us confirm your identity. You are entitled to exercise the rights described above free from discrimination.

Limits on your privacy rights and choices. In some instances, our obligation to comply with a request from you may be limited, for example this may include where fulfilling your request would impair the rights of others, our ability to provide a Service you have requested, or our ability to comply with our legal obligations and enforce our legal rights. If you are not satisfied with how we address your request, you may submit a complaint by contacting us as provided in the “How to Contact Us” section below.

Depending on your location, such as if you reside in the European Economic Area, United Kingdom, Australia, or Canada, you may have the right to complain to a data protection regulator where you live or work, or where you feel a violation has occurred. For example, click here to find your local supervisory authority in the EEA. In the UK, the competent authority is the Information Commissioner’s Office; in Australia it is the Office of the Australian Information Commissioner; in Canada it is the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner of Alberta, the Office of the Information and Privacy Commissioner for British Columbia, or the Commission d'accès à l'information du Québec.

8. Other Sites and Services

Our Services may contain links to websites and other online services operated by third parties. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites or online services operated by third parties, and we are not responsible for their actions. This Privacy Policy does not apply to such third-party sites or services, which have different privacy policies and processes that we recommend you to review.

9. How we hold and secure personal information

We generally hold personal information in electronic form, on the computing infrastructure provided by us and our service providers. There may be occasions where your personal information is stored in hard copy form, usually on a temporary basis.

We use reasonable organizational, physical, technical, and administrative measures designed to protect against unauthorized access, misuse, loss, disclosure, alteration, and destruction of personal information we maintain. Depending on the volume and sensitivity of the information, the purposes for which it is used and the format in which it is stored, we implement a combination of measures to protect your personal information, including:

• A privacy framework governing the protection of personal information through its lifecycle. This framework defines the roles and responsibilities of our personnel, provides a process for dealing with complaints regarding the protection of the information, and addresses the retention and destruction of personal information.
• Internal policies and procedures that define the roles and responsibilities of our employees throughout the information life cycle and limits their access to such information on a “need-to-know” basis.
• If information is collected or stored in electronic format, technical safeguards such as encryption, firewalls, passwords, antivirus software and similar measures.
• A designated an individual to monitor our compliance with applicable privacy laws as set out in Section 13 below.
• Employee privacy and data security training.

Unfortunately, data transmission over the Internet cannot be guaranteed as completely secure. Therefore, while we strive to protect your personal information, we cannot guarantee the security of personal information.

10. Retention of Personal Information

Where required under applicable laws, we retain personal information only for as long as is necessary to fulfil the purposes for which it was collected and processed, in accordance with our retention policies, and in accordance with applicable laws and regulatory obligations. With respect to biometric information, please see our Biometric Notice and Consent.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of personal information, the purposes for which we use personal information and whether we can achieve those purposes through other means, and the applicable legal and regulatory requirements.

Once no longer required, your personal information will be securely destroyed in accordance with legal requirements.

11. Children’s Privacy

Our Services are not intended for use by children under 13 years of age (or 14 if you are in Québec, Canada). Children who are under the age of majority in their jurisdiction must use an account created by a parent or guardian and must have the explicit permission of a parent or guardian to use the Services. If we learn that we have collected personal information through our Services from a child under 13 (or 14 in Québec, Canada) without the consent of the child’s parent or guardian as required by law, we will take appropriate steps to delete that information. If you become aware or believe that a child has provided us with personal information, please contact us as set out in the "How to Contact Us" section below.

12. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. Where we do so, we will update the date of this Privacy Policy and post it on the Services. If we make material changes to this Privacy Policy, we will let you know. By continuing to interact with us after the modified version of the Privacy Policy has been posted, you are accepting the changes to the Privacy Policy, subject to any additional requirements that may apply. It is your responsibility to ensure that you read, understand and accept the latest version of the Privacy Policy. The “Effective Date” at the top of this Privacy Policy indicates when it was last updated.

13. How to Contact Us

Interactive Memories, Inc. is the entity responsible for your personal information, as the controller/responsible organization under applicable laws. If you have any questions or comments about this Privacy Policy, our privacy practices, or if you would like to exercise your rights with respect to your personal information, please email our us at privacy@mixbook.com. You may also contact us by mail at 2000 Broadway St., Redwood City, CA 94063.

If you are an individual in the EU, UK, Iceland, Norway, or Switzerland, you can also contact DataRep, our Data Protection Representative, by emailing mixbook@datarep.com or writing to DataRep, The Cube, Monahan Road, Cork, T12 H1XY, Republic of Ireland (referencing "Mixbook" or "Interactive Memories" in the body of the correspondence).