Privacy Policy

Last Modified: 17 November 2025

Your privacy is important to us.

EveLab Insight Hong Kong Limited and its affiliates (“we”, “us” or “our”) are dedicated to protecting the privacy of our users (“users” or “you”). This Privacy Policy (this “Policy”) is meant to explain our practices regarding how we collect, store, use, manage and protect your user information (including your personal information) as a controller and/or business under applicable data protection laws during your use of MakeupPlus application including all its features (our “Services”). For the purpose of this Policy, the term “affiliates” shall mean any entity which directly or indirectly controls, is controlled by, or is under common control with EveLab Insight Hong Kong Limited. For the purpose of the foregoing, “control” shall mean (i) the direct or indirect ownership of more than 50 per cent of the outstanding voting securities or capital stock of such entity or other comparable equity or ownership interest, or (ii) the control of management decisions and economic interests of the entity by way of contractual arrangements.

Please note that the scope of this Policy is limited solely to your user information (including your personal information) collected or received by us when you are using our Services. In this Policy, “personal information” refers to any information or combination of information that can be used to identify, contact or locate an individual to whom the collected information pertains.

BY USING OUR SERVICES, YOU ARE AGREEING TO THIS POLICY AND THE COLLECTION, USE, PROCESSING, RETENTION, DISCLOSURE AND SHARING OF YOUR USER INFORMATION, INCLUDING YOUR PERSONAL INFORMATION, IN THE MANNER PROVIDED IN THIS POLICY. IF YOU DO NOT AGREE WITH ANY OF THE TERMS OF THIS POLICY OR ANY SUBSEQUENT CHANGES TO THIS POLICY, PLEASE DO NOT USE OUR SERVICES.

Please note that it is mandatory for you to provide certain categories of data (as specified at the time of collection when using our Services). In the event that you do not provide any or sufficient data marked as mandatory, we may not be able to complete the registration process or provide you with our Services. Also, please note that, unless we define a term in this Policy, all capitalized terms used in this Policy have the same meanings as in our Terms of Service. So, please make sure that you have read and understand our Terms of Service.

If you have any questions regarding this Policy or any privacy-related matters, please contact our Data Protection Officer via email at compliance@evelabinsight.com (please quote “MakeupPlus” in your email title), or via registered mail at Unit 7702A, Level 77, International Commerce Centre, 1 Austin Road West, Kowloon, Hong Kong (attention: Legal Department, EveLab Insight). Please note that for all other enquiries, feedback, suggestions and/or complaints not related to privacy or intellectual property infringement (including but not limited to any cancellation of subscription, payment disputes, refund requests and technical support of EveLab Insight), you should contact us via email at makeupplus@meitu.com. If your email is sent to an incorrect email address, relating to an incorrect subject matter, it may lead to a potential delay or failure in processing your requests properly.

THE INFORMATION WE COLLECT

In order to provide and improve our Services, we will collect and process your personal information and user information in accordance with this Policy. If you do not provide this information, we may be unable to provide you with our products or Services. You should ensure that all personal information and user information submitted to us is complete, accurate, true and correct. Failure on your part to do so may result in our inability to provide you with all or some of our Services.

Account Information

When you use our Services, we might recommend you sign up for an account with us to take full advantage of our Services and all their features. When you create an account, we will collect the following information that can be used to identify you or provide our Services to you:

· Mandatory: User ID or email

· Optional: name, username, gender, date of birth, and location

Anyone can access our Services, but there are certain services that require a subscription fee, such as accessing to our premium content and enjoying advertisement privileges (“Subscription Service”). If you choose to make a purchase on our Subscription Service, we will collect certain personally identifiable information, such as your device ID. A third-party app store or payment processor may receive, access or use your financial information and billing address for the purpose of processing transactions and renewals. If you purchase content or sign up for Subscription Services through a third-party app store or a payment processor, you should refer to that third party’s terms for information on how it maintains and uses personal financial information for all purchases. For the avoidance of doubt, we will not collect any financial information from you.

Mobile Device Information

When you use our Services on your mobile device, we will collect information about your device, including its International Mobile Equipment Identity (“IMEI”), Unique Device Identifier (“UDID”) or Android ID, Universally Unique Identifier (“GUUID”), User ID (“UID”), Identifier for Advertising (“IDFA”) and Identifier for Vendor (“IDFV”), Open Anonymous Device Identifier (“OAID”) Integrated Circuit Card Identifier (“ICCID”), Media Access Control (“MAC”) address, the type of device you use, operating system version, a list of mobile applications installed on your device and resolution, which will be used by us for statistical and/or analytical reasons, including without limitation to improve our technical functionality, server load-balancing, analysis of technical data relating to your mobile device so as to optimize our Services and graphics adaptation.

As stated below in the “Location Information” section, we may collect your location-based information from your mobile device if you choose to share it with us. If you subsequently wish to stop sharing Location Information, you may do so at any time by editing the relevant setting on your mobile device.

Mobile Analytics

To better understand and improve the functionality of our Services, we will collect information such as how often you use the application, the events that occur within the application, aggregated usage, performance data, and where the application was downloaded from.

Network Information

When you use our Services, we will collect information about the network you use, including the name of the operator and the type of network, so as to understand the distribution of operators and networks used by our users. In addition, we will collect information such as the name of the WiFi network to which you connect, the location of the WiFi network, and the duration of your WiFi connection to understand the environment under which you prefer to use our Services.

Location Information

We may collect your location-based information from your mobile device if you choose to share it with us.

· Mandatory: network information, IP address, and system time zone

· Optional: country code, network location, and system country

This information will help us understand user distribution and usage scenarios and allow us to provide users with the correct version of our apps, the reappearance of the geo-location or the publishing of the real-time geo-location where you take any photos or shoot any videos, and improve our Services. Unless we obtain your consent, location data WILL NOT BE ACQUIRED or USED to identify you individually. Except as otherwise provided in this Policy, we will not share this Location Information with any third parties. If you no longer wish to allow us to collect or use such information, you may turn off your Internet access or GPS, or disable our access to information about your network, GPS and device. Please note that we may still continue to receive some Location Information, such as your Network Information, IP address and system time zone, as a result of you using our Services.

Log Information

When you use some of our Services, including generating and browsing certain content, we will automatically collect certain relevant log information stored in MakupPlus (“Log Information”). Log Information may include (i) details on when and how often you use our Services, (ii) device statistics, including critical operation paths, errors, crashes, language and time zone. This Log Information is used to improve our Services and is NOT USED to identify our users individually.

Image and Facial Feature Information

By choosing to use the AI double eyelid function and AI photo function of our Services, you understand and agree that we must upload your photos to our server for processing before returning processed photos to you for the purposes of providing such service to you and continuous optimization and that we will also receive the EXIF data about your photos (EXIF data may contain GPS coordinates where photos were taken and processed, equipment type, ISO and information about the front and rear cameras and creation time, depending on the equipment manufacturer) for the purpose of further optimizing our Services, such as providing a better match of photo effects to your equipment. By enabling the camera and/or allowing access to photos on your device by us, you agree that we may access, collect and/or use your photos for photo editing.

Metadata

Metadata refers to technical data associated with user content. Put simply, metadata is data that describes data. For example, metadata can describe the analysis results of facial features, gender, age of the characters in photos and other elements contained in photos, which are generated and tagged by the computer algorithm and artificial intelligence. When you use our Services, we will use photo metadata to provide you with certain features including precise “Facial Recognition”, “Key-Points Recognition”, “Region Segmentation”, “Content Tags” and other custom features based on a combination of these basic features. We may use your photo metadata to provide you with more suitable filters and better photo effect when our apps process your photos; we may also use your photo metadata to provide you with more suitable filters and better photo effect when our apps process your photos; we may also make use of the metadata to serve up a more contextually relevant products or services to you.

We will neither use the results for other purposes, nor capture any data in the file nor upload data to the server for recording purposes.

Cookies

We use “cookies” that store and retrieve information of user’s usage from time to time to provide customized Services for each user. Cookies are small amounts of information that the server uses to operate the app/website, sends to the user’s device and are also stored on the hard disk in the user’s device. You may refuse the installation of cookies. Information collected may include information about your Internet Protocol (IP) address, browser type, Internet Service Provider (ISP), referring and exit pages, your operating system, dates and timestamps, and clickstream data.

· Purpose of use of cookies: Cookies are used to provide information optimized for each user by identifying the visit to and use type of each service and website that the user has visited, popular search terms, secure access status, etc.

· Installation, operation and refusal of cookies: A user may refuse the installation of cookies by sending an email to makeupplus@meitu.com (please quote “MakupPlus” in your email title).

· If a user refuses to store cookies, he or she may experience difficulties in using customized Services.

Information Collected Through Integration with ChatGPT or Similar Services

When you use ChatGPT or other similar integrated features in MakeupPlus, we may collect and process personal information that is included in your text inputs and the generated outputs.

Advertising-Related Information

We and our third-party service providers may include advertisements within our Services, and with your consent, we may collect and use information about you such as your Advertising ID, geographic location and IP address for the purpose of delivering and tracking these advertisements. If your device does not have Advertising ID, we may use other persistent identifiers. We may also access your App list and collect the application package names of the applications installed on your device. We use the above information to help us better count, track and provide advertisements based on suitability, language, geographic location and other details. If you wish to opt out of interest-based advertising, you may opt out by sending email to makeupplus@meitu.com (please quote “MakeupPlus” in your email title). Please note you will continue to receive generic ads after you opt out of interest-based advertising.

Information Collected by Third Party Services

Our Services provided to you may contain our service provider’s Application Programming Interfaces (APIs) or Software Development Kits (SDKs), which may have tracking tools of such service providers. These third parties may use cookies, APIs and SDKs on our Services and collect and analyze user information. In addition, some third-party SDKs may allow advertisers to collect information in order to provide content that is more relevant to you. Third parties may access your information such as your device identifiers, region (defined as the location where a given language is used), location information and IP address under their respective privacy policies. If you want to know more about such third parties, you may send an email to compliance@evelabinsight.com (please quote “MakeupPlus” in your email title).

Information that You Proactively Provide to Us

When you contact us (including but not limited to our customer support team and Data Protection Officer), we collect the data you provide to us, for example, your contact details (e.g. email address and/or telephone number).

Other Information

We may also collect other information which is not related to your identity. For example, we may collect information on the type and version number of your operating system to better understand system upgrades, we may collect information on your system language for the purpose of language adaptation, and we may collect your App list to understand user preferences. If we choose to collect such information, we will do so for the purpose of improving our Services provided to you.

HOW WE USE INFORMATION

In addition to the uses listed above, we collect and use your user information and personal information for the following purposes:

(i) Services. To provide, process, maintain, improve and develop our Services provided to you, including customer support, and other services provided through our products.

(ii) Statistical analysis. To develop and analyze statistics on the use of our products and Services for the purpose of improving our products and our Services.

(iii) To create an account. The personal information that we collect when you use our Services to create an account will be used by us to create your account and profile.

(iv) To provide location-based services. When you use our Services, we or third party service providers may take advantage of your location information to provide you with advertising, the correct version of our Services and help you gain good user experience.

(v) To improve user experience. Certain optional features such as user experience programs allow MakeupPlus to analyze data regarding the use of our products and our Services and improve user experience.

(vi) To provide push services. Device information may be used by us to provide push services to assess the performance of adverts and the success of software updates, or provide notifications on new product releases.

(vii) To verify your identity. Verifying your identity using a text message when you log in to your account helps prevent unauthorized logins to your account.

(viii) To collect feedback from you. Your feedback is of great value in helping MakeupPlus improve our Services. To keep track of your feedback, MakeupPlus may use the personal information provided by you to contact you and retain the records.

(ix) Other purposes. We will collect, store, maintain and use information about you for purposes under the “The Information We Collect”, and for purposes of running our operations, pursuing our legitimate interests (e.g., research (including marketing research), network and information security, and fraud prevention), and satisfying our legal obligations.

INFORMATION SHARING AND DISCLOSURE

We may share your information with third parties who provide services on our behalf to help with our business activities. These services may include:

(i) Fulfilling orders and delivering packages;

(ii) Providing you with advertising;

(iii) Payment processing;

(iv) Providing customer services;

(v) Fulfilling subscription services;

(vi) Conducting research and analysis; and

(vii) Providing cloud computing infrastructure.

We will not share with or disclose to third parties (other than our service providers) your personal information in whole or in part except for the purposes of:

(i) protecting the security of others or their property;

(ii) preventing or dealing with fraud;

(iii) safeguarding our legitimate rights and interests;

(iv) taking action in line with our purposes as described in the “The Information We Collect” or the “How We Use Information” sections;

(v) complying with laws, rules and regulations or requests by government departments, judicial authorities, law enforcement, or private parties, which are typically designed to uphold Internet security and the rights, property and safety of us, our users and third parties; and/or

(vi) evaluating or completing a transaction where we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or other event where your information may be sold or transferred.

BASES FOR USING YOUR INFORMATION

We will only collect and process personal information where we have lawful bases and we typically rely on one of the following four legal bases: -

(i) consent (where you have given consent);

(ii) contract (where processing is necessary for the performance of a contract with you, for example, to operate the site or deliver any services you have requested);

(iii) legitimate interests (for example we need to use your information to provide and improve our Services, including protecting your account, providing customer support). We rely on our legitimate interests as our lawful basis only where those interests are not overridden by the impact on you (unless we have your consent or our processing is otherwise required or permitted by law); and

(iv) legal obligations (to comply with the laws, rules and regulations or requests by government departments, judicial authorities or law enforcement).

If you have questions about the lawful bases on how we process your personal information, please contact us at compliance@evelabinsight.com (please quote “MakeupPlus” in your email title).

THIRD PARTY WEBSITES AND SERVICES

Our Services may contain links to other websites and services. In addition, other websites and services may reference or link to our Services. These other domains and websites are not controlled by us, and we do not endorse or make any representations about third party websites or services. We encourage our users to read the privacy policies of each and every website and service with which they interact. Visiting these other websites or services is at your own risk.

INFORMATION SECURITY

We will take reasonable measures to prevent the loss, improper use of, unauthorized access to or disclosure of information. For example, some of our Services will use encryption techniques (such as SSL) to protect your personal information. However, you understand and accept that (in the Internet industry) even though we take reasonable security measures, we cannot always guarantee that your information is 100% secure. You understand and accept that we cannot ensure or warrant the security of any information you provide to us. We do not accept liability for unintentional disclosure. Further, you understand and accept that the system and communication network used by you to access our Services may fail due to factors beyond our control.

INFORMATION ACCESS AND CONTROL

We will take all reasonable and appropriate technical measures to ensure that you can access, update and correct your personal information or other personal information provided to us by you when using our Services. Before you access, update, correct or remove such personal information, we may verify your identity in order to protect the security of your account.

DATA RETENTION

Subject to applicable laws, rules and regulations and the fulfillment of our business or legal purposes, we will delete your information (including your personal information) promptly upon your termination of your account with us.

PRIVACY RIGHTS

In accordance with applicable law, you may have the right to: (i) request confirmation of whether we are processing your personal information; (ii) obtain access to or a copy of your personal information; (iii) receive an electronic copy of personal information that you have provided to us, or ask us to send that information to another company (right to data portability); (iv) object to or restrict our uses of your personal information; (v) seek correction or amendment of inaccurate, untrue, incomplete, or improperly processed personal information; (vi) withdraw your consent; and (vii) request erasure of personal information held about you by us, subject to certain exceptions prescribed by law.

If you wish to exercise your rights, you may send an email to compliance@evelabinsight.com (please quote “MakeupPlus” in your email title) or mail your request to Unit 7702A, Level 77, International Commerce Centre, 1 Austin Road West, Kowloon, Hong Kong (attention: Legal Department, EveLab Insight). We will process your request in line with applicable laws within a reasonable period of time after receiving your email or mail, and will cease collecting, using and disclosing your personal information thereafter, subject to certain exceptions prescribed by law. To protect your privacy, we will take steps to verify your identity before fulfilling your request. Please note that if you withdraw your consent or delete your personal information, your use of some of our Services may be affected.

California residents have the right not to receive discriminatory treatment by us for the exercise of their rights conferred by the California Consumer Privacy Act.

INFORMATION ABOUT CHILDREN

We will not knowingly collect or request personal information from children under 16 (or any other age stipulated by law applicable to your region). If you are under 16, please do not send your personal information to us, including but not limited to your name, address, phone number or email address. If you believe we may have any information about children under 16 (or any other age stipulated by law as children applicable to your region), you may send an email to (please quote “MakeupPlus” in your email title) or send a registered mail to Unit 7702A, Level 77, International Commerce Centre, 1 Austin Road West, Kowloon, Hong Kong (attention: Legal Department, EveLab Insight). If we learn that we have collected personal information from children under 16 (or any other age stipulated by law applicable to your region), we will promptly take steps to delete such information and terminate the associated account.

CROSS-BORDER DATA TRANSFERS

Depending on the jurisdiction in which you are a user of, and subject to the special rules and policy of such jurisdiction as stated in this Policy, you understand and agree that all information collected via or by us may be transferred, processed, and stored anywhere in the world, including but not limited to, the People’s Republic of China, the Hong Kong Special Administrative Region of the People’s Republic of China (“Hong Kong”), Japan, South Korea, Singapore, the United States, the European Union, in the cloud, on our servers, on the servers of our affiliates, or the servers of our service providers, in order to provide our Services.

GOVERNING LAW

This Policy is established, comes into force, and will be enforced and interpreted under the laws of Hong Kong, without regard to its conflict of law provisions. Any disputes arising hereunder will also be resolved in accordance with the Terms of Service. We do not represent or warrant that this Policy complies with the privacy law of any jurisdiction. Therefore, you should not interpret this Policy in accordance with such law.

AMENDMENTS TO THIS POLICY

You agree that we may update this Policy according to relevant laws and regulations or based on our business decisions, and you agree to be bound by any such revisions hereto. We will post any significant changes to this Policy on MakeupPlus or notify you by other means as required by law.

FOR USERS IN THE EUROPEAN ECONOMIC AREA AND THE UNITED KINGDOM

For cases in which we process personal information within the scope of the European General Data Protection Regulation and the UK General Data Protection Regulation (collectively, “GDPR”), you will find the relevant details on the processing of your personal information in the GDPR Notice below.

FOR USERS IN JAPAN

Right to data disclosure, correction, erasure or suspension of use

If you are in Japan, as a data subject, you have the right to request the disclosure, correction, erasure or suspension of use of your personal information, and we are obliged to meet your request without undue delay. You may send your request by email to compliance@evelabinsight.com (please quote “MakeupPlus” in your email title) or by mail to Unit 7702A, Level 77, International Commerce Centre, 1 Austin Road West, Kowloon, Hong Kong (attention: Legal Department, EveLab Insight).

FOR USERS IN SOUTH KOREA

International Data Transfers

We process the personal information of users only within the scope specified under HOW WE USE INFORMATION, and in principle, will not provide personal information of users to a third party. However, with your consent, for purposes of providing our Services described under INFORMATION SHARING AND DISCLOSURE to you, we may collect your personal information from, transfer it to, and store and process it elsewhere.

· Personal information transferred: please refer to the section “The Information We Collect” of this Policy above

· Transfer date and method: transferred on submission for storage and processing

· Country to which personal information is transferred: the People’s Republic of China

· Retention of personal information: please refer to the section “Data Retention” of this Policy above

Also, we may transfer your personal information to the following third parties located outside of South Korea:

Name of the person providing personal information	Purpose of the use of personal information	Particulars of personal information to be collected	Period for retaining and using personal information
Apple Inc. https://www.apple.com/legal/privacy/en-ww/	Subscription payment services	IDFA, IP User's UID, location	For such period as stated in the privacy policy of the relevant third-party platform
		IDFA, GAID, Android ID, IP User's UID, location
Google LLC https://policies.google.com/privacy?hl=en-US		IDFA, GAID, Android ID, IP User's UID, location
		IDFA, GAID, Android ID, IP User's UID, location
		IDFA, GAID, Android ID, IP User's UID, location

We may also transfer your personal information to the third-party service providers located outside of South Korea which provide advertisements within our Services.

Whenever we share information outside of where you live, we ensure that the transfer complies with your local law so that your personal information is adequately protected.

You may refuse the above overseas transfer of your personal information by contacting our department in charge of protecting personal information as stated below. If you refuse to the said overseas transfer of your personal information, we will exclude your personal information from those subject to overseas transfer. However, in such case, we may restrict your use of our Services that require overseas transfer of personal information.

Also, we may receive your personal information from the following third parties:

Name of the person providing personal information	Purpose of the use of personal information	Particulars of personal information to be collected	Period for retaining and using personal information
Apple Inc. https://www.apple.com/legal/privacy/en-ww/	Subscription payment services	IDFA, IP User’s UID, Location	Until your termination of your account with us
Google LLC https://policies.google.com/privacy?hl=en-US		IDFA, GAID, Android ID, IP User’s UID, Location
		Android ID, IDFA, GAID, User’s UID
		Android ID, IDFA, GAID, User’s UID
		IDFA, GAID, Android ID, IP User's UID, location

Data Retention

1. Procedures for Destruction: We select personal information subject to destruction and destroy them with approval of our data protection officer.

2. Method of Destruction: We will destroy personal information stored and filed electronically in a way that can be deleted by using a means that renders the record irrecoverable as far as possible.

Department in Charge of Protecting Personal Information and Handling Complaints

EveLab Insight Hong Kong Limited

Attn: Arthur Law, Head of Legal Department Unit 7702A, Level 77, International Commerce Centre,

1 Austin Road West, Kowloon,

Hong Kong

Email: compliance@evelabinsight.com (please quote “MakeupPlus” in your email title)

FOR USERS IN THE UNITED STATES OF AMERICA

You agree that EveLab Insight and the Companies may use facial recognition technology to collect biometric information from the photos or images you provide. EveLab Insight and the Companies may use such information to provide and improve the Service, and for our internal research purposes. If your biometric information is subject to the Illinois Biometric Information Privacy Act, we will delete your biometric information within three years of your last interaction with the Service.

In accordance with applicable law, you may have the right to:

(i) confirm whether or not we are processing your personal information;

(ii) obtain access to or a copy of your personal information with accompanying details;

(iii) receive an electronic copy of personal information that you have provided to us, or ask us to send that information to another company i.e., right of data portability;

(iv) correct your personal information;

(v) request to opt-out of certain processing activities including, as applicable, if we process your personal information for “targeted advertising” (as “targeted advertising” is defined by applicable privacy laws), if we “sell” your personal information (as “sell” is defined by applicable privacy laws), or if we engage in profiling in furtherance of certain decisions that produce legal or similarly significant effects concerning you;

(vi) request erasure of personal information held about you by us; and

(vii) appeal our decision to decline to process your request.

If you would like to exercise any of your rights under the applicable privacy laws, please contact our Data Protection Officer via email at compliance@evelabinsight.com (please quote “MakeupPlus” in your email title) or via registered mail at Unit 7702A, Level 77, International Commerce Centre, 1 Austin Road West, Kowloon, Hong Kong (attention: Legal Department, EveLab Insight). We will process such requests in accordance with applicable laws.

If you are a Virginia resident and would like to appeal our decision with respect to your request, you may do so by informing us of this and providing us with information supporting your appeal.

The following paragraphs only apply to our processing of your personal information that is subject to the California Consumer Privacy Act (as amended from time to time) (“CCPA”).

The CCPA provides California residents with the right to know what categories of personal information we have collected about them, and whether we disclosed that personal information for a business purpose (e.g., to a service provider) in the preceding twelve months. California residents can find this information below:

Category of Personal Information Collected	Category of Third Parties to Whom Personal Information is Disclosed to for a Business Purpose
Identifiers	· Service Providers · EveLab Insight Affiliates
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))	· Service Providers · EveLab Insight Affiliates
Protected classification characteristics under California or federal law	· Service Providers · EveLab Insight Affiliates
Commercial information	· Service Providers · EveLab Insight Affiliates
Biometric information	· Service Providers · EveLab Insight Affiliates
Internet or other electronic network activity	· Service Providers · EveLab Insight Affiliates
Geolocation data	· Service Providers · EveLab Insight Affiliates
Sensory data	· Service Providers · EveLab Insight Affiliates
Professional or employment-related information	N/A
Non-public education information (per the Family Education Rights and Privacy Act (20 U.S.C. Sec. 1232g, 34 C.F.R. Part 99))	N/A
Inferences drawn from other personal information to create a profile about a consumer	· Service Providers · EveLab Insight Affiliates
Personal information that reveals a consumer’s social security, driver’s license, state identification card, or passport number	N/A
Personal information that reveals a consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account	· Service Providers · EveLab Insight Affiliates
Personal information that reveals a consumer’s precise geolocation	· Service Providers · EveLab Insight Affiliates
Personal information that reveals a consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership	· Service Providers · EveLab Insight Affiliates
Personal information that reveals the contents of a consumer’s mail, email, and text messages unless MakeupPlus is the intended recipient of the communication	N/A
Personal information that reveals consumer’s genetic data	N/A
Biometric information that is processed for the purpose of uniquely identifying a consumer	N/A
Personal information collected and analyzed concerning a consumer’s health	N/A
Personal information collected and analyzed concerning a consumer’s sex life or sexual orientation	N/A

The categories of sources from which we collect Personal Information and our business and commercial purposes for using and disclosing Personal Information are set forth in “The Information We Collect”, “How We Use Information”, and “Information Sharing and Disclosure” above, respectively. We will retain personal information in accordance with the time periods set forth in “Data Retention” above.

In the preceding twelve months, we have not “sold” any personal information (as defined by the CCPA), nor do we have actual knowledge of any “sale” of personal information of minors under 16 years of age.

In the preceding twelve months, we have not “shared” any personal information for “cross-context behavioral advertising” (as such terms are defined in the CCPA), nor do we have actual knowledge of any “sharing” of personal information of minors under 16 years of age for “cross-context behavioral advertising”

We only use and disclose sensitive personal information for the following purposes:

(i) To provide the Services.

(ii) To prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, and or confidentiality of stored or transmitted personal information.

(iii) To resist malicious, deceptive, fraudulent, or illegal actions directed at us and to prosecute those responsible for those actions.

(iv) To ensure the physical safety of natural persons.

(v) To verify or maintain the quality or safety of our products, Services, or devices, and to improve, upgrade, or enhance our Services or devices.

(vi) For purposes that do not infer characteristics about individuals.

California residents have the right not to receive discriminatory treatment by us for the exercise of their rights conferred by the CCPA.

To protect your privacy, we will take steps to reasonably verify your identity before fulfilling requests submitted under the CCPA. These steps may involve asking you to provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative. Examples of our verification process may include asking you to provide the email address or phone number we have associated with you and providing a verification code that is sent to your email address or phone number.

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. To authorize an agent, provide written authorization signed by you and your designated agent and contact us using the information in “Privacy Rights” above for additional instructions.

We do not “sell” personal information or “share” personal information for “cross-context behavioral advertising” so we do not respond to opt-out preference signals.

If you are a Nevada resident, we do not “sell” your personal information.

FOR USERS IN BRAZIL

Legal basis for processing data

If you are in Brazil, the legal basis for processing your personal information that we may rely on are:

(i) consent (where you have given consent);

(ii) contract (where processing is necessary for the performance of a contract with you, for example, to operate the site or deliver any services you have requested);

(iii) legal obligations (to comply with the laws, rules and regulations or requests by government departments, judicial authorities or law enforcement); and

(iv) to prevent fraud and for the purpose of protect credit.

If you have questions about the lawful bases on how we process your personal information, please contact us at compliance@evelabinsight.com (please quote “MakeupPlus” in your email title).

Right to data disclosure, correction, erasure or suspension of use, portability and to withdraw consent

If you are in Brazil, as a data subject, you have the right to request the disclosure, correction, erasure, suspension of use or portability of your personal data, as well as the rights to withdraw consent and to be informed about the potential negative consequences of such withdrawal, and to be informed about public and private entities with which we have shared your personal data, and we are obliged to meet your request without undue delay. You may send your request by email to compliance@evelabinsight.com (please quote “MakeupPlus” in your email title) or by mail to Unit 7702A, Level 77, International Commerce Centre, 1 Austin Road West, Kowloon, Hong Kong (attention: Legal Department, EveLab Insight).

Sensitive personal information

If you are in Brazil, you understand and agree that, in order to be able to render our Services to you, we may collect sensitive personal information, such as facial features of the characters in photos and other elements contained in photos.

Representative

If you are in Brazil, you can contact our Data Protection Officer via email at compliance@evelabinsight.com (please quote “MakeupPlus” in your email title) or mail to Unit 7702A, Level 77, International Commerce Centre, 1 Austin Road West, Kowloon, Hong Kong (attention: Legal Department, EveLab Insight).

International Data Transfers

To provide our Services to you, we may collect your personal information from, transfer it to, and store and process it elsewhere.

· Personal information transferred: please refer to the section “The Information We Collect” of this Policy above

· Transfer date and method: transferred on submission for storage and processing

· Country to which personal information is transferred: The People's Republic of China

· Retention of personal information: please refer to the section “Data Retention” of this Policy above

Whenever we share information outside of where you live, we ensure that the transfer complies with your local law so that your personal information is adequately protected.

Data Retention

Subject to applicable laws, rules and regulations and the fulfillment of our business or legal purposes, we will retain your information (including your personal information) for such period as is required for us to continue to provide you with our Services, as well as during the limitations statutes set forth in the Brazilian Civil Core, LGPD, Brazilian Civil Rights Framework for the Internet, and Brazilian Consumer Protection Code.

We will destroy your personal information without delay when your personal information becomes unnecessary. When we destroy your personal information, we will take commercially reasonable and technically feasible measures to ensure the personal information is permanently deleted.

After the termination of Services we may retain your personal information to comply with legal or regulatory obligations, transfer to third parties, provided that the requirements for data processing as provided in LGPD are obeyed, and for our exclusive use, provided the information will be anonymized.

Choice of law

If you are resident in Brazil, this Policy will be enforced and interpreted under the laws of Brazil.

GDPR NOTICE

In context with the provision of the Services we process personal data.

If the GDPR applies to our processing of your personal data, we process personal data only in accordance with the GDPR. In our above (general) Privacy Policy, you find information on when the GDPR applies to our processing of personal data. This GDPR Notice supplements the above (general) Privacy Policy and includes detailed information on our processing of your personal data under the GDPR.

I. Information on the controller

1. Identity and contact details of the controller

EveLab Insight Hong Kong Limited

Unit 7702A, Level 77, International Commerce Centre,

1 Austin Road West, Kowloon,

Hong Kong

compliance@evelabinsight.com

2. Identity and contact details of the controller’s representatives

The European Union

Rivacy GmbH

Mexikoring 33

22297 Hamburg

info@rivacy.eu

The United Kingdom

Rivacy Limited

St James’ Hall, Mill Road

Lancing, West Sussex BN15 0PT

United Kingdom

3. Contact details of the controller’s data protection officer

EveLab Insight Hong Kong Limited

Legal Department

Unit 7702A, Level 77, International Commerce Centre,

1 Austin Road West, Kowloon,

Hong Kong

compliance@evelabinsight.com

II. Information on the processing of personal data

1. Details on the personal data which are processed

Categories of personal data processed	Personal data included in the categories	Sources of the data	Obligation of the data subject to provide the data	Storage duration
Protocol Data	Protocol data which accrue when using the Services to provide content from the server of our applications. The data accruing during use is defined by the network protocol for transferring information between your terminal device and the applications' server. This includes IP address, type and version of the mobile operating system used, the content accessed, the content previously accessed, date and time of access.	User of the Services	The provision of the data is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data. If the data is not provided, we cannot provide the content of our applications requested by you.	The data you provide will remain stored in your account for as long as your account exists until you delete it yourself. You can delete your account at any time.
Registration Data	Name, username, gender, date of birth, mobile phone number, location.	User of the Services	The provision of the information marked as mandatory during the registration process is a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data. If the mandatory information is not provided, you cannot make full use of the Services.	The data you provide will remain stored in your account for as long as your account exists until you delete it yourself. You can delete your account at any time.
Subscription Data	Information on current and/or past subscriptions.	User of the Services	The provision of the information marked as mandatory during the registration process is a requirement necessary to enter into a subscription contract. The provision of other data is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data. If the mandatory information is not provided, you cannot make full use of the Services.	The data you provide will remain stored in your account for as long as your account exists until you delete it yourself. You can delete your account at any time.
Mobile Device Data	Information about your mobile device, including its International Mobile Equipment Identity (IMEI), Unique Device Identifier (UDID) or Android ID, Universally Unique Identifier (GUUID), User ID (UID), Identifier for Advertising (IDFA) and Identifier for Vendor (IDFV), Open Anonymous Device Identifier (OAID), Integrated Circuit Card Identifier (ICCID), Media Access Control (MAC) address, Google Advertising ID (GAID), the type of device you use, operating system version, a list of mobile applications installed on your device and resolution.	User of the Services	The provision of the data is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data. If the data is not provided, we cannot provide the content of our applications requested by you.	The data you provide will remain stored in your account for as long as your account exists until you delete it yourself. You can delete your account at any time.
Mobile Analytics Data	Information to better understand and improve the functionality of our Services. These include information such as how often you use the application, the events that occur within the application, aggregated usage, performance data, and where the application was downloaded from.	User of the Services	The provision of the data is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.	The data you provide will remain stored in your account for as long as your account exists until you delete it yourself. You can delete your account at any time.
Network Data	Name of the operator and the type of network, name of the WiFi network to which you connect, the location of the WiFi network, and the duration of your WiFi connection.	User of the Services	The provision of the data is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.	The data you provide will remain stored in your account for as long as your account exists until you delete it yourself. You can delete your account at any time.
Location Data	Country code, latitude and longitude, network location, IP address and the system country and system time zone recorded on your device.	User of the Services	The provision of the data is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.	The data you provide will remain stored in your account for as long as your account exists until you delete it yourself. You can delete your account at any time.
Log Data	Log Information may include (i) details on when and how often you use our Services, (ii) device statistics, including critical operation paths, errors, crashes, language and time zone.	User of the Services	The provision of the data is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.	The data you provide will remain stored in your account for as long as your account exists until you delete it yourself. You can delete your account at any time.
Image Data	Photo/video of the data subject; EXIF data stored in the image file (EXIF data may contain GPS coordinates where photos were taken and processed, equipment type, ISO and information about the front and rear cameras and creation time, depending on the equipment manufacturer).	User of the Services	The provision of the data is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data. If the data is not provided, you cannot make full use of the Services.	The data are stored in server log files for a maximum period of 21 days.
Meta Data	Information which describes the analysis results of facial features, gender, age of the characters in photos and other elements contained in photos.	User of the Services	The provision of the data is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data. If the data is not provided, you cannot make full use of the Services.	The data you provide will remain stored in your account for as long as your account exists until you delete it yourself. You can delete your account at any time.
Face Recognition Data	Facial feature information of data subject (including but not limited to facial images and facial marks).	User of the Services	The provision of the data is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data. If the data is not provided, you cannot make full use of the Services.	When the content recommendation is finished or upon the closing of the application, the facial mapping information is discarded.
Cookie Data	Data subject’s Internet Protocol (IP) address, browser type, Internet Service Provider (ISP), referring and exit pages, operating system, dates and timestamps, clickstream data. To the extent such personal data is stored in cookies, you can find more detailed information in Section III below.	User of the Services	The provision of the data is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data. If the data is not provided, you cannot make full use of the Services.	The data you provide will remain stored in your account for as long as your account exists until you delete it yourself. You can delete your account at any time. The data will be erased when the user logs out from their account. The cookie will be replaced when the token is expired (after 30 days).
Information Collected Through Integration with ChatGPT or Similar Services	Personal data that is included in the text inputs and the generated outputs.	User of the Services	The provision of the data is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data. If the data is not provided, you cannot make full use of the Services.	The data you provide will remain stored in your account for as long as your account exists until you delete it yourself. You can delete your account at any time.
Advertisement Data	Advertising ID (including IMEI, Android ID, OAID, IMSI, ICCID, GAID, MEID, mac addr, IDFV, IDFA), geographic location and IP address.	User of the Services	The provision of the data is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data. If you do not provide this data we are not able to provide you with interest-based advertising.	The data you provide will remain stored in your account for as long as your account exists until you delete it yourself. You can delete your account at any time.
Third Party Tracking Data	Device identifiers, region (defined as the location where a given language is used), location information, IP address. To the extent such personal data is stored in cookies, you can find more detailed information in Section III below.	User of the Services	The provision of the data is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. There is no obligation of the data subject to provide the data.	The data you provide will remain stored in your account for as long as your account exists until you delete it yourself. You can delete your account at any time.

2. Details on the processing of the personal data

Purpose of processing the personal data	Categories of personal data processed	Automated decision-making	Legal basis and, where applicable, legitimate interests	Recipient
Provision of the Services	Protocol Data Registration Data Subscription Data Network Data Location Data Image Data Meta Data Face Recognition Data Information Collected Through Integration with ChatGPT or Similar Services	No automated decision-making takes place.	For processing activities relating to the app user: Art. 6 (1) (b) GDPR (performance of a contract to which the data subject is party or taking steps at the request of the data subject prior to entering into a contract) For processing of Location Data: Art. 6 (1) (a) GDPR (consent) For processing activities relating to data subjects different from the device owner: Art. 6 (1) (f) GDPR (pursuing legitimate interests under balancing of interests): Our legitimate interest is the provision of our services	Other EveLab Insight entities Apple Inc. Google LLC Meta Platform, Inc.
Statistical analysis (develop and analyse statistics on the use of our products and Services for the purpose of improving our products and Services)	Protocol Data Mobile Device Data Mobile Analytics Data Network Data Location Data Log Data Cookie Data	No automated decision-making takes place.	Art. 6 (1) (a) GDPR (consent)	Other EveLab Insight entities Apple Inc. Google LLC Meta Platform, Inc.
Creating an account	Protocol Data Registration Data Subscription Data Location Data	No automated decision-making takes place.	Art. 6 (1) (f) GDPR (pursuing legitimate interests under balancing of interests): Our legitimate interest is the provision of the content of our applications requested by the user.	Other EveLab Insight entities Apple Inc. Google LLC Meta Platform, Inc.
Providing location-based services (for providing user with advertising, the correct version of our Services and help user gaining good user experience)	Protocol Data Location Data Advertisement Data	No automated decision-making takes place.	Art. 6 (1) (a) GDPR (consent)	Other EveLab Insight entities Apple Inc. Google LLC
Improving user experience (optional features such as user experience programs allow us to analyse data regarding the use of our products and our Services and improve user experience)	Protocol Data Mobile Device Data Mobile Analytics Data Network Data Location Data Log Data Image Data Meta Data Cookie Data Third Party Tracking Data	No automated decision-making takes place.	Art. 6 (1) (a) GDPR (consent)	Other EveLab Insight entities Apple Inc. Google LLC Meta Platform, Inc,
Providing push services (for assessing the performance of adverts and the success of software updates, or providing notifications on new product releases)	Protocol Data Mobile Device Data Advertisement Data	No automated decision-making takes place.	Art. 6 (1) (a) GDPR (consent)	Other EveLab Insight entities Apple Inc. Google LLC Meta Platform, Inc.
Verifying user’s identity	Protocol Data Registration Data	No automated decision-making takes place.	Art. 6 (1) (f) GDPR (pursuing legitimate interests under balancing of interests): In this case, our legitimate interest is verifying your identity to be able to provide the Services to you.	Other EveLab Insight entities Apple Inc. Google LLC
Collecting feedback from user (to help us improve our Services)	Protocol Data Registration Data	No automated decision-making takes place.	Art. 6 (1) (a) GDPR (consent)	Other EveLab Insight entities Apple Inc. Google LLC Meta Platform, Inc.
Complying with any applicable rules, laws and regulations, codes of practice or guidelines or to assist in law enforcement and investigations by relevant authorities	Protocol Data Registration Data Subscription Data	No automated decision-making takes place.	Art. 6 (1) (c) GDPR (necessary for compliance with a legal obligation to which the controller is subject)	Public authorities Other EveLab Insight entities
Maintaining the safe and stable operation of the Services, such as identifying or dealing with any failure of the Services	Protocol Data Network Data Log Data	No automated decision-making takes place.	Art. 6 (1) (f) GDPR (pursuing legitimate interests under balancing of interests): Our legitimate interest is ensuring the safe and stable operation of the IT infrastructure used for the provision of the Services.	Other EveLab Insight entities
Protecting the security of your account, network, operation, and system, and to prevent phishing, website fraud and Trojan horse viruses	Protocol Data Network Data Log Data	No automated decision-making takes place.	Art. 6 (1) (f) GDPR (pursuing legitimate interests under balancing of interests): Our legitimate interest is ensuring the security of the IT infrastructure used for the provision of our websites, in particular for the detection, elimination and conclusive documentation of incidents (e.g. DDoS attacks).	Other EveLab Insight entities
Processing of requests (customer service)	Protocol Data Registration Data Subscription Data	No automated decision-making takes place.	If your request concerns a contract to which you are party or the performance of pre-contractual measures: Art. 6 (1) (b) GDPR (performance of a contract to which the data subject is party or taking steps at the request of the data subject prior to entering into a contract). Otherwise: Art. 6 (1) (f) GDPR (pursuing legitimate interests under balancing of interests): In this case, our legitimate interest is the processing of your request.	Other EveLab Insight entities

3. Details on the recipients of personal data and the transfer of personal data to third countries and/or international organizations

To support our global operations, we may transfer your personal data across borders to our affiliates and the following third parties.

Recipient	Recipient’s role	Transfers to third countries and/or international organisations
Apple Inc.	Processor	United States
Google LLC	Processor	United States
Meta Platform, Inc.	Processor	United States
Alibaba Cloud (Singapore) Private Limited	Processor	Singapore
Beijing Volcano Engine Technology Co., Ltd.	Processor	China

If your personal data is transferred to jurisdictions located outside of the EEA, the UK, or Switzerland, we will ensure that appropriate safeguards are in place. These may include:

1. there is an adequacy decision of the EU Commission for the country where the recipient is located;

2. we have concluded so-called standard data protection clauses pursuant to Art. 46(2)(c) GDPR (or their approved equivalents for the UK and Switzerland) with the recipient;

3. in certain situations, we rely on derogations provided for under the applicable law together with measures required under the applicable law to safeguard the security of your data.

To request information about our safeguards for cross-border data transfers, please contact us using the contact information in Section I.

III. Information on the use of cookies or similar technologies

The following section currently only deals with cookies. If similar technologies (browser fingerprints, local storage, session storage, etc.) are used, this section would have to be adapted accordingly.

We use cookies in connection with offering our Services. In doing so, we use the processing and storage functions of your device and/or your device’s browser and collect information from the memory of your device and/or your device’s browser.

You will find more detailed information on this in the following.

1. General information on cookies

Cookies are small text files with information that can be placed on a user’s device when an app is used or a website is visited. When the relevant app or website is used or visited again with the same device, the cookie and the information it contains can be retrieved.

a) First-party and third-party cookies

Depending on where a cookie comes from, a distinction can be made between first-party cookies and third-party cookies:

First-party cookies	Cookies that are placed and accessed by the operator of the app or website as the controller or by a processor engaged by the controller
Third-party cookies	Cookies that are placed and accessed by controllers other than the operator of the app or website that are not processors engaged by the operator of the app or website

b) Transient and persistent cookies

A distinction can be made between transient and persistent cookies depending on how long they remain active:

Transient cookies

(Session cookies)

Cookies that are automatically deleted when you close the app or your browser

Persistent cookies

Cookies that remain stored on your device for a certain period of time after the app or browser is closed

c) Consent-free cookies and cookies requiring consent

Users’ consent is required for some cookies depending on their function and purpose of use. Thus, a distinction can be made between cookies that require users’ consent and those that do not:

Consent-free cookies	Cookies that have as their sole purpose to transmit a message using an electronic communication network
Consent-free cookies	Cookies that are necessary so that the party offering a service that has been expressly requested by a participant or user can provide this service (“strictly necessary cookies”)
Cookies requiring consent	Cookies for all purposes of use other than the aforementioned

2. Management of the cookies used in our app and on our website

a) Granting and withdrawing consents to the use of cookies in the data protection settings of our app and website

If consent is necessary for the use of certain cookies, we only use these cookies if you have previously granted your consent to this. You can find information as to whether the use of a particular cookie requires consent in the information on the cookies used in our Services in Section III.3. of this Privacy Policy.

You cannot deactivate cookies that are strictly necessary in the data protection settings of our app or website. However, you can generally deactivate these cookies in your app or browser at any time.

b) Managing cookies using device/browser settings

You can also manage the use of cookies in your device’s or your browser’s settings. Different browsers have different ways to configure cookie settings. You can find more extensive information on this, for example at .

However, we would like to point out that some functions of our app or website may not work properly or at all if you deactivate cookies in general on your device.

3. Cookies used in our app and on our website

The following cookies may be used in our app and on our website:

Name

First-party / third-party

Purpose of use and content

Effective term

Consent necessary?

mt_access_token

First-party

User login token

It will be erased when users log out from their account. It will be replaced when the token is expired (30 days).

mt_client_id

First-party

User login token

It will be erased when users log out from their account. It will be replaced when the token is expired (30 days).

IV. Information on the rights of data subjects

As a data subject, you have the following rights with regard to the processing of your personal data:

Right of access (Art. 15 GDPR)

Right to rectification (Art. 16 GDPR)

Right to erasure (“right to be forgotten”) (Art. 17 GDPR)

Right to restriction of processing (Art. 18 GDPR)

Right to data portability (Art. 20 GDPR)

Right to object (Art. 21 GDPR)

Right to withdraw consent (Art. 7 (3) GDPR)

You may contact us for the purpose of exercising these rights using the contact information in Section I.

Where applicable, you find information on any specific modalities and mechanisms which facilitate the exercise of your rights, in particular the exercise of your rights to data portability and to object, in the information on the processing of personal data in Section II of this GDPR Notice.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

Below you find more detailed information on your rights with regard to the processing of your personal data:

1. Right of access

As a data subject, you have a right to obtain access and information under the conditions provided in Art. 15 GDPR.

This means in particular that you have the right to obtain confirmation from us as to whether we are processing your personal data. If so, you also have the right to obtain access to the personal data and the information listed in Art. 15 (1) GDPR. This includes information regarding the purposes of the processing, the categories of personal data that are being processed and the recipients or categories of recipients to whom the personal data have been or will be disclosed (Art. 15 (1) (a), (b) and (c) GDPR).

You can find the full extent of your right to access and information in Art. 15 GDPR.

2. Right to rectification

As a data subject, you have the right to rectification under the conditions provided in Art. 16 GDPR.

This means in particular that you have the right to receive from us without undue delay the rectification of inaccuracies in your personal data and completion of incomplete personal data.

You can find the full extent of your right to rectification in Art. 16 GDPR.

3. Right to erasure (“right to be forgotten”)

As a data subject, you have a right to erasure (“right to be forgotten”) under the conditions provided in Art. 17 GDPR.

This means that you have the right to obtain from us the erasure of your personal data and we are obliged to erase your personal data without undue delay when one of the reasons listed in Art. 17 (1) GDPR applies. This can be the case, for example, if personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed (Art. 17 (1) (a) GDPR).

If we have made the personal data public and are obliged to erase it, we are also obliged, taking account of available technology and the cost of implementation, to take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you have requested the erasure by such controllers of any links to, or copy or replication of those personal data (Art. 17 (2) GDPR).

The right to erasure (“right to be forgotten”) does not apply if the processing is necessary for one of the reasons listed in Art. 17 (3) GDPR. This can be the case, for example, if the processing is necessary for compliance with a legal obligation or for the establishment, exercise or defence of legal claims (Art. 17 (3) (b) and (e) GDPR).

You can find the full extent of your right to erasure (“right to be forgotten”) in Art. 17 GDPR,.

4. Right to restriction of processing

As a data subject, you have a right to restriction of processing under the conditions provided in Art. 18 GDPR.

This means that you have the right to obtain from us the restriction of processing if one of the conditions provided in Art. 18 (1) GDPR applies. This can be the case, for example, if you contest the accuracy of the personal data. In such a case, the restriction of processing lasts for a period that enables us to verify the accuracy of the personal data (Art. 18 (1) (a) GDPR).

Restriction means that stored personal data are marked with the goal of restricting their future processing (Art. 4 (3) GDPR).

You can find the full extent of your right to restriction of processing in Art. 18 GDPR.

5. Right to data portability

As a data subject, you have a right to data portability under the conditions provided in Art. 20 GDPR.

This means that you generally have the right to receive your personal data with which you have provided us in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance from us if the processing is based on consent pursuant to Art. 6 (1) (a) or Art. 9 (2) (a) GDPR or on a contract pursuant to Art. 6 (1) (b) GDPR and the processing is carried out by automated means (Art. 20 (1) GDPR).

You can find information as to whether an instance of processing is based on consent pursuant to Art. 6 (1) (a) or Art. 9 (2) (a) GDPR or on a contract pursuant to Art. 6 (1) (b) GDPR in the information regarding the legal basis of processing in Section II of this GDPR Notice.

In exercising your right to data portability, you also generally have the right to have your personal data transmitted directly from us to another controller if technically feasible (Art. 20 (2) GDPR).

You can find the full extent of your right to data portability in Art. 20 GDPR=.

6. Right to object

As a data subject, you have a right to object under the conditions provided in Art. 21 GDPR.

At the latest in our first communication with you, we expressly inform you of your right, as a data subject, to object.

More detailed information on this is given below:

Right to object on grounds relating to the particular situation of the data subject

As a data subject, you have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on Art. 6 (1) (e) or (f), including profiling based on those provisions.

You can find information as to whether an instance of processing is based on Art. 6 (1) (e) or (f) GDPR in the information regarding the legal basis of processing in Section II of this GDPR Notice.

In the event of an objection relating to your particular situation, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

You can find the full extent of your right to objection in Art. 21 GDPR=.

Right to object to direct marketing

Where your personal data are processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing.

You can find information as to whether and to what extent personal data are processed for direct marketing purposes in the information regarding the legal basis of processing in Section II of this GDPR Notice.

If you object to processing for direct marketing purposes, we no longer process your personal data for these purposes.

You can find the full extent of your right to objection in Art. 21 GDPR.

7. Right to withdraw consent

Where an instance of processing is based on consent pursuant to Art. 6 (1) (a) or Art. 9 (2) (a) GDPR, as a data subject you have the right to withdraw your consent at any time pursuant to Art. 7 (3) GDPR. The withdrawal of your consent does not affect the legitimacy of the processing that occurred based on your consent until the withdrawal. We inform you of this before you grant your consent.

You can find information as to whether an instance of processing is based on Art. 6 (1) (a) or Art. 9 (2) (a) GDPR in the information regarding the legal basis of processing in Section II of this GDPR Notice.

8. Right to lodge a complaint with a supervisory authority

As a data subject, you have a right to lodge a complaint with a supervisory authority under the conditions provided in Art. 77 GDPR.

The supervisory authorities responsible for us are:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit

Ludwig-Erhard-Str 22, 20459 Hamburg

E-mail: mailbox@datenschutz.hamburg.de

Phone: +49 40 42854-4040

Information Commissioner’s Office E-mail: dpo@ico.org.uk Phone: 0303 123 1113

V. Information on the technical terms of the GDPR used in this GDPR Notice

The technical terms relating to data protection used in this GDPR Notice have the meaning used in the General Data Protection Regulation.

The full scope of the definitions of the General Data Protection Regulation can be found in Art. 4 GDPR.

You will find more detailed information on the most important technical terms of the General Data Protection Regulation used in this GDPR Notice below:

“Personal data” means any information relating to an identified or identifiable natural person (”data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

“Data subject” means the respective identified or identifiable natural person, to which the personal data refers to;

“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

“Recipient” means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;

“Third party” means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;

“International organisation” means an organisation and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries; and

“Third country” means a country which is not a member state of the European Union (”EU”) or the European Economic Area (“EEA”) or the United Kingdom.

FOR USERS IN VIETNAM

If you are a user in Vietnam, this section will supplement and constitute an integral part of the Policy, and is formulated in accordance with the applicable laws and regulations in Vietnam, including Decree 13/2023/ND-CP on personal data protection (as amended from time to time) and other relevant laws, regulations, regulatory requirements and national standards that govern or otherwise relate to the processing of your personal information during the use of our Services (collectively, the “Vietnam Privacy Regulations”).

The terms in this section shall have the same meaning defined under the Policy unless otherwise clearly specified. In the event of any conflict between the terms in this section and the provisions of the main body of the Policy, the terms in this section will prevail.

The Information We Collect

In this Policy, “personal information” or “personal data” refers to any information in the form of symbols, letters, numbers, images, sounds or the like on an electronic medium that is associated with a particular person or helps to identify a particular person. Personal information includes basic personal data and sensitive personal data.

Some of the personal information that we collect may comprise “sensitive personal data”. This refers to personal data that is associated with your privacy that, when violated, will directly affect your legitimate rights and interests. Sensitive personal data that we collect and process include but not limited to location information and facial feature information.

Scope of Processing

The Policy explains how we “process” your personal information. This includes how we may collect, record, analyse, verify, store, correct, disclose, associate, access, retrieve, revoke, encrypt, decrypt, copy, share, transmit, provide, transfer, delete, destroy or undertake such other related actions in respect of your personal information.

Our Legal Bases for Processing Your Personal Information

We will only process your personal information when we have a legal basis to do so. In most cases, we process your personal information after we have obtained your consent for the purposes listed in the Policy.

Your personal information may also be processed in the following cases and for which your consent will not be required, including:

a) in cases of emergency where it is necessary to immediately process the relevant personal information to protect the life and health of you or others;

b) disclosure of the personal information in accordance with the law;

c) processing of personal information by the competent state agencies in the event of a state of emergency on national defence, national security, social order and safety, major disasters or dangerous epidemics; or where there is a risk of a threat to security and national defence but not to the extent of declaring a state of emergency; or to prevent and combat riots and terrorism, to prevent and combat crimes and violations of the law in accordance with the law;

d) fulfilment of obligations under contracts with you with relevant agencies, organisations and individuals as prescribed by law;

e) to serve the activities of state agencies as prescribed by specialised laws; and

f) other cases as prescribed by the law.

Your rights

In accordance with the applicable Vietnam Privacy Regulations, you have the following rights in respect of your personal information that you disclose to us:

· Right to know: You have the right to be informed of the data processing activities in respect of your personal information, unless the law provides otherwise.

· Right to consent: You have the right to agree (or not agree) to the processing of your personal information, except in the following cases:

- in cases of emergency where it is necessary to immediately process the relevant personal information to protect the life and health of you or others;

- disclosure of the personal information in accordance with the law;

- processing of personal information by the competent state agencies in the event of a state of emergency on national defence, national security, social order and safety, major disasters or dangerous epidemics; or where there is a risk of a threat to security and national defence but not to the extent of declaring a state of emergency; or to prevent and combat riots and terrorism, to prevent and combat crimes and violations of the law in accordance with the law;

- fulfilment of obligations under contracts with you with relevant agencies, organisations and individuals as prescribed by law;

- to serve the activities of state agencies as prescribed by specialised laws; and

- other cases as prescribed by the laws.

· Right of access: You have the right to access your personal information in order to view, correct or request correction of your personal information, unless the law provides otherwise.

· Right to withdraw consent: You have the right to withdraw your consent in respect of the processing of your personal information, unless the law provides otherwise.

· Right to deletion: You have the right to delete or request the deletion of your personal information, unless the law provides otherwise.

· Right to restriction of data processing: You have the right to restrict the processing of your personal information, unless the law provides otherwise. The restriction will be carried out within 72 hours after your request, unless the law provides otherwise.

· Right to be provided with data: You have the right to request us to provide you with your personal information, unless the law provides otherwise.

· Right to object: You have the right to object our processing of your personal information in order to prevent or limit the disclosure of your personal information or its use for advertising and marketing purposes, unless the law provides otherwise. We will fulfil your request within 72 hours after receiving such request, unless the law provides otherwise.

· Right to complain, denounce and initiate lawsuits: You have the right to complain, denounce and initiate lawsuits in accordance with the law.

· Right to claim compensation: You have the right to claim compensation in accordance with the law if there is a violation of the applicable laws, unless the law provides or agreed otherwise by you and us.

· Right to self-defence: You have the right to self-defence according to the applicable law, or to request the relevant agencies and organisations to protect your civil rights as prescribed in Article 11 of Vietnam's Civil Code.

To exercise any of your rights, or if you have any question about our processing of your personal information, please send us a request using the contact details specified at the beginning of this Policy. In order to process this request, note that we may ask you to provide us with additional information in order to confirm your identity.

Your obligations

In accordance with the applicable Vietnam Privacy Regulations, you have the following obligations in respect of your personal information that you disclose to us:

· To protect your own personal information and to request relevant organisations and individuals to protect your personal information;

· To respect and protect the personal information of other data subjects;

· To fully and accurately provide your personal information when you consent to the processing;

· To participate in the distribution of personal information protection skills; and

· To comply with the provisions of the law on the protection of personal information

Retention duration

We will process your personal information commencing from the time in which you access or use our Services and for a period that is no longer than necessary for the purposes identified in this Policy.

If we are required to process your personal information pursuant to or in order to comply with a legal obligation, we will keep your personal information for as long as it is required by us to comply with such obligation. Upon expiry of the applicable data retention period or required by law, we will delete your personal information.

Organisations involved in the processing of your personal information

We may disclose your personal information to third parties, for processing in accordance with the purposes set out in the section “How we Use Information” and “Information Sharing and Disclosure”. Some of these parties may be located outside of Vietnam. These parties who are related to or involved in the processing of your personal information include:

· Service providers that provide services to help with our business activities, including those involved in providing advertising, payment processing, customer service, fulfilment of subscription services, research and analytics, and cloud computing infrastructure;

· Operators of social media platforms if you choose to share photos and/or videos on a social medial platform;

· Law enforcement agencies, public authorities and regulators;

· Our affiliates; and

· Any other third party for the purposes set out in the section “Information Sharing and Disclosure”.

Language

This Privacy Policy is prepared and drafted in English, but may be translated into other languages (including but not limited to Vietnamese). Should any conflict arise between the English language version of this Agreement and any translation hereof, the English language version shall be controlling.

美妆相机个人信息保护政策

最新修改日期:2022年9月30日

本个人信息保护政策(“本政策”)旨在向您说明，在使用美妆相机APP（以下称“产品”或“服务”）时，您应了解的内容：

导言

我们非常重视对您的个人信息的保护，我们也致力于维持您对我们的信任，我们承诺将按业界普遍适用的安全标准，采取相应的安全保护措施来保护您的个人信息，在您下载、安装、开启、浏览及使用（以下统称“使用”）美妆相机的全过程，均适用于本政策。但需要特别说明的是，本政策不适用于其他第三方向您提供的产品或服务。如果您使用第三方提供的产品或服务，请关注第三方产品或服务的用户协议及其个人隐私保护政策。

下文将帮您详细了解我们如何收集、存储、使用、传输、提供、公开披露与保护个人信息；帮您了解查询、更正、补充、删除、复制、转移个人信息的方式。其中，有关您个人信息权益的重要内容已用加粗形式提示，在使用我们的产品和服务前，请您务必仔细阅读并充分了解本政策。

一、我们如何收集、存储和使用您的个人信息

二、我们如何使用Cookie

三、我们如何共享、转让、公开披露您的个人信息

四、我们如何保护您的个人信息

五、您的权利

六、我们如何处理未成年人的个人信息

七、您的个人信息如何在全球范围转移

八、适用法律及管辖

九、本政策如何更新

十、我们的联系方式

十一、附录：权限申请及应用场景

一、我们如何收集和使用您的个人信息

（一）、注册、登录及使用美图帐号

1、在您使用本产品和服务时，我们建议您注册一个美图帐号，以更加充分地使用本产品和服务的全部功能；为此，您需要提供手机号码（用于实名认证），您应当为帐号创建密码，我们会收集您的昵称、头像，收集这些信息是为了帮助您完成帐号注册和使用我们的服务，保护您帐号的安全。如您仅需要拍照、美化图片、人像美容此类基本产品功能及服务，您无需注册美图帐号并提供上述信息。

2、关于美图帐号

美图帐号可登录、使用美图公司旗下各APP（包括但不限于美图秀秀、美拍、美颜相机、海报工厂等），为满足您一致的服务体验，在您在登录美图公司旗下其他APP时且自主选择使用已注册的美图帐号的，该美图帐号将会同步您的昵称、头像、地区、性别等您自主填写的公开信息等。如您不希望上述内容被同步，请您在登录美图公司旗下其他APP时选择其他注册、登录方式。

（二）、向您提供网络安全及运营安全保障

为保障您的帐号、网络、运营及系统安全，预防恶意程序、钓鱼网站欺诈及木马病毒，在您使用本产品的过程中，我们可能会按照实现安全保障需求的一定频率收集您的设备信息，包括不可变更的设备标识信息（指由设备制造商编入到设备以对其进行标识的一串字符，Android如IMEI、AndroidID、OAID、IMSI、ICCID、GAID、MEID、VAID、AAID，iOS如IDFV、IDFA，本政策中所指的“设备标识信息”均同本定义）、硬件序列号、MAC地址。请您理解，当您将处于设备屏幕中的美妆相机APP切换至后台运行时，由于部分设备机型及系统原因，您此前使用美妆相机相关功能而产生的信息收集行为，可能无法立即停止，从而将导致短暂的后台信息收集行为。

（三）、向您提供美妆服务

（1）由于我们所提供的美妆相机服务是面向全球的，因此，为了结合您所在地区从而为您匹配同地区对应版本的产品或者与设备所在地区相关的内容或服务时，我们可能会使用与本服务相关的粗略地理位置信息（如IP地址、WLAN接入点、蓝牙和基站），以保障内容或服务的质量；我们也仅会基于网络信息（如IP）对应的城市及/或地区向你展示对应版本产品的内容或服务。我们仅会基于为您提供上述服务所必须而收集您的粗略地理位置信息，上述信息无法识别任何特定的用户。

（2）我们为您提供的美妆相机是一款工具性虚拟主题美妆APP，美妆相机app内置五官分析、肤质分析与妆容推荐功能。在您使用美妆相机的图像拍摄、相册导入等功能时，我们会收集影像信息、EXIF数据，收集这些信息是为了提供图像的编辑服务，这类信息是为提供服务必须收集的基础信息，但并非用于识别任何特定的用户。

（四）向您提供其他相关产品功能和/或服务

为实现以下各项产品功能和/或服务，我们可能需要向您收集相对应的个人信息，若您拒绝提供，则无法使用该等特定服务。

1、客户服务。

当您向美图提起投诉、进行咨询或申诉时，为了方便与您联系或帮助您解决问题，我们可能需要您提供姓名、手机号码、电子邮件及其他有效的联系方式等个人信息。如您拒绝提供上述信息，我们可能无法向您及时反馈相关处理结果。

2、AI算法优化服务

当您使用相机和图片精修功能拍照时，我们会采用美图人脸点数据技术收集您的皮肤和五官参数，这是为了实现AI算法优化，更准确快速反馈清晰的面部图片，使用次数越多，AI算法优化效果越好。这类信息是为提供本服务必须收集的信息，收集后即作去标识化处理，不会用于识别任何特定的用户。

3、个性化展示服务。

（1）为了便于您更好地管理您的偏好，获得更轻松的访问体验，我们会基于收集的信息，对用户偏好进行特征分析和用户人群画像（该个性化推荐算法不会识别特定自然人的真实身份），以帮助在工具素材推荐上呈现更符合您需求的内容，以减少您对海量互联网内容的筛选时间。为此，我们需要收集的信息包括您的设备标识信息、符合国家或行业团体标准的广告标识信息、语言及时区、使用本产品浏览器型号、运行中的进程信息、您的应用列表信息。如果您对我们推送的广告不感兴趣，也可以在相应广告页面中选择“关闭”或“跳过”提示键关闭该广告。

（2）我们还可能收集您的网络运营商及种类、网络类型、WIFI接入点（如SSID、BSSID），以实现在广告推送过程中帮助您节省网络流量的目的，例如：当我们监测到您处于WIFI环境下，我们可能为您直接播放视频类广告内容；当我们检测您处于无网络、或弱移动网络的环境下，我们将仅为您推送您已经缓存于本地的广告内容。

4、维护产品安全及时排除故障。

为维护我们服务的正常运行，以及保障您的帐号安全、排查产品故障、改进及优化我们的服务，我们会收集您的EXIF数据、设备标识信息、操作日志信息、设备品牌、系统版本、CPU信息。这类信息是为提供服务必须收集的信息，收集后即作去标识化处理，不会用于识别任何特定的用户。

5、当您使用美妆相机中提供的自拍、妆容特效或滤镜等工具进行拍摄时，我们会根据您的操作及使用的工具类型使用传感器信息，以适配您所选用的工具。当您拍照或浏览内容时，为了适配您的设备状态，我们会调用您设备的旋转矢量传感器、加速度传感器信息，重力传感器，陀螺仪传感器，以识别您的设备横竖屏状态。

6、用于互动分享和调起第三方支付等功能。如您将美妆相机中内容分享至第三方平台时，我们会读取您的应用列表信息用以判断该第三方平台是否存在从而达成分享目的；如您使用美妆相机中支付功能时，我们也会读取您的应用列表信息用以判断该第三方支付应用是否存在以完成支付功能。

7、消息通知：我们将会向您在使用美妆相机产品或服务的过程中提供的联系方式（如：手机号码）发送一种或多种类型的通知，如产品活动及福利告知、身份验证、安全验证、营销信息或向您进行相关的问卷调查。但如果您不想接收我们给您发送的此类信息，您可通过短信中提供的退订方式或我们提供的其他方式进行退订。

在您开启通知权限的前提下，我们可能向您推送您关注的用户、内容及热点推荐等，如您不希望收到上述推荐，您可在手机系统设置中关闭美妆相机通知权限。

您也可以通过《个人信息收集清单》快速了解我们如何收集您的个人信息。

（五）、我们可能从第三方间接获取您的个人信息

1、您使用第三方帐号（微博、微信、QQ）登录美图时，可选择授权美图在符合相关法律法规要求的前提下读取并获得您在该第三方平台上登记、公布、记录的公开信息（包括昵称、头像）。

2、美图需要您授权从第三方获取上述信息是为了记住您作为美图用户的登录身份，以向您提供更优质的产品和/或服务。我们仅会在您的授权同意的范围内收集并使用您的个人信息。在您使用第三方帐号注册或登录后，您的第三方帐号将会与美图帐号进行绑定，但您可以在【美妆相机】-【个人中心】图标-点击头像-【我的美图帐号】-【第三方帐号绑定】中选择“解除绑定”，进行取消帐号绑定。

（六）、美图基于其它特别情况对您的个人信息的使用

1、如果您认为您的相关权利遭受侵犯，您可依据我们的侵权投诉流程、通过我们对外公布的联系方式提起投诉、举报。在此过程中，我们将要求您提供个人有效身份信息以核实投诉、举报的真实性。与此同时，如果您申请解除您的美图帐号异常状态的，我们也可能要求您提供有效身份信息进行核实。此为个人敏感信息，我们将采取严格的保密措施，并不会向第三方进行共享。

2、请您理解，我们向您提供的功能和服务是不断更新和发展的，如果我们要将您的个人信息用于本政策未载明的其它用途、变更使用目的、增加或减少对您个人信息的收集时，我们将以合理的方式（例如页面提示、交互流程、网站公告等）向您告知。

二、我们如何使用Cookie

为保证网站正常运行，为帮助您获得更轻松的访问体验，并向您推荐您可能感兴趣的信息，我们会在您的计算机或移动设备上存储名为Cookie的小数据文件。Cookie通常包含标识符、站点名称以及一些号码及字符。借助于Cookie，网站能够存储您的偏好等数据，以此帮助您免去重复填写个人信息、输入历史搜索内容等繁琐；同时我们还可能利用上述技术为您推荐、展示、推送您感兴趣的内容。您可根据自己的偏好管理或删除Cookie，您也可以清除计算机上保存的所有 Cookie。有关详情，请参见AboutCookies.org。我们不会将 Cookie 用于本政策所述目的之外的任何用途。大部分网络浏览器都设有阻止Cookie的功能，您可以通过浏览器设置选项清除计算机上保存的所有Cookie，但如果您这么做，可能会导致您在每一次访问我们的网站时都需要亲自更改用户设置。

三、我们如何共享、转让、公开披露您的个人信息

（一）、共享

我们不会与任何公司、组织、个人分享您的个人信息，但以下情况除外：

1、在获取明确同意的情况下共享：获得您的明确同意后，我们会与其他方共享您的个人信息。

2、在法定条件下共享：我们可能会根据法律法规规定、诉讼争议解决需要、按照政府主管部门或司法机关依法提出的强制要求，对外共享您的个人信息。

3、在法律要求或允许的范围内，为了保护美图及其用户或社会公众的利益、财产或安全免遭损害而有必要提供您的个人信息给第三方；

4、与我们的关联公司共享：您的个人信息可能会与我司（厦门鸿天创视科技有限公司）的关联公司进行共享，我们只会在为实现向您提供本产品相关功能和服务的目的下共享必要的个人信息且受本隐私政策所声明目的的约束。关联公司若要改变个人信息的处理目的，将再次征求您的授权同意。我们的关联公司包括：厦门美图网科技有限公司及其分、子公司；厦门美图之家科技有限公司及其分、子公司；厦门美图宜肤科技有限公司及其分、子公司等。我司及我司关联公司合称“美图”。

（二）、向合作方共享个人信息

仅为实现本政策中声明的目的，我们的某些服务将委托被我们授权的合作伙伴提供（我们会与授权的合作伙根据法律规定签署相关处理协议，并对其个人信息使用活动进行监督），如推广服务、产品分析服务、技术支持服务、电商平台合作、运营商计费充值服务。我们可能会与合作伙伴共享您的某些个人信息，以保障为您提供的服务得以顺利完成，并帮助我们提供更好的客户服务和用户体验。我们仅会出于合法、正当、必要、特定、明确的目的共享您的个人信息，并且只会共享提供服务所必要的个人信息；同时，对我们与之共享个人信息的公司、组织和个人，我们会与其签署严格的保密协议，要求其按照我们的隐私政策以及其他任何相关的保密和安全措施来处理个人信息。我们的合作伙伴无权将共享的个人信息用于任何其他用途。我们的合作伙伴包括以下类型：

· （1）广告服务类合作伙伴。

A.功能类型：广告归因。

合作伙伴类型：广告主和/或其委托的代理商（例如秒针）和/或广告联盟（例如穿山甲）
使用目的：广告主评估广告投放效果
处理方式：
由我们共享无法直接识别用户的去身份化的数据，广告主自行处理以判断广告转化的用户来源、广告转化的效果等，支撑其商业决策。我们要求广告主严格遵守我们关于数据隐私保护的措施与要求，包括但不限于根据数据保护协议、个人信息保护政策及相关法律法规进行处理，并严格按照相关用户授权范围处理数据，避免识别出用户个人身份，保障隐私安全。
个人信息类型（iOS 客户端）：如IDFA等设备标识符；如曝光、点击数据等广告数据
个人信息类型（Android 客户端）：如OAID等设备标识符；如曝光、点击数据等广告数据。

B.功能类型：程序化广告推送
合作伙伴类型：广告主和/或其委托的代理商和/或广告联盟（例如穿山甲）
使用目的：帮助广告主进行程序化广告推送
处理方式：
由我们共享无法直接识别用户的去身份化的数据，广告主通过自动化方式自行决策是否下发广告。我们要求广告主严格遵守我们关于个人信息保护政策的措施与要求，包括但不限于根据数据保护协议、个人信息保护政策及相关法律法规进行处理，并严格按照相关用户授权范围处理相关个人信息，避免识别出用户个人身份，保障信息安全。
个人信息类型（iOS 客户端）：如IDFA等设备标识符；如曝光、点击数据等广告数据。
个人信息类型（Android 客户端）：如OAID等设备标识符；如曝光、点击数据等广告数据。

C.功能类型：优化广告投放效果
合作伙伴类型：广告主和/或其委托的代理商和/或广告联盟（例如穿山甲）
使用目的：帮助广告主提升广告投放效果
处理方式：
由我们共享无法直接识别用户的去身份化的数据，广告主对数据进行分析并优化其广告投放的模型、策略等，提升广告投放的效果以及用户的体验。我们要求广告主严格遵守我们关于个人信息保护的措施与要求，包括但不限于根据数据保护协议、个人信息保护政策及相关法律法规进行处理，并严格按照相关用户授权范围处理相关个人信息，避免识别出用户个人身份，保障信息安全。
个人信息类型（iOS 客户端）：如IDFA等设备标识符；如曝光、点击数据等广告数据
个人信息类型（Android 客户端）：如OAID等设备标识符；如曝光、点击数据等广告数据。
注：上文所列的IDFA均为 iOS 14.5之前版本的信息

（2）电商类供应商。当您通过美妆相机提供的推广服务进行商品购买时，将跳转至上述第三方平台或品牌方官方网站即试装产品的官方购买服务完成最终购买，在此期间我们不会向第三方共享您的任何个人信息。

（3）技术支持类合作伙伴：为我们提供技术分析服务的合作伙伴，会向我们的用户收集相关个人信息用于实现其所支持的服务。如在您使用本产品并进行登录的过程中，我们可能会获取您的设备信息：如设备平台，设备厂商，设备品牌，设备型号及系统版本，本政策中所指的“设备信息”均同本定义。我们可能会按照实现登录认证需求的一定频率收集您的上述设备信息，这类信息是为提供服务必须收集的信息，不会也不能用于识别任何特定的用户。同时，还有提供分析服务的合作伙伴，会向我们的用户收集基于其信息安全规则完成去标识化处理的少量个人信息，以帮助我们统计产品用户分布、评估产品推广效果。

（三）、我们与第三方共享的个人信息的具体种类和目的，您可详见《个人信息第三方共享目录》。

（四）、转让

我们将不会将您的个人信息转让给任何公司、组织和个人，但以下情况除外：

1、在明确获得您的同意的前提下，我们会向其他方转让您的个人信息；

2、在涉及合并、收购或破产清算时，如涉及到个人信息转让，我们会在要求新的持有您个人信息的公司、组织等主体继续接受此隐私政策的约束，如果本政策约定的个人信息的收集、处理方式、使用目的等发生改变，我们将要求该公司、组织等主体重新向您征求授权同意。

（五）、公开披露

我们仅会在以下情况下，收集或公开披露您的个人信息：

1、获得您明确的同意后；

2、基于法律法规、司法机关或行政主管部门的强制性要求，我们可能会披露您的个人信息。

（六）、依法不经授权处理个人信息的情形

根据相关法律法规的规定，在以下情形中，我们可以在不征得您的授权同意的情况下处理您的个人信息。

1. 为订立、履行您作为一方当事人的合同所必需；

2. 为履行法定职责或者法定义务所必需；

3. 为应对突发公共卫生事件，或者紧急情况下为保护您的生命健康和财产安全所必需；

4. 为公共利益实施新闻报道、舆论监督等行为，在合理的范围内处理个人信息；

5. 依照相关法律规定在合理的范围内处理个人自行公开或者其他已经合法公开的个人信息；

6. 法律、行政法规规定的其他情形。

四、我们如何保护您的个人信息

（一）、我们已使用符合业界标准的安全防护措施保护您提供的个人信息，防止数据遭到未经授权访问、公开披露、使用、修改、损坏或丢失。我们会采取一切合理可行的措施，保护您的个人信息。例如，在您的浏览器与 “服务”之间交换数据时受 SSL 加密保护；我们对产品提供的配套Web服务提供HTTPS 安全访问方式；我们会使用加密技术确保数据的保密性；我们会使用受信赖的保护机制防止数据遭到恶意攻击；我们会部署访问控制机制，确保只有授权人员才可访问个人信息；以及我们会举办安全和隐私保护培训课程，加强员工对于保护个人信息重要性的认识。

（二）、保存期限：我们会采取一切合理可行的措施，确保未收集无关的个人信息。我们只会在达成本政策所述目的所需的期限内保留您的个人信息，除非法律法规有强制的留存要求，例如《中华人民共和国电子商务法》要求商品和服务信息、交易信息保存时间自交易完成之日起不少于三年；例如《网络安全法》要求按照规定留存相关的网络日志不少于六个月。我们判断个人信息的存储期限主要参考以下标准并以其中较长者为准：完成与您相关的服务所需保留的必要期限；应对您可能的查询或投诉；保证我们为您提供服务的安全和质量；您是否同意更长的留存期间；是否存在关于保留期限的其他特别约定或法律法规规定。对于超出期限的个人信息，我们会立即删除或做匿名化处理。

（三）、互联网并非绝对安全的环境，而且电子邮件、即时通讯、及与其他用户的交流方式并未加密，我们强烈建议您不要通过此类方式发送个人信息。请使用复杂密码，协助我们保证您的账号安全。

（四）、互联网环境并非百分之百安全，我们将尽力确保或担保您发送给我们的任何信息的安全性。

（五）、在不幸发生个人信息安全事件后，我们将按照法律法规的要求，及时向您告知：安全事件的基本情况和可能的影响、我们已采取或将要采取的处置措施、您可自主防范和降低风险的建议、对您的补救措施等。我们将及时将事件相关情况以邮件、信函、电话、推送通知等方式告知您，难以逐一告知个人信息主体时，我们会采取合理、有效的方式发布公告。同时，我们还将按照监管部门要求，主动上报个人信息安全事件的处置情况。

五、您的权利

按照中国相关的法律、法规、标准，我们保障您对自己的个人信息行使以下权利：

（一）、访问、删除、更正您的个人信息

1、个人信息访问和更正——如果您希望编辑您美图帐号中的个人信息、昵称、性别、头像、地区、生日等，您可于【美妆相机】-【个人中心】-【个人信息】中执行此类操作。

2、帐号信息访问和更正——您可在【美妆相机】-【个人中心】-【个人信息】-【帐号与安全】中更换您绑定的手机号、修改密码、登录记录、第三方帐号绑定、注销账号等。

3、在以下情形中，您可以向我们提出删除个人信息的请求：

（1）、如果我们处理个人信息的行为违反法律法规；

（2）、如果我们收集、使用您的个人信息，却未征得您的同意；

（3）、如果我们处理个人信息的行为违反了与您的约定；

（4）、如果您不再使用我们的产品或服务，或者您注销了美图帐号；

（5）、如果我们终止服务及运营。

以上删除请求一旦被响应，我们还将同时尽可能通知从美图获得您个人信息的主体，要求其及时删除相应信息，除非法律法规另有规定，或者这些主体获得您的独立授权。当您从我们的服务中删除信息后，我们可能不会立即从备份系统中删除相应的信息，我们将会在备份更新时删除这些信息或者实现匿名化处理。

（二）、个人信息浏览与导出

在帐号登录情况下，如果您需要浏览您的个人信息或希望导出您的个人信息副本，您可点击产品端内右上角【个人中心】图标-点击头像-【我得美图帐号】-【美图安全中心】-【个人信息浏览与导出】中申请个人信息副本的提取，您提交申请后，我们将会在24小时内发送至您指定的邮箱。

（三）撤回您的授权

如果您希望撤销同意我们收集、使用和披露您的其他个人信息或者希望我们更正、更新或删除您的个人信息，可通过本政策中的联系方式与我们联系。我们将会在收到您的电子邮件或者挂号信后的合理时间内处理您的请求并停止收集、使用和披露您的个人信息。

但请您理解并同意，当您撤回某些授权时，将导致与之相关的产品功能不可用，我们无法继续为您提供撤回同意或授权所对应的特定功能和/或服务，并且您撤回授权的决定不会影响此前基于您的授权而开展的个人信息处理。

（四）、注销帐户

您可在【美妆相机】-端内右上角【个人中心】图标--点击头像-【我得美图帐号】-【美图安全中心】-【注销帐号】中进行帐号注销，您可自行选择【注销当前应用帐号】或【注销美图帐号】。我们将在验证您的身份并清理帐号中的资产后，为您提供帐号注销服务。您注销成功后，我们将停止为您提供产品或服务，并根据适用法律的要求删除您的个人信息或作匿名化处理。

（五）、对于您的权利要求的响应

为保障安全，在您提出上述权利主张时，您可能需要提供书面请求，或以其他方式证明您的身份。我们将在验证您的身份后再处理您的请求。一般情况下，我们将在【15】天内做出答复。对于您合理的请求，我们原则上不收取费用，但对多次重复、超出合理限度的请求，我们将酌情收取一定费用。对于与您的身份不直接关联的信息、无端重复信息，或者需要过多技术手段（例如，需要开发新系统或从根本上改变现行惯例）、给他人合法权益带来风险或者不切实际的请求，我们可能会予以拒绝。

在以下情形中，按照法律法规要求，我们将无法响应您的请求：

1、与国家安全、国防安全有关的；

2、与公共安全、公共卫生、重大公共利益有关的；

3、与犯罪侦查、起诉、审判和执行判决等有关的；

4、有充分证据表明个人信息主体存在主观恶意或滥用权利的；

5、响应您的请求将导致您或其他个人、组织的合法权益受到严重损害的；

6、涉及商业秘密的。

（六）、关闭个性化推荐

您可在【个人中心】图标-【个性化选项】-【个性化广告推荐】/【推送通知】进行关闭。选择关闭个性化广告推荐时，我们将在您关闭后停止向您推送个性化内容和广告，但您收到的推荐内容和广告的总量不会减少。

六、我们如何处理未成年人的个人信息

（一）、我们的产品主要面向成人。除非您在使用某些特定功能时，我司可通过实名认证信息判断您为未成年人外，受限于本产品特性，我司并未开发其他识别您真实年龄的产品功能。

（二）、不满十四周岁未成年人（本政策所指“未成年人”，特指不满十四周岁的未成年人），在未获得父母或监护人同意的前提下，不应创建自己的个人信息主体帐户。如果您的年龄为14周岁以下，在使用我们的产品和/或服务前，请您务必在监护人的陪同下阅读本政策，并确保已征得您的监护人明确同意后，再使用我们的服务。

（三）、对于经监护人同意使用我们的产品或服务而收集未成年人个人信息的情况，我们只会在法律法规允许、监护人明确同意或者保护未成年人所必要的情况下处理此信息。

（四）、如果您的监护人不同意您按照本政策使用我们的服务或向我们提供个人信息，请您立即终止使用我们的服务并及时通知我们。

（五）、如果您是父母或者监护人，对您所监护的未成年人使用我们的产品/服务或其向我们提供的用户信息有任何疑问时，请您及时与我们联系。

（六）、如果我们发现在未获得监护人同意的情况下收集了未成年的个人信息，则会设法尽快删除相关未成年人的信息。同时，为保护未成年人个人信息安全，我们设置了专门的《未成年人个人信息保护规则》，请您仔细阅读。

七、您的个人信息如何在全球范围内转移

我们会按照法律法规的规定，将中华人民共和国境内（以下简称“中国”）收集的用户个人信息存储于中国境内。我们不会将上述信息传输至境外，当确有必要向境外传输的情形发生时，我们将会遵循国家相关法律规定进行评估、认证，并取得您的单独同意。

八、适用法律及管辖

本隐私政策适用中华人民共和国大陆地区法律。本隐私政策项下争议，由被告住所地法院管辖。

九、本政策如何更新

我们的个人信息保护政策可能会根据业务的调整、法律法规或政策的变化而适时变更。未经您明确同意，我们不会削减您按照本个人信息保护政策所应享有的权利。本政策更新后，我们会发出更新版本，并在更新后的条款生效前通过私信、通知、公告或其他适当的方式提醒您更新的内容，以便您及时了解本政策的最新版本。

如本政策变更的类型涉及人信息的处理目的、处理方式和处理的个人信息种类发生变更的，我司将重新取得您的同意。

若您不同意修改后的隐私政策，您有权并应立即停止使用我们的产品和/或服务。如果对本政策的更新存在疑义，请您及时通过本政策公示的联系方式与我方联系。

十、我们的联系方式

我公司为在中华人民共和国厦门地区成立的厦门美图网科技有限公司。如果您对本政策内容有任何疑问、意见、建议或进行申诉，您可通过以下方式联系我们：

电子邮箱：legal@meitu.com，

联系地址：中华人民共和国厦门市思明区软件园二期望海路6号楼2单元1-3层。

十一、附录：权限申请及应用场景

此处仅为权限相关说明，我们将在您使用特定产品功能时，向您申请使用该功能所必须的权限，如您不同意开启该权限，请点击“不允许”，拒绝该权限的申请仅将影响您对特定产品功能的使用。我们在此向您列举产品将可能收集的权限类型及其使用目的。

APP权限	权限与获取信息描述	权限使用目的及业务场景
电话权限	读取手机状态	读取手机状态，涉及到用户设备的IMEI信息，用于保障您的帐号、网络、运营及系统安全，预防钓鱼网站欺诈及木马病毒及进行用户数据统计（安装、活跃度等）。
存储权限（写入）	写入外部存储	用于将用户拍摄完毕的图片、视频保存到本地等的文件保存功能。
录音权限	录制声音	用于美妆相机的视频录制功能：包括全身模式相机、主拍照相机、电音特效相机中的拍视频功能。
相机权限	允许使用相机	用于产品的拍照、视频录制的功能：包括美妆自拍、主拍照相机、高级美妆相机、试妆、视频录制功能。
蓝牙服务	允许使用蓝牙服务	使用蓝牙权限。用于自拍杆功能。
存储权限（读取）	读取外部存储	读取本地图片、视频等文件，用于帮助用户进行图片、视频美化。
通知权限	向用户发送通知	向用户推送平台活动、营销信息等。

Privacy Policy

美妆相机个人信息保护政策

美妝相機隱私政策

最新修改日期:2019年2月20日

壹、我們如何收集和使用您的個人信息

二、我們如何使用Cookie

三、我們如何共享、轉讓、公開披露您的個人信息

（壹）共享

（二）轉讓

（三）公開披露

四、我們如何保護您的個人信息

五、您的權利

六、我們如何處理兒童的個人信息

七、您的個人信息如何在全球範圍內轉移

八、本政策如何更新

九、適用法律及管轄

Privacy Policy

美妆相机个人信息保护政策

美妝相機隱私政策

最新修改日期:2019年2月20日

壹、 我們如何收集和使用您的個人信息

二、我們如何使用Cookie

三、我們如何共享、轉讓、公開披露您的個人信息

（壹）共享

（二）轉讓

（三）公開披露

四、我們如何保護您的個人信息

五、您的權利

六、我們如何處理兒童的個人信息

七、您的個人信息如何在全球範圍內轉移

八、本政策如何更新

九、適用法律及管轄

壹、我們如何收集和使用您的個人信息