Privacy Policy
Last Updated: 31 Dec, 2022
Welcome to HyPic (the “Platform"). The Platform is provided and controlled by Bytedance Pte. Ltd. (“we" or “us").
We are committed to protecting and respecting your privacy. This privacy policy (the “Policy") sets out the basis on which any information we collect from you, or that you provide to us, will be processed by us, including how we may use, process, share and/or transfer your personal data. Please read this Policy carefully to understand our practices regarding your information and how we will handle it before accessing or using the Platform or the services. By accessing or using the Platform and our related websites, services, applications, products and/or content available on the Platform (collectively, the “Services"), you acknowledge that you have read and understood the practices described in this Policy, and hereby consent to us collecting, using, processing, disclosing or transferring your personal data in accordance with this Policy. If you do not agree with this Policy, you should not access or use the Platform or Services.
The Platform includes the HyPic mobile software applications ("HyPic APP") and HyPic services in other forms now existing or hereafter devised, related Software Development Kit ("SDK") and Application Programming Interface ("API") for you through third-party websites and software applications to access and use the Platform and the Services. The version of the Platform may differ for factors such as the jurisdiction from which you access the Platform and the device you use. The Services, in full or in part, may not be available in all jurisdictions, for all devices or in all languages. You should obtain, download, and install the appropriate version according to the actual device conditions of your jurisdiction.
Please note that "Jurisdiction - Specific Supplemental Terms" at the end of this Policy may apply to you depending on the jurisdiction from which you are accessing and using the Platform and/or the Services, which are deemed to be incorporated into this Policy by reference.
For the purposes of this Policy, unless the context otherwise requires, “you" and “your" means you, the user of the Services, and “information" means information which we collect about you or which is provided to us by you, including your personal data.


SUMMARY
What information do we collect about you?
We collect and process information about you when you interact with the Platform and/or Services, or in accordance with our request. We may also collect information about you through automated means when you access our Platform or use the Services. These include technical and behavioural information about your use of the Services.
We use your information to provide the Platform and Services to you and to improve, develop and administer it. We use your information to, among other things, ensure your safety.
Who do we share your information with?
We may share your information with third party service providers who help us to deliver the Platform, send notifications to you, or conduct analysis, or with any member of our corporate group to improve the Platform, allow you to access other services provided by such member of our corporate group, or for internal business purposes. Where and when required by law, we will share your information with law enforcement agencies or regulators, and with third parties pursuant to a legally binding court order.
How long do we retain your information?
We retain your information for as long as it is necessary to provide you with the Services and fulfil our contractual obligations and rights in relation to the information involved. Where we do not need your information in order to provide the Services to you, we retain it only as long as we have a legitimate business purpose in keeping such data or where we are subject to a legal obligation to retain the data. We will also retain your information if we believe it is or will be necessary for the establishment, exercise or defence of legal claims.
How will we notify you of any changes to the Policy?
We may amend or update this Policy from time to time. We will use commercially reasonable efforts to notify you of any material changes to this Policy by a notice provided through the Platform or other appropriate means. You should regularly review this Policy to stay informed of our privacy practices. The “Last Updated" date at the top of this Policy reflects the effective date of any changes. Your continued access to or use of the Platform or the Services after the date of the updated Policy constitutes your acceptance of the updated Policy and how we may collect, use, process, disclose or transfer your information pursuant to such updated Policy. If you do not accept the updated Policy, you must stop accessing the Platform or using the Services.


1.The types of information we collect
We collect and use the following information about you:
Information you choose to provide. Where such features are provided in your country, we process the content and personal data you upload or access through the Platform, including the photographs and images uploaded on the Platform (“User Content"). We may collect information about the images that are a part of your User Content, such as identifying the objects and scenery that appear, the existence and location within an image of face and body features and attributes in your User Content. We may collect this information only to provide you with relevant functions (such as image editing), and we will not save this information. We may also collect your feedback about the Services if you choose to provide it.
Information we collect automatically. We may collect the following information about you:

Information we obtain from other sources. We may receive information about you from other sources, including through third-party services providers or partners. If you choose to sign up or log in to use the Platform using your social media network account details (e.g., Facebook) or account details with other third parties (e.g., Apple), we may collect information from these services, including your username and avatar.


2. Cookies
“Cookies" are small files which, when placed on your device, enable us to collect certain information, including personal data, from you in order to provide certain features and functionality. We and our service providers and business partners use Cookies to collect data and recognize you and your device(s) on the Platform and elsewhere across your different devices. We do this to measure the traffic and functionality of our website. By accessing or using the Platform and Services, you consent to our use of Cookies. You may be able to control some of the information we collect by adjusting your browser settings to refuse or disable Cookies. Because each browser is different, please consult the instructions provided by your browser. Please note that you may need to take additional steps to refuse or disable certain types of Cookies. In addition, your choice to disable cookies is specific to the particular browser or device that you are using when you disable cookies, so you may need to separately disable cookies for each type of browser or device. If you choose to refuse, disable, or delete Cookies, some of the functionality of the Platform may no longer be available to you. Without this information, we are not able to provide you with all the requested services.


3. How we use your information
We will use the information we collect about you in the following ways:



4. How we share your information
This section sets out how we may share your information with third parties.
Service Providers
We may share the categories of personal information listed above with our service providers (whether in or outside your country) in order to provide you with the Platform and Services for the purposes as set out in this Policy, including with:

Our Corporate Group
We may share your information with any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, or companies that we control, are controlled by or under common control, and our service providers and strategic business partners, in each case in or outside your country, for the purposes set out in this Policy, as permitted by applicable law, to assist in the improvement and optimization of the Platform, or for our internal business purposes.
Law Enforcement
We may share your information with law enforcement agencies, public authorities or other entities if legally required to do so, or if we have a good faith belief that such use is reasonably necessary to:

Sale or merger
We may also disclose your information to third parties:

We may share all of the information we collect in connection with a substantial corporate transaction, such as the sale of a website, a merger, consolidation, asset sales, or in the unlikely event of bankruptcy.
Finally, we may share information with third parties at your direction and with your consent, whenever applicable.
Third-party content
The Platform and Services may contain links to content maintained by third parties who we do not control. We are not responsible for the privacy practices of these third parties, and the information practices of these third parties are not covered by this Policy. If there are links directing to other websites, please note that each of these websites is governed by its own Terms and Conditions of Use and Privacy Policy, and we do not accept any responsibility for these policies.


5. Where we store your information
The information that we collect from you is stored in the United States for the purposes as described in this Policy. By submitting your information, you agree to such transfer, storing or processing. We will take reasonable steps to secure your information and treat it in accordance with this Policy. Where we transfer any personal data out of the country where you live, including for one or more of the purposes as set out in this Policy, we will do so in accordance with the requirements of applicable data protection laws, including, for example, by entering into data transfer agreements with the recipient to ensure your personal data is accorded an adequate level of protection.


6. Your choices and rights
You may be afforded rights in your country under applicable laws such as the ability to access your data, delete your data, and potentially others. If you have any questions on how to use the settings or want to know about any rights with regard to your personal data you may have in the country where you live, please contact us at retouchpics.support@bytedance.com.


7. The security of your information
We will take reasonable steps to secure your information and treat it in accordance with the Policy. You should understand that, although we will do our best to protect your information, unfortunately, no data storage system or transmission of data over the Internet or any other public network can be guaranteed to be completely secure. We have put in place technical and organizational measures that we will amend and update from time to time to improve the overall security of our systems.


8. Data retention
We retain your information for as long as it is necessary to serve the purpose(s) for which such information was collected, including to fulfill our contractual relationship and to provide you with the Platform or the Services. Where we do not need your information in order to provide the Platform or the Services, we retain it only for so long as we have a legitimate business or legal purpose in keeping such information, as long as this is permitted by applicable law. However, there are occasions where we are likely to keep this information for longer in accordance with our legal obligations or where it is necessary for the establishment, exercise or defence of legal claims.
After you have terminated your use of our Platform or Services, we may store your information in an aggregated and anonymized format. Notwithstanding the foregoing, we may also retain any information as reasonably necessary to comply with our legal obligations, allow us to resolve and litigate disputes, and to enforce our agreements.


9. Information relating to children
The Platform is not directed at or suitable for use by children under the age of 13 or equivalent minimum age in the relevant jurisdiction (“relevant age"). Users under the relevant age are not allowed to use the Platform. If we become aware that personal information has been collected from a person under the relevant age, we will delete the user’s information in accordance with applicable law. If you believe that we may have information about or collected from a child under the relevant age, please contact us at retouchpics.support@bytedance.com.


10. Complaints
In the event that you wish to make a complaint about how we process your personal information, please contact us in the first instance at retouchpics.support@bytedance.com and we will endeavour to deal with your request as soon as possible. This is without prejudice to your right to launch a claim with the relevant data protection authority or follow the dispute process provided in the Terms of Service.


11. Changes
We may amend or update this Policy from time to time. We will use commercially reasonable efforts to notify you of any material changes to this Policy by a notice provided through the Platform or other appropriate means. You should regularly review this Policy to stay informed of our privacy practices. The “Last Updated" date at the top of this Policy reflects the effective date of any changes. Your continued access to or use of the Platform or the Services after the date of the updated Policy constitutes your acceptance to the updated Policy and how we may collect, use, process, disclose or transfer your information pursuant to such updated Policy. If you do not consent to the updated Policy, you must stop accessing or using the Platform and Services.
Unless otherwise explicitly stated under this Policy, if there is any inconsistency among different language versions, the English version shall prevail.


12. Contact
Questions, comments and requests regarding this Policy are welcomed and should be addressed to:
HyPic, Bytedance Pte. Ltd.
Email: retouchpics.support@bytedance.com
Address: 1 Raffles Quay, #26-10, South Tower, Singapore 048583


SUPPLEMENTAL TERMS – JURISDICTION SPECIFIC
Some jurisdiction-specific laws contain additional terms, which are set out in this section. If you are a user in which the laws of the jurisdictions set out below apply, the terms set out below apply to you in addition to the terms set out above, and, in the event of a conflict, the terms set out below prevail.


Brazil
By using Hypic Platform, you acknowledge that you have read, understood, and agreed with the practices described in this Privacy Policy, so the following additional terms apply. If any conflict arises between the main Privacy Policy and the jurisdiction-specific terms, the following terms shall prevail:
Exercise of data protection rights. You have the right to request information regarding the processing of their personal information, such as confirmation of the existence of processing, right to access to data/copies of data, right to rectification of incomplete, inaccurate or outdated data, right to anonymization, blocking or erasure of unnecessary, excessive or processed data in violation of the law, right to data portability, right to object to processing personal data for direct marketing purposes, deletion of personal data processed with the consent of the data subject, information from public and private entities with which the controller shared data, information about the possibility of not providing consent and about the consequences of not giving it, right to withdraw consent at anytime.
Limitation to data subjects’ rights. In certain situations, we may have legitimate reasons for not fulfilling some of your requests. For example, we may decline to comply with a request for erasure when the retention of your data is necessary to comply with legal or regulatory obligations, or when such retention is necessary to protect our rights and interests in the event of a dispute. In such cases, when we cannot comply with a request that you have made, we will inform you the reasons why we cannot comply with your request.
Contact. In case of doubt about your privacy, your rights, or how to exercise them, please contact us through dpobrasil@bytedance.com.


California / CCPA Notice for California Residents
Under the California Consumer Privacy Act as amended (“CCPA”), California residents have the right to know what personal information about them is collected, request deletion of their personal data, opt-out of the sale of their personal data, and not be discriminated against if they choose to exercise any of these rights. This notice supplements information provided throughout this Policy. Capitalized terms used below that are not otherwise defined in this Policy have the meanings given to them in the CCPA.

Categories of Personal Information About You We Collect, Use, and Disclose:
Throughout our Policy, we discuss in detail the specific pieces of personal information we collect from and about the users of our Services. During the 12 months leading up to the effective date of this Policy, we collected all of the types of personal information described in the “The types of information we collect” section of this Policy, if the Services were available to you. Under the CCPA, we are also required to provide you with the “categories” of personal information we collect as defined by applicable California law. Depending upon the types of services you use, the categories we collect are: identifiers (such as IP address, device-specific identifiers, and passwords); commercial information (such as records of your transactions with us); internet or other network or device activity (such as record of your use of Services); visual information; location information based on your SIM card and/or IP address; user-generated content; inferences we make from other data; and other information that identifies or can be reasonably associated with you.

We collect the above categories of information from you, our business partners, marketers, researchers, analytics partners, social network services, and other parties. We use these categories of information to provide and manage the Services you request; to communicate with you; to analyze the use of our Services; to improve and develop our Services; to personalize your experience and customize the Services; to market our Services to you; for bug detection and error reporting; to audit consumer interactions on the Services; to protect the rights of the Services; and for legal compliance. For more detail regarding the purposes for which we use information, please see the “How We Use Your Information” section.

Depending on the circumstances, we may share any of the above categories of information we collect with: Enterprise Customers; platform developers; our corporate group; service providers; business partners to provide you with services that you request and information about services and offers that we think you may be interested; other parties, including government entities, when required by law or to protect our users and services; third party integration services pursuant to that service and your settings; and with your consent or in connection with a corporate transaction. In addition, we may share commercial information and financial data, including your payment information, with payment processors. See the “How we use your information” and “How we share your information” sections for more information.

The CCPA also sets forth certain obligations for businesses that “Sell” personal information to third parties. We do not “Sell” any of the data we collect about you.

CCPA Consumer Privacy Rights
The CCPA also allows you to request us to:


If you’d like to exercise any of the other rights afforded to you, you may contact us via the Contacting Us section above.

Please note that you may designate an agent to make requests to exercise your rights under CCPA. We will take steps both to verify the identity of the person seeking to exercise their rights as listed above, and to verify that your agent has been authorized to make a request on your behalf through providing us with a signed written authorization or a copy of a power of attorney. We will not discriminate against you in a manner prohibited by the CCPA because of you exercising your CCPA rights.

European Economic Area (EEA) and United Kingdom
The information provided in this section applies to individuals in the European Economic Area and the United Kindom, which we refer to in this notice collectively as “Europe”.

Legal bases for processing. We use your personal data only as permitted by law. Our legal bases for processing your personal data described in this Privacy Policy are described in the table below.

Processing purposeLegal basisTo enable us to administer, operate, and process your requested operations on visual materials; and provide you with troubleshooting.The processing is necessary to perform the contract governing our provision of the ServicesTo understand how you use the Services, including reviewing user feedback, to monitor, improve and develop the Services and conduct product developmentThe processing is necessary for our legitimate interests, namely, to identify and resolve issues with the Services and to improve the Services.To share your information with third party platforms and/or developers to provide you with features, such as content posting to third party platforms. The processing is necessary for our legitimate interests, namely to provide you with a seamless experience, allow you to interact with third-party games, apps and service through the Services and your content to be shared on other platforms, enable third parties to authenticate users, and optimise your experience.To comply with any legal obligation, including where necessary to assist in law enforcement and investigations conducted by any governmental and/or regulatory authority.This processing is necessary in order to comply with our legal obligations.To communicate with you, including to notify you about changes to the Services, provide customer support to you and send you other service-related messages.The processing is necessary for the performance of a contract with you.To send you marketing communications in accordance with your preferences.The processing is necessary for our legitimate interests, namely to promote new developments and features of the Services and other services which may be of interest to you, based on your preferences of such communications.
Your rights. If you are located in Europe, in addition to the rights set out in the "Your Choices and Rights" section, you also have the following rights in relation to your personal data:
Right of portability. If any automated processing of personal data is based on your consent or a contract with you, you have a right to transfer or receive a copy of the personal data in a usable and portable format.

Right to erasure. You have the right, in some circumstances, to require us to erase your personal data without undue delay if the continued processing of that personal data is not justified.
Right to restriction. You have the right, in some circumstances, to require us to limit the purposes for which we process your personal data if the continued processing of the personal data in this way is not justified, such as where the accuracy of the personal data is contested by you.
Right to objection. You also have the right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation. There may be compelling reasons for continuing to process your personal data, and we will assess and inform you if that is the case.
To make such requests, contact us at the email address provided the "Contacting Us".
You also have the right to lodge a complaint with your local supervisory authority, but we encourage you to first contact us with any questions or concerns.

Cross-border transfer. We have taken appropriate safeguards to ensure that your personal data will remain protected and require our third-party service providers and partners if applicable to have appropriate safeguards as well. For onward transfers of your personal data, we ensure that: (i) the personal data is transferred to countries recognized as offering an equivalent level of protection; or (ii) the transfer is made pursuant to appropriate safeguards, such as standard data protection clauses adopted by the European Commission.


UK GDPR Representative: Cosmo Technology Private Limited, whose registered office is at 2 Temple Back East, Temple Quay, Bristol, BS1 6EG, United Kingdom.
EEA GDPR Representative: Mikros Information Technology Ireland Limited, whose registered office is located at Mespil Business Centre, Mespil House, Sussex Road, Dublin 4, Ireland.

Israel
If you are using our services in Israel, the following additional terms apply.



Indonesia
If you are using our services in Indonesia, the following additional terms apply:
Age, Parental and Guardian Consent. By accessing and/or using our Services, you represent that you are at least 21 years of age or married or not under guardianship. If you are below 21 years old and you are not married, or under guardianship:

If you do not have consent from your parent(s) or legal guardian(s), you must cease accessing the Services.
Your Rights. You may withdraw your consent to our disclosure of personal data to third parties. Upon your request, we will cease to display, publish, transmit, disseminate, and/or open access to your personal data to third parties. Please note that by withdrawing your consent to the disclosure and/or collection of your personal data, we may not be able to fulfill your requests and you may not be able to use some of HyPic's features and functionality.
You may request us to (i) disclose the history of your personal data that we have collected; and/or (ii) erase and dispose your personal data that we have collected on our server. Please note that by requesting us to erase and dispose your personal data, you may not be able to use some of HyPic's features and functionality.
To exercise any of your rights, contact us at: retouchpics.support@bytedance.com.
Notification. In the event of any breach of personal data, we will notify you and provide you with information regarding such breach of personal data.
Data retention. We retain your information for as long as it is necessary to provide you with the Services. Where we do not need your information in order to provide the service to you, we retain it only for so long as we have a legitimate business purpose in keeping such data. However, there are occasions where we are likely to keep this data for five (5) years (or longer if required) in accordance with our legal obligations or where it is necessary for the establishment, exercise or defence of legal claims.
After you have terminated your use of our Services and the five (5) years retention period has lapsed, we store your information in an aggregated and anonymised format. Non-personally identifiable information may be retained indefinitely for analytics.
Language. In the event of any inconsistency or different interpretation between the English text and Indonesian text of this Policy, the English text shall prevail and the relevant Indonesian text shall be deemed to be automatically amended to conform with and to make the relevant Indonesian text consistent with the relevant English text. You acknowledge that you have read this Policy and understand its content and that this Policy has been agreed to freely and without duress. You acknowledge that you fully understand the language and the content of this Policy, and you agree that you will not use the provisions under Law of the Republic of Indonesia No. 24 of 2009 on Flag, Language, State Emblem and National Anthem, Presidential Regulation No. 63 of 2019 on Use of Indonesian Language or any other laws and regulations to invalidate this Policy.


Philippines
If you are using our Services in Philippines, the following additional terms shall apply pursuant to the relevant laws, rules and regulations and issuances by the Philippines National Privacy Commission (“NPC”) on data privacy.
Your Rights. To the extent that the relevant laws, rules and regulations on data privacy recognize your rights and freedoms as data subjects, you shall have the right to information, object, access, rectification, erasure or blocking, lodge complaints before the NPC, damages and data portability. Before we can respond to a request to exercise one or more of the rights listed above, you may be required to verify your identity or your account details. You can exercise your rights by contacting us at retouchpics.support@bytedance.com.


South Korea
If you are using our Services in South Korea, the following additional terms apply:
Data retention. We destroy personal data whose purpose of collection as consented to by you have been achieved, or whose periods of and use to which you consented to or which were provided in the Policy have expired; provided, however, we will continue to store your personal data for the following statutorily-prescribed periods, where applicable, including, but not limited to:

Destruction of Personal data. We destroy your personal data in a manner that renders it unrestorable by the relevant department.
Your Rights



Thailand
If you are using our Services in Thailand, the following additional terms apply:
Legal Basis. Subject to section entitled "3. How we use your information", we may rely on (1) contractual basis, for our initiation or fulfilment of a contract with you; (2) legal obligation, for the fulfilment of our legal obligations; (3) legitimate interest, for the purpose of our legitimate interests and the legitimate interests of third parties; (4) vital interest, for preventing or suppressing a danger to a person’s life, body, or health; and/or (5) public interest, for the performance of a task carried out in the public interest or for the exercising of official authorities.
If you fail to provide your personal data when requested, we may not be able to provide our Services to you.
Parental and Guardian Consent. Our activities are not generally aimed at minors, and we do not knowingly collect personal data from users who are minors (those who have not reach the legal age (20 years of age or by marriage)) without their parental consent when it is required, or from quasi-incompetent persons and incompetent persons without their legal guardian's consent. If we learn that we have unintentionally collected personal data from such persons, we will delete it immediately or continue to process such personal data if we can rely on other legal bases apart from consent. If you are under the age of 20, or if you are a quasi-incompetent person or incompetent person, you declare that your parent or legal guardian has acknowledged our Terms of Service and the Policy, and you have the consent of your parent or legal guardian to use the Services, if required.
Your Rights Pursuant to and subject to the Personal Data Protection Act B.E.2562 (2019), you have the right to (i) access and have a copy of your personal data or know the source of any personal information obtained without your consent; (ii) request an update or rectification of your personal data; (iii) request that we restrict the use of your personal data under certain circumstances; (iv) the right to data portability where the collection of your personal data is based on consent or because it is necessary for the performance of a contract or for taking steps at your request prior to entering into our Services; (v) where the processing of your personal data is based on consent, the right to withdraw that consent; (vi) the right to object to collection, use and/or disclosure in certain circumstances; (viii) the right to lodge complaints before the appropriate data protection regulator; and (ix) the right to request us to erase, destroy or anonymize your personal data.
Before we can respond to a request to exercise one or more of the rights listed above, you may be required to verify your identity or your account details. You can exercise your rights by contacting us at retouchpics.support@bytedance.com.
Where we transfer and/or store your information. Subject to section entitled “4. How we share your information”, the information that we collect from you may be transferred to and stored in the United States, for the purposes as described in the Policy. By submitting your information, you agree to this transfer, storing or processing.
How we share your information. In addition to the existing section entitled “4. How we share your information”, if you agree to push notifications, we may also provide your device information to your operating system.
Turkey If you are using our Services in Turkey, the following additional terms: Data Controller Representative. You may contact our data controller representative in Turkey by email or mail to handle questions and complaints in connection with the processing of your personal data if you are in Turkey. İlay Yılmaz ilay.yilmaz@esin.av.tr Ebulula Mardin Cad., Gül Sok. No. 2 Maya Park Tower 2, Akatlar-Beşiktaş 34335 Istanbul Turkey
Legal bases for the processing of your personal data. We rely on the following legal bases while processing your personal data in accordance with Article 5 of the Law No. 6698 on Protection of Personal Data:

Your rights. According to Article 11 of the Data Protection Law, you have the following rights with respect to your personal data:

You may exercise your rights listed above by contact us at: please contact us at retouchpics.support@bytedance.com. The requests found in your application will be resolved as soon as possible according to the nature of your request and within thirty days at the latest free of charge. However, if your request incurs additional cost to our company, then you may be charged over the tariff fee determined by the Turkish Personal Data Protection Board.
Amendments. The following sections of the Policy do not apply to individuals in Turkey:

United Arab Emirates If you are using the Services in the United Arab Emirates (“UAE”), the following additional terms apply:
How we share your personal data In addition to the main text of this Policy, by using the Services in the UAE you agree to the terms of this Privacy Policy and consent to our sharing of your personal data in line with the main text of this Privacy Policy.
Governing law and dispute resolution
By using our Services in the UAE, this Privacy Policy will be governed by and interpreted in accordance with the laws of the UAE. In the event of a dispute arising between the parties in connection with this Privacy Policy:



Vietnam
If you are using our Services in Vietnam, the following additional terms apply:
Age, Parental and Guardian Consent. By accessing and/or using the Services, you represent that you are at least 16 years of age or not under guardianship. If you are below 16 years old or under guardianship:

If you do not have consent from your parent(s), you must cease accessing the Services.