This Privacy Policy for Romangic Lab LLC ("Romangic," "we," "us," or "our") describes how and why we collect, use, disclose, store, and otherwise process personal information when you download or use the Wayshot mobile application, visit a Romangic website that links to this Privacy Policy, contact us, participate in research or promotions, or otherwise interact with our related products and services (collectively, the "Services").

Romangic Lab LLC is responsible for deciding how personal information is processed through the Services. If you do not agree with this Privacy Policy, please do not use the Services. If you have questions, concerns, or a privacy request, please get in touch with us at wayshot-privacy@romangic.com. See Section 17 for additional information.

The Services may contain links to, integrate with, or allow you to interact with third-party websites, applications, platforms, or services. This Privacy Policy does not apply to the privacy practices of third parties that Romangic does not control. We encourage you to review the privacy notices of those third parties before providing them with personal information.

The following summarizes key provisions of this Privacy Policy. Please review the full Privacy Policy for complete information about our privacy practices.

What personal information do we process? We may process account and profile information; media, prompts, and outputs; purchases and subscriptions; communications; device and app identifiers; usage, attribution, diagnostics, performance, and locally stored information. Learn more about the information we collect.

Do we process sensitive personal information? We do not intentionally request or collect the categories of sensitive personal information. Information you choose to submit may, depending on its content, incidentally contain or reveal sensitive information. Learn more about sensitive personal information.

Do we receive information from third parties? Yes. We may receive information from sign-in, subscription, analytics, attribution, sharing, and other service providers. Learn more about information received from other sources.

How do we use personal information? We use personal information to provide, secure, analyze, personalize, develop, and improve the Services, manage transactions and communications, and comply with law. Learn more about how we process information.

When do we disclose personal information? We disclose information to providers and other recipients as needed to operate the Services, follow your instructions, protect rights and safety, comply with law, or complete a business transaction. Learn more about disclosures.

Is personal information transferred internationally? Yes. Information may be processed in the United States, China, and other countries, subject to legally required safeguards. Learn more about international transfers.

What choices and rights do you have? You may manage device permissions, media, subscriptions, account deletion, and rights available under applicable law. See Section 12 for general privacy rights and choices, Section 13 for rights available to residents of certain U.S. states, and Section 14 for rights available in other regions.

Do we collect information from children? Wayshot is intended for a general audience and is not directed specifically to children. We do not knowingly collect children's information in violation of law or knowingly sell or share the personal information of consumers under 16. Learn more about children's privacy.

How do we process face-related information? Wayshot may process photos containing faces and on-device facial keypoints to provide requested features. Wayshot does not use this information to identify individuals or create biometric identifiers. Learn more about face data.

In Short: We collect information you provide, information generated when you use the Services, information stored on your device, and limited information from third parties that support the Services.

We collect personal information you provide when you register, use a feature, make a purchase, contact us, submit feedback, participate in a survey or interview, redeem a code, or otherwise interact with the Services. This may include:

• account and profile information, such as user ID, email address, authentication information, nickname, profile photo, account status, country or region, and language;
• photos, videos, optional audio, prompts, instructions, editing choices, ratings, feedback, and other content you submit;
• contact details, survey responses, messages, and social-media or messaging handles supplied for support, research, or promotions; and
• purchase, subscription, entitlement, transaction, renewal, refund, and voucher information. The app store you purchase through processes payment credentials (Apple on iOS and Google Play on Android), and we do not receive your complete payment-card number.

When you choose to use the relevant feature, Wayshot may request access to the camera, microphone, photo library, notifications, or tracking permission. We may process selected or captured media; media URLs and identifiers; timestamps and source information; camera and editing settings; prompts and editing parameters; outputs and processing status; and saved-photo history. You can manage permissions in your device's system settings: through Settings > Wayshot on iOS, and through Settings > Apps > Wayshot > Permissions on Android. On Android 13 and later, you can also grant access to selected photos rather than your entire photo library. If you decline a permission, the corresponding feature may not work.

We and our service providers may automatically collect:

• device, app, installation, account, attribution, and advertising identifiers, which on iOS include IDFV and, when permitted through Apple ATT, IDFA, and on Android include the Google Advertising ID (GAID), together with device, operating-system, app-version, language, country, time-zone, IP-address, network information, and push notification tokens;
• app interactions, sessions, feature use, editing, subscription, installation, attribution, campaign, conversion, and notification events; and
• crash, error, diagnostic, performance, network, security, and log information, including session replays and crash screenshots that may be linked to a user or device. Logs may include photo identifiers and event-specific operation parameters, but not the underlying photos.

We may use anonymous or device-linked identifiers before a named account is created to operate the Services, preserve settings, prevent abuse, and associate later account activity.

Wayshot may store preferences, authentication information, processing tasks, media metadata, cached responses, prompts, recent edits, and other operational data on your device. Photos saved to the system photo library remain under your device controls.

We may receive authentication information from Apple or Google sign-in; purchase and subscription status from Apple, Google Play, and RevenueCat; attribution and campaign information from attribution or advertising providers; and analytics, diagnostics, fraud, or service information from providers that support the Services.

We process personal information to:

• provide, maintain, personalize, and operate the Services;
• create and authenticate accounts and manage profiles, sessions, subscriptions, purchases, refunds, entitlements, promotions, and vouchers;
• provide camera, media, editing, AI-processing, saving, history, and sharing features;
• send service communications and respond to support, feedback, surveys, interviews, and other requests;
• analyze use, test and improve features, and measure product performance;
• use photos, generated outputs, and feedback to develop, train, evaluate, maintain, and improve models, algorithms, and features supporting the Services, subject to the opt-out choices described in Section 7;
• measure acquisition, attribution, campaigns, marketing effectiveness, and conversions; and
• diagnose problems, protect users and the Services, prevent fraud or abuse, comply with law, enforce agreements, manage corporate transactions, and protect legal rights.

We may analyze or infer preferences, interests, product engagement, editing patterns, attribution results, or similar insights to personalize and improve the Services, understand audiences, and measure marketing. Wayshot does not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects. AI editing and composition guidance provide creative or assistive outputs at your request.

In Short: Where applicable law requires a legal basis, we rely on contract, consent, legitimate interests, and legal obligations as appropriate to the processing activity.

This section applies when the GDPR, UK GDPR, or another law requires us to identify a legal basis.

Privacy laws may provide additional protections for certain types of personal information. Under the CCPA, such information is referred to as “sensitive personal information”; under the GDPR and UK GDPR, certain information is referred to as “special categories of personal data.”

Wayshot does not actively request or specifically collect sensitive personal information or special categories of personal data. However, photos, prompts, feedback, communications, or other content that you choose to submit may incidentally contain or reveal such information, depending on its content.

To the extent permitted by applicable law, we may process such information contained in your submissions to provide the features you request, maintain the security and integrity of the Services, comply with legal obligations, or establish, exercise, or defend legal claims. Where special categories of personal data are subject to the GDPR or UK GDPR, we process such data only when we have an applicable legal basis and satisfy an additional legal condition required for processing such data.

Photos, generated outputs, and feedback used for the model development, evaluation, or improvement purposes described in Section 7 may incidentally contain sensitive personal information or special categories of personal data. Such content is subject to the same filtering, authorized manual review, quality evaluation, access controls, retention, deletion, and in-app opt-out measures described in Section 7. It is not de-identified before being used for these purposes.

We do not use such information for the purpose of inferring sensitive characteristics about you. Wayshot does not use face-related information to identify individuals or create facial biometric templates or identifiers. For more information about how we process face-related information, please see Section 16.

In Short: We disclose information to service providers and other recipients when necessary to operate the Services, follow your instructions, protect rights and safety, comply with law, or complete a business transaction.

We may disclose personal information in the following circumstances:

Service providers and processors. We use providers for cloud hosting, storage, content delivery, backend services, authentication, AI and media processing, subscriptions, analytics, diagnostics, crash reporting, logs, performance monitoring, notifications, customer support, surveys, security, and related operations. PostHog may store session replays, Datadog may store diagnostic logs, and Sentry may store crash screenshots and related device diagnostics.

Principal providers used or observed for these purposes include Microsoft Azure; Apple; Google services such as Firebase, Google sign-in, Google Play, Google Cloud AI, and Google advertising services; RevenueCat; PostHog; Datadog; Sentry; Adjust; Snap/Snap Kit; and other infrastructure or platform providers.

Advertising, attribution, and measurement providers. We may disclose identifiers, campaign, conversion, subscription, and product-interaction information to providers such as Adjust and Google advertising services for attribution, analytics, fraud prevention, campaign measurement, and marketing. RevenueCat may transmit subscription and revenue events, together with applicable device, app, or user identifiers, to Adjust for subscription and revenue attribution and campaign measurement. Some disclosures may constitute “sharing” under California law.

Social and sharing platforms. When you choose to share content or use a third-party platform feature, information may be disclosed to the selected platform and to sharing-technology providers such as Snap/Snap Kit. The third-party platform independently controls information it receives under its own privacy notice.

App stores and sign-in providers. The Apple App Store and Google Play, together with a selected Apple or Google sign-in provider, process information needed for distribution, purchases, subscriptions, notifications, attribution, and authentication.

Legal, safety, and rights protection. We may disclose information to comply with law or legal process; respond to authorities; protect Romangic, users, or others; investigate fraud, abuse, or security incidents; enforce agreements; or establish, exercise, or defend legal claims.

Business transfers. Information may be disclosed or transferred in connection with a merger, acquisition, financing, reorganization, bankruptcy, asset sale, or similar transaction.

At your direction. We disclose information when you request or authorize it, including when you submit media for AI processing, share an edited image, connect an external account, or participate in an optional activity.

In Short: Our websites may use cookies and similar technologies, while the Wayshot app uses SDKs, device identifiers, local storage, and related mobile technologies.

Romangic websites may use cookies, pixels, local storage, and similar technologies to operate the site, remember preferences, understand use, and maintain security. Where required, we request consent before using non-essential technologies and provide choices through available cookie controls or browser settings.

The Wayshot app uses SDKs, device and app identifiers, local storage, and similar mobile technologies for authentication, subscriptions, analytics, diagnostics, attribution, advertising measurement, security, sharing, and other app functions.

Where Apple requires tracking permission, Wayshot uses the ATT framework on iOS. You can grant or withdraw permission through iOS Settings; if permission is denied, providers should not receive an available IDFA from Wayshot.

On Android, you can reset the Google Advertising ID (GAID) or delete the advertising ID through Settings > Security & privacy > More privacy settings > Ads on your device; once deleted, providers should not receive an available advertising ID from Wayshot.

Traditional browser Do Not Track signals are not subject to a uniform standard. Where required by applicable law and technically supported, we process recognized opt-out preference signals such as Global Privacy Control for the browser or device that sends the signal.

In Short: Wayshot provides AI-assisted features, some of which require selected content and instructions to be processed on servers operated by us or our providers.

Wayshot offers AI-assisted photo editing and camera-assistance features. Server-side AI processing may transmit selected media, prompts, editing parameters, and related identifiers to our infrastructure and providers, including Google Firebase Storage and Google Cloud AI, to generate the requested result.

On-device composition guidance uses local processing and does not upload facial keypoints.

Romangic uses photos, generated outputs, and feedback to develop, train, evaluate, maintain, and improve models, algorithms, and features supporting the Services. This use is enabled by default and may be separate from generating the specific output you request. You may opt out at any time using the available model-training setting in the App (Settings-Privacy-AI Training).

Training content is not de-identified before use. Romangic filters content, permits authorized personnel to conduct manual review, and performs quality evaluation of training data and model outputs. We apply the access controls and security measures described in Section 10.

We retain training data for up to 6 months. If you submit a deletion request, we use the user ID associated with the training data to locate and delete the related training data.

Romangic is based in the United States, and our servers and providers may process personal information in the United States and other countries. Some analytics, diagnostics, cloud, social-sharing, and SDK providers may process information outside the country where you use the Services, including in the United States and China.

International processing may occur when we use cloud hosting, storage, AI processing, analytics, diagnostics, attribution, subscription, authentication, customer-support, or social-sharing providers, or when our personnel or providers access information from another country to operate and support the Services.

The laws of a destination may differ from those in your location. Where applicable law requires a transfer mechanism, we use an available lawful mechanism and appropriate safeguards, which may include contractual protections, transfer assessments, technical and organizational measures, or another mechanism recognized by law. See Section 17 to request more information about safeguards relevant to your information.

In Short: We retain personal information only for as long as reasonably necessary for the relevant service, security, legal, transaction, dispute, and improvement purposes described below.

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, maintain an account or subscription, protect security, comply with law, resolve disputes, and enforce agreements. Retention depends on the information's nature and sensitivity, the feature involved, user choices, legal or contractual requirements, and security needs.

The following table summarizes our current retention criteria. It does not create a fixed period where a specific period has not been established.

You may request account deletion through the in-app account settings. Wayshot currently provides a 7-day period during which signing in may cancel a pending deletion. After deletion is completed, we delete or de-identify personal information that is no longer reasonably necessary, subject to applicable legal, security, fraud-prevention, dispute, backup, and technical requirements. Backup information may remain isolated until overwritten or deleted under the backup cycle. Deleting the app does not by itself delete a Wayshot account.

We use administrative, technical, and organizational safeguards designed to protect personal information. These include encrypted network transport, access controls, authentication, secure-development practices, monitoring, and measures appropriate to the information and processing.

No system, storage method, or transmission is completely secure. You are responsible for protecting your device and account credentials and for using the Services in a secure environment.

Wayshot is a general-audience creative application and is not designed or directed specifically to children. App store age ratings (Apple App Store and Google Play) are content ratings, not a statement that the Services are designed for children.

For purposes of this Privacy Policy, whether an individual is considered a child depends on applicable law in the jurisdiction where the individual resides. For example, generally under 13 in the United States and, depending on the Member State, under 13 to 16 in the EEA.

We do not knowingly collect a child’s personal information in violation of applicable law. If we learn that this has occurred, we will take reasonable steps to delete the information. A parent or guardian may submit a request as described in Section 17.

We do not knowingly sell or share for cross-context behavioral advertising the personal information of consumers under 16 years of age.

Depending on your location and subject to legal exceptions, you may have the right to:

• access personal information;
• correct inaccurate personal information;
• delete personal information;
• restrict or object to processing;
• receive personal information in a portable format;
• withdraw consent;
• opt out of sale, sharing, targeted advertising, or certain profiling;
• limit certain uses or disclosures of sensitive personal information;
• appeal a decision concerning a privacy request; and
• complain to a competent regulator.

You may also:

• manage camera, microphone, photo-library, and notification permissions in your device's system settings — Settings > Wayshot on iOS, or Settings > Apps > Wayshot > Permissions on Android; manage ATT tracking permission on iOS, or reset or delete the advertising ID through Settings > Security & privacy > More privacy settings > Ads on Android;
• choose whether to import, capture, upload, save, or share media;
• manage subscriptions through the app-store account you purchased with — Settings > [your name] > Subscriptions on iOS, or the Google Play app under your profile icon > Payments and subscriptions > Subscriptions on Android;
• manage third-party sign-in through the provider and contact us about the Wayshot-side account association;
• delete media or editing history where the feature provides a control; and
• request account deletion in the app.

To exercise a privacy right, submit a request as described in Section 17.

In Short: Residents of certain U.S. states may have additional rights, and California residents receive the disclosures and choices described in this section.

Subject to applicable law, residents of certain U.S. states may have the right to:

• know about or access personal information;
• correct inaccurate personal information;
• delete personal information;
• obtain a portable copy of personal information;
• opt out of sale, sharing, targeted advertising, or certain profiling;
• limit certain uses or disclosures of sensitive personal information;
• appeal a decision concerning a privacy request; and
• receive equal service and pricing without unlawful discrimination for exercising a privacy right.

The categories listed below are the categories of personal information that we have collected in the preceding 12 months.

We do not collect biometric information for the purpose of uniquely identifying an individual, professional or employment-related information, or non-public education records, unless otherwise disclosed at or before collection.

We disclose these categories for the business purposes described above. We do not sell personal information for monetary or other valuable consideration. During the preceding 12 months, we may have shared the following categories of personal information for cross-context behavioral advertising as that term is defined by California law:

California residents may opt out of the sharing of personal information by emailing wayshot-privacy@romangic.com; see Section 17 for information about submitting requests. You may also use applicable device controls, including ATT settings on iOS and the “Delete advertising ID” setting on Android. Where required by California law, we treat a recognized opt-out preference signal, such as Global Privacy Control, as a request to opt out for the browser or device that sends the signal. If the signal can be associated with a known account, we will apply it to the account as required by law. An opt-out does not prevent disclosures that are not sale or sharing under California law, including disclosures to service providers or disclosures you direct.

For information about how we handle sensitive personal information, see Section 4. We do not use or disclose sensitive personal information for purposes that give rise to a right to limit under the CCPA. If this changes, we will provide the notice and choices required by law.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

An authorized agent may submit a California privacy request as described in Section 17.

We will not unlawfully discriminate against you for exercising a CCPA right. For example, we will not deny Services, charge a different price, or provide a different level or quality of Services solely because you exercised a right, except as permitted by law, including in connection with a properly offered financial incentive.

Romangic may offer voluntary surveys, interviews, product research, promotions, or similar programs that provide a financial incentive, price or service difference, or other benefit. Benefits may include money, subscription access, discounts, promotional items, or another reward identified in the applicable offer. The information involved depends on the program and may include account or contact information, survey responses, ratings, feedback, product interests and experiences, communications, and information needed to administer the program and deliver the benefit.

For example, we may invite a user to submit a short product-experience survey and optionally participate in an interview. A participant who chooses to be contacted may provide a phone number, email address, or social-media or messaging handle. An offer may provide USD 15 or one month of Wayshot Pro for a qualifying interview. This example does not limit the structure or terms of future programs.

Participation is optional. The material terms, eligibility requirements, benefit, information involved, method of opting in, and available withdrawal method will be presented at or before enrollment in the particular program. You opt in by taking the affirmative action identified in the offer, such as submitting a form or accepting an invitation after reviewing its terms. You may withdraw as described in the offer or by submitting a request as described in Section 17, although withdrawal may affect eligibility for a benefit that has not yet been earned or delivered.

The value of an incentive is reasonably related to the value Romangic expects to receive from the participant's information, time, feedback, insights, or engagement, taking into account the anticipated usefulness of the information, the nature and duration of participation, and the costs of administering the program and providing the benefit. Participation is not conditioned on unrelated sale or sharing of personal information. When required, an offer-specific notice will provide additional material terms before you opt in.

In Short: Individuals in the EEA, UK, Australia, New Zealand, South Africa, and other jurisdictions may have additional rights under applicable local law.

Romangic Lab LLC is the controller of personal data processed as described in this Privacy Policy. Subject to applicable law, individuals may have the right to:

• request access to personal data;
• request correction of inaccurate or incomplete personal data;
• request erasure of personal data;
• request restriction of processing;
• receive personal data in a portable format and, where applicable, request its transmission to another controller;
• object to processing, including processing based on legitimate interests in light of their particular situation;
• withdraw consent at any time, without affecting processing carried out before withdrawal; and
• lodge a complaint with the supervisory authority where they live, work, or believe an infringement occurred.

Any processing of special categories of personal data is subject to the additional conditions described in Section 4.

We may use personal data to create or derive preferences, interests, product insights, attribution results, or audience information for personalization, analytics, service improvement, and marketing measurement. We do not make decisions based solely on automated processing that produce legal or similarly significant effects.

Personal data may be transferred to the United States, China, or other countries outside the EEA or UK using a legally recognized mechanism and supplementary safeguards where required.

Subject to applicable law, residents of Australia and New Zealand may:

• request access to personal information;
• request correction of inaccurate or incomplete personal information; and
• raise a privacy complaint with us.

We will consider requests and complaints under applicable local law. If you are not satisfied with our response, you may have the right to contact the Office of the Australian Information Commissioner or the Office of the Privacy Commissioner in New Zealand, as applicable.

Subject to applicable law, residents of South Africa may:

• request access to personal information;
• request correction or deletion of personal information;
• object to or request restriction of certain processing; and
• raise a privacy complaint with us or the Information Regulator of South Africa.

Residents of Canada, Switzerland, and other jurisdictions may have additional rights under local law, including rights to access, correct, delete, restrict, object to, or obtain a copy of personal information, as applicable. See Section 17 to exercise a right. We will apply the law relevant to your request.

In Short: We may update this Privacy Policy as our Services, practices, or legal requirements change and will identify the latest revision by the “Last updated” date.

We may update this Privacy Policy to reflect changes in the Services, our practices, or legal requirements. The “Last updated” date identifies the latest revision. We encourage you to review this Privacy Policy periodically to stay informed about our privacy practices. Where applicable law requires additional notice of a material change, we will provide notice through an appropriate available channel.

Photos may contain faces. Wayshot does not use face-related information to identify individuals, extract or retain facial vector features, or create facial biometric templates or identifiers.

AI photo editing. When you request AI editing, the selected photo may be uploaded to Google Firebase Storage and processed through Google Cloud AI. This processing is initiated by you and requires the media to leave your device.

On-device composition guidance. A local model may detect approximate facial keypoints in real time. The keypoints are discarded after use and are not uploaded.

Local storage. Photos saved to the system photo library remain under your device controls; account media and editing history are retained as described in Section 9.

Face-related content is disclosed to cloud-storage and AI-processing providers only when you initiate server-side AI editing, or to a sharing platform at your direction. On-device facial keypoints are not disclosed.

On-device facial keypoints are discarded immediately after the real-time function. Media and edited outputs retained for account history remain until deleted or no longer needed, subject to backup, security, and legal retention.

We do not sell face-related information. Submitted photos, including photos containing faces, may be used for model development as described in Section 7. For this use, Romangic does not extract or retain facial vector features or use face-related information to identify individuals. On-device facial keypoints are not retained, uploaded, or used for training.

In Short: You may contact Romangic or exercise a privacy right using the address, dedicated email, or available in-app controls described below. We may verify requests and require proof of authority from an authorized agent or representative.

If you have questions, comments, concerns, or privacy requests, contact:

Romangic Lab LLC

6081 Meridian Avenue, STE. 70-284

San Jose, CA 95120

Santa Clara County, CA

United States

Email: wayshot-privacy@romangic.com

Contact us at wayshot-privacy@romangic.com to exercise your privacy rights. You may also request account deletion through the in-app deletion function. Describe the right you wish to exercise and provide enough information for us to identify the relevant account or records and understand your request.

Account deletion is available in the app settings. Deleting the app does not delete an account. Deletion may be subject to a 7-day cancellation period, verification, legal retention, isolated backups, and the exceptions described in Section 9. As described in Section 7, we use the associated user ID to locate and delete related training data when processing a deletion request.

We may verify your identity by matching information associated with your account, device, transactions, or prior interactions and may request additional information where reasonably necessary. Verification information is used for request handling except as otherwise permitted by law.

Where permitted, an authorized agent or representative may submit a request through the same channel. We may require evidence of authority and ask you to verify your identity or confirm your authorization, unless applicable law provides otherwise.

We respond within the period required by law. If we cannot fulfill a request, we will explain why and provide any required information for an appeal or complaint. Available appeals may be submitted to wayshot-privacy@romangic.com. We do not unlawfully discriminate against users for exercising a privacy right.