Privacy Policy

• •We, us, our: FreeRoyalties, Inc. (d/b/a Zooly.ai)
• •Personal Information: Any information relating to an identified or identifiable individual.
• •Sensitive Personal Information (CPRA): Includes biometric information, precise geolocation, racial or ethnic origin, union membership, contents of certain communications, and other information requiring heightened protection.
• •Special Category Data (GDPR): Includes racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data (for identification), health data, sex life or sexual orientation.

We may collect and use the following categories of personal information:

• •Identifiers: Name, email, payment details, account credentials.
• •Account Information: Log-ins, passwords, payment information.
• •Commercial Information: Records of products or services purchased.
• •Internet/Electronic Network Information: Browsing history, search history, user interactions.
• •Geolocation Data: IP-based location.
• •AI/Generated Content Information: AI-generated images (or Work Product as defined in the Terms of Use), video, or likeness content created at your request.
• •Inferences: Profiles based on preferences, characteristics, behavior, and aptitudes.
• •Biometric Information: (see Section 2A below).

Definition

“Biometric information” means data generated from your physical, biological, or behavioral characteristics that can be used to identify you. This includes, but is not limited to, photographs, video selfies, facial geometry, likeness-based templates, or other unique identifiers that Zooly processes when you use products such as PhotoBomb or likeness-generation features.

Collection and Purpose

We collect biometric information only when you voluntarily provide it (e.g., uploading a selfie). We use it solely to:

• •Generate and deliver images, videos, or likeness-based content at your request.
• •Provide related customer support.
• •Maintain platform integrity and security.

We do not sell your biometric information or use it for advertising; however, we may share it with our partners and service providers in order to provide you with certain products and services available on our website or mobile app.

Consent

We require your explicit, informed consent before collecting or using biometric information. Consent will be obtained through a clear opt-in process at the point of collection. If you are under 13, we require verifiable parental consent before collecting biometric information.

Retention and Destruction

• •Selfies and likeness templates will be permanently deleted no later than 90 days after your last use of the service, or within 30 days after account closure, unless law requires longer retention.
• •Where required (e.g., Illinois BIPA), biometric information will be destroyed within three (3) years of your last interaction with our services, whichever is sooner.
• •AI-generated likenesses (e.g. Work Product), avatars, or voice models created at your request are considered derivative works produced under your direction. Zooly treats any underlying biometric data used to generate such content in accordance with this Section, but AI outputs themselves are not treated as biometric data once delivered.

Security

We use encryption, strict access controls, and industry-standard safeguards to protect biometric information.

International Transfers

If biometric data is transferred outside your country of residence, we rely on Standard Contractual Clauses (SCCs) or participation in adequacy frameworks such as the EU–U.S. Data Privacy Framework.

Your Rights

You may request access to or deletion of your biometric information, or withdraw consent at any time, by contacting info@zooly.ai.

We collect personal information from the following sources:

• •You, directly via our platform, phone, text, or email.
• •Third parties with your consent (e.g., payment processors).
• •Advertising networks, internet service providers, data analytics providers.
• •Operating systems, social networks, publicly available records.
• •Cookies and tracking technologies (see Section 11A below).
• •IT / security systems including automated monitoring of networks, emails, and messages.

Our services are not directed to children under 13, and we do not knowingly collect personal information from them. If we learn that such information has been collected, we will delete it promptly.

We may use your personal information to:

• •Provide and improve our services (performance of contract).
• •Prevent and detect fraud (legitimate interest).
• •Comply with legal obligations.
• •Maintain operational efficiency and training.
• •Protect trade secrets and confidential data.
• •Conduct statistical analysis and audits.
• •Update customer records and maintain communications.
• •Market our services to customers (with consent where required).
• •Process biometric information (with explicit consent).

Automated Decision-Making: Zooly does not engage in automated decision-making that produces legal or similarly significant effects about you. If this changes, we will update this Policy and describe your rights to obtain human review, express your point of view, and contest the decision.

We may send you promotional messages about our products and services. You may opt out at any time via unsubscribe links, STOP messages, or by contacting info@zooly.ai. We will always respect your preferences.

We may share personal information with carefully selected third parties that provide services necessary to operate, secure, or improve our platform and business operations. These may include hosting and infrastructure providers, data-storage and analytics partners, customer-support tools, and professional advisers.

All such third parties act under written agreements that:

• •require them to process personal information only on our behalf and in accordance with our instructions;
• •prohibit them from selling, using, or disclosing personal information for their own purposes;
• •oblige them to implement appropriate technical and organizational measures to safeguard the data; and
• •require them to delete or return personal information once their services are complete or upon our request.

We retain responsibility for the personal information we share with these service providers and ensure that they meet our privacy and security standards. When applicable, we also enter into data-processing and international-transfer agreements incorporating approved safeguards (such as the EU Standard Contractual Clauses or other lawful mechanisms).

Personal information may also be disclosed:

• •when required by law, legal process, or lawful government request;
• •to protect our rights, safety, or property, or that of others; or
• •in connection with a corporate transaction such as a merger, acquisition, or sale of assets, where the recipient will be bound by comparable data-protection obligations.

We do not sell or rent personal information, and we do not permit our service providers to use it for their own independent marketing or analytics unless expressly authorized by us and permitted by law. Partners receiving AI-generated outputs may not extract biometric identifiers, perform re-identification, or use the media to train face/voice recognition models, and must delete upon our request or upon termination of the collaboration.

By using the Zooly Platform, you grant Zooly a limited license to process and use your personal information as necessary to operate and improve our Services, deliver requested Work Product, and support limited promotional and business uses consistent with this Policy and applicable law.

Zooly acts as a controller (under GDPR) / business (under CPRA) when determining purposes and means of processing. Zooly may share your personal information and AI-generated outputs (e.g. Work Product) with trusted service providers, hosting and analytics vendors, marketing partners, and affiliates under written data-processing agreements that:

• •restrict processing to Zooly’s documented instructions;
• •prohibit sale or independent use of the data;
• •require industry-standard security measures; and
• •mandate deletion or return of data when services end.

Zooly may also use de-identified or aggregated data for analytics, research, or marketing. We may use User Content and related personal data to develop and improve our models and Services, in accordance with this Policy and applicable law. Where required, we will rely on your consent and provide controls to opt out of such use (except where necessary to provide or secure the Services). We do not sell personal information. Any sharing for cross-context advertising is subject to your opt-out rights under the CPRA.

You may withdraw consent or exercise your privacy rights at any time as described in Section 9 (California Consumers) and Section 10 (EEA/UK Data Subjects) by contacting info@zooly.ai. Withdrawal of consent applies prospectively and does not affect prior lawful uses.

We do not sell biometric or sensitive personal information. For California residents, we provide a “Do Not Sell or Share My Personal Information” option in compliance with the CPRA. You can exercise your “Do Not Sell or Share My Personal Information” rights by emailing info@zooly.ai. We also honor browser-based Global Privacy Control (GPC) signals where required.

We retain personal data only as long as needed:

• •Account and financial data: Duration of account + 7 years.
• •Marketing data: Until you opt out or after 2 years of inactivity.
• •Biometric data: See Section 2A.

Once no longer needed, data is deleted or anonymized.

Under the CPRA, you have the right to:

• •Know what data we collect.
• •Opt out of sale or sharing.
• •Limit use of sensitive personal information.
• •Request deletion or correction.
• •Be free from retaliation for exercising your rights.

We may request information to verify your identity before fulfilling a request. You may designate an authorized agent to submit requests on your behalf, subject to verification of the agent’s authority.

You may limit our use and disclosure of Sensitive Personal Information by emailing info@zooly.ai.

You have the right to:

• •Be informed of collection and use.
• •Access your data.
• •Rectify inaccuracies.
• •Request deletion (right to be forgotten).
• •Restrict processing.
• •Data portability.
• •Object to processing / marketing.
• •Not be subject to automated decision-making.

Requests can be made to info@zooly.ai.

Information Collected via Cookies/Similar Tech

You can review or change your cookie preferences at any time via the cookie banner “Settings” link. We categorize cookies as strictly necessary (no consent), analytics, and advertising (consent-based in jurisdictions where required). When you interact with Zooly.ai, we use cookies, SDKs, and similar technologies that may collect online identifiers (e.g., IP address, device identifiers, cookie IDs), usage data, and diagnostic information. Under GDPR, some of this information is personal data. We use: (i) strictly necessary cookies to run the site; and (ii) non-essential cookies (analytics/advertising) only with your consent where required. You can manage preferences in our cookie banner at any time. You can control or disable cookies in your browser settings. Doing so may limit certain functionality or features of the services. We honor Global Privacy Control (GPC) signals for CPRA “sale/share” opt-out where applicable.

Analytics Tools

We use third-party analytics tools, such as Google Analytics, to help us understand how our website and services are used. These tools use cookies to gather information about usage patterns and site performance. You can opt out by using Google Ads Settings or the Google Analytics Opt-Out Tool.

Advertising and Social Media Pixels

Zooly.ai uses tools such as Facebook Pixel to measure traffic, improve site performance, and deliver more relevant content and advertising. You can manage or opt out of this data collection through your Facebook Ad Preferences.

Aggregated Insights

We may compile and analyze data across users in aggregated, de-identified form to understand trends, user behavior, or site performance. This aggregate information does not identify any individual and may be shared with affiliates, partners, or service providers for legitimate business or research purposes.

Do Not Track Signals

Our services currently do not respond to “Do Not Track” (DNT) browser settings or signals. If we implement DNT compliance in the future, we will update this Privacy Policy accordingly.

If we transfer your data outside your country, we use Standard Contractual Clauses (SCCs) or rely on the EU–U.S. Data Privacy Framework. Safeguards are in place to ensure equivalent protection. For UK transfers, we use the UK Addendum/IDTA to the SCCs. Where required, we conduct Transfer Impact Assessments to evaluate destination-country risk.

When we engage service providers or partners located in other jurisdictions, we ensure that these transfers are made under appropriate safeguards and written agreements that require the recipient to protect your personal information to a level substantially equivalent to that provided under applicable law. Where Zooly relies on consent for such transfers, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

We use encryption (in transit and at rest), limited access, monitoring, and breach-notification procedures to protect personal information. In the event of a data breach affecting your personal information, we will provide notifications as required by applicable law.

This policy may be updated from time to time. Updates will be posted on our website and, where appropriate, notified via email. Your continued use of the Zooly Platform after any update to this Privacy Policy constitutes your acknowledgment and acceptance of the revised Policy.

For questions or to exercise your rights, contact us at: info@zooly.ai