Introduction
Collage Labs, Inc ("we," "us," "our," or the "Company") provides this privacy policy for the Collage Digital Asset Management system. The policy explains how personal information is collected, used, disclosed, and protected through our DAM system, including web and mobile applications (collectively, the "Services").
This privacy notice describes how we might use your information if you:
- Visit the website at https://app.collage.inc and access its features
- Download and use the mobile application
- Engage with us in related ways including sales, marketing, or events
Definitions used in this policy:
- "Web App" refers to websites referencing this policy
- "Mobile App" refers to applications referencing this policy
- "Services" refers to the Website, App, and related services including sales, marketing, or events
By using the Services, you acknowledge reading and understanding this privacy policy and consent to information collection, use, and disclosure as described.
1. Information We Collect
We collect the following categories of personal information when you use our Services:
Contact information: Name, email address, phone number, and other contact details provided during account registration or when you contact us.
User profile information: Job title, company name, location, and optional profile photos provided during registration.
Asset information: File names, descriptions, tags, and metadata about digital assets you upload to the platform.
Usage information: Pages viewed, features used, downloaded assets, search queries performed, and interaction patterns within the Services.
Technical information: IP address, browser type and version, operating system, device identifiers, referring URLs, and general location data derived from your IP address.
Financial information: Payment card information or payment method details for billing purposes, processed through our third-party payment processor. Subscriptions are available only through the Web App, so mobile app access requires Web App subscriber login.
Information Collected Automatically
When you visit our website or use our Services, we automatically collect certain information through cookies and similar tracking technologies. This includes:
- Analytics data via Google Analytics (through Google Tag Manager)
- Session replay and behavioral analytics via Amplitude
- Advertising and conversion tracking via LinkedIn Insight Tag
- Visitor identification via RB2B
For more information about the cookies and tracking technologies we use, please see Section 8 (Cookies and Tracking Technologies) below.
2. Legal Basis for Processing (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal information based on the following legal grounds:
- Contract performance: Processing necessary to provide you with our Services, manage your account, and fulfill our contractual obligations to you.
- Legitimate interests: Processing necessary for our legitimate business interests, such as improving our Services, preventing fraud, and ensuring security, provided these interests are not overridden by your rights.
- Consent: Processing based on your freely given consent, such as for marketing communications and non-essential cookies. You may withdraw consent at any time.
- Legal obligation: Processing necessary to comply with applicable laws and regulations.
3. How We Use Your Information
We use the personal information we collect for the following purposes:
Providing our Services: Enabling account access, digital asset management, content distribution, and all features of the Collage platform.
Communicating with you: Account updates, asset-related notifications, service announcements, and responses to your inquiries.
Improving our Services: Analyzing usage patterns, conducting research, and enhancing functionality, performance, and user experience.
Marketing: Sending marketing communications about our Services and related offerings. You may opt out of marketing emails at any time by clicking the unsubscribe link in any email or contacting us.
Analytics and personalization: Understanding how users interact with our website and Services to improve content, features, and user experience.
Security and fraud prevention: Detecting, preventing, and responding to security incidents, fraud, and other harmful activity.
Compliance: Meeting legal and regulatory requirements, enforcing our terms, and protecting our rights.
4. How We Share Your Information
We do not sell your personal information. We may share your information in the following circumstances:
Service providers: We share information with third-party service providers who assist in delivering our Services. These providers are contractually obligated to use your information only for the purposes we specify and to implement appropriate security measures. Our current service providers include:
- Cloud hosting and infrastructure (Amazon Web Services)
- Payment processing (Stripe)
- Email communications (SendGrid)
- Analytics and product improvement (Google Analytics, Amplitude)
- Customer support (Freshdesk)
- Advertising and marketing (LinkedIn, RB2B)
Legal requirements: We may disclose personal information when required by law, regulation, legal process, or enforceable governmental request, including court orders and subpoenas.
Business transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you of any such change in ownership or control.
With your consent: We may share your information for other purposes with your explicit consent.
5. Data Retention
We retain your personal information for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law. Specifically:
- Account data: Retained for the duration of your account and for a reasonable period after account closure to comply with legal obligations and resolve disputes.
- Asset data: Retained for the duration of your subscription. Upon account termination, uploaded assets are deleted within 90 days unless otherwise agreed.
- Usage and analytics data: Retained in aggregate or anonymized form for up to 24 months for product improvement purposes.
- Marketing data: Retained until you opt out of marketing communications or request deletion.
- Financial data: Retained as required by applicable tax and accounting regulations.
6. How We Protect Your Information
We implement appropriate technical, administrative, and physical security measures to protect your personal information from unauthorized access, use, disclosure, alteration, or destruction. These measures include:
- Encryption of data in transit (TLS/SSL) and at rest
- Access controls limiting data access to authorized personnel
- Regular security assessments and monitoring
- Secure development practices
While we strive to protect your personal information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.
7. International Data Transfers
Collage Labs, Inc is based in the United States. If you access our Services from outside the United States, your personal information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.
For users in the EEA, UK, or Switzerland, we rely on appropriate safeguards for international data transfers, including Standard Contractual Clauses approved by the European Commission, to ensure your personal information receives an adequate level of protection.
8. Cookies and Tracking Technologies
We use cookies and similar tracking technologies on our website and within our Services. These technologies help us analyze usage, personalize your experience, and deliver relevant advertising.
Types of cookies we use:
- Essential cookies: Required for the basic functionality of our website and Services. These cannot be disabled.
- Analytics cookies: Help us understand how visitors interact with our website by collecting and reporting information. We use Google Analytics (via Google Tag Manager) and Amplitude for this purpose.
- Session replay: Amplitude Session Replay records user interactions to help us improve the user experience. These recordings do not capture sensitive form inputs.
- Marketing cookies: Used to track visitors across websites for advertising purposes. We use LinkedIn Insight Tag for conversion tracking and audience building, and RB2B for visitor identification.
Managing your cookie preferences:
You can manage your cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. Please note that disabling certain cookies may affect the functionality of our Services.
We honor Global Privacy Control (GPC) signals. If your browser sends a GPC signal, we will treat it as a valid opt-out request for the sale or sharing of personal information.
9. Your Privacy Rights
Rights for all users
Regardless of your location, you have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate or incomplete information
- Request deletion of your personal information
- Opt out of marketing communications
Additional rights under GDPR (EEA, UK, Switzerland)
If you are located in the European Economic Area, United Kingdom, or Switzerland, you also have the right to:
- Restrict processing of your personal information
- Object to processing based on legitimate interests
- Data portability — receive your data in a structured, machine-readable format
- Withdraw consent at any time, without affecting the lawfulness of processing based on consent before withdrawal
- Lodge a complaint with your local data protection authority
Additional rights under CCPA/CPRA (California residents)
If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
- Right to know: You may request information about the categories and specific pieces of personal information we have collected, the purposes for collection, and the categories of third parties with whom we share it.
- Right to delete: You may request that we delete your personal information, subject to certain exceptions.
- Right to correct: You may request correction of inaccurate personal information.
- Right to opt out: You have the right to opt out of the sale or sharing of your personal information. We do not sell personal information in the traditional sense, but certain advertising activities (such as targeted advertising via LinkedIn and RB2B) may constitute "sharing" under the CCPA.
- Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights.
To exercise any of these rights, contact us at support@collage.inc. We will respond to verifiable requests within 45 days (CCPA) or 30 days (GDPR).
10. Do Not Sell or Share My Personal Information
Collage Labs does not sell personal information in exchange for monetary consideration. However, some of our advertising and analytics practices — such as the use of LinkedIn Insight Tag and RB2B — may constitute "sharing" of personal information for cross-context behavioral advertising under the CCPA.
You may opt out of this sharing by:
- Sending a request to support@collage.inc
- Enabling the Global Privacy Control (GPC) signal in your browser
11. Children's Privacy
Our Services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete that information promptly. If you believe we may have collected information from a child under 16, please contact us at support@collage.inc.
12. Automated Decision-Making
We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects. Our AI-powered search features process asset metadata and content to improve search results but do not make decisions about individuals.
13. Changes to This Privacy Policy
We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated policy on this page with a revised "Last updated" date. For significant changes, we may also notify you via email or through a notice within our Services.
We encourage you to review this policy periodically to stay informed about how we protect your information.
14. Contact Us
If you have questions, concerns, or requests regarding this privacy policy or our data practices, please contact us:
- Email: support@collage.inc
- Mail: Collage Labs, Inc, 8149 W Virginia Ave, Lakewood, CO 80226
For GDPR-related inquiries, you may also lodge a complaint with your local data protection supervisory authority.