Privacy Policy

Effective date: August 13, 2026 VISITORS, CUSTOMERS, GALLERY CLIENTS, AND PHOTOGRAPHERS This Privacy Policy explains how WOOPLAK LLC (“Wooplak,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information in connection with our websites, accounts, galleries, photography workflows, design and print services, orders, referrals, commissions, payouts, support, and related services (collectively, the “Service”). It applies to website visitors, customers, gallery clients, photographers, account holders, support contacts, and recipients of authorized referral communications. This policy describes Wooplak's practices. A photographer or business that independently collects or uses personal information may have separate legal duties and privacy notices. WHO IS RESPONSIBLE AND HOW TO CONTACT US WOOPLAK LLC is responsible for the personal information described in this policy, subject to the roles and requirements established by applicable law. Questions, requests, and complaints may be directed to: Privacy Officer WOOPLAK LLC 1710 NJ-34 Wall Township, NJ 07727 [email protected] INFORMATION WE COLLECT Depending on how you interact with the Service, we may collect: - Identity, contact, and account information, such as name, email address, telephone number, mailing or shipping address, login identifiers, account status, communication preferences, and authentication or security records. - Photographer and business information, such as business name, portfolio, location, application or provisioning records, approvals, program participation, referral activity, commissions, payee information, payout status, and limited tax-status or verification information. - Gallery and client information, such as names and contact details supplied by a photographer or client, gallery access and authentication records, selections, comments, delivery status, and related communications. - Photographs and production content, such as uploaded photographs, image metadata, designs, proofs, final files, logos, printing instructions, crops, layouts, and order assets. - Order and transaction information, such as products, prices, discounts, shipping details, fulfillment status, refunds, commissions, payouts, and related financial and audit records. - Limited payment information, such as payment status, provider transaction identifiers, payment method type, billing details, and last four digits received from a payment provider. When payment credentials are collected on a provider-hosted form, Wooplak does not receive the full card number or security code. - Communications, such as support requests, complaints, feedback, rights notices, survey responses, and messages you send us. - Device and activity information, such as IP address, device and browser type, operating system, approximate location derived from IP, cookie or session identifiers, pages and features used, timestamps, referring pages, performance data, error reports, and security events. SOURCES OF INFORMATION We collect information directly from you; from an authorized photographer, customer, business, or account administrator; automatically when the Service is used; and from operational providers that support authentication, payment, shipping, storage, email, security, support, or an integration you request. If a photographer provides client, subject, or recipient information, the photographer must have authority to provide it and is responsible for any notice or consent required in that relationship. If you believe information was provided without authority, contact the Privacy Officer. HOW WE USE INFORMATION We use personal information to: - create, authenticate, secure, administer, and support accounts; - operate galleries and access controls; - upload, process, check, resize, display, deliver, and store photographs and designs; - prepare print files, fulfill and ship orders, process payments, and provide customer service; - administer discounts, referrals, commissions, verification, reversals, and payouts; - send transactional, service, legal, security, referral, and consented marketing communications; - prevent fraud, infringement, abuse, unauthorized access, and other harm; - diagnose errors, measure performance, maintain availability, and improve usability; - maintain accounting, tax, acceptance, dispute, fraud, compliance, and legal records; - enforce agreements and policies, establish or defend legal claims, and comply with law; and - carry out another purpose disclosed when information is collected, with consent where required. We use information under the legal grounds applicable to the context, which may include performing a contract or requested service, consent, compliance with law, and legitimate interests such as security, fraud prevention, support, and improving the Service, where those grounds are recognized and not overridden by applicable rights. We automatically collect limited device, browser, usage, diagnostic, and security information. We use service providers to protect Wooplak, diagnose errors, measure performance, and improve the service. We do not use this information for third-party targeted advertising. WHEN WE DISCLOSE INFORMATION We may disclose information to operational service providers that help with hosting, storage, authentication, payments, shipping, printing, email, diagnostics, customer support, security, professional advice, and requested account integrations. They may process information only for the services and purposes authorized for them, subject to contracts and applicable law. Photographs may be processed by Wooplak and operational providers to provide requested features, perform quality and safety checks, fulfill orders, secure the Service, respond to rights complaints, and comply with law. Authorized photographers, customers, gallery clients, fulfillment providers, and support personnel may receive access appropriate to their role and the requested workflow. If you connect Dropbox or another optional account, we exchange the data, authorization tokens, and files needed to provide that integration. Disconnecting stops future transfers by Wooplak but does not delete copies already stored in the external account or information retained for security, audit, or legal purposes. We may also disclose information when we reasonably believe disclosure is required by law or legal process; necessary to investigate fraud, abuse, security events, or rights complaints; or necessary to protect a person, Wooplak, the Service, or legal rights. We may disclose information to legal, accounting, insurance, and other professional advisers subject to appropriate obligations. If Wooplak is involved in a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction, information may be disclosed or transferred as part of due diligence or the transaction, subject to applicable law and appropriate protections. We do not sell personal information. We do not share personal information for third-party targeted advertising, and we do not use third-party advertising trackers. We do not disclose personal information to third parties for their own direct marketing except at your direction or with consent where applicable. COOKIES AND SIMILAR TECHNOLOGIES The Service uses cookies and similar local technologies needed for login, security, fraud prevention, gallery access, cart state, preferences, and reliable operation. We may use limited operational measurement to understand performance and feature use. Browser or device controls can block or delete cookies, but essential features may not work correctly without them. Where applicable law requires consent or controls for a nonessential technology, we will provide them before using that technology. PHOTOGRAPH AND GALLERY ACCESS Photographs are available through authorized account, gallery, order, and fulfillment workflows. Access may also be provided on a limited need-to-know basis for support, quality, safety, security, rights complaints, legal holds, or compliance. Access links and credentials should be treated as confidential; a recipient who forwards them may allow another person to gain access. RETENTION AND DELETION Unless a different disclosed rule applies, unselected proofs become eligible for permanent deletion 30 days after confirmed selection, and delivered galleries and their files become eligible for permanent deletion 30 days after delivery. Deletion eligibility does not guarantee that every copy is removed on the first eligible day. Courtesy reminders are not guaranteed and are not a precondition to deletion. We retain account, support, and other personal information only as long as reasonably needed for the purposes described in this policy. Order, shipping, tax, payment, refund, commission, payout, acceptance, consent, unsubscribe, fraud, security, complaint, dispute, and legal records may be retained longer to meet operational or legal needs, establish or defend claims, enforce agreements, or comply with law. Deletion from active systems may not immediately remove limited backup copies. We may also preserve information subject to a legal hold or retain limited records needed to prevent fraud, document a request, respect an unsubscribe, protect security, or comply with law. When retention is no longer reasonably necessary, we delete, de-identify, or securely dispose of information in accordance with our procedures. SECURITY We use reasonable administrative, technical, and physical safeguards designed for the nature of the information and risks involved. These may include access controls, authentication, encryption in transit or at rest where appropriate, logging, provider review, and incident-response procedures. No internet transmission, storage system, provider, or security measure is perfectly secure, and we cannot guarantee that information will never be lost, corrupted, accessed, disclosed, or altered without authorization. You are responsible for securing your credentials, devices, gallery links, connected accounts, and independent copies of photographs, and for notifying us promptly of suspected unauthorized access. INTERNATIONAL AND CROSS-BORDER PROCESSING Wooplak and its providers may process information in the United States, Canada, and other jurisdictions where they operate. Privacy and government-access laws may differ from those in your location. We use contractual, organizational, and other measures required by applicable law for cross-border processing. Canadian information processed outside Canada may be accessible to courts, law-enforcement, or national-security authorities under the laws of the other jurisdiction. YOUR CHOICES AND PRIVACY RIGHTS Depending on your location and relationship with Wooplak, you may have rights to request access to personal information, correction, deletion, information about processing or disclosures, withdrawal of consent, restriction or objection, portability, or review of a decision. You may unsubscribe from marketing using the link in the message or by contacting us. Transactional, security, account, and legal communications may continue when necessary. To make a request, contact [email protected] and describe the request. We may verify identity and authority before acting, including authority to request information about another person or business account. Applicable law may allow or require us to decline, limit, charge for, or retain information in response to a request. Withdrawing consent does not affect earlier lawful processing and may prevent us from providing a requested feature. We will respond within the period required by applicable law. We will not discriminate against a person for exercising an applicable privacy right. An authorized agent may submit a request where permitted, subject to verification. CANADIAN QUESTIONS AND COMPLAINTS Canadian individuals may ask about our privacy practices, access or correct personal information, withdraw consent where applicable, or make a complaint to the Privacy Officer. We will investigate and respond in accordance with applicable federal and provincial law. If you are not satisfied, you may contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator. Contacting us first is welcome but does not prevent you from contacting a regulator. CHILDREN AND PHOTOGRAPHS OF MINORS The Service is not offered for account creation or independent use by anyone under 18, and Wooplak does not knowingly collect personal information directly from children for their own accounts. Adults may upload photographs containing minors only when they possess the required authority, permissions, releases, and consents. If you believe a child provided information directly without appropriate authority, contact the Privacy Officer. THIRD-PARTY SERVICES AND LINKS The Service may link to or integrate with third-party services. Their privacy practices apply to information they independently receive or control. You should review their notices before connecting an account or leaving the Service. Wooplak is not responsible for an unrelated third party's independent practices, except to the extent applicable law provides otherwise. CHANGES TO THIS POLICY We may update this policy to reflect changes in the Service, law, providers, or practices. The current version and effective date will appear on the public policy page. We will provide additional notice of a material change when required or appropriate and obtain fresh consent when a new use or applicable law requires it. Earlier versions will be retained as required for audit and evidence. CONTACT Privacy Officer WOOPLAK LLC 1710 NJ-34 Wall Township, NJ 07727 [email protected]