---

This Privacy Policy ("Policy") describes how Overturn LLC, doing business as BrandBay ("BrandBay," "we," "us," or "our"), collects, uses, discloses, and protects information in connection with your use of the BrandBay platform and services ("Services"), available at https://www.brandbay.io and https://app.brandbay.io.

This Policy applies to two distinct groups: (1) Customers — individuals or businesses who register for and use the BrandBay platform to organize, store, and share digital branding assets; and (2) Invited Users — individuals who are invited by a Customer to access one or more brand workspaces within the platform.

If you are an Invited User who was added to a Customer's brand workspace through a white-label portal (see Section 14 of our Terms of Service), the Customer is the data controller for your personal data. You should also review the Customer's privacy policy. We process your data on their behalf as a data processor.

If you are an Invited User who was added through the standard BrandBay application (app.brandbay.io), BrandBay acts as the data controller for your account data.

If you have questions about this Policy, contact us at: legal@zeruapps.com

---

1. INFORMATION WE COLLECT

1.1 Information You Provide Directly

When you register for or use the Services, we collect:

• Account Information: Name, email address, and password.
• Billing Information: Payment details (processed and stored by Stripe; we do not store full card numbers). Billing address if required for tax purposes.
• Profile Information: Any additional information you choose to add to your account.
• Brand Configuration: Brand names, descriptions, and organizational settings you configure within the platform.
• Communications: Messages or inquiries you send to our support team.

1.2 Information Collected Automatically

When you access the Services, we automatically collect:

• Log Data: IP address, browser type, operating system, referring URL, pages viewed, and timestamps.
• Device Information: Device type, unique device identifiers, and browser settings.
• Usage Data: Feature interactions, clicks, session durations, and navigation paths within the application.

1.3 Cookies and Similar Technologies

We use cookies and similar tracking technologies to operate and improve the Services. See our Cookie Policy for full details at https://www.brandbay.io/legal-cookies.

• Strictly Necessary Cookies: Session authentication cookies required for the BrandBay application to function. These cannot be disabled without disrupting core functionality.

We also use analytics cookies on our marketing website to understand visitor behavior and improve user experience. These cookies are only set with your consent via our cookie consent tool. Additionally, if you arrived at our website through an affiliate link, affiliate tracking cookies may be set to attribute your visit. For full details of every cookie, including names, durations, and consent requirements, see our Cookie Policy.

1.4 Customer Content and Embedded Metadata

When you upload files to BrandBay, the files may contain embedded metadata such as EXIF data in images (which can include camera settings, GPS coordinates, timestamps, and device information). BrandBay stores uploaded files in their original form and does not automatically strip embedded metadata.

For certain image formats that require server-side compression (such as TIFF), the original image file — including any embedded metadata — is transmitted to a third-party image processing service for thumbnail generation. See Section 7 for details on our sub-processors.

You are responsible for stripping any sensitive metadata from files before uploading them to BrandBay, particularly if those files will be shared publicly or with third parties through the platform.

2. INFORMATION COLLECTED ABOUT INVITED USERS

When a Customer invites another individual to a brand workspace, we collect the following data:

• Email Address: Provided by the Customer at the time of invitation.
• Name: Provided by the Invited User when they create their BrandBay account.
• Account Data: Login credentials and profile information created during the registration process.

For Invited Users who access BrandBay through a Customer's white-label portal (on a custom domain), the Customer is the data controller, and we process the Invited User's data as a data processor on the Customer's behalf. The Customer is responsible for providing appropriate privacy disclosures to their Invited Users and ensuring a lawful basis for the invitation.

For Invited Users who are invited through the standard BrandBay application (app.brandbay.io), BrandBay acts as the data controller. Upon accepting the invitation and creating an account, these Invited Users become BrandBay users in their own right and are subject to this Policy.

3. HOW WE USE INFORMATION

3.1 For Customers

We use Customer information to:

• Create, manage, and authenticate your account.
• Process and manage subscription billing and payments.
• Provide and maintain the Services, including troubleshooting and technical support.
• Send service-related and transactional communications, including account notices, billing confirmations, policy updates, and security alerts. These communications are non-negotiable and cannot be opted out of while your account is active.
• Send marketing and promotional communications from Overturn LLC about BrandBay features, updates, new products, and other Zeru Apps platforms and services. Zeru Apps operates multiple products and, as a Customer of any Zeru Apps product, you may receive communications about our broader product portfolio. The Zeru Apps brand and its relationship to its individual products is prominently disclosed on each product website. We rely on legitimate interests as the legal basis for this processing (see Section 4). You may opt out of marketing communications at any time using the unsubscribe link in any email without affecting your account.
• Analyze usage patterns to improve and develop the Services.
• Protect the security and integrity of the Services.
• Comply with legal obligations.

3.2 For Invited Users

For Invited Users who access BrandBay through a Customer's white-label portal, we process their data as a data processor, solely as instructed by the Customer, to:

• Deliver invitation emails and facilitate account creation.
• Provide access to the Customer's brand workspaces and assets.
• Deliver password reset emails.

For Invited Users who register through the standard BrandBay application (app.brandbay.io), we process their data as a data controller for the same purposes described in Section 3.1, adjusted for their role and feature access. These users may also receive marketing communications from Zeru Apps, subject to the same opt-out rights.

4. LEGAL BASES FOR PROCESSING (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom (UK), we rely on the following legal bases to process your personal data:

• Performance of a Contract (Article 6(1)(b)): Processing necessary to provide, maintain, and administer the Services you have subscribed to or registered for, including billing, account management, team invitations, and technical support.
• Legitimate Interests (Article 6(1)(f)): Marketing and promotional communications about BrandBay and other Zeru Apps products sent to existing Customers and direct-registered users. We rely on legitimate interests rather than consent for this processing because: (1) Customers enter a relationship with Overturn LLC — the parent company — whose brand and product portfolio is openly disclosed on each product website, giving rise to a reasonable expectation that Zeru Apps may communicate about its other products; (2) the marketing is directed only at existing Customers with an established commercial relationship; and (3) a clear and easy opt-out is provided in every communication. This basis is also used for analytics, security monitoring, fraud prevention, and platform improvement.
• Legitimate Interests (Article 6(1)(f)) — continued: Where we send marketing communications to EU/UK Customers, we have assessed that our legitimate interests are not overridden by Customer rights given the existing business relationship, the reasonable expectations created by the visible Zeru Apps brand identity across all products, and the low privacy impact of B2B product communications. Customers retain the right to object to this processing at any time (see Section 14). Users invited through a white-label portal do not receive marketing communications from us.
• Legal Obligation (Article 6(1)(c)): Where processing is required by applicable law, such as tax, financial reporting, or law enforcement requirements.

Where we act as a data processor for white-label Customers' Invited Users, we process that data on the basis of the Customer's instruction and their relevant legal basis as data controller.

5. HOW WE SHARE INFORMATION

5.1 Sub-Processors and Service Providers

We share data with trusted third-party service providers who assist in operating the Services. These parties are contractually bound to protect data and to use it only as instructed. Key categories include:

• Application Infrastructure: Third-party application infrastructure providers that host and operate the BrandBay platform and associated services.
• Payment Processing: Stripe, Inc. (subscription billing).
• Transactional Email: Third-party email service for invitation emails and password resets.
• Image Processing: Third-party image compression service for server-side thumbnail generation of certain image formats.
• Customer Marketing: Encharge.io (email marketing and CRM for Zeru Apps' own marketing communications to Customers; no Invited User data from white-label portals is shared with this service).
• Cloud Infrastructure: Asset storage and delivery providers located in the United States.

5.2 Business Transfers

In the event of a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred as part of the transaction. We will notify you via email or a prominent notice on our website prior to such a transfer.

5.3 Legal Requirements

We may disclose information if required by law, subpoena, or court order, or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of us, our users, or the public.

5.4 Affiliate Program Data Sharing

If you purchase a BrandBay subscription or lifetime license through an affiliate referral link, limited information about your purchase — including your name, email address, and transaction amount — may be shared with the referring affiliate partner for the purpose of calculating and verifying affiliate commissions. This sharing is based on our legitimate interest in operating the affiliate program and the affiliate's legitimate interest in receiving compensation for referrals. Affiliate partners are contractually required to use this information solely for commission verification purposes and to comply with applicable data protection laws. You may contact us at legal@zeruapps.com to object to this processing.

5.5 No Sale of Personal Data

We do not sell your personal data to third parties for monetary consideration.

6. COOKIES AND TRACKING TECHNOLOGIES

Our full Cookie Policy is available at https://www.brandbay.io/legal-cookies. A summary of the key cookies used:

• Strictly Necessary Cookies: Session authentication cookies required for the BrandBay application to function. Cannot be opted out of without impairing core functionality.

BrandBay does not use advertising or behavioral targeting cookies. We use analytics cookies and affiliate tracking cookies on our marketing website with your consent. You can manage cookie preferences through your browser settings or our cookie consent tool (CookieYes). See our full Cookie Policy for details.

7. THIRD-PARTY SUB-PROCESSORS

A list of our key sub-processors is maintained below. We will update this list when sub-processors change. Where required by applicable law (including GDPR Article 28), we will provide at least 30 days' prior written notice before engaging a new sub-processor or making material changes to an existing one, giving you the opportunity to object. Notice will be provided via email or in-app notification.

• Application infrastructure provider — Platform hosting and application operation (USA). The identity of this provider is considered confidential business information and is not disclosed; however, this provider is bound by confidentiality and data protection obligations consistent with this Policy, including appropriate safeguards for international data transfers.
• Stripe, Inc. — Payment processing and subscription billing (USA).
• Transactional email service provider — Delivery of invitation emails and password reset emails (USA). Processes email addresses, names, and white-label portal configuration data (such as the Customer's company name for branded emails). Bound by a GDPR-compliant data processing addendum. DPA available at twilio.com/legal/data-protection-addendum.
• Asset storage and delivery provider — Cloud object storage for Customer Content and asset delivery infrastructure (USA). The identity of this provider is considered confidential business information and is not disclosed; however, this provider is bound by a data processing agreement and confidentiality obligations consistent with this Policy.
• DDoS protection and security provider — Provides DDoS protection and security services for asset delivery infrastructure. Processes IP addresses and request metadata in the course of providing security services. Bound by a GDPR-compliant data processing addendum.
• Image compression service provider — Server-side image compression and thumbnail generation for certain image formats (EU). Receives original image files, including any embedded metadata (such as EXIF data), for the purpose of generating compressed thumbnail versions. Does not retain original images after processing. DPA available at shortpixel.com DPA.
• Encharge.io (PXCH Holding I, LLC) — Email marketing and CRM for Zeru Apps' own Customer communications (USA). No Invited User data from white-label portals is shared with this service. DPA available at gdpr.encharge.io/dpa. Transfers rely on Standard Contractual Clauses (Module 2).
• Website analytics provider — Visitor analytics and heatmap data on the BrandBay marketing website (www.brandbay.io) only. Processes IP addresses, browser/device information, and page interaction data. Analytics cookies are set only with your consent via our cookie consent tool. Does not process data within the BrandBay application.
• Affiliate tracking provider — Affiliate referral tracking on the BrandBay marketing website. Sets cookies to attribute referrals and processes limited purchase data (name, email, transaction amount) to calculate affiliate commissions. Cookie duration is 60 days. See our Cookie Policy for details on the specific cookies set.
• Cookie consent management provider — CookieYes. Manages cookie consent preferences on the BrandBay marketing website. Processes consent records, IP addresses, and browser information for the purpose of recording and enforcing cookie consent choices.
• Forms and engagement provider — Provides on-site forms, popups, banners, and promotional content on the BrandBay marketing website (www.brandbay.io). Processes email addresses submitted through forms, browser/device information, and page interaction data. Active only on the marketing website, not within the BrandBay application.

Full details and Data Processing Agreements are available upon request at legal@zeruapps.com.

8. DATA SECURITY

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, or destruction. These measures include encryption of data in transit (TLS/SSL), access controls, and security monitoring.

However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security. You are also responsible for maintaining the security of your account credentials.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected individuals and applicable regulatory authorities without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required by applicable law (including GDPR Article 33). Our Data Processing Addendum (Section 29 of our Terms of Service) contains additional detail on breach notification obligations for Customer Personal Data.

9. DATA RETENTION

We retain Customer account data for as long as your account is active and for a period of up to 90 days following account termination, after which it is deleted or anonymized.

Invited User account data is retained for as long as the Invited User's account remains active. If an Invited User is removed from all brand workspaces, their account persists as a free-tier account and data is retained accordingly.

Customer Content (uploaded assets) is retained until deleted by the Customer or until the account is terminated, subject to the 90-day post-termination retention period described in our Terms of Service.

Certain data may be retained for a longer period if required by applicable law — for example, transaction records and billing data may be retained for up to seven (7) years to comply with tax, accounting, and financial reporting obligations.

Backup data may persist for a limited period following deletion requests, consistent with our backup rotation schedule, but will not be used for any active processing.

10. INTERNATIONAL DATA TRANSFERS

Our servers and primary storage infrastructure are located in the United States. If you are accessing the Services from outside the United States, your data will be transferred to, processed in, and stored in the United States.

For users in the EEA, UK, or Switzerland, we rely on appropriate safeguards for international data transfers as required by applicable law. Specifically:

• Where we transfer personal data to sub-processors located in the United States or other third countries, we ensure that each sub-processor has implemented appropriate transfer mechanisms, including the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Addendum (UK IDTA). These mechanisms are incorporated into each sub-processor's Data Processing Agreement, which governs our relationship with that sub-processor.
• Our key sub-processors — including Stripe, Inc. and Encharge.io — each maintain their own DPAs incorporating the applicable SCCs and transfer mechanisms. Our image compression provider is located in the EU and processes data within the EEA. Links to or copies of these DPAs are available upon request at legal@zeruapps.com.

A full list of our sub-processors is set out in Section 7 of this Policy. We will provide at least 30 days' prior written notice before engaging any new sub-processor that may involve an international transfer of personal data, consistent with our obligations under applicable data protection law.

For questions about our international transfer mechanisms or to request copies of applicable DPAs, please contact us at legal@zeruapps.com.

11. CHILDREN'S PRIVACY

The Services are intended for use by individuals who are at least 18 years of age. We do not knowingly collect or solicit personal information from anyone under the age of 18. If we learn that we have collected personal information from a child under 18, we will delete it promptly.

If you believe we may have collected information from a minor, please contact us at legal@zeruapps.com.

12. YOUR PRIVACY RIGHTS (ALL USERS)

Regardless of your location, you may exercise the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to legal retention obligations.
• Opt-Out of Marketing: Unsubscribe from marketing emails at any time using the unsubscribe link in any email, or by contacting us at legal@zeruapps.com.
• Data Portability: Where applicable, request a portable copy of your data.

To submit a data subject access request (DSAR), please email legal@zeruapps.com or visit our DSAR page at https://www.brandbay.io/legal-dsar. We will respond within 30 days (or within the timeframe required by applicable law).

If you are an Invited User who was added to a Customer's brand workspace through a white-label portal, please contact the Customer directly, as they are the data controller for your data. We will cooperate with Customers to fulfill Invited User requests.

13. CALIFORNIA PRIVACY RIGHTS (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of categories and specific pieces of personal information we have collected, disclosed, or sold.
• Right to Delete: Request deletion of your personal information, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: We do not process sensitive personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

Categories of Personal Information Collected in the Past 12 Months:

Category	Examples	Collected
A. Identifiers	Name, email address, IP address, account username	YES
B. Commercial Information	Subscription tier, payment history	YES
C. Internet / Network Activity	Page visits, feature engagement, session data	YES
D. Geolocation Data	Approximate location based on IP address	YES
E. Professional or Employment Info	None collected directly by BrandBay	NO
F. Biometric Information	None	NO
G. Protected Classification Characteristics	None	NO
H. Sensitive Personal Information	None	NO
I. Inferences	Usage patterns derived from interaction data	YES

To submit a CCPA request, contact us at legal@zeruapps.com. We will verify your identity before processing your request. We will respond within 45 days. You may designate an authorized agent to submit requests on your behalf; the agent must provide proof of authorization.

14. EEA / UK PRIVACY RIGHTS (GDPR / UK GDPR)

If you are located in the European Economic Area or United Kingdom, you have the following rights:

• Right of Access (Article 15 GDPR)
• Right to Rectification (Article 16 GDPR)
• Right to Erasure / Right to be Forgotten (Article 17 GDPR)
• Right to Restriction of Processing (Article 18 GDPR)
• Right to Data Portability (Article 20 GDPR)
• Right to Object to Processing (Article 21 GDPR)
• Rights related to Automated Decision-Making (Article 22 GDPR)

To exercise these rights, contact us at legal@zeruapps.com. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority. A list of EU supervisory authorities is available at: ec.europa.eu.

Our designated Data Protection contact for GDPR purposes is reachable at legal@zeruapps.com.

Right to Object to Marketing: You have the right to object at any time to the processing of your personal data for direct marketing purposes, including profiling related to such marketing. If you object, we will cease processing your data for marketing purposes without delay. To exercise this right, use the unsubscribe link in any marketing email or contact us at legal@zeruapps.com.

EU/UK Representative: We do not currently maintain an establishment in the EEA or UK. If you are located in the EEA or UK and have concerns about our processing of your personal data, you may contact us directly at legal@zeruapps.com. We are evaluating the appointment of an EU representative under Article 27 GDPR and a UK representative under Article 27 UK GDPR as our user base grows, and will update this Policy when such appointments are made.

15. CANADIAN PRIVACY RIGHTS (PIPEDA / QUÉBEC LAW 25)

If you are located in Canada, we process your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws, including Québec Law 25.

You have the right to access, correct, and request deletion of your personal information. To exercise these rights, contact us at legal@zeruapps.com.

16. DO NOT TRACK

We do not currently respond to 'Do Not Track' (DNT) signals from browsers because no uniform industry standard for recognizing and implementing DNT has been adopted. We will update this Policy if a standard is established.

17. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, Services, or applicable laws. We will notify you of material changes by updating the 'Last Updated' date at the top of this Policy and, where appropriate, by email or in-app notification. Your continued use of the Services after the effective date of any change constitutes your acceptance of the updated Policy.

18. CONTACT US AND DATA SUBJECT REQUESTS

For privacy-related inquiries, data subject access requests, or complaints:

Data Subject Access Requests: Email legal@zeruapps.com with the subject line 'DSAR Request' and include your full name, email address associated with your account, and a description of your request. We will verify your identity and respond within the timeframe required by applicable law.