P3RSON Privacy Policy

1. Who We Are and What This Policy Covers

P3RSON, Inc. ("P3RSON," "we," "us") runs the P3RSON app and the p3rson.com website. This policy explains what personal information we collect, why, who receives it, how long we keep it, and the choices you have.

P3RSON is offered in the United States. We do not target users in the European Union, the European Economic Area, or the United Kingdom (see Section 12).

This policy is part of the P3RSON Legal Suite. It works with the Terms of Service, the AI Features Notice, the Biometric and Sensitive Data Notice, the Guardian and COPPA policy, the Data Retention document, and the Sub-Processors list. Defined terms follow the Terms of Service.

2. Information We Collect

2.1 Information You Give Us

• Account: name, email address, phone number (if you add one), date of birth, location you choose to provide, profile photo, social links (optional)
• Payments and tax: payout details and tax identification for creators when the law requires a tax form. Card and bank details go directly to Stripe; we do not receive the full card number. This includes card payments for P3 Coins bought on p3rson.com, which are made on a Stripe Checkout page
• Using the service: booking requests and confirmations, messages, portfolio uploads, Digitals photos, ratings and reviews, reports and appeals you send us
• Guardian information: for users aged 13 to 17, the guardian's name, relationship, and email address (see Section 9)

2.2 Information We Collect Automatically

• Device and app data: app version, device type, operating system, crash reports, performance metrics
• Usage data: likes, comments, shares and saves you make, and video playback records. App usage analytics (Firebase Analytics), which would measure impressions, clicks and session times, are off in this version
• Advertising data: when sponsored posts are turned on, ad delivery and impression/click records kept by our servers and linked to your P3RSON account
• Security data: IP address, sign-in history, and signals that help us stop fraud, abuse, and sanctioned-country access. We use the approximate location of your IP address to spot suspicious sign-ins and for sanctions checks. We keep sign-in location history for 90 days and erase it when you delete your account

2.3 Information From Others

• Stripe: account verification results and payment status
• Apple: purchase status for P3 Pro and P3 Coins, and, where your device supplies it, Apple's Declared Age Range signal (used to set adult or minor status, on iOS 26 or later sometimes instead of a typed birthday, and, where the app offers it, to review an under-13 lock)
• Other users: reports, reviews, and messages about you

2.4 Images and Biometric or Sensitive Data

Digitals photos are images of you. When you agree, we send them to AI providers for analysis (Section 5). We do not create or store face templates, faceprints, or face geometry. Section 6 and the Biometric and Sensitive Data Notice explain what is kept and when it is destroyed.

2.5 Admin Access and Audit Logging

• Agency admins can see data for the team and talent inside their own agency: profiles, bookings, earnings summaries, and booking threads linked to the talent the agency represents
• Admins cannot see passwords, payment methods, raw tax data, or home addresses, and cannot start payouts
• We log when agency admins open talent roster records
• Audit logs are kept for 7 years. To ask which admins opened your data, email privacy@p3rson.com. We confirm the request within 10 business days and answer within 45 days

3. How We Use Your Information

When sponsored posts are turned on, we show contextual sponsored posts selected by our servers and labeled “Ad,” without profile-interest targeting. We keep ad delivery and impression/click records linked to your account for frequency caps and billing reports. We do not use your images to train AI models.

4. Who Receives Your Information

We do not sell your personal information. We do not share it for cross-context behavioral advertising. We share it only as described here.

Each provider acts as our service provider and may use the information only to serve us. The Sub-Processors list is at p3rson.com/subprocessors. We post changes at p3rson.com/subprocessors at least 30 days before a new processor starts. To object, email privacy@p3rson.com.

We also disclose information when the law requires it (a valid subpoena or court order), to protect someone's safety, to enforce our Terms, to report child sexual abuse material to NCMEC, and in a merger or sale of the business (we will tell you first and the same promises will bind the new owner). Guardians receive the guardian records for their minor. Other users and the public see only what you choose to make public.

4.1 Media Kit recipients and Sent history

Today you can share one public link to your Media Kit and revoke it. Sharing with named people, Sent history, and open or view receipts are not available in this version; the parts below about them apply only once the app shows them to you.

People who see your Media Kit can send you a booking request or an inquiry through P3RSON. We send it to whoever the kit names: to you for a kit you publish yourself, or to your agency for an agency Media Kit you approved. A request includes the sender's P3RSON account and organization and the version of the kit they saw. Your agency's staff can see requests sent to the agency as their role allows.

If you approve an agency Media Kit, it shows your name, the Digitals and the profile details you approved, and your agency's name, to anyone with its link. You can remove it at any time in the app.

People with your share link receive only the frozen content you selected. Recipient details entered by the sender do not verify the identity of a viewer.

When you share a Media Kit or Digitals, we keep a frozen copy of the selected content and a Sent history showing the recipient details you entered, the share date, link settings and recorded activity. Later edits to your profile do not change that copy. We use these records to provide sharing, activity receipts, your history, and security controls.

Sent history and its frozen content remain after a link expires or is revoked and after P3 Pro ends. After P3 Pro ends, your existing history is read-only: you can review it, but you cannot create or resend shares without the required subscription and eligibility. Subscription lapse does not delete your history. Privacy requests and safety controls remain available regardless of subscription status.

We delete this history and its associated personal data when the account is deleted or when a valid legal deletion request requires it. If the law requires preservation of particular records, we restrict those records to that purpose and delete them when the preservation requirement ends. We do not retain all Sent history merely because one record must be preserved. This rule does not let us recall copies already saved outside P3RSON.

Read-only history preserves your ability to revoke links and make privacy, export and deletion requests.

Before you view this Media Kit

Recipients see this notice, with a link to this Privacy Policy, before they choose to view the kit or leave without viewing it:

If you continue, P3RSON will record when this link is opened, how many times it is opened, whether the kit is viewed, and your device type. The sender can see this activity in their Sent history.

You do not need a P3RSON account. We show an unsigned-in viewer as “Someone with the link.” A recipient name entered by the sender does not verify who opened the link. Anyone the link is forwarded to may open it while it remains available.

This activity stays in the sender’s history after the link expires, is revoked, or their P3 Pro ends. We delete it on account deletion or a valid legal deletion request, subject to legally required preservation. For privacy requests, contact privacy@p3rson.com.

We do not use Media Kit link-opening or viewing activity for advertising, and we do not use it to track you across other companies’ apps or websites.

Essential request processing and security logs are separate from the activity shown to the sender. Leaving without viewing does not record a Sent-history open or view.

5. AI Features and Image Analysis

5.1 Where We Use AI

5.2 What Is Sent and What Comes Back

• To Anthropic: the photo image data and a fixed instruction. In the P3 Audit, all four photos go together. We send no name, email, or account ID. The instruction tells the model not to infer your age, gender, race, skin tone, emotion, attractiveness, or identity, and not to infer any health condition
• To AWS Rekognition: the image. It returns the number of faces, a face-detection confidence, brightness and sharpness values, and content-safety labels. We use these to ask you to retake a photo or to flag a photo for review. We do not use face comparison, face search, or face indexing, and Rekognition is not used to identify anyone
• To AWS Comprehend: text only, to detect toxic content
• We store with your audit record: the readiness score, per-photo quality checks, AI Scout Notes, reason codes, moderation flags, and the face-count, confidence, brightness, and sharpness values
• Providers process the information in the United States. Under the commercial terms that apply to our use of their services, they do not use it to train their models. They may keep inputs for a short period for their own safety and abuse monitoring

5.3 Your Consent

• Before your first Digitals photo leaves your device for AI analysis, the app shows a consent sheet that names the provider and what is sent, and says how long we keep your photos and results. You agree by checking an "I agree" box that starts unchecked. It is separate from the Terms and this policy, and it is optional
• You can decline and keep using every feature that does not need AI analysis
• Withdraw consent any time in Settings > Privacy and data > Manage consent > AI Photo Analysis. We stop sending new photos right away
• Users under 18 cannot use AI analysis in this version, because guardian approval and a guardian's separate consent are not available. If they are offered later, the private P3 Audit would be the only AI use for under-18 users, and only after a guardian separately consents to sending the photos to the provider

5.4 What AI Does Not Do

• AI results are feedback. We do not use them to decide eligibility, hiring, credit, housing, or pricing, and they are not predictions about a person
• AI Scout Notes are labelled as AI-generated. They never suggest changing your body
• You can ask a person to review any AI result: email privacy@p3rson.com
• Agency matching and recommendations are not run by the AI providers named in this section

See the AI Features Notice for the full description.

6. Biometric and Sensitive Data

• No face templates. P3RSON does not create, store, or sell faceprints or face geometry
• Consent first. We ask for your written consent before we analyze your Digitals. The AI photo review consent sheet says how long we keep your photos and results and has an "I agree" checkbox that starts unchecked. Checking it and continuing is your electronic signature, and we store it as your written release
• Schedule. Frozen copies of selected Digitals in Media Kit Sent history follow the specific Sent-history rule in the Data Retention Policy. This does not extend retention of private AI analysis, audit results, face-detection values or biometric data. Source Digitals images and audit results are kept until you delete them or delete your account. In all cases we destroy them no later than 3 years after your last interaction with your account, unless a longer period is required by law or a legal hold applies. Account deletion removes them within 30 days, and backups within a further 30 days
• No sale, lease, trade, or advertising use of biometric information
• Who sees results: you, and for a minor, the minor and the verified guardian. Not brands, not the public
• Health: we do not infer health conditions or skin conditions from your images
• Requests: email privacy@p3rson.com to access, correct, or delete this information or to withdraw consent

The Biometric and Sensitive Data Notice has the full schedule and legal notices for Illinois, Texas, Washington, Colorado, and California residents.

7. How Long We Keep Information

Legal holds and active disputes can pause deletion. The Data Retention document has the complete schedule.

8. Your U.S. State Privacy Rights

If you live in a state with a comprehensive privacy law (including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia), you have these rights. We give them to every U.S. user.

Timing. We confirm a request within 10 business days and answer within 45 days. We can extend by up to 45 more days for complex requests and will tell you why.

Verification. In-app requests from a signed-in account need no more proof. For email requests we ask for two data points we already hold. An authorized agent needs your signed permission plus identity proof for both of you.

Appeal a denial. If we deny a request, reply to our answer with the subject "Appeal" or email privacy@p3rson.com. We answer within 45 days and explain the result in writing. If your state allows it, you can also contact your state attorney general.

California. Email ccpa@p3rson.com for California requests. In the past 12 months we disclosed identifiers, account and content data, usage data, and, for the AI features you consented to, images to the service providers listed in Section 4 for business purposes. We did not sell or share personal information.

Marketing email and other choices: tap Unsubscribe in any marketing email, or email privacy@p3rson.com. App usage analytics are off in this version. For AI photo review, go to Settings > Privacy and data > Manage consent > AI Photo Analysis.

Automated tools. P3 Audit, P3 Index, and AI Scout Notes are feedback tools and are not used for decisions about eligibility, hiring, credit, housing, or pricing.

9. Children's Privacy

• Under 13: no accounts. If we learn an account belongs to a child under 13, we suspend and lock it. We keep a small record to keep it locked: the account ID, the date of the lock, the date of birth that was entered, and a one-way (hashed) form of the sign-in email and phone number, so the same details cannot open another account. We delete the child's other information when a parent or guardian asks and as the Data Retention document states
• 13 to 17: accounts are read-only. Guardian approval is not available in this version, so a minor cannot post or use the private P3 Audit. A minor cannot use any monetization feature: bookings, P3 Coins, tips, subscriptions, payouts, Stripe, sponsorships, or NIL deals
• No profiling: we do not market to minors, build behavioral profiles of them, sell or share their information, or train models on it. Analytics for minors are limited to basic functional data such as crash reports
• No ads for minors or unknown age: minors and accounts whose adult age status is unknown see no ads
• Notifications: we send members under 18 no social push notifications, such as new-post alerts. They get only account and security notices
• Guardians can email guardian-support@p3rson.com to review the minor's information, ask us to delete the minor's data, and export it. We confirm a request within 10 business days and answer within 45 days. Guardian approval is not available in this version; if it is offered later, the Guardian and COPPA policy describes the controls that would apply from the date the app shows them as available
• Age: we set age from the date of birth you enter, Apple's Declared Age Range signal where your device provides it, guardian verification, and adult verification before adult-only features. You confirm your age when you create your account, with Apple's age range or your date of birth, and you cannot change your date of birth in the app. Where the app offers it, we also use Apple's age range to review an account locked as under 13 from a date of birth entered on that account (once per account). Apple's age range prompt needs iOS 26 or later
• Guardian records (consent signature and verification) are kept for 7 years. Guardian email addresses are encrypted, never shown to the minor, brands, or creators, and never used for marketing
• Third parties: we disclose a minor's information to a third party outside the service only with a guardian's separate consent. In this version, no minor's photos go to an AI provider. If that changes, a minor's photos would go to an AI provider only for the private P3 Audit after that consent

The Guardian and COPPA policy has the full process.

10. Security and Breach Notice

• Data is encrypted in transit and encrypted at rest, with stronger protection for sensitive fields
• Access is limited by role. Each agency's data is isolated from other agencies. Access is logged
• Our written information security program names a responsible coordinator, assesses risk each year, controls access, oversees vendors, and sets out how we respond to incidents
• We investigate suspected incidents immediately. We notify affected users without unreasonable delay and within the time state law requires (in California, within 30 days of confirming a breach of unencrypted personal information). Processors must tell us within 24 hours of a confirmed incident
• No system is perfectly secure. Report a security concern to security@p3rson.com

11. Cookies and Tracking

• App: the app sends crash reports to Firebase Crashlytics so we can fix bugs. App usage analytics are off in this version
• Website: we use essential cookies and your saved choice on the cookie banner. Plausible Analytics counts page views without cookies. If you click Accept on the banner, Google Analytics 4 also measures how the site is used. If you decline, or your browser sends Global Privacy Control or Do Not Track, neither is used. If you buy Coins on the web at p3rson.com, you sign in with your P3RSON account (Apple, Google or email) through Firebase Authentication, and the sign-in is kept in your browser for that session only
• Contextual ads without cross-app tracking: sponsored posts are labeled “Ad.” We do not use advertising networks, advertising pixels, or cross-app or cross-site tracking for advertising. We do not display an App Tracking Transparency (ATT) prompt for this advertising. We do not sell data to data brokers
• A Global Privacy Control signal is treated as an opt-out request

12. Users Outside the United States

P3RSON is offered in the United States. If you use the app from another country, you do so at your own risk and you are responsible for following your local laws. Your information is stored and processed in the United States. U.S. law governs this policy. We make no statement that the service is lawful or appropriate outside the United States.

13. Content You Upload

• You own your content. P3RSON is a licensee only, with permission to store, display, analyze (with your AI consent), back up for up to 30 days after deletion, and serve it so the platform works. The Terms of Service, Section 2, has the full license
• We do not sell your content, use it in advertising, train AI models on it, make derivatives of it, or sublicense it
• Viewers can view, like, comment, and share within P3RSON. They cannot redistribute or reuse your content
• Deleting content: a deleted post is hidden at once and cannot be restored. We permanently delete it and its files 60 days after you delete it, except for legal holds or safety reviews. To confirm a deletion, email privacy@p3rson.com
• Copyright: send takedown notices to the designated agent on the DMCA Policy page (dmca@p3rson.com). Intimate image removal requests go through the process in the Community Guidelines (48-hour removal)
• Credit: your name and profile link appear with your content on P3RSON

14. Changes to This Policy

For a material change we tell you in the app at least 30 days before it takes effect; it applies to you after that notice period, or earlier if you accept it. A hotfix release that changes no legal text does not notify you again. You can request earlier versions at privacy@p3rson.com.

15. Contact

• Privacy questions and requests: privacy@p3rson.com (we confirm within 10 business days and answer within 45 days)
• California requests: ccpa@p3rson.com
• Biometric and sensitive data: privacy@p3rson.com
• Guardians and minors: guardian-support@p3rson.com
• Security: security@p3rson.com
• Mail for privacy requests: Dino Fulgencio, P3RSON, Inc., 348 West 57th Street #257, New York, NY 10019, USA
• Company and principal place of business: P3RSON, Inc., 1 Barker Avenue, White Plains, NY 10601, USA