Privacy Notice

About this Privacy Notice

This Privacy Notice is meant to give you information about what personal data we collect about you, how we use it, why we use it, and how you control the data processing.

It covers our web app at app.passportphotoflow.com and our website at passportphotoflow.com.

Privacy at a Glance

• Your photos stay private. We use the photos you process only to provide the service you asked for. We never sell them, never use them for advertising, and never use them to train AI models.

• Advertising our own website and web app. When you buy after clicking an ad, we use the ad-click identifier to tell the ad platform (Google or Microsoft Advertising) about that purchase, so we can measure the ad. We do not upload customer lists or your email address to ad platforms. U.S. state privacy laws may call this a "sale" or "sharing" of personal information (Section 3.3).

• Your rights. You can ask to access, correct, delete or receive a copy of your data, and appeal if we refuse (Sections 7, 13 and 14). Write to support@passportphotoflow.com.

Table of Contents

• Privacy at a Glance

1. The Basics: Who We Are, Our Role, and Definitions

• 1.1 Who We Are

• 1.2 Definitions and Recommendations

2. Personal Data We Collect, How We Use it, and Why

• 2.1 Contact Information

• 2.2 Order Data

• 2.3 Activity and System Data (Cookies)

• 2.4 Payment Data

• 2.5 Other Information PassportPhotoFlow Processes

• 2.6 Biometric Data Retention and Destruction Policy

• 2.7 Additional Notices

• 3. Our Marketing Activities

• 3A. Your Privacy Choices

• 4. Sharing the Personal Data We Collect

• 5. International Transfers

• 6. Security

• 7. Your Rights

• 8. Data Retention

• 9. Cookies and Similar Technologies

• 10. Third-Party Services

• 11. Children

• 12. Changes to the Privacy Notice

• 13. U.S. State Privacy Rights (CCPA and Other States)

• 14. Israeli Privacy Rights (Annex B)

1. The Basics

1.1 Who We Are

We, PassportPhotoFlow, a business managed by Mobile Flow Ltd, offer passport and visa photo preparation services through our app. Our offices are located at Kiryat HaMada St 20, Jerusalem, Israel 9777600, and our registration number is 517148722.

Mobile Flow Ltd is responsible for (the "controller" of) the personal data described in this Privacy Notice. If you have questions about our company or your privacy, or want to exercise your rights, you can contact us at support@passportphotoflow.com.

1.2 Definitions and Recommendations

When we refer to “app”, we mean our web app that provides passport and visa photo preparation services.

When we refer to "services", we mean our app and any services available thereon.

When we refer to our "websites", we mean passportphotoflow.com and our web app at app.passportphotoflow.com. This Privacy Notice covers all of them.

When we refer to "personal data", we mean information that is defined as personal data under law. This includes information that identifies you directly or indirectly, including unique identifiers like IP addresses or cookie IDs.

When we refer to "you", we mean any user of our app. If you are registering for the Services on behalf of a company or organization, the term "you" is also meant to refer to that company, where it makes sense from the context. When we mean to refer only to such company, we'll use the term "customer".

This Privacy Notice is meant to be read together with our Terms of Service, which you can find at https://passportphotoflow.com/terms. In general, we recommend that you routinely review this privacy notice and your preferences on our app.

2. Personal Data We Collect, How We Use It, and Why

Below is a description of the types of personal data we collect, how we use it, and the reason why we consider each use lawful. You have no legal obligation to provide us with personal data, but if you don't provide us with certain information, we may not be able to provide you with the associated services.

2.1 Contact Information

When you send us a message through the contact option on our app, on our site or any other means, we collect any data you provide, such as your name, email, the content and subject of your message.

How We Use this Data: To respond to your message or inquiry.

2.2 Order Data

You do not need an account to use our app, and we do not ask you to sign in with a third-party account. When you place an order, we process the email address you give at checkout, an order reference and the private order link we create for you.

How We Use this Data: To deliver your order, send you your receipt and order details, answer support and refund requests, prevent fraud, and keep our accounting records.

2.3 Activity and System Data (Cookies)

When you use our app or websites, we automatically collect data about your computer or mobile device, including personal data such as your IP address, device identifiers, browser and device type, the page or ad that brought you to us (including ad-click identifiers such as Google's gclid, gbraid or wbraid, or Microsoft's msclkid), usage data, metadata, and your activity on our services (for example, which pages and screens you viewed, for how long, and what you clicked). We work out your approximate country from your IP address or your device or browser settings; we do not collect your precise location. For more information about the cookies we use and how to adjust your preferences, see the Cookies and Similar Technologies section below.

How We Use this Data: We mainly use this data to generate aggregated analytics data about the use of our services so we can maintain and improve the services and develop new products or services. We also use it to prevent fraud and abuse and protect the security of our services, to apply the privacy choices that apply in your region, and to measure and improve our advertising as described in Section 3.3. The analytics tools we use are Google Analytics and Microsoft Clarity. On our websites, Microsoft Clarity is set up to mask form inputs and photo previews. We also share ad-click identifiers with advertising platforms (for example, Google and Microsoft Advertising) to measure our ads for our own website and web app, and we do not use your photos or their contents for advertising. See Section 3.3 for details and your opt-out. For more information about how Google uses information from sites and apps that use its services, and how you can control it, see: www.google.com/policies/privacy/partners/.

2.4 Payment Data

If you make a purchase through the services, the payment is processed by Paddle.com, which sells to you as our reseller and merchant of record. They collect your payment details under their own privacy policies. We receive information about the purchase, such as the product, price, currency, taxes, date, refund status, a transaction identifier and, for purchases on our websites, your billing country. We do not receive or store your full payment card number.

How We Use this Data: To provide what you bought, to process refunds, to prevent fraud, to keep our accounting records and, as described in Section 3.3, to measure our advertising.

2.5 Other Information PassportPhotoFlow Processes

Depending on how you use the Services, we also process:

• Photos of the user's face (processed to make the photo; face geometry computed on-device and not stored).
• Email address (delivery link, receipt).
• Payment data (handled by Paddle, merchant of record).
• Device/usage analytics (GA4, consent-gated where required).
• Ad click identifiers (gclid/gbraid/wbraid/msclkid) for conversion measurement.
• Refund-request attachments (photo or PDF of an agency rejection notice, which may show your name) — kept 90 days to assess the request.

How We Use this Data: To provide the Services you request, as described in this notice.

2.6 Biometric Data Retention and Destruction Policy

To check your photo, our app measures points on your face (for example where your eyes and chin are). These measurements are made on your device, are discarded as soon as the check finishes, are never sent to us, and are never used to identify you. We ask for your consent before you take or upload a photo. Your photo passes through our server to be sealed and, when you download it, to make your files; it is not stored there. Photos are deleted automatically 24 hours after upload if you don't buy, or 30 days after purchase, and "Delete my photos now" on your order page removes them sooner. We ask for your electronic signature before any photo is taken or uploaded, and keep a record of that consent (date, notice version, and whether it was for yourself or your child) for 5 years, without the photo or any measurements.

What we measure

To check your photo against the requirements, our web app measures points on the face in the photo, for example the eyes, chin, top of the head and head tilt, and whether the eyes are open. Software running in your browser on your device makes these measurements.

Purpose

We use the measurements only to check the photo against the requirements and to crop and size it. We never use them, or your photo, to identify anyone, to build a face template or faceprint, to compare faces, or to train any model.

Retention and destruction

The measurements exist only in your browser's memory while the check runs. They are discarded when the check finishes or when you leave the page, and they are never sent to us or anyone else. How long each kind of data is kept:

• Face measurements: Discarded when the check finishes; never sent to us. Made on your device only to check the photo.

• Your photos: Not stored on our servers. Your photo passes through our server only to be sealed and returned to you, and again when you download it to make your files; it is not kept or logged there. The sealed photo is stored only in the browser you used and can no longer be used 24 hours after upload if unpaid, or 30 days after purchase, and is deleted from your browser at that moment if the app is open, otherwise the next time you open it; "Delete my photos now" removes it immediately. So you can download and retake within the order window.

• Consent records (date, notice version, self or child; no photo or measurements): 5 years. Proof of your consent as required by biometric privacy laws.

If we ever came to possess biometric identifiers or biometric information, we would destroy them as soon as the purpose for which they were obtained is satisfied, and never later than the shortest period any applicable law allows.

No sale or disclosure

We never sell, lease, trade or otherwise profit from biometric data, and we do not disclose it.

Consent

We ask for your electronic signature before any photo is taken or uploaded. A parent or legal guardian gives consent for a child. We keep a record of the consent (date, notice version, and whether it was for yourself or a child) for 5 years, without the photo or any measurements.

Security

We protect this data with encryption and access controls at least as protective as those we use for other confidential information.

Contact

Questions about this policy, or requests about your data: support@passportphotoflow.com or https://passportphotoflow.com/support. Mobile Flow Ltd, Kiryat HaMada St 20, Jerusalem, Israel 9777600. If you live in Washington or Nevada, our Consumer Health Data Privacy Policy also applies.

2.7 Additional Notices

• Children. A parent or legal guardian must take or upload a child's photo and give consent on the child's behalf.

3. Our Marketing Activities

As described above, we use some of the personal data we collect to advertise our own services and to measure our ads, as described below. We do not send you marketing emails; any email we send you is about your order (for example, receipts).

3.3 Advertising, Measurement and Your Right to Opt Out

We advertise PassportPhotoFlow on Google (Google Ads) and, from time to time, on other platforms such as Microsoft Advertising. We do not upload customer lists to advertising platforms. To measure our ads, we share limited personal data with these advertising partners as described below. We only use it to advertise our own website and web app.

• Measuring our ads (conversions). When you arrive at PassportPhotoFlow from an ad, the ad platform adds an ad-click identifier to the link (for example, Google's gclid, gbraid or wbraid, or Microsoft's msclkid). When you make a purchase, we may tell the ad platform that its ad led to that purchase, using the click identifier (for clicks in the previous 90 days), the date and the value. For Microsoft Advertising, we send only the click identifier, the date and time of the purchase, its value and currency; if that purchase is later refunded or charged back, we tell Microsoft to withdraw or reduce it. We never send an ad platform your email address or anything about your photos.

• What we do not do. We do not run remarketing campaigns that show you ads because you visited our websites. We do not build advertising audiences from the contents of your photos or the pages you view. We never share the contents of your photos or your history with advertising partners.

Under the California Consumer Privacy Act and similar U.S. state laws, sharing online identifiers and purchase information with Google for advertising may be considered a "sale" or "sharing" of personal information for cross-context behavioral advertising, or "targeted advertising". You can opt out at any time (see Section 3A). We send Microsoft Advertising only the click identifier and purchase details described above, to measure our own ads; we treat this as a disclosure for a business purpose (ad measurement), not as a sale or sharing (Section 13.1).

What we send, depending on your choices:

When you opt out, we stop using your information for personalized advertising going forward. We may continue to use the ad-click identifier to measure conversions and the performance of our own ads (for example, to know that a purchase resulted from a campaign), with Google ad personalization turned off; this is not personalized advertising. On passportphotoflow.com and app.passportphotoflow.com, an opt-out (including a Global Privacy Control signal) also switches off Microsoft Clarity.

3A. Your Privacy Choices

You can control how your personal data is used for advertising and analytics. These choices are free and never change your price or what you get. On passportphotoflow.com and app.passportphotoflow.com, the "Your Privacy Choices" link, shown with the opt-out icon, at the bottom of every page opens your choices: "Allow", "Only necessary" and "Do not sell or share". Your choice is saved in your browser.

To access, correct or receive a copy of your data, or to exercise any other right, see Sections 7, 13 and 14.

4. Sharing the Personal Data We Collect

We share your Personal Data with infrastructure providers strictly as needed to provide the service you asked for and to store your data securely during the retention period. All such providers are bound by confidentiality and data protection obligations.

We do not sell the contents of your photos to anyone. We share your personal data as follows:

4.1 Customers

If you use our services in connection with a company that is our customer, that customer may have access to information about your use of our services.

4.2 Service Providers and Sub-Processors

We engage the third-party service providers and sub-processors listed below to help us operate the Services. Each provider only receives the Personal Data needed to perform its function, has agreed to confidentiality restrictions, and has undertaken to use your Personal Data solely as we direct. We may update this list from time to time as our vendors change. You can review each provider's own privacy practices by following the links below.

4.2b Advertising and Measurement Partners

We share limited personal data with the following advertising and measurement partners, as described in Section 3.3. You can opt out as described in Section 3A.

4.3 Change of Ownership

If we are looking to sell our company, liquidate assets, or merge with another, we may share your personal data with other interested parties as part of negotiations toward that transaction. In such case, or where we do sell our company, your personal data shall continue to be subject to the provisions of this Privacy Notice.

4.4 Law Enforcement Related Disclosure

We may share your personal data with government agencies or other relevant parties, such as a law office or independent auditor: (i) if we believe that such disclosure is appropriate to protect our rights, property or safety (including the enforcement of the Terms of Service and this Privacy Notice) or those of a third party; (ii) if required by law or court order; or (iii) as is necessary to comply with any legal and/or regulatory obligations, such as audit requirements.

5. International Transfers

We are based in Israel, and many of our service providers, including Google, are located in the United States or other countries. Your personal data may therefore be processed outside the country where you live. When we transfer personal data from the European Economic Area, the United Kingdom, Switzerland or Israel, we rely on a lawful transfer mechanism, such as an adequacy decision, the provider's certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), or the European Commission's Standard Contractual Clauses included in the provider's data processing terms. You can ask us for more information about these safeguards at support@passportphotoflow.com.

6. Security

The security of your personal data is important to us. We comply with industry standards and applicable law to make sure that your personal data will be held securely and that it will not be shared or lost accidentally. Data travels between your device and our servers over encrypted connections, and our cloud providers encrypt the data they store for us. However, it is impossible to guarantee absolute security. The security of your data also depends on the security of the devices you use and the way in which you protect your user IDs and passwords.

7. Your Rights

Everyone. You can see, update and delete much of your data yourself in the app, and you can contact us at any time to ask for a copy of your data, to correct it or to delete it. Your privacy choices are described in Section 3A.

Israel. See Annex B (Section 14).

United States. How to Control Our Use of Your Personal Data. Depending on which laws apply, you have certain legal rights over your data. If you are a resident of the State of California or of another U.S. state with a comprehensive consumer-privacy law (such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, or Montana, among others), depending on the applicability of certain laws and exemptions, you may have certain rights over your data, as detailed in Annex A to this Privacy Notice. To exercise your rights, please contact us at support@passportphotoflow.com. We may ask for reasonable evidence to verify your identity before we can comply with any request.

We respond to requests within 45 days in the United States (which we may extend once, as the law allows, and will tell you if we do), or within any shorter period the applicable law requires.

8. Data Retention

We retain your personal data as long as necessary to fulfill each of the purposes we described above.

When deciding how long to store personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized access, the purposes for which the personal data was collected, as well as applicable legal requirements. Please note that we may delete information from our systems without notifying you first. Retention by any of our service providers or subcontractors may vary in accordance with each business's retention policy.

In some circumstances, we may store your personal data even after we're finished using it if required to do so by law (e.g. to fulfill tax or audit requirements), or to keep accurate records of our interactions in case there is a prospect of litigation relating to your personal data. In such cases, we will maintain the same security measures as described above.

The table below summarizes how long we keep the main types of personal data:

When you ask us to delete your data, we delete your photos and order details, except records we must keep by law (such as transaction records for tax and accounting).

Please contact us at support@passportphotoflow.com if you would like details about the retention periods for each type of personal data we process.

9. Cookies and Similar Technologies

9.1 What are Cookies?

A cookie is a small piece of text that is sent to your device and store certain information. There are other technologies that act similarly, like web beacons, pixel tags, and your browser's local storage, but for simplicity's sake we'll refer to them all as "cookies".

9.2 First-Party / Third-Party Cookies

We use both our own cookies (called "first-party cookies") and cookies of third-parties (called "third-party cookies"). Both we and the third party process data received from such cookies.

9.3 How We Use Cookies

While the specific names and types of cookies we use may change from time to time, they generally fall into one of the categories listed below.

9.4 Third Party Cookies

In addition to our first-party cookies, we place cookies from the third-party services listed in Section 4.2

9.5 How to Adjust Your Preferences

You can change your cookie and advertising choices at any time with "Your Privacy Choices" on passportphotoflow.com and app.passportphotoflow.com, and we honor Global Privacy Control signals (Section 3A). Some browsers also offer a "Do Not Track" (DNT) setting. There is no common standard for how websites should respond to DNT signals, so our websites do not change their behavior when they receive one; we honor Global Privacy Control signals instead, as described in Section 3A. Most web browsers are initially configured to accept cookies, but you can change the settings so your browser refuses all cookies or certain types of cookies. In addition, you are free to delete any existing cookies at any time. Please note that some features of the services may not function properly when cookies are disabled or removed. For example, if you delete cookies that store your privacy choices, you will be required to input these each time you visit.

10. Third-Party Services

You may have access to third-party services through our services. Please note that all use of third-party services is at your own risk and subject to such third party's terms and privacy policies. We do not take any responsibility for the performance of other services.

11. Children

Our services are meant for adults. A parent or legal guardian may use them to make a photo of their child: the parent or guardian takes or uploads the child's photo and, before it is checked, confirms that they are the child's parent or legal guardian and gives consent on the child's behalf. We use a child's photo only to make the photo that was ordered, we keep it for the same periods as any other photo (Section 8), and we never sell or share it or use it for advertising. We do not knowingly collect personal data directly from children under the age of thirteen (13), and we do not knowingly sell or share the personal data of anyone under the age of sixteen (16). If you believe that a child has given us personal data without the consent of a parent or legal guardian, please contact us at support@passportphotoflow.com and we will delete it.

12. Changes to the Privacy Notice

We may update this Privacy Notice from time to time to keep it up to date with legal requirements and the way we operate our business. We will place any updates on this webpage and change the "Last updated" date at the top. Please come back to this page every now and then to make sure you are familiar with the latest version. Earlier versions are available on request from support@passportphotoflow.com.

13. Annex A — U.S. State Privacy Rights

This Annex describes additional rights that may apply to you if you are a resident of certain U.S. states with comprehensive consumer-privacy laws. Sections 13.1 through 13.8 describe your rights under California law; Section 13.9 describes rights for residents of other states. The rights described here apply only to the extent the relevant law applies to you and to our processing, and subject to that law's exceptions. To exercise any right described in this Annex, contact us at support@passportphotoflow.com. We may ask for reasonable evidence to verify your identity, or that you are an authorized agent, before acting on a request.

13.1 Your Rights Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA)

If you are a resident of the State of California, depending on the applicability of certain laws and exemptions, you may have certain rights over your data. Below is some general information about rights that may apply to you. We recommend that you check the law or consult with a lawyer to understand what applies in your specific case. We may ask for reasonable evidence to verify your identity or to verify that you have been authorized to act on behalf of the relevant individual. For the purposes of this section, "personal data" shall have the meaning of "Personal Information" as defined under the CCPA.

Personal information we collect, and who receives it. The table below covers the 12 months before the "Last updated" date. We collect this information from you, from your device, from Paddle, and from advertising and attribution partners. We use it for the purposes described in Sections 2 and 3, and we keep it for the periods described in Section 8.

13.2 Right to Know

You have the right to request that we disclose to you any or all of the following in respect of the 12-month period preceding your request:

• The specific personal data we have collected about you.

• The categories of personal data we have collected about you. The categories we collect include identifiers, commercial information — records of the purchases you made — internet or other electronic network activity information, approximate location, audio, electronic or visual information (the photos you process), professional or employment-related information, and inferences drawn from such information, as detailed in Sections 2 and 4 and in the table in Section 13.1.

• The categories of sources from which we collected the personal data about you.

• The categories of third parties to whom we disclose personal data about you (including our service providers listed in Section 4.2).

• The categories of personal data about you we have sold and the categories of third parties to whom we have sold such personal data.

• The categories of personal data about you we have disclosed for a business purpose and the categories of third parties to whom we have disclosed such personal data.

• Our business or commercial purpose(s) for collecting or selling your personal data.

13.3 Right to Delete

Subject to certain exceptions, you have the right to request that we or any of our service providers delete your personal data.

13.4 Right to Correct

You have the right to request that we correct any inaccurate personal data that we maintain about you, considering the nature of the personal data and the purposes of the processing of the personal data.

### 13.5 Right to Opt-Out of the Sale or Sharing of Personal Data As described in Section 3.3, we share online identifiers (ad-click identifiers and cookie identifiers) and information about your purchases with Google to measure and advertise our own website and web app, which may be considered a "sale" or "sharing" under the CCPA. You have the right to opt out at any time, and we honor opt-outs without discrimination. You can opt out using "Do not sell or share" under the "Your Privacy Choices" link (shown with the opt-out icon) at the bottom of every page of our websites, by emailing support@passportphotoflow.com, or by sending a Global Privacy Control (GPC) signal, which we treat as a valid opt-out (see Section 3A); when we have honored your opt-out or GPC signal, "Your Privacy Choices" shows "Opt-out request honored". We act on opt-out requests as soon as we can, and no later than 15 business days after we receive them. We may deny any request to opt-out that we deem, in our good-faith, reasonable and documented belief, to be fraudulent.

13.6 Right to Limit Use and Disclosure of Sensitive Personal Data

To the extent we collect any sensitive personal data about you, you have the right to instruct us to limit our use of such personal data only to the purpose of providing you with our services and certain business operation purposes. We do not use or disclose sensitive personal information for purposes that would require us to offer a "Limit the Use of My Sensitive Personal Information" option; in particular, we do not use your photos or their contents for advertising.

13.7 Right to Non-Discrimination for Exercising your Consumer Privacy Rights

You have the right not to be discriminated against for exercising any of your consumer privacy rights, such as, not being denied any goods or services or charged different prices or rates.

13.8 How to Exercise your California Privacy Rights

Contact Information. To exercise any of the rights detailed above, please submit a verifiable request to us by contacting us at support@passportphotoflow.com. You may only request to exercise your right of access twice within a 12-month period. We confirm receipt of a request to know, delete or correct within 10 business days and respond within 45 days; if we need more time (up to 45 more days), we will tell you why.

Submitting a Verifiable Request. In order to exercise your right to know or right to delete you must submit a request containing sufficient information that allows us to reasonably verify you are the person about whom we collected the applicable Personal Data or an authorized agent of such person, which may include details of your order, such as the email address you used.

Submitting Requests through an Authorized Agent. An authorized agent may exercise requests on your behalf. In order to exercise your right to know or right to delete through an agent, we may ask for reasonable evidence to verify your identity and the agent’s identity, and written authorization permitting the agent to act on your behalf before complying with your request. In order to submit a request to opt-out of the sale of your personal data through an agent, we may ask for written authorization permitting the authorized agent to act on your behalf before complying with your request. We reserve the right to deny the request of any agent that does not provide proof that they have been authorized to act on behalf of the applicable consumer in accordance with applicable law.

The Past 12 Months. In the past 12 months we have disclosed the following categories of personal data for a “business purpose” (as defined in the CCPA): personal identifiers, commercial information, internet or other electronic network activity information, approximate location, audio, electronic or visual information, professional or employment-related information, and inferences drawn from such information, all as further detailed in Sections 2 and 4 and in the table in Section 13.1. In addition, we have “shared” (and, to the extent the term applies, “sold”) online identifiers (ad-click identifiers and cookie identifiers) and commercial information (purchase information) with an advertising partner (Google) to measure and advertise our own website and web app, as described in Section 3.3. We do not knowingly sell or share the personal information of consumers under 16 years of age. We have not disclosed, sold, or shared the contents of your photos or your history for advertising. You may opt out of this sharing as described in Sections 3.3 and 13.5.

13.9 Your Rights Under Other U.S. State Privacy Laws

If you are a resident of a U.S. state that has a comprehensive consumer-privacy law in effect — including Virginia (Virginia Consumer Data Protection Act, VCDPA), Colorado (Colorado Privacy Act, CPA), Connecticut (Connecticut Data Privacy Act, CTDPA), Utah (Utah Consumer Privacy Act, UCPA), Texas (Texas Data Privacy and Security Act, TDPSA), Oregon (Oregon Consumer Privacy Act, OCPA), Montana (Montana Consumer Data Privacy Act), and other states with similar laws now in force (such as Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Indiana, Tennessee, Florida, and others as they take effect) — you may have the following rights with respect to your personal data, subject to the exceptions and limitations of the applicable law:

• Right to access / confirm. To confirm whether we process your personal data and to access that data.

• Right to delete. To request that we delete personal data we have collected about you.

• Right to correct. To request that we correct inaccurate personal data we maintain about you.

• Right to data portability. To obtain a copy of your personal data in a portable and, to the extent technically feasible, readily usable format.

• Right to opt out. To opt out of the processing of your personal data for purposes of (i) targeted advertising, (ii) the “sale” of personal data, and (iii) certain profiling in furtherance of decisions that produce legal or similarly significant effects. As described in Section 3.3, we share online identifiers (ad-click identifiers and cookie identifiers) and purchase information with Google to measure and advertise our own website and web app, which may constitute "targeted advertising" or a "sale" under these laws. You may opt out using "Do not sell or share" under the "Your Privacy Choices" link at the bottom of every page of our websites, by emailing support@passportphotoflow.com, or with a Global Privacy Control (GPC) signal, which we honor (see Section 3A). We do not use your personal data for profiling in furtherance of decisions that produce legal or similarly significant effects.

• Right to non-discrimination and to appeal. You have the right not to receive discriminatory treatment for exercising these rights, and, where the applicable law provides, the right to appeal our refusal to act on a request.

To exercise any of these rights, contact us at support@passportphotoflow.com. We will respond within the time period required by the applicable law. We may need to verify your identity before fulfilling your request, and you may use an authorized agent to submit a request where permitted by law. If we decline your request, you may, where the applicable law allows, appeal that decision by replying to our response or contacting us again at the same email address with the subject line "Privacy appeal". We will respond to your appeal in writing within the time the applicable law requires (generally 45 to 60 days) and explain our decision. If we deny your appeal, you may contact the Attorney General of your state.

13.9a Consumer Health Data (Washington and Nevada)

If you live in Washington or Nevada, our Consumer Health Data Privacy Policy explains which consumer health data we collect (such as images of your face), why, who receives it, and how to access or delete it or withdraw your consent. We do not sell consumer health data.

13.10 Other Notices for California Residents

We do not disclose personal information to third parties for their own direct-marketing purposes (Cal. Civ. Code § 1798.83). We do not offer financial incentives in exchange for personal information. We do not use or disclose sensitive personal information for purposes that would give you the right to limit it under the CCPA.

14. Annex B — Your Rights Under Israeli Law

This section applies to individuals whose personal data is processed by us under the Israeli Protection of Privacy Law, 5741-1981 and its regulations (the "PPL"), as amended (including Amendment No. 13). It supplements the rest of this Privacy Notice.

14.1 Notice and Purposes of Processing

We collect and process your personal data for the purposes described in Sections 2 through 4 of this Privacy Notice — principally to provide the passport and visa photo preparation services you request, operate and secure the Services, process payments, comply with legal obligations, and communicate with you. Providing certain data is necessary to use the Services; where data is requested on a voluntary basis, we will indicate this. We are the entity that determines the purposes and means of processing your data; our contact details are in Section 14.5.

14.2 Right to Inspect and Correct Your Data

Under Sections 13 and 14 of the PPL, you have the right to inspect the personal data we hold about you, and to request that we correct, amend, or delete data that is inaccurate, incomplete, unclear, or out of date. To exercise these rights, contact us at support@passportphotoflow.com. We may take reasonable steps to verify your identity before responding, and we will respond within the time periods required by the PPL. If we decline a correction request, you may note your objection and, where applicable, we will record that the data is disputed.

14.4 Transfers Outside Israel

We use service providers and store data on infrastructure located outside Israel, including in the United States (see the list of sub-processors in Section 4.2). Where we transfer personal data outside Israel, we do so in accordance with the PPL and its regulations governing transfers of data abroad, and we require recipients to provide an adequate level of protection for your data through appropriate contractual and security safeguards.

14.5 How to Contact Us

For any privacy request or question under Israeli law, contact us at support@passportphotoflow.com. If you believe your privacy rights have been infringed, you may also contact the Israeli Privacy Protection Authority (PPA).