Last Updated: February 2026

Candid Color Systems, Inc. and its affiliates (“CCS,” “Candid,” “NowCandid,” “we,” “us,” or “our”) respect your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you:

• Visit our websites (including www.candid.com, www.nowcandid.com, and related domains),
• Use our studio platforms and tools,
• Purchase photographs or products through our ecommerce galleries,
• Interact with events powered by CCS,
• Use selfie check-in or optional Face Matching features,
• Contact us or otherwise interact with our Services.

By using our Services, you acknowledge that you have read and understood this Privacy Policy.

1. Who This Policy Applies To

This Privacy Policy applies to:

1.1 Studios / Photographer Customers (“Studios”)

Professional photographers, schools, leagues, and organizations that use CCS software and services to upload, organize, sell, and deliver photographs.

1.2 Buyers and Event Participants (“Buyers” or “End Users”)

Parents, attendees, students, athletes, and others who:

• Are photographed at events,
• Browse galleries,
• Place photo orders,
• Use selfie check-in,
• Interact with CCS-powered ecommerce platforms.

Depending on the context, CCS may act as:

• A data controller (for account administration, security, marketing, ecommerce operations), or

A service provider / processor on behalf of Studios

2. Personal Information We Collect
The information we collect depends on how you interact with our Services.

2.1 Information Studios Provide

When Studios create accounts or use our platform, we may collect:

• Name, business name, and contact information
• Email address
• Account login credentials
• Payment and banking information for payouts (processed via payment providers)
• Support communications
• Marketing preferences
• Event metadata and uploaded images

2.2 Information Buyers Provide

When Buyers place orders or interact with Events, we may collect:

• Name
• Shipping and billing address
• Email address
• Telephone number
• Order details
• IP address
• Payment information (processed via secure payment providers)
• Selfie uploads (if using selfie check-in)
• Communications with customer support
• Directory-level contact data from schools

Only the last four digits of a credit card may be visible to a Studio where necessary for reconciliation. Full payment data is processed through secure payment providers.

2.3 Information Collected Automatically

We automatically collect certain information when you use our Services:

• IP address
• Browser type and version
• Device identifiers
• Operating system
• Referring URLs
• Pages visited
• Timestamps and clickstream data
• Error logs
• Cookie identifiers (see Section 7)

2.4 Information From Third Parties

We may receive information from:

• Payment processors
• Hosting and infrastructure providers
• Analytics providers
• Face Matching vendor (see Section 8)
• App stores or platform providers

2.5 Sensitive Information

We do not intentionally collect:

• Social Security numbers
• Government-issued ID numbers
• Protected health information
• Financial account credentials (outside payment processing)
• Other sensitive personal information not necessary for Services

Studios should not upload sensitive data unrelated to photography services.

3. How We Use Personal Information
We use personal information to:

3.1 Provide Services

• Create and manage accounts
• Host and display galleries
• Process and fulfill photo orders
• Deliver digital images
• Process payments and payouts
• Provide customer support

3.2 Communicate

• Order confirmations
• Service notifications
• Security alerts
• Marketing communications (where permitted) including SMS

3.3 Improve and Secure Services

• Analyze usage trends
• Improve platform functionality
• Prevent fraud
• Detect abuse
• Maintain system integrity

3.4 Comply With Legal Obligations

• Tax compliance
• Fraud investigations
• Legal process responses

4. How We Share Personal Information
We do not sell personal information for money.

We may share personal information as follows:

4.1 With Studios

When Buyers place an order, relevant order details are shared with the Studio that photographed the event, including:

• Buyer name
• Contact information
• Order details
• Shipping information
• Limited payment reconciliation information (last four digits only)

Studios are independent businesses and are responsible for their own privacy practices.

4.2 With Service Providers

We share information with vendors who provide services on our behalf, such as:

• Payment processors
• Hosting providers
• Analytics providers
• Infrastructure providers
• Communications vendors
• Face Matching vendor (see Section 8)

These providers are contractually required to protect information and use it only to provide services.

4.3 Legal and Protection

We may disclose information if necessary to:

• Comply with law
• Respond to lawful requests
• Enforce agreements
• Protect rights and safety
• Prevent fraud or abuse

4.4 Business Transfers

If CCS undergoes a merger, acquisition, or asset sale, personal information may be transferred as part of that transaction.

Biometric data is never sold as an asset.

5. Controller vs. Processor Roles

Depending on the situation:

• CCS acts as a controller for account management, ecommerce operations and security.
• CCS acts as a service provider / processor when hosting or processing personal information or conducting marketing on behalf of Studios.

Studios are responsible for providing legally required notices and obtaining consents from their End Users where required.

6. Ecommerce Transactions

When Buyers place orders:

• Payments are processed via secure payment providers.
• CCS uses encryption in transit.
• Access to personal information is limited to personnel with legitimate business need.
• Order information is retained consistent with legal and accounting requirements.

7. Cookies and Similar Technologies

We use cookies and similar technologies to:

• Operate our website
• Remember preferences
• Improve performance
• Prevent fraud
• Measure marketing effectiveness (where permitted)

Cookie categories may include:

• Strictly necessary
• Functional
• Analytics
• Advertising (where applicable)

You may manage cookie preferences via:

• Browser settings
• Cookie consent tools (where available)
• [Insert Cookie Settings Link]

Where required by law, we obtain consent for non-essential cookies.

8. Facial Recognition / Face Matching (Optional Feature)

Certain Studios may enable an optional Face Matching feature.

8.1 How It Works

• CCS provides event images to a third-party Face Matching vendor.
• The vendor analyzes facial features to identify relationships between images.
• The vendor returns to CCS only image relationship data (e.g., which photos appear to contain the same person).
• CCS uses this relationship data to enable photo grouping and search functionality.

8.2 Biometric Data Handling

• The Face Matching vendor may generate biometric templates during processing.
• Any biometric identifiers created are stored (if at all) by the vendor, not CCS.
• CCS does not receive or retain biometric templates.
• CCS does not sell or use biometric data for advertising.

Studios are responsible for obtaining legally required consent before enabling Face Matching.

Additional details are available in our Biometric Information Policy: https://www.candid.com/biometric-information-policy/

9. Your Rights and Choices

Depending on your location, you may have rights to:

• Access personal information
• Correct inaccurate information
• Delete personal information
• Obtain a copy (data portability)
• Opt out of targeted advertising
• Opt out of “sale” or “sharing” (as defined by certain state laws)
• Appeal certain decisions (where required by law)

You may submit requests to:
ccssupport@candid.com

We may verify your identity before fulfilling requests.

You may opt out of marketing emails using the unsubscribe link

10. U.S. State Privacy Rights

Residents of states such as California, Colorado, Connecticut, Virginia, Texas, Oregon, Utah, Montana, and Delaware may have specific rights under applicable law.

We do not sell personal information for monetary consideration.

If applicable, you may opt out of “sharing” for cross-context behavioral advertising at:

Do Not Sell or Share My Personal Information

We honor Global Privacy Control (GPC) signals where required by law.

We will not discriminate against you for exercising your rights.

11. Data Retention

We retain personal information:

• As long as accounts are active
• As necessary for order fulfillment
• As necessary for contractual obligations
• For legal, tax, and accounting compliance
• For fraud prevention
• To enforce agreements
• To resolve disputes

Aggregated or de-identified information may be retained longer.

Biometric retention (if applicable via vendor) is governed by our Biometric Information Policy.

12. Security

We implement administrative, technical, and physical safeguards designed to protect personal information, including:

• Encryption in transit
• Access controls
• Monitoring and logging
• Network protections
• Vendor security review processes

No system is 100% secure.

13. Children’s Privacy

Our Services are not directed to children under 13. Events may involve minors photographed by Studios. Studios are responsible for obtaining parental or guardian consent where required by law.

Parents should supervise minor children when using ecommerce platforms.

14. International Transfers

CCS is based in the United States. If you access our Services from outside the U.S., your information may be transferred to and processed in the United States or other jurisdictions where our service providers operate.

Where required, appropriate safeguards are used.

15. Updates to This Privacy Policy

We may update this Privacy Policy periodically. We will update the “Last Updated” date and post changes on our website.

If changes are material, we may provide additional notice.

16. Contact Us

Candid Color Systems, Inc.
1300 Metropolitan Ave

Oklahoma City, OK 73108

Email: ccssupport@candid.com