Privacy Policy | VSCO

📸 Hi there! To improve your experience, we use cookies, scripts, and similar tools on our site. These tools help us collect and share information with our partners to better understand how you use our services and provide you more relevant content, including targeted ads. By using our site, you agree to our Terms of Use and Privacy Policy.

Your Privacy Choices
Close

Privacy Policy

Effective as of June 22, 2026

At VSCO, it’s important to us to be open and transparent with our users (who we refer to as our “Creators”) who trust us with their data. This Privacy Policy describes our privacy practices and how we handle your data that we collect through our websites, products, services, social media, marketing activities, and other ways described in this Privacy Policy (collectively, our “Services”). This Privacy Policy supplements our Terms of Use. All provisions of our Terms of Use likewise apply to this Privacy Policy. This Privacy Policy does not apply to personal information that VSCO processes on behalf of customers of Studio Manager, which is processed in accordance with VSCO's Data Processing Addendum.

California Notice at Collection/State Law Privacy Rights: Check out the U.S. State Privacy Rights section below if you’re a resident of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Montana, Minnesota, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia for additional information about your personal information and rights under state law.

Table of Contents

  1. Data We Collect
  2. How We Use Your Data
  3. How We Share Your Data
  4. How Your Data is Maintained
  5. Your Choices
  6. Age Restrictions on Providing Us Data
  7. Changes to this Privacy Policy
  8. Contacting VSCO
  9. U.S. State Privacy Rights
  10. Privacy Notice to European Creators
  11. Privacy Notice for China Residents
  12. Privacy Notice for Brazil Residents
  13. Privacy Notice for Mexico Residents

Data We Collect

Data You Provide Us
What This Is
Account Data
Data we need to set up and maintain your account, like your account credentials, name, email, or phone number. This also includes information we need to verify whether you’re eligible to use our Services, like date of birth.
Profile Data
Data that allows you to customize your profile so other Creators can get to know you better, like your profile photo, interests, and links you might include.
Our Communications With You
The communications between us when we reach out to you, or you reach out to us.
Feedback
Any feedback that you provide to us regarding our Services, like in questionnaires, surveys, interviews, or beta tests.
Payment and Transactional Data
Information we need to process payments or keep track of your subscription, like payment card information and purchase history.
Marketing Data
Details about your engagement, and certain preferences for receiving marketing communications.
User-Generated Content
All the content you create or post on our Services, and your interactions with other Creators and their content, such as comments or direct messages. 
Data About Others
Contact information of others you might share with us, like when you invite your friends to use our Services.
Date We Collect from Third Parties
What This Is
Data from Social Media Platforms
Your interactions with our social media posts, or when you mention VSCO or use a VSCO-related hashtag on social media platforms.
Data from Other Creators
Data our Creators provide us about you, like when they invite you to use our Services or store information within VSCO Galleries, Workspace, or similar offerings. 
Data from your Single Sign On (SSO) Provider
Information related to your account with the SSO provider, like your name, picture, username, email address, or phone number.
If you use Google API Services to connect to our Services, our use of information received from that API may be subject to the Google User Data Policy, including the Limited Use requirements.
Data from Advertising Partners and Intermediaries
Information we receive about you from third-party advertising partners and intermediaries, such as event data (e.g. actions taken on a third-party property, like purchases or downloads), email addresses, phone numbers, or other identifiers (e.g. cookie IDs, mobile advertising IDs, alternative IDs like LiveRamp RampIDs), or demographic or other analytical data.
Data from Other Partners
Information we get if you access our Services through a partnership we have with another party.
Data We May Collect Automatically
What This Is
Device Data
Information about your device or browser when you use our Services, like your operating system, device type, IP address, unique identifiers, and general location information.
Online Activity Data
Your interactions with different parts of our Services, including information you provide, the pages, profiles, content, or ads you view or interact with or search, the website that referred you to us, your interactions with us through various communications channels, and clicks, mouse movements, keystrokes, or other actions taken on the Services.

We typically collect this information through a variety of first or third-party tracking technologies, such as cookies, pixels, APIs, or SDKs, and we may otherwise use third-party partners to process this information.

You may be able to configure your browser and device settings to limit or disable the use of cookies or similar technologies. You can learn more in the “Your Choices” section of this Privacy Policy.
Metadata about User-Generated Content
Information about how, when, and where you created or edited your content.

How We Use Your Data

Once we collect your data, we use it in a few different ways. This table summarizes the different ways we may use your data.

How We Use Your Data
What This Means
Delivering our Services
We use your data to provide and enhance our Services and our business, including to facilitate payment for our Services.
Providing AI Tools
We offer AI-powered tools, such as chatbots for onboarding/support or photo-editing tools that use artificial intelligence to make the changes you prompt. When you use these photo-editing tools, they analyze the content you provide, including the people and objects in such content, to apply your instructions or prompts.

We do not use these photo-editing tools to recognize, verify, or identify any specific person in any content. We also do not extract or store biometric information from your content. Any analysis needed to make the requested edit is used only to provide that edit and is not stored after the edit is complete.
Improving our Services
We use your data to monitor our Services and to improve their performance and effectiveness, as well as improve and better tailor any offers or ads in connection with our Services.
Research and Development
We may use your data for research and development so we can understand and improve our, or our partners’ services (including artificial intelligence and machine learning models) or develop inferences about you. As part of these activities, we may also create aggregated, de-identified, or other anonymous data from your data.
Marketing
Direct marketing. We may send you direct marketing communications about our Services or products or services that we offer with our marketing partners. If you would rather not receive our marketing emails, you can follow the steps in the “Your Choices” section later in this Privacy Policy.
‍
Interest-based advertising. We may engage third-party advertising partners to display ads on our Services and on third-party properties. These companies may use cookies and similar technologies in connection with our Services, our communications, and on other services, and use the information collected via such technologies to serve ads on our Services that they think will interest you (e.g., ads from third-party advertisers) or on other third-party properties (e.g., ads from VSCO or other ads that may interest you). This activity is typically called interest-based advertising or targeted advertising.

We may also receive information about our Creators from third-party advertising partners, which we then use to match to, and better understand, those Creators or similar Creators within our Services to serve targeted advertising to those Creators on an advertiser’s behalf. Similarly, we may upload information about our Creators to advertising partners to facilitate interest-based advertising to those users, or similar users, on our or other services. You can learn more about your choices for limiting interest-based advertising in the “Your Choices” section of this Privacy Policy.

We may also disclose information, such as event data, ad view/click data, and user identifiers, to advertising partners for purposes of measuring the effectiveness of ads.

Note that information we may receive from other sources may also be used for interest-based advertising purposes, such as information we receive that helps us better understand our users or information and inferences about you that we gather through our own research and development.
Administrative/Support Communications
To send you technical notices, updates, security alerts, and other administrative or support messages.
Compliance and Protection
To provide our Services, we must be mindful of the many legal, ethical, and contractual requirements that apply to us, so we might use your data to respond to lawful data requests, respond to subpoenas, warrants, or other lawful requests, protect our Creators, establish, and defend against legal claims, enforce our terms and policies, or comply with other legal requirements. 
Other Uses
For any other purpose for which we have provided notice or for which you have consented.

How We Share Your Data

We might need to share your data with other parties to help us do the things mentioned above. This table summarizes the other parties that might receive your data.

Who we might share your data with
Why we might share your data with them
Affiliates
We might share your data with our corporate affiliates or subsidiaries to do the things mentioned in this Privacy Policy.
Service Providers and Partners
We use certain companies and individuals that provide services on our behalf or help us operate our Services or our business, like data or service hosting, payment processors, email delivery, advertising, or marketing services. We may also share your data with partners for their own business purposes, such as the development and improvement of their services.
Advertising Partners and Intermediaries
We work with third-party advertising partners and intermediaries (e.g., ad networks, retargeters, sell-side or demand-side platforms, ad servers, clean rooms, identity resolution providers, measurement providers, and publishers such as social media platforms or digital/print content providers, advertisers, agencies) to facilitate the delivery of advertising to you on our Services or on third-party properties or to measure the effectiveness of those ads.

You can learn about the options you have to opt-out of interest-based advertising in the “Your Choices” section of this Privacy Policy.
Professional Advisors
We may need to share your data with our professional advisors, like our lawyers, auditors, bankers, and insurers if it’s necessary for them to provide their services.
Authorities and Others
We may need to share your data with law enforcement, government authorities, and private parties if we need to do so for the compliance or protection purposes described above.
Business Transferees
If we go through a business transaction like a merger, acquisition, corporate divestiture, or dissolution (including bankruptcy), or a sale of all or some of our assets, we may share or transfer your data to the parties (or their advisors) to the transaction during the transaction or in contemplation of the transaction (including during due diligence).
Other Creators, Companies and the Public
Your profile, content, and interactions with other content or Creators on our Services can be seen and used by others. We may also offer ways for you to interact with businesses that may wish to work with you, and your data, like your contact details, may be made available to facilitate such potential interactions. 

How Your Data is Maintained

How long we retain your data
Only as long as we reasonably need it for the uses mentioned above.
How you can delete your data
Follow the instructions here.
What happens when we no longer need your data
We’ll either delete your data or anonymize it unless deletion or anonymization isn’t possible or practical (for example, because your data is in backup archives or in certain emails), in which case we’ll make sure your data is securely stored and isolated from further processing.
What data remains
Remember that it is impossible to ensure that anything on the internet is ever completely removed. Even after your account is deleted, your content may still be visible, for example, if you’ve shared it on other platforms or if other people copied or shared your content before you deleted your account.

Your Choices

What you can do with your data
How to make it happen
Access or update your information
You can review and update certain account information by logging into your account.
Opt-out of marketing communications
You can opt-out of marketing-related emails by following the unsubscribe instructions at the bottom of a marketing email, or by contacting us. You will continue to receive other non-marketing emails related to our Services. If you receive marketing text messages from us, you can opt out by replying STOP to our marketing message.
Disable push messages
You can stop receiving push notifications from us by changing your preferences in your device’s notification settings menu. Please note we do not have any control over your device’s notifications settings and are not responsible if they do not function as intended.
Adjust cookie preferences
In certain U.S. states or in the European Economic Area, you can opt out of the use of certain cookies and similar technologies by clicking “Your Privacy Choices” in the footer of our website or within our mobile app. 

Additionally, most browsers let you limit or reject cookies by configuring your browser settings accordingly.
Disable mobile location data
You can disable our access to your device’s geolocation in your mobile device settings.
Decline to provide information
You can decide not to give us certain data, but then you may not be able to use certain features of our Services.
Configure third-party platform settings
If you connect to our Services through a third-party platform (like a social media account), you may be able to use your settings in your account with that platform to limit the information we receive from it moving forward.
Delete your data
You can choose to delete certain content from your account. You can delete your account and data entirely by following the instructions here.

If you are under 18 years of age, you can also use these same instructions to exercise your right to delete your content under California’s “Online Eraser” Law.
Opt-out of interest-based advertising
You can opt out of receiving interest-based advertising on websites through participating members of the Network Advertising Initiative by clicking here or the Digital Advertising Alliance (DAA) by clicking here.

You can also opt out of receiving interest-based advertising in mobile apps through participating members of the DAA by using the AppChoices mobile app. Note that we may work with companies that may not participate in these opt-out mechanisms but might offer their own opt-out.

In certain U.S. states, you can opt out of the use of “Targeted Advertising” by clicking “Your Privacy Choices” in the footer of the website or within our mobile app, and adjusting your preferences.
Limit advertising ID use in your mobile settings
You may be able to configure your mobile device to limit how your mobile advertising ID can be used for interest-based advertising purposes.

Age Restrictions on Providing us Data

General Audience Services
Our Services are intended for a general audience and are not directed to, targeted toward, or intended for use by people under 13. However, some of our Services may have higher age restrictions.
Unintentional Receipt of Data of People Under 13.
If we learn that we collected data through our Services from a child under 13, we will delete it.

Changes to this Privacy Policy

Notification of Material Changes
If we make any material change to this Privacy Policy, we will notify you via email, through a notification posted on our Services, or as otherwise permitted by law.
Effective Date of Changes
Your use of our Services after the effective date mentioned in any updated Privacy Policy indicates your acceptance of the updated Privacy Policy.

Contacting VSCO

Online Support Center
Mailing Address
VSCO
548 Market St, Suite 92958
San Francisco, CA 94104
Attention: Legal Department

U.S. State Privacy Rights

This section provides additional disclosures to residents of U.S. states with consumer privacy laws currently in effect, including further information on their rights under such laws. In this section, when we use the term “personal information” we mean (or similar term, such as “personal data”) as it is defined under those laws.

Verification
We’ll need enough detail to understand and respond to your request. We may also need you to provide documentation (such as government identification, a copy of a receipt for membership, or other information) to verify your identity, or need you to log in from a verified, valid device.
Authorized Agents
You can have an authorized agent make a request on your behalf, but we’ll need to verify your agent’s identity and may need documentation or other confirmation that you provided your authorized agent permission to submit the request on your behalf.
Sensitive Information
We process “sensitive personal information” (or similar term, such as “sensitive data”) only as reasonably expected for providing the services that you’ve requested or as otherwise permitted without requiring a corresponding right to restrict or limit such use.
Profiling
We do not undertake any “profiling in furtherance of decisions that produce legal or similarly significant effects” on our Creators.

Your Privacy Rights

Access
You can access a copy of your personal information by following the instructions available here or by submitting a request here.
Correction
You can request that we correct inaccurate personal information that we have collected about you by submitting a support request here or by submitting a request here.
Deletion
You can request deletion of the personal information that we have collected from you, by following the instructions available here or by submitting a request here.

Note: Customers of The Freelance Photographer (www.thefreelancephotographer.com) or Workspace (www.vsco.co/workspace) can exercise their access, correction, or deletion right by emailing support@vsco.co with the subject line “Privacy Request” and a message requesting such right in relation to that Service. If you are a client of a Workspace customer, please reach out to the Workspace customer directly for privacy requests.

‍Opting out of “sales,” “sharing,” and processing for “targeted advertising” purposes.

We work with advertising partners and intermediaries (e.g. ad networks, sell-side or demand-side platforms, identity resolution providers, clean rooms, measurement providers, publishers, advertisers/agencies) to help deliver targeted ads to you on our Services or other properties based on your activity across unrelated properties (e.g. your activity on our Services and social media networks or other digital properties) and to measure the effectiveness of such ads.

Using cookies or other tracking technologies, we make personal information (e.g. device data tied to online activity data, identity data such as email addresses or phone numbers) available to such partners or intermediaries for such purposes. We may also upload information (e.g. email address, phone number) about our Creators to these partners or intermediaries to facilitate such purposes. In either case, under certain state consumer privacy laws, these disclosures of personal information may be considered a “sale,” “share,” or processing of personal information or “targeted advertising” unless certain exceptions apply (e.g. disclosing personal information to a “service provider” or “processor,” where applicable).

For information on “third parties” to whom we may “sell” data, as required under certain state privacy laws, please see the “Vendor Details” section in our Your Privacy Choices link on VSCO.co’s website.

If we know that you’re 13-15 years of age, we won’t “sell” or “share” your personal information unless we get your consent to do so. 

Opting out of “Sales,” “Shares,” and “Targeted Advertising” Involving Cookies or Other Tracking Technologies
You can opt-out of "sales,” “shares,” and processing for “targeted advertising” that occur via cookies or other tracking technologies by clicking Your Privacy Choices in our website footer or within our mobile app (where applicable) for each Service and adjusting your preferences.

Your request to opt-out will apply only to the browser on the device from which you submit the request, and, if you delete your cookies, you will need to opt-out again in a subsequent session for that Service.

Alternatively, for this opt-out in relation to cookies and other tracking technologies, you can also broadcast the Global Privacy Control (GPC) to opt-out on each participating browser on the device that you’re using. Learn more at the Global Privacy Control website.
Opting out of “Sales,” “Shares,” and “Targeted Advertising” Not Involving Cookies or Other Tracking Technologies
To opt-out of “sales/shares” or processing of personal information for “targeted advertising” that do not rely on third-party advertising partners or intermediaries’ tracking technologies on this website (e.g. upload of users’ email addresses to certain ad platforms to target them with ads), you must also opt out by submitting a request here (also accessible via the Your Privacy Choices link on VSCO.co’s website).
Appeals
You may appeal our refusal to take action on a request exercising one of your rights mentioned above by contacting our Support Team.

Right to Know. If you’re a California resident, you have the right to know the following as it relates to the last 12 months: the categories of personal information that we’ve collected about you, the categories of sources from which we’ve collected the personal information, the business or commercial purpose for collecting, “selling,” or “sharing” the personal information, the categories of recipients to whom we’ve disclosed the personal information for a business purpose, and the categories of third parties to whom the personal information was “sold” or “shared.”

CCPA category of Personal Information (PI)
Examples of PI we collect in this category
Source of PI
Business and commercial purposes
Categories of third parties to whom we sell or share PI for interest-based advertising
Identifiers
Account data, profile data, data about others, our communications with you, identifiers, data about others
You or Third-party sources
Delivering our Services, Research and Development, Marketing, and Compliance and Protection
Advertising Partners and Intermediaries
California Customer Records (as defined in California Civil Code section 1798.80)
Account data, profile data, our communications with you, feedback, payment and transactional data, your content, data about others
You
Delivering our Services, Research and Development, Marketing, and Compliance and Protection
Advertising Partners and Intermediaries
Commercial Information
Payment and transactional data, marketing data, feedback, online activity data
You or Automatic collection
Delivering our Services, Research and Development, Marketing, and Compliance and Protection
Advertising Partners and Intermediaries
Online Identifiers
Profile data, device data
You or Automatic collection
Delivering our Services, Research and Development, Marketing, and Compliance and Protection
Advertising Partners and Intermediaries
Internet or Network Information
Marketing data, device data, and online activity data
You or automatic collection
Delivering our Services, Research and Development, Marketing, and Compliance and Protection
Advertising Partners and Intermediaries
Geolocation Data
Device data and metadata about certain content of Creators
Automatic collection
Delivering our Services, Research and Development, Marketing, and Compliance and Protection
Advertising Partners and Intermediaries
Inferences
May be derived from your: Payment & transactional data, marketing data, content of Creators, device data, online activity data
N/A
Delivering our Services, Research and Development, Marketing, and Compliance and Protection
Advertising Partners and Intermediaries
Protected Classification Characteristics
We do not intentionally collect this information, but it may be revealed in identity data, content of Creators, or other information we collect
N/A
N/A
N/A
Sensory Information
Creator content (images, video or audio)
You
Delivering our Services, Research and Development, Marketing, and Compliance and Protection
N/A
Sensitive Personal Information
Sensitive personal information that may be revealed in content of Creators
N/A
N/A
N/A
*Note: You might voluntarily provide additional information to us, which may contain other categories of personal information not mentioned in this table.

Privacy Notice to European Creators

The information provided in this notice applies only to individuals in the European Economic Area, United Kingdom and Switzerland (collectively, “Europe”) and explains our practices regarding personal data that we collect from you or which we have obtained about you from a third-party, and the legal bases for processing your personal data. It also describes your rights in respect to our processing of your personal data.

Personal data. “Personal data” as used in this notice has the same meaning given in European data protection legislation.

Controller. VSCO is the controller of your personal data covered by this Privacy Policy for purposes of European data protection legislation.

Data protection representative.

  • Pursuant to Article 27 of the General Data Protection Regulation (GDPR), VSCO has appointed European Data Protection Office (EDPO) as its GDPR Representative in the EU. You can contact EDPO regarding matters pertaining to the GDPR:
  • Pursuant to Article 27 of the UK GDPR, VSCO has appointed EDPO UK Ltd as its UK GDPR representative in the UK. You can contact EDPO UK regarding matters pertaining to the UK GDPR:

Legal bases for processing. We use your personal data only as permitted by law. Our legal bases for processing personal data are described in the table below.

Processing purpose

Details regarding each processing purpose listed below are provided in the section of our Privacy Policy titled “How we use your data”.
Legal basis
Processing is necessary to perform the contract governing our provision of our Services or to take steps that you request prior to signing up for our Services. If we have not entered into a contract with you, we process your personal data based on our legitimate interest in providing our Services that you access and request.  
These activities constitute our legitimate interests. We do not use your personal data for these activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
Compliance and Protection
Processing is necessary to comply with our legal obligations.
Processing activities for which you have consented
Processing is based on your consent. Where we rely on your consent, you have the right to withdraw it any time in the manner indicated when you consent or in our Services.

Use for new purposes. We may use your personal data for reasons not described in this Privacy Policy where permitted by law and the reason is compatible with the purpose for which we collected it. If we need to use your personal data for an unrelated purpose, we will notify you and explain the applicable legal basis.

Retention. We retain personal data for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

When we no longer require the personal data we have collected about you, we will either delete or anonymize it or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible. If we anonymize your personal data (so that it can no longer be associated with you), we may use this information indefinitely without further notice to you.

Sensitive personal data. We ask that you not provide us with any sensitive personal data (e.g. social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background or trade union membership) on or through our Services, or otherwise to us.

If you provide us with any sensitive personal data to us when you use our Services, you are consenting to our processing and use of such sensitive personal data in accordance with this Privacy Policy. If you do not consent to our processing and use of such sensitive personal data, you must not submit such sensitive personal data through our Services.

Your rights. You have the following rights in relation to the personal data we hold about you:

  • Right of access: You can ask us if we are processing your personal data and to provide you with a copy of it (along with certain details). If you require additional copies, we may need to charge a reasonable fee.
  • Right to rectification: If the personal data we hold about you is inaccurate or incomplete, you are entitled to request to have it rectified.
  • Right to erasure: You can ask us to delete or remove your personal data in some circumstances such as where we no longer need it or if you withdraw your consent to our processing of your personal data (where applicable).
  • Right to restrict processing: You can ask us to 'block' or suppress the processing of your personal data in certain circumstances, such as where you contest the accuracy of that personal data.
  • Right to data portability: You have the right, in certain circumstances, to obtain personal data you have provided us with (in a structured, commonly used and machine readable format) and to reuse it elsewhere or to ask us to transfer this to a third-party of your choice.
  • Right to object: You can ask us to stop processing your personal data, and we will do so, if we are:
    • relying on our own or someone else's legitimate interests to process your personal data, unless we can demonstrate compelling legal grounds for the processing; or
    • processing your personal data for direct marketing purposes.
  • Right to withdraw consent: If we rely on your consent (or explicit consent) as our legal basis for processing your personal data, you have the right to withdraw that consent at any time.
  • Right to lodge a complaint with the supervisory authority: If you have a concern about any aspect of our privacy practices, including the way we have handled your personal data, you can report it to the relevant supervisory authority. You can find your data protection regulator here.

You may submit these requests through our Support Center. We may request specific information from you to help us confirm your identity and process your request. Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions.

Cross-border data transfer. If we transfer your personal data out of Europe to a country not deemed to provide an adequate level of personal data protection for purposes of applicable data protection laws such that additional safeguards are required, the transfer will be performed:

  • pursuant to the recipient’s compliance with Standard Contractual Clauses or Binding Corporate Rules;
  • pursuant to the consent of the individual to whom the personal data pertains; or
  • as otherwise permitted by applicable laws.

You may contact us through our Support Center if you want further information on the specific mechanism used by us when transferring your personal data out of Europe.

Privacy Notice for China Residents

If you are a resident based in the mainland of China, we will collect, store, use, process, transfer, provide, disclose and delete (collectively referred to as the “Process”, “Processing” or “Processed”) your personal data in accordance with the PRC Personal Information Protection Law (“PIPL”) and the relevant applicable laws. The terms used in this Privacy Notice for China Residents have the definitions given to them under PIPL, including terms such as “data processor” and “data controller.”

Legal basis

Unlike in other jurisdictions, a legitimate interest is not a justified legal basis to process personal data in China. Consequently, we will obtain your proper consent for processing of your personal data as required by the PIPL and other relevant laws.

You hereby grant your separate consent to the cross-border data collection and other relevant data processing activities set forth in this Privacy Policy. In the event of any material change of the purpose or method of processing or the type of personal data we process, we will re-obtain your consent.

We will secure your separate consent if we undertake any of the following data processing activities in a manner that materially differs from this Privacy Policy:

  • Processing of sensitive personal data;
  • Use of personal data in automated decision-making;
  • Provision of personal data to another personal data processor;
  • Disclosure of the personal data we Process to the public; or
  • Cross-border collection of your personal data

For the avoidance of any doubt, “sensitive personal data” refers to the personal data that is likely to result in damage to the personal dignity of any natural person or damage to his or her personal or property safety once disclosed or illegally used, including such information as biometric identification, religious belief, specific identity, medical health, financial account and precise geolocation, as well as the personal data of minors under the age of 14.

The processing of sensitive personal data is only for a specific purpose and sufficient necessity, and strict protection measures must be taken to ensure its data security.

Data we collect from you

Please see the above section “Data we collect” for details on the categories of data we collect from you.

Purpose and method to Process your data

Please see the above section “How we use your data” for details on how we process your personal data. Unless otherwise stated in the Privacy Notice for China Residents, the relevant sections in this Privacy Policy will apply regarding our processing of your personal data.

How long and where your data will be retained

We will collect your personal data from the United States and process your personal data in the United States. We will take necessary measures to ensure that the direct collection and other processing activities of your personal data comply with the relevant regimes under the PIPL.

Please see the above section "How Long We Keep Your Data” on the retention period of your personal data.

Your Rights

As a data subject, you have the following rights:

  • Right to know and make decisions. You have the right to be informed and to decide on the Processing of your personal data, as well as the right to restrict or deny another person from the Processing of your personal data, unless otherwise provided by the relevant laws and regulations of PRC.‍
  • Right to access and make copies. You have the right to access or make copies of your personal data from us, unless otherwise provided by the relevant laws and regulations of PRC.‍
  • Right of portability. We will provide a way for transfer where you request to transfer your personal data to another personal data processor you designate, provided that the conditions prescribed by the PRC national cybersecurity authority are met.‍
  • Right to correct and complete. If you discover that your personal data is incorrect or incomplete, you have the right to request us to correct or complete your personal data.‍
  • Right to delete. We will delete your personal data under the circumstances required by the PIPL. In case we fail to do so, you have the right to request the deletion in such circumstances as described by the law.

In the event that the retention period prescribed by the applicable laws and regulations has not expired, or it is technically difficult to delete the personal data, we will retain the personal data. However, we will cease the Processing of the personal data, except for storage and any necessary measure taken for security protection.

  • Right to request explanation. You have the right to require us to explain our rules regarding the processing of personal data.
  • Right to withdraw. You have the right to withdraw your consent to the processing of your personal data carried out based on your consent. We will provide an easy way to withdraw consent. Your withdrawal of consent shall not affect the validity of any activity of processing of your personal data already carried out before the withdrawal based on your consent.
  • Right to opt-out of marketing communications. You can opt-out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of a marketing email, or by contacting us. You will continue to receive other non-marketing emails related to our Services. If you receive marketing text messages from us, you can opt out by replying STOP to our marketing message.

We will establish an accessible mechanism for you to exercise your rights. If we determine that your request to exercise your rights is not practical, we will let you know the reasons for such determination.

Consent

This Privacy Notice for China Residents is an integral part of our Privacy Policy. Prior to using our Services, you have carefully read, fully understood and accepted this Privacy Policy, including the Privacy Notice for China Residents.  By accepting and consenting to this Privacy Policy, you have granted your consent to authorize VSCO to process your personal data in accordance with this Privacy Policy.

If you are a resident in China and younger than 14 years old, please do not use our Services or provide any of your personal data to VSCO. Please do not provide any personal data to VSCO if your parent or legal guardian has not accepted this Privacy Policy following discussion with you and granted separate consent to authorize VSCO to process your personal data in accordance with this Privacy Policy.

Privacy Notice for Brazil Residents

If you use our Services in Brazil, this document supplements and prevails over any conflicting provisions with this Privacy Policy, so this supplement and the Privacy Policy must be read and interpreted jointly. The joint document is considered a full privacy notice in Brazil.

Personal data. “Personal data” as used in this notice has the same meaning given under the Brazilian General Data Protection Law, Law No. 13,709/2018 (Lei Geral de Proteção de Dados – “LGPD”).

Data Controller. VSCO is the controller of your personal data covered by this Privacy Policy for LGPD purposes. You can contact VSCO at: 548 Market Street, Suite 92958, San Francisco, California 94104-5401, Attn: VSCO Legal Department

Legal bases for processing. We use your personal data only as permitted by law. Our legal bases for processing personal data are described in the table below. Details regarding each processing purpose listed below are provided in the section of our Privacy Policy titled “How we use your data”.

Processing purpose
Legal basis
Processing is necessary to perform the contract governing our provision of our Services or to take steps that you request prior to signing up for our Services. If we have not entered into a contract with you, we process your personal data based on our legitimate interest in providing our Services you access and request.
These activities constitute our legitimate interests determined based on your legitimate expectations after purpose and necessity considerations. We do not use your personal data for these activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). This does not apply to sensitive data under LGPD (e.g. social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background or trade union membership). Processing of sensitive data will be based on your consent as detailed in item “Sensitive Personal Data” below.
Processing activities for which you have consented
Where we rely on your consent, you have the right to withdraw it any time in the manner indicated when you consent or in our Services.

‍Use for new purposes. We can use your personal data for reasons not described in this Privacy Policy where permitted by law and the reason is compatible with the purpose for which we collected it. If we need to use your personal data for an unrelated purpose, we will notify you and explain the applicable legal basis.

Retention. We retain personal data for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

When we no longer require the personal data we have collected about you, we will either delete or anonymize it or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible. If we anonymize your personal data (so that it can no longer be associated with you), we can use this information indefinitely without further notice to you.

Sensitive personal data. We ask that you not provide us with any sensitive personal data (e.g. social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background or trade union membership) on or through our Services, or otherwise to us.

If you provide us with any sensitive personal data to us when you use our Services, you are consenting to our processing and use of such sensitive personal data in accordance with this Privacy Policy. If you do not consent to our processing and use of such sensitive personal data, you must not submit such sensitive personal data through our Services.

Your rights. You have the following rights in relation to the personal data we hold about you:

  • Right of access: You can ask us if we are processing your personal data and to provide you with a copy of such data (along with certain details). If you require additional copies, we may need to charge a reasonable fee.
  • Right to rectification: If the personal data we hold about you is inaccurate or incomplete, you are entitled to request to have it rectified.
  • Right to erasure: You can ask us to delete or remove your personal data in some circumstances such as where we no longer need it or if you withdraw your consent to our processing of your personal data (where applicable).
  • Right to restrict processing: You can ask us to 'block' or suppress the processing of your personal data in certain circumstances, such as where you contest the accuracy of that personal data.
  • Right to data portability: You have the right, in certain circumstances, to obtain personal data you have provided us with (in a structured, commonly used and machine readable format) and to reuse it elsewhere or to ask us to transfer this to a third-party of your choice.
  • Right to object: You can ask us to stop processing your personal data, and we will do so, if we are:
    • relying on our own or someone else's legitimate interests to process your personal data, unless we can demonstrate compelling legal grounds for the processing; or
    • processing your personal data for direct marketing purposes.
  • Right to withdraw consent: If we rely on your consent (or explicit consent) as our legal basis for processing your personal data, you have the right to withdraw that consent at any time.
  • Right to lodge a complaint with the supervisory authority: If you have a concern about any aspect of our privacy practices, including the way we have handled your personal data, you can report it to the Brazilian Data Protection Authority (Autoridade Nacional de Proteção de Dados – “ANPD”).

You can submit these requests through our Support Center. We can request specific information from you to help us confirm your identity and process your request. Applicable law can require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions.

Cross-border data transfer. While ANPD has not determined which countries provide an adequate level of personal data protection for LGPD purposes, after such determination, if the transfer is to a country not recognized as adequate by ANPD, the transfer will be performed:

  • pursuant to the recipient’s compliance with ANPD’s standard contractual clauses or equivalent standard contractual clauses from other countries as determined by ANPD;
  • binding corporate rules or bespoke contractual clauses approved by ANPD;
  • pursuant to the consent of the individual to whom the personal data pertains; or
  • as otherwise permitted by applicable laws.

You can contact us through our Support Center if you want further information on the specific mechanism used by us when transferring your personal data out of Brazil.

Direct marketing. By accepting the terms of our Services, you acknowledge and agree that:

  • We can send you direct marketing communications about our Services or products or Services that we offer with our marketing partners. If you would rather not receive our marketing emails, you can follow the steps in the “Opt-Out of Marketing” section later in this Privacy Policy.‍
  • We can also receive information about our Creators from third-party advertising partners, which we then use to match to, and better understand, those Creators or similar Creators within our Services to serve targeted advertising to those Creators on an advertiser’s behalf. Similarly, we can upload information about our Creators to advertising partners to facilitate interest-based advertising to those users, or similar users, on our or other services. You can learn more about your choices for limiting interest-based advertising in the “Your Choices” section of this Privacy Policy.
  • We can also disclose information, such as event data, ad view/click data, and user identifiers, to advertising partners for purposes of measuring the effectiveness of ads (e.g. whether actions that you take on or off our Services were a result of ads that you have seen or clicked on).

Note that information we can receive from other sources can also be used for interest-based advertising purposes, such as information we receive that helps us better understand our users.

Privacy Notice for Mexico Residents

If you use our Services in Mexico, this document supplements and prevails over any conflicting provisions with this Privacy Policy, so this supplement and the Privacy Policy must be read and interpreted jointly. The joint document is considered a Full Privacy Notice in Mexico.

Data controller. Visual Supply Company located at 548 Market St. Suite 92958, San Francisco, CA 94104, is the data controller of the personal data that we process in relation to our Services.

Legal basis. Your consent is the legal basis for us processing your personal data.

Processing purposes. Except for “Marketing”, which is an ancillary purpose, the rest of the processing purposes listed in Section “How we use your data” above, are considered primary purposes.

If you do not want to receive our marketing communications, please opt-out from those communications following the steps mentioned in Section “Your Choices” above.

Data transfer. We may transfer your data to carry out a merger, acquisition, reorganization or transfers of assets or other corporate transactions. In that case we may transfer or disclose data related to you to the party or parties involved in the transaction. With your consent to this Privacy Notice, you grant us your consent for said transfer.

Your rights. You have the right to know what personal data we have about you, what we use it for (Access). Likewise, it is your right to request the correction of your personal data if it is outdated, inaccurate or incomplete (Rectification); that we delete your data from our records or databases (Cancellation); as well as you can oppose the use of your personal data for specific purposes (Opposition). You also have the right to Revoke your consent and to Limit the Use or Disclosure of your personal data.

If you would like to exercise any of your rights, you may contact us through our Support Center or submit a request. Please send us your request from the email account that you registered in our Services, so we can authenticate your identity.

Si usted usa nuestros servicios en México, este documento suplementa y prevalece sobre cualquier disposición que entre en conflicto con la Política de Privacidad, por lo que el presente suplemento y la Política de Privacidad deben ser leídos e interpretados conjuntamente. El documento conjunto es considerado un Aviso de Privacidad Integral en México.

Responsable: Visual Supply Company located at 548 Market St. suite 92958, San Francisco, CA 94104 es el responsible de los datos personales que procesamos en relación con nuestros Servicios.

Base legal. Su consentimiento es la base legal para el tratamiento de sus datos personales.

Finalidades de tratamiento: Con excepción de “Marketing”, la cual es una finalidad secundaria, el resto de las finalidades de tratamiento incluidas en la Sección “Cómo usamos sus datos” mencionada arriba, son consideradas finalidades primarias.

Si usted no desea recibir nuestras comunicaciones de marketing, puede manifestar su negativa para recibirlas siguiendo los pasos mencionados en la Sección “Sus opciones” mencionada arriba.

Transferencias. Podemos transferir sus datos para llevar a cabo una fusión, adquisición, reorganización o transferencia de bienes, u otra transacción corporativa. En ese caso podemos transferir o divulgar sus datos a la otra parte o partes involucradas en la transacción. Con su consentimiento al presente Aviso de Privacidad, usted otorga su consentimiento para dicha transferencia.

Sus derechos. Usted tiene el derecho de saber qué datos personales tenemos de usted, así como las condiciones generales de procesamiento (Acceso). De igual forma, tiene derecho a solicitar la corrección de sus datos personales si están desactualizados, incorrectos o incompletos (Rectificación); a solicitar que eliminemos sus datos personales de nuestros expedientes y bases de datos (Cancelación); así como a oponerse al tratamiento de sus datos personales para propósitos específicos (Oposición). También derecho a revocar su consentimiento y a limitar el uso o divulgación de sus datos personales.

Si usted desea ejercer cualquiera de sus derechos, póngase en contacto con nosotros a través de nuestro Centro de Ayuda o envíe una solicitud. Si nos envía una solicitud, por favor hágalo desde el correo electrónico que tenga registrado en nuestros Servicios para que podamos verificar su identidad.

Contact us
‍You may contact us through our Support Center with any questions regarding the processing of your personal data.

WHERE PHOTOGRAPHERS TURN PRO