Privacy Policy

COCO AI, INC.

(d/b/a Coco Labs)

Last Updated: October, 2026

Coco AI, Inc., a Delaware corporation doing business as Coco Labs (“Coco Labs,” “we,” “us,” or “our”), respects your privacy. This Privacy Policy (this “Policy”) describes how we collect, use, disclose, retain, and protect Personal Information in connection with our websites located at www.cocolabs.ai and www.vybstudio.ai, the vyb Studio platform, our Waitlist, our API, our marketing communications, and the other Services described in our Terms of Service. It also explains the choices and rights available to you, including under the laws of the United States, the European Economic Area, the United Kingdom, Switzerland, Canada, Brazil, and other jurisdictions.

This Policy is a notice of our privacy practices. It is not a contract, and you are not asked to consent to it simply by visiting the Sites. Where Applicable Law requires your consent for a particular activity, we request that consent separately. If you have any questions about this Policy, please contact us at privacy@cocolabs.ai.

1. DEFINITIONS AND SCOPE

1.1 Personal Information. “Personal Information” means any information that identifies, relates to, describes, or is reasonably capable of being associated with, directly or indirectly, an identified or identifiable individual or household, and includes any information defined as “personal data,” “personal information,” or a similar term under Applicable Law. Personal Information does not include information that has been de-identified or aggregated so that it can no longer reasonably be linked to an individual.

1.2 Other Defined Terms. Capitalized terms used but not defined in this Policy, including “Account,” “Applicable Law,” “Authorized User,” “Business User,” “Enterprise Agreement,” “Feedback,” “Free Tier,” “Inputs,” “Models,” “Outputs,” “Paid Plan,” “Public Gallery,” “Services,” “Sites,” “Third-Party Models,” “Usage Data,” “Waitlist,” and “Your Content,” have the meanings given to them in our Terms of Service.

1.3 Scope. This Policy applies to Personal Information about individuals who visit the Sites, join the Waitlist, create an Account, use the Services, receive our communications, or otherwise interact with us. This Policy does not apply to (a) Personal Information that we process on behalf of Business Users, as described in Section 1.5; (b) the practices of third parties, including the Third-Party Services described in Section 18; or (c) Personal Information about our employees, contractors, and job applicants, which is addressed in separate notices.

1.4 Controller. Coco AI, Inc. is the controller (or the equivalent under Applicable Law) responsible for the Personal Information described in this Policy, except as provided in Section 1.5. Our contact details are set out in Section 20.

1.5 Information Processed on Behalf of Business Users. Where a Business User, such as a company that subscribes to a business Paid Plan, enters into an Enterprise Agreement, uses team accounts, or accesses the API, submits Personal Information to the Services as part of Your Content, we process that Personal Information on behalf of, and in accordance with the instructions of, the Business User, as its processor or service provider under our agreement with it. In those cases, the Business User’s own privacy notice governs, and individuals should direct their requests to the Business User. We remain the controller of Personal Information used to administer Business User Accounts, process billing, generate Usage Data, and maintain the security and integrity of the Services.

2. INFORMATION WE COLLECT

2.1 Information You Provide to Us. We collect the following Personal Information that you provide directly:

(a) Waitlist Information. When you join the Waitlist, we collect your email address and any other information you choose to provide, such as your name, company, role, and intended use of the Services.

(b) Account Information. When you create an Account, we collect your name, email address, password, and telephone number. If you register or sign in through Google, we receive your name, email address, and profile image from Google, subject to your Google account settings.

(c) Professional Information. During onboarding and while you use the Services, we may collect information about your employer or company, job title, role, industry, team size, and how you intend to use the Services.

(d) Your Content. We collect the prompts, instructions, text, images, logos, brand assets, files, and other Inputs you submit; the brand profiles you create (such as brand names, color palettes, typography, and style preferences); the Outputs generated for you; the edits you make; and your conversation and generation history. Your Content may include Personal Information about you or about other people, such as photographs of individuals.

(e) Feedback and Survey Responses. We collect the ratings (such as likes and dislikes), comments, reviews, bug reports, and survey responses you provide.

(f) Payment and Transaction Information. Payments are processed by our third-party payment processor, Stripe. We do not receive or store your full payment card number. We receive limited information from Stripe, such as your name, billing country and postal code, card type, the last four digits of your card, transaction amounts and dates, and the status of your subscription and Credits.

(g) Communications. When you contact us, we collect your contact details and the content of your communications, including records and copies of correspondence.

(h) Promotions. If you participate in a contest, promotion, or similar program, we collect the information you provide in connection with it.

2.2 Information Collected Automatically. When you access or use the Sites or the Services, we and our service providers automatically collect the following information:

(a) Device and Connection Information. Your IP address, browser type and version, operating system, device type, device and advertising identifiers, language settings, referring and exit URLs, and internet service provider.

(b) Approximate Location. Your approximate location, such as your city, region, and country, inferred from your IP address. We do not collect precise geolocation from your device.

(c) Usage Data. Information about how you interact with the Sites and the Services, including pages viewed, features used, clicks, time spent, timestamps, errors, Credit consumption, and interaction signals, such as which Outputs you select, download, regenerate, approve, or reject, and the types and frequency of edits you make. We use session recording features in our analytics tools to record interactions with our web pages. Text entered into form fields, including passwords, is masked in your browser before the recording is transmitted, and payment card fields are hosted by our payment processor and are not recorded. Text displayed on a page, such as your email address on an account screen, may be recorded. Session recordings are retained for 30 days.

(d) Cookies, Pixels, and Similar Technologies. Information collected through cookies, web beacons, pixels, software development kits, and local storage, as described in Section 6.

(e) Email Engagement. Whether you open our emails and click links in them, collected through web beacons embedded in our emails.

2.3 Information from Third Parties. We receive Personal Information from the following third parties:

(a) Single Sign-On Providers. Google, if you use Google to register or sign in, as described in Section 2.1(b).

(b) Payment Processor. Stripe, which provides payment confirmations, subscription status, and fraud prevention signals.

(c) Analytics and Advertising Partners. Providers such as Google, Meta, Mixpanel, and PostHog, which provide information about your interactions with the Sites and our advertisements, conversion events, and aggregated demographic and interest reports.

(d) Business Users. Administrators of Business User Accounts, who may provide the names, email addresses, and roles of Authorized Users.

(e) Business Partners. Referral, co-marketing, integration, or other business partners with whom we may work in the future, which may provide contact and business information about prospective customers. We will process any such information in accordance with this Policy.

2.4 Information About Other People. If Your Content includes Personal Information about other individuals, such as photographs of employees, models, customers, or children appearing in product imagery, you are responsible for providing any notice and obtaining any consent that Applicable Law requires, including the consent of a parent or guardian where an image depicts a minor. If you use the Free Tier, please do not upload images of identifiable children.

2.5 Sensitive Information. We do not request, and do not intend to collect, sensitive Personal Information, such as information revealing racial or ethnic origin, religious or philosophical beliefs, health, sex life or sexual orientation, biometric or genetic data, government identification numbers, financial account credentials, or precise geolocation. The only exception is your Account login credentials, which some U.S. state laws treat as sensitive and which we use only to authenticate you and secure your Account. We do not use facial recognition technology, and we do not extract biometric identifiers from images you upload. Please do not include sensitive Personal Information in Your Content.

3. HOW WE USE INFORMATION

We use Personal Information for the following purposes:

3.1 Providing and Operating the Services. To create and manage Accounts; administer the Waitlist and grant access; process Inputs and generate Outputs; route Inputs to the appropriate Models, including Third-Party Models; save your brand profiles, preferences, and history; and personalize your experience.

3.2 Transactions and Account Administration. To process payments, subscriptions, and Credits; send notices about your Account and subscription, including renewal and expiration notices; and carry out our obligations and enforce our rights under our agreements with you, including for billing and collection.

3.3 Communications. To respond to your inquiries and support requests; notify you of changes to the Services, our Terms of Service, or this Policy; and administer surveys.

3.4 Marketing and Advertising. To send you news, product updates, and offers about our own products and services; to measure the effectiveness of our marketing; and to show you advertisements for the Services on third-party websites and platforms based on your visits to the Sites (often called “retargeting”), as described in Section 6. We do not send marketing about third parties’ products or services. Your choices regarding marketing and advertising are described in Sections 6 and 7.

3.5 Analytics and Improvement. To understand how the Sites and the Services are used, measure performance, diagnose and fix problems, develop new features, and improve our customer service.

3.6 Model Development and Training. To develop, train, evaluate, and improve our Models and Services, as described in Section 4.

3.7 Public Gallery. To display Outputs generated under the Free Tier in the Public Gallery, as described in our Terms of Service and Section 5.4.

3.8 Safety, Security, and Integrity. To detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Service, including through automated and human review of Inputs and Outputs and content filtering; to report apparent child sexual abuse material to the National Center for Missing & Exploited Children as required by law; and to process requests to remove non-consensual intimate imagery.

3.9 Legal Compliance and Protection of Rights. To comply with Applicable Law, legal process, and lawful requests from public authorities, and to establish, exercise, or defend legal claims.

3.10 Aggregated and De-identified Information. To create aggregated or de-identified information that does not identify any individual, such as statistics about the number of users, usage trends, and the features most frequently used. We may share that information with investors, prospective investors, business partners, and the public. We maintain and use de-identified information in de-identified form, do not attempt to re-identify it except as permitted by Applicable Law, and contractually prohibit recipients from re-identifying it.

3.11 Corporate Transactions. To evaluate and carry out a merger, acquisition, financing, reorganization, or sale of all or part of our business or assets.

3.12 Other Purposes. For any other purpose disclosed to you when we collect the information, or with your consent.

4. USE OF INFORMATION TO DEVELOP AND TRAIN OUR MODELS

4.1 Free Tier. If you use the Free Tier, we may use Your Content (including your prompts, the images and other files you upload, the Outputs generated for you, and your conversation and generation history), your Feedback, and Usage Data to develop, train, fine-tune, evaluate, and improve our Models and Services. Authorized personnel and contractors who are bound by confidentiality obligations may review samples of this information for these purposes. Please do not submit confidential information or Personal Information about other people to the Free Tier. You may opt out of the use of Your Content for model training by emailing notrain@cocolabs.ai from the email address associated with your Account or, when we make the option available, through your Account settings. We will apply your opt-out to Your Content submitted after we process your request.

4.2 Paid Plans. If you use a Paid Plan, we do not use Your Content to train or fine-tune our Models, except as agreed in an Enterprise Agreement. We process Your Content under a Paid Plan to provide the Services to you (for example, by analyzing the images and brand assets you upload to identify colors, typography, and style) and to keep the Services safe. We use only the ratings you provide through our like and dislike features, and Usage Data in aggregated or de-identified form, to improve the Services and our Models. When you submit Feedback, we may review the Inputs and Outputs associated with it in order to understand it, but we will not use those Inputs and Outputs to train our generative Models unless you have opted in.

4.3 Safeguards. We take steps designed to limit the Personal Information included in training datasets. We do not use training data to build profiles of individuals or to make decisions about them, and we do not sell training datasets containing Personal Information.

4.4 Your Choices. You may delete items of Your Content or your Account at any time, and you may exercise the rights described in Sections 12 through 17, including, where available, the right to object to our use of your Personal Information for model training. If you delete Your Content, opt out under Section 4.1, or object to its use for training, we will exclude it from training datasets created afterward. Information that has already been used to train a Model, however, cannot practicably be removed from that Model’s parameters.

4.5 Third-Party Model Providers. Certain features of the Services use Third-Party Models, including models made available by OpenAI and Google. Certain features of the Services use Third-Party Models, including models made available by OpenAI and Google and models hosted by fal.ai, such as Bria’s background removal model and Meta’s Segment Anything Model 3. When you use those features, we transmit the relevant Inputs, including images you upload, and related context, to the applicable provider so that it can generate Outputs on our behalf. These providers may retain such information for a limited period under their terms, for example to monitor for abuse.

4.6 Open-Source Models. Certain of our Models are based on openly licensed models that we host on our own cloud infrastructure. When we use those Models, your Inputs are not sent to the developers of the underlying open-source models.

5. HOW WE DISCLOSE INFORMATION

5.1 Service Providers and Processors. We disclose Personal Information to service providers and processors that perform services on our behalf. We require them by contract to keep Personal Information confidential, protect it, and use it only to provide services to us. Our principal service providers are listed below, and we may engage additional providers that perform similar functions, such as email delivery and customer support providers.

5.2 Advertising Partners. We allow advertising partners, including Meta (through the Meta Pixel) and Google (through Google Analytics and Google Ads remarketing), to collect information through cookies, pixels, and similar technologies on the Sites. That information includes cookie and device identifiers, IP address, browser information, the pages you visit, and events such as sign-ups and purchases. These partners use it to show you advertisements for the Services on other websites and platforms and to measure the effectiveness of those advertisements. They may also use it in accordance with their own privacy policies. Under certain U.S. state laws, this activity may constitute a “sale” or “sharing” of Personal Information or “targeted advertising,” and you may opt out as described in Sections 6.5 and 13.

5.3 Third-Party Model Providers. We disclose Inputs and related context to Third-Party Model providers as described in Section 4.5.

5.4 Public Gallery. Outputs generated under the Free Tier may be displayed publicly in the Public Gallery, and any Personal Information depicted in those Outputs will be visible to the public. We do not display your uploaded Inputs in the Public Gallery, and we do not identify you by name in connection with a publicly displayed Output without your consent. You may request removal of an Output from the Public Gallery by contacting support@cocolabs.ai.

5.5 Business Users. If your Account is provided by or associated with a Business User, such as your employer, the Business User’s administrators may access, manage, export, and delete Your Content and information about your use of the Services.

5.6 Legal Requirements and Protection of Rights. We disclose Personal Information where we believe in good faith that disclosure is necessary to (a) comply with Applicable Law, legal process, or a lawful request from a public authority, including law enforcement and national security authorities; (b) report apparent child sexual abuse material to the National Center for Missing & Exploited Children; (c) enforce our Terms of Service and other agreements, including for billing and collection; (d) detect, prevent, or address fraud, security, or technical issues; or (e) protect the rights, property, or safety of Coco Labs, our users, or the public.

5.7 Corporate Transactions. We disclose Personal Information in connection with an actual or proposed merger, acquisition, financing, due diligence, reorganization, bankruptcy, receivership, or sale of all or part of our business or assets, subject to appropriate confidentiality obligations. Any successor will be required to handle your Personal Information in a manner consistent with this Policy.

5.8 Affiliates. We may disclose Personal Information to any current or future parent company, subsidiary, or affiliate under common control with us, which will handle it in a manner consistent with this Policy.

5.9 With Your Consent or at Your Direction. We disclose Personal Information with your consent or at your direction, such as when you choose to share an Output or connect the Services to a third-party service.

5.10 Aggregated and De-identified Information. We disclose aggregated or de-identified information as described in Section 3.10.

5.11 No Sale for Money; No Third-Party Direct Marketing. We do not sell Personal Information in exchange for money. We do not disclose Personal Information to third parties for their own direct marketing purposes.

6. COOKIES, PIXELS, AND SIMILAR TECHNOLOGIES

6.1 Technologies We Use. We and our partners use cookies (small text files stored by your browser), pixels and web beacons (small graphics or code embedded in web pages and emails), software development kits, and local storage (collectively, “Cookies”) on the Sites and in our emails.

6.2 Categories of Cookies. We use the following categories of Cookies:

(a) Strictly Necessary. These enable you to sign in and remain signed in, keep the Services secure, balance traffic, and remember your Cookie choices. The Services cannot function without them, and if you block them you will not be able to sign in.

(c) Analytics. These help us understand how the Sites and the Services are used and how they perform, and include Cookies placed by Mixpanel, PostHog, and Google Analytics.

(d) Advertising. These allow our advertising partners, including Meta and Google, to show you advertisements for the Services on other websites and platforms based on your visits to the Sites, and to measure the effectiveness of those advertisements.

6.3 Google Analytics Advertising Features. We have enabled the Google Analytics advertising features of Remarketing and Demographics and Interests Reporting. Google and its vendors use first-party Cookies (such as Google Analytics Cookies) and third-party Cookies together to inform, optimize, and serve advertisements based on your past visits to the Sites, and to provide us with aggregated reports about the demographics and interests of our visitors. You can learn how Google uses information from sites that use its services at https://policies.google.com/technologies/partner-sites. You can opt out of personalized advertising from Google through your Google ad settings, and you can prevent your data from being used by Google Analytics by installing the Google Analytics Opt-out Browser Add-on available at https://tools.google.com/dlpage/gaoptout.

6.4 Email Beacons. Our emails may contain web beacons that tell us whether an email was opened and which links were clicked. You can limit this by disabling the automatic loading of images in your email client.

6.5 Your Cookie Choices.

(a) Consent. We place analytics and advertising Cookies only with your consent, which you may give or withdraw at any time through the “Your Privacy Choices” link on the Sites.

(b) Browser Controls. You may set your browser to refuse some or all Cookies or to alert you when Cookies are being set. If you block strictly necessary Cookies, you will not be able to sign in to or use the Services.

(d) Industry Opt-Outs. You may opt out of interest-based advertising from participating companies through the Network Advertising Initiative (https://optout.networkadvertising.org), the Digital Advertising Alliance (https://optout.aboutads.info), and, in Europe, the European Interactive Digital Advertising Alliance (https://www.youronlinechoices.eu). You may also adjust your advertising preferences in your Meta and Google account settings.

Opt-outs are generally specific to the browser and device you use, and you may need to renew them if you clear your Cookies.

6.6 Do Not Track and Global Privacy Control. There is no uniform standard for responding to “Do Not Track” browser signals, and the Sites do not currently respond to them. We do, however, honor the Global Privacy Control (“GPC”) signal as a valid request to opt out of the sale or sharing of Personal Information and of targeted advertising for the browser or device that sends it and, where we can associate the browser with your Account, for your Account. Honoring the GPC signal does not affect strictly necessary Cookies or your ability to sign in.

7. YOUR CHOICES

7.1 Account Information. You may review and update your Account information at any time through your Account settings.

7.2 Marketing Emails. You may unsubscribe from marketing emails at any time by following the unsubscribe instructions in any marketing email or by contacting privacy@cocolabs.ai. We will process your request promptly and, in any event, within the time required by Applicable Law. You will continue to receive service-related communications, such as security alerts, billing notices, and notices of changes to our terms, while your Account remains active.

7.3 Model Training. You may opt out of model training as described in Section 4.1.

7.4 Public Gallery. You may request removal of an Output from the Public Gallery as described in Section 5.4.

7.5 Cookies and Advertising. Your choices regarding Cookies and advertising are described in Section 6.

7.6 Account Deletion. You may delete your Account through your Account settings or by contacting privacy@cocolabs.ai.

8. DATA RETENTION

We retain Personal Information for as long as reasonably necessary to fulfill the purposes described in this Policy, including to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. In determining retention periods, we consider the nature and sensitivity of the information, the purposes for which we process it, the potential risk of harm from unauthorized use or disclosure, applicable legal and regulatory requirements, and applicable limitation periods. In particular:

(a) Account Information is retained for as long as your Account remains active and for a reasonable period afterward for legal, tax, dispute resolution, and fraud prevention purposes.

(b) Your Content is retained for as long as your Account remains active or until you delete it, subject to backup retention cycles and Section 4.4.

(c) Waitlist Information is retained until you are granted access to the Services, you ask us to remove you, or we discontinue the Waitlist.

(d) Payment and Transaction Records are retained for the periods required by tax, accounting, and other Applicable Law.

(e) Usage Data and Analytics Information is retained in accordance with the retention settings we configure with our analytics providers and for as long as needed for the purposes described in Section 3.5. Session recordings are retained for 30 days.

(f) Communications are retained for as long as needed to respond to you and maintain records of our interactions.

(g) Safety and Security Records are retained for as long as necessary to protect the Services and comply with Applicable Law.

(h) Marketing Suppression Records are retained for as long as necessary to honor your opt-out choices.

We may retain aggregated or de-identified information indefinitely.

9. DATA SECURITY

We maintain safeguards designed to protect Personal Information against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure or access. These include encryption of data in transit using Transport Layer Security, hosting on cloud infrastructure provided by Google Cloud Platform, and authentication requirements for Account access. No method of transmission over the internet or of electronic storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your password confidential and for notifying us promptly at support@cocolabs.ai if you believe your Account has been compromised. If a security incident affects your Personal Information, we will notify you and the relevant authorities as required by Applicable Law.

10. INTERNATIONAL DATA TRANSFERS

We are based in the United States, and the Services are hosted in the United States. If you access the Services from outside the United States, your Personal Information will be processed in the United States, and it may also be processed in other countries where our service providers operate. These countries may have data protection laws that differ from those of your country, and Personal Information processed in them may be accessible to courts, law enforcement, and national security authorities under the laws of those countries. Where Applicable Law requires, we protect transfers of Personal Information to our service providers with appropriate safeguards. These include the standard contractual clauses approved by the European Commission, the United Kingdom International Data Transfer Addendum, clauses recognized under Swiss law, the standard contractual clauses approved by the Brazilian National Data Protection Authority, our service providers’ certifications under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, or other lawful transfer mechanisms. You may request a copy of the relevant safeguards by contacting privacy@cocolabs.ai.

11. CHILDREN’S PRIVACY

The Services are intended for individuals who are at least 18 years of age and are not directed to children. We do not knowingly collect Personal Information from children under the age of 13, or under any higher age at which Applicable Law requires parental consent, and we do not knowingly sell or share the Personal Information of consumers under the age of 16. If we learn that we have collected Personal Information from a child in violation of Applicable Law, we will delete it and close the associated Account. If you believe that a child has provided Personal Information to us, please contact privacy@cocolabs.ai. Images of minors that Business Users include in Your Content, such as product imagery, are subject to Section 2.4.

12. YOUR PRIVACY RIGHTS

12.1 Overview. Depending on where you live, you may have the rights described in Sections 13 through 17. Regardless of where you live, we will consider and respond to requests to access, correct, or delete your Personal Information, subject to the exceptions and limitations in Applicable Law.

12.2 Submitting a Request. You may submit a request by emailing privacy@cocolabs.ai or by writing to us at the address in Section 20. You may also access, update, and delete certain information directly through your Account settings. Because we operate exclusively online and have a direct relationship with our users, we accept requests by email.

12.3 Verification. To protect your Personal Information, we will verify your identity before fulfilling a request, generally by matching the information you provide with the information we hold and by confirming that you control the email address associated with your Account. We may request additional information where reasonably necessary, and we will use it only to verify your request.

12.4 Authorized Agents. Where Applicable Law permits, you may designate an authorized agent to submit a request on your behalf. We may require the agent to provide written permission signed by you, and we may require you to verify your identity directly with us, unless the agent holds a valid power of attorney.

12.5 Timing. We will respond within the period required by Applicable Law, for example within one month under the GDPR and within 45 days under the CCPA, each subject to any extension that Applicable Law permits.

12.6 Appeals. If we decline to take action on your request, we will explain our reasons. Where Applicable Law provides a right to appeal, you may appeal our decision by replying to our response or emailing privacy@cocolabs.ai with the subject line “Privacy Request Appeal,” and we will respond within the period required by Applicable Law. If we deny your appeal, you may contact the attorney general or data protection authority of your jurisdiction.

12.7 No Discrimination or Retaliation. We will not discriminate or retaliate against you for exercising your privacy rights.

13. ADDITIONAL INFORMATION FOR UNITED STATES RESIDENTS

13.1 California Notice at Collection and Disclosures. This Section applies to residents of California and supplements the rest of this Policy. It is provided under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its implementing regulations (collectively, the “CCPA”), to the extent the CCPA applies to us. We collect the following categories of Personal Information, from the sources described in Section 2, for the business and commercial purposes described in Sections 3 and 4, and we disclose them as follows:

We retain each category of Personal Information in accordance with the criteria in Section 8. We use and disclose sensitive personal information only for purposes permitted by the CCPA without a right to limit, such as authenticating you and securing your Account. We do not have actual knowledge that we sell or share the Personal Information of consumers under the age of 16.

13.2 California Privacy Rights. If you are a California resident, you have the right, subject to the exceptions in the CCPA, to (a) know the categories of Personal Information we have collected about you, the categories of sources, the business or commercial purposes for collecting, selling, or sharing it, the categories of third parties to which we disclose it, and the specific pieces of Personal Information we have collected about you; (b) delete Personal Information we have collected from you; (c) correct inaccurate Personal Information; (d) opt out of the sale or sharing of your Personal Information; and (e) not receive discriminatory treatment for exercising these rights. You may exercise your right to opt out of sale or sharing through the “Your Privacy Choices” link on the Sites or by enabling the GPC signal in your browser, and you may exercise your other rights as described in Section 12.

13.3 California “Shine the Light.” California Civil Code Section 1798.83 permits California residents to request information about the disclosure of their Personal Information to third parties for those third parties’ direct marketing purposes. We do not disclose Personal Information to third parties for their own direct marketing purposes.

13.4 Other U.S. States. Depending on your state of residence, you may have the right, subject to exceptions under Applicable Law, to (a) confirm whether we process your Personal Information and access it; (b) correct inaccuracies; (c) delete it; (d) obtain a portable copy of it; (e) opt out of the sale of your Personal Information, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects; and (f) appeal our decision on your request, as described in Section 12.6. We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects. You may opt out of targeted advertising and sale as described in Section 6.5 and through the GPC signal.

13.5 Nevada. Nevada residents may submit a request to opt out of the sale of covered information, as defined under Nevada law, by contacting privacy@cocolabs.ai. We do not currently sell covered information as defined under Nevada law.

14. ADDITIONAL INFORMATION FOR THE EUROPEAN ECONOMIC AREA, THE UNITED KINGDOM, AND SWITZERLAND

14.1 Application. This Section applies if you are located in the European Economic Area (“EEA”), the United Kingdom, or Switzerland, and it supplements the rest of this Policy. It is provided under the General Data Protection Regulation (EU) 2016/679 (the “GDPR”), the GDPR as incorporated into the laws of the United Kingdom (the “UK GDPR”), and the Swiss Federal Act on Data Protection, as applicable.

14.2 Legal Bases for Processing. We process your Personal Information on the following legal bases:

14.3 Your Rights. Subject to the conditions and exceptions in Applicable Law, you have the right to (a) access your Personal Information and receive a copy of it; (b) rectify inaccurate or incomplete Personal Information; (c) erase your Personal Information; (d) restrict our processing of your Personal Information; (e) receive your Personal Information in a structured, commonly used, and machine-readable format and have it transmitted to another controller; (f) object to processing based on our legitimate interests, including the use of your Personal Information for model training, and to object at any time to processing for direct marketing purposes; and (g) withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. You may exercise these rights as described in Section 12.

14.4 Complaints. You have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work or where an alleged infringement occurred. A list of EEA supervisory authorities is available at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. In the United Kingdom, you may contact the Information Commissioner’s Office (https://ico.org.uk), and in Switzerland, the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch). We would, however, appreciate the opportunity to address your concerns first.

14.5 Provision of Personal Information. You must provide your email address and a password, or sign in through a supported single sign-on provider, to create an Account, and you must provide payment information to purchase a Paid Plan. Without that information, we cannot provide the relevant Services. All other information is provided voluntarily.

14.6 Automated Decision-Making. We use automated tools to detect content that may violate our Terms of Service, and these tools may automatically block Inputs or Outputs. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. You may request human review of any decision to suspend or terminate your Account by contacting legal@cocolabs.ai.

15. ADDITIONAL INFORMATION FOR CANADA

If you are located in Canada, this Section applies under the Personal Information Protection and Electronic Documents Act and applicable provincial privacy laws, including the privacy laws of Québec. We collect, use, and disclose your Personal Information with your consent, which may be express or implied depending on the sensitivity of the information and your reasonable expectations, and you may withdraw your consent at any time, subject to legal and contractual restrictions and reasonable notice. You have the right to access and request correction of your Personal Information, and you may have additional rights under provincial law. Your Personal Information is stored and processed in the United States and may be processed in other jurisdictions, as described in Section 10. Our Privacy Officer is responsible for our compliance with Canadian privacy laws and may be contacted at privacy@cocolabs.ai. You may also file a complaint with the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca) or, in Québec, the Commission d’accès à l’information du Québec (https://www.cai.gouv.qc.ca). We send commercial electronic messages to Canadian recipients only with consent as required by Canada’s anti-spam legislation, and each message identifies us and includes an unsubscribe mechanism.

16. ADDITIONAL INFORMATION FOR BRAZIL

If you are located in Brazil, this Section applies under the Lei Geral de Proteção de Dados Pessoais (Law No. 13,709/2018) (the “LGPD”). We process your Personal Information on the legal bases provided in the LGPD, including the performance of a contract, our legitimate interests, compliance with legal obligations, the regular exercise of rights, and your consent, as applicable to the purposes described in Sections 3 and 4. Subject to the LGPD, you have the right to (a) confirmation of the existence of processing; (b) access to your Personal Information; (c) correction of incomplete, inaccurate, or outdated information; (d) anonymization, blocking, or deletion of unnecessary or excessive information or information processed in violation of the LGPD; (e) portability; (f) deletion of information processed with your consent; (g) information about the public and private entities with which we share your Personal Information; (h) information about the possibility of denying consent and the consequences of doing so; (i) revocation of consent; (j) review of decisions made solely on the basis of automated processing; and (k) petition the Autoridade Nacional de Proteção de Dados (ANPD). Our person in charge of data protection (encarregado) is our Privacy Officer, who may be contacted at privacy@cocolabs.ai. International transfers of your Personal Information are made in accordance with the mechanisms permitted by the LGPD, as described in Section 10.

17. ADDITIONAL INFORMATION FOR OTHER JURISDICTIONS

If you are located in another jurisdiction, such as Australia, India, Japan, Singapore, or South Korea, you may have rights under local law to access, correct, or delete your Personal Information, to withdraw your consent, and to lodge a complaint with your local data protection authority. You may exercise these rights as described in Section 12. Your Personal Information will be transferred to and processed in the United States and other countries as described in Section 10. Where local law requires your separate consent to a particular processing activity or to an international transfer, we will request that consent before undertaking it. The Services are not available in mainland China.

18. THIRD-PARTY SERVICES

The Services may integrate with, or permit you to access, websites and services operated by third parties, such as Google sign-in, and we may from time to time offer third-party products or services in connection with the Services. Third parties that operate those websites and services have their own privacy policies and practices, which govern their use of your information. We are not responsible for those practices, and we encourage you to review the privacy policies of any third-party services you use.

19. CHANGES TO THIS POLICY

We may update this Policy from time to time. When we do, we will post the updated Policy on the Sites and update the “Last Updated” date above. If we make material changes, we will notify you by email or through the Services before the changes take effect. Where Applicable Law requires your consent to a change, including any material change in how we use Personal Information that we have already collected, we will obtain your consent before applying the change to that information.

20. CONTACT US

If you have any questions or concerns about this Policy or our privacy practices, or if you wish to exercise your rights, please contact us at:

Coco AI, Inc. (d/b/a Coco Labs)

Attn: Privacy Officer

700 El Camino Real, Suite 120, #1354, Menlo Park, California 94025, USA

Privacy inquiries and requests: privacy@cocolabs.ai

General inquiries: hi@cocolabs.ai

Individuals in the EEA and the United Kingdom may also contact our representatives identified in Section 14.2.