Privacy Policy

Last updated: May 10, 2025

Visto is committed to protecting and respecting your privacy. By this Privacy Policy (the "Policy"), we describe how we might collect, store, use, and/or share ("process") your personal data when visit and use services ("Services") through our website.

1. Personal Data We Collect

Depending on the relevant circumstances and applicable local laws and requirements, we will collect some or all the data listed below to enable us to provide our Services to you. To the extent applicable, such information may include:

1.1. Personal data that you provide to us

1. Account Information. When you create an account, we will collect information including your email address. We automatically generate a unique, unified Visto ID for you, ensuring a consistent and streamlined user experience. Such Visto ID extends across multiple services, please review the individual privacy policies associated with each service.
2. Feedback Information. This includes your feedback on complaints and communications with our customer service. We are dedicated to offering efficient response, ensuring that your issues are promptly resolved. If you refuse to provide the feedback Information, it will not affect your use of our Services.
3. Payment Information: In order to provide the Services you purchased to you, we will collect information including your email address, billing address, your business affiliation (company or organization name), type of Services you purchase, amount you pay to complete your order, Subscription ID and Subscription-related URLs (such as purchase confirmation page URL, subscription cancelation URL).
4. Other Data you voluntarily provide to us.

1.2. Personal data that we automatically collect or generate about you

1. Usage data relating to your use of the Services, which reveals your preferences, interests, or manner of use of the Services and the times of use, including your click, browsing, and editing activity. We would collect your usage data via cookies and similar technologies. For more information, please refer to Section 3 of this Policy.
2. Device and network data that may be associated with your device or browser, including device identification information (such as IMEI, Android ID, and OAID), network connectivity status, device ID, model, and IP address.

1.3. Personal Data provided to us by third parties

1. Account Information. If you choose to register or log in through social media or other third-party services (such as Google, Apple and Facebook), we will collect the corresponding account information based on your authorization. The profile information we receive may vary depending on the social media provider concerned, but will often include your name, email address, and profile picture.
2. Payment Information. We utilize third-party payment services (such as Google Pay and Apple Pay) to process transactions. The payment details such as credit card information you provide during the purchase process will be collected by these services. For the completion of the transactions, we may collect some information related to your payment, such as payment status, payment account ID and other information provided by third-parties.

1.4. Prohibited data

To better protect your privacy, we do NOT process the following information otherwise specified in the individual privacy policies:

• personal health data (e.g. medical records or an individual's health care claim information);
• government-issued ID numbers (e.g. driver's license numbers, Social Security Numbers);
• personal financial data or financial account numbers;
• personal data of children under 16;
• genetic and biometric data such as your facial image.

2. How We Use Your Data and the Legal Bases for These Uses

2.1. Legal Bases in General

We will only use your personal data when the applicable laws allow us to. Our legal bases for collecting and using the personal data described in this Policy depends on the personal data we collect and the specific context in which we collect the information:

• We need to perform a contract with you;
• You have given us consent to do so;
• In specific jurisdictions, processing your personal data is in our legitimate interests, including
  • providing, maintaining and marketing our Services;
  • detecting, preventing and enforcing violations of our Terms of Use including misuse of Services, fraud, abuse, and other trust and safety protocols; and
  • protecting our legal rights and the rights of others. If legitimate interest is not an available legal base in a particular jurisdiction, we will engage in the processing activities described above on a legal base that is available in that particular jurisdiction;
• We need to comply with our legal obligations under the applicable laws.

2.2. Purposes and Legal Bases for Processing

The purposes for which we process personal data, subject to applicable laws, and the legal base on which we perform such processing, are as follows:

3. Cookies and Other Tracking Technologies

Cookies are small text files stored by your web browser when you use websites. You can control how websites use cookies by configuring your Cookie Preferences at the bottom of our Website. Note that if you disable cookies entirely, our Services may not function properly.

We and our third-party partners, such as analytics and advertising partners, may collect information about you via cookies. The information collected may include information such as unique identifies, system information, IP address, web browser, device type, your system preferences, and the web pages that you visit, and where you have clicked.

3.1 Types of Cookies

We may use both session cookies and persistent cookies. A session cookie disappears after you close your browser. A persistent cookie remains after you close your browser and may be used by your browser on subsequent visits to our Services. We or our third-party partners may place the cookies under one of the following purposes:

Function cookies: these cookies are essential for the core functionality of the site and related services. Without them, the site cannot function properly, so they cannot be disabled.

Marketing cookies: these cookies allow us and our partners to deliver ads that are more relevant to your interests for marketing purposes. Without them, you will still see ads, but they may not be as tailored to your preferences.

Measurement cookies: these cookies are used to analyze site usage, helping us measure and improve site performance. Without these cookies, we wouldn't be able to understand which content is most valued or track how often unique visitors return, making it difficult to enhance the information we provide to you.

4. How We Share Your Personal Data

We will only share your personal data for lawful, legitimate, necessary, specific, and explicit purposes, and we will only share the personal data required to provide the Services. We require our partners and services providers, through agreements, to retain your personal data only for the necessary period and to implement adequate security measures to protect data security.

4.1. Affiliates and corporate partners

We disclose the categories of personal data described above in Section 1 between and among our affiliates and related entities, for legitimate business purposes and the operation of the Services, in accordance with applicable laws.

4.2. Services providers

We may share any personal data listed in Section 1 with our Service Providers. These parties help us provide the Services or perform business functions on our behalf. They include:

• Hosting and technology vendors. For instance, we use Amazon Web Services to power the infrastructure for our Services.
• Support and customer service vendors. We may use Zendesk or other third-party providers to provide you with customer support services.
• Payment processors. We use qualified payment processors such as Apple and Google. Please check their terms of service and privacy policy for information on their use and storage of your personal data, as applicable.

4.3. Law enforcement agencies, public authorities or other judicial bodies and organizations

We disclose personal data if we are legally required to do so, or if we have a good faith belief that such use is reasonably necessary to:

• comply with a legal obligation, process or request;
• enforce our terms, policies, and standards, including investigation of any potential violation thereof;
• detect, prevent or otherwise address security, fraud or technical issues; or
• protect the rights, property or safety of us, our users, a third party or the public as required or permitted by applicable laws (including exchanging information with other companies and organizations for the purposes of fraud protection).

4.4. Change of corporate ownership

If we are involved in a merger, acquisition, bankruptcy, reorganization, partnership, asset sale or other transaction, we may disclose your personal data as part of that transaction. Should one of these events occur, we will make reasonable efforts to notify you before your personal data becomes subject to different privacy and security policies and practices.

5. Data Security and Retention Process

5.1. How we secure your personal data

We have implemented appropriate technical and organizational security measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, and other unlawful or unauthorized processing, in accordance with applicable laws.

Your account is protected by a password for your privacy and security. You must prevent unauthorized access to your account and personal data by selecting and protecting your password appropriately and limiting access to your computer or device and browser by signing off after you have finished accessing your account. If you have any concerns that your account or personal data has been put at risk, for example if someone could have found out your password, please contact us by using the contact details provided in the Section "Contact Us".

While we use reasonable commercial efforts to protect the data, no technology, data transmission, or system can be guaranteed to be 100% secure. In the event of a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to your data, we will notify you according to the applicable laws.

5.2. How do we retain your personal data

We adhere to retention policies for the personal data we collect to ensure that it is not retained longer than necessary for the intended purpose. If you deactivate your account, delete personal data, or the retention period is expired, we will delete or anonymize your personal data, except in the following cases:

• Compliance with legal requirements regarding data retention according to the applicable laws.
• Extension of the period for financial, audit, dispute resolution, or other legitimate purposes.

When assessing how long your personal data is retained, we consider criteria such as: (i) the nature of the personal data and the activities involved; (ii) when and for how long you use the Services; and (iii) our legitimate interests and our legal obligations.

6. International Transfers of Personal Data

We use global cloud services to process and back up your Personal Data. Currently, we use the data centers that are in Singapore, the United States and EU. Based on where you are, we will store your Personal Data in the nearest data center. For example, if you are within the European Economic Area, your Personal Data will be processed and stored on the server in EU; if you are located in the U.S., your Personal Data will be processed and stored within the U.S. We also rely on service providers around the globe to support our operations. Consequently, your personal data may be accessed by our affiliates or transferred to third-party service providers and business partners in various locations, to fulfill the purposes set forth in this Policy.

In the event of an international transfer of personal data, when required by applicable laws, we will provide an adequate level of protection for your personal data using various means, including implementing Standard Contractual Clauses or data transfer agreements that comply with applicable laws between our affiliates and third parties or any other lawful approach that permits the lawful transfer of personal data from those countries.

Please find below the relevant information on transfer across national borders:

• Visto may transfer your payment information to payment processing companies outside the EU to process transactions.
• Visto may use third party cookies and tracking tools (such as AdWords, Bing, bugsplat, Criteo, Facebook, FireBase, Flurry, Google Analytics, Hotjar, LinkedIn, Pardot, Quora) to track the information on how Users use the Sites and products, such Sites usage data and product usage data may be sent to and stored in third party servers located outside the EU. Such third-party cookies and tracking tools may send the tracking data or analysis report to Visto for our above-mentioned purpose. Most of the third-party cookies and tracking tools process your Personal Data anonymously;
• Visto may transfer your email address and other necessary information such as your name to email delivery service providers outside the EU to deliver promotion emails to you;
• Visto may store the Personal Data on the servers leased from server service providers;
• Visto may transfer your relevant Personal Data to marketing platforms and service providers outside the EU to complete relevant service;
• Visto may transfer your relevant Personal Data to fraud monitoring and prevention providers outside the EU to complete relevant service.

You can obtain more details of the protection given to your personal data when it is transferred outside of your country by contacting us as referred to in the Section 13 below.

7. Children

Our Services are not intended for children under the age of 16. We do not knowingly solicit data from or market to children under 16 years of age. If you do not meet applicable age requirements, please do not use our Services.

If we learn that personal data from users less than 16 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under age 16, please contact us.

8. Your Privacy Rights

Subject to applicable law and depending on where you reside, you may have some rights regarding your personal data, as described below. If you have any other requests relating to the access of your personal data, please contact us using the contact details listed in the Section "Contact Us".

8.1. Data Access

You may have the right to know what personal data we process about you, including the categories of personal data, the business or commercial purposes for collection, the categories of third parties to whom we disclose it and other information according to the applicable law.

You may have the right to access and obtain a copy of your personal data in accordance with the applicable laws. Where applicable, we will provide the information in a portable, machine-readable, readily usable format.

8.2. Data Correction

You may have the right to request that we correct inaccurate personal data that we retain about you, subject to certain exceptions.

8.3. Data Deletion

You have the right to delete your account and erase your personal data. Upon deleting your account, all your personal data will be deleted. Additionally, you may also request deletion of the personal data you provide by contacting us. If some of your personal data cannot be deleted, we will inform you of the reasons for not taking action.

Please note that we reserve the right to retain some of your personal data where there are valid grounds for us to do so under applicable laws.

8.4. Withdrawal of Consent

Where we process your personal data on the basis of your consent, you may withdraw your consent by contacting us. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

8.5. Objection to the Processing

Subject to applicable laws, you may object to the processing of your personal data based on our legitimate interests where there are grounds relating to your particular situation by contacting us. Please note that we may have an overriding legitimate interest to keep processing your personal data, but we will let you know where this is the case.

8.6. Restriction to the Processing

If you would like to restrict our processing of your personal data, you may contact us. You have the right to restrict the processing of your data where one of the following applies:

• the processing is unlawful and you oppose the erasure of relevant personal data;
• for the purpose of establishment, exercise or defense of legal claims, you request us to retain your personal data that we were supposed to delete;
• your objection regarding the accuracy of your personal data is pending our verification;
• your request to object to the processing of your personal data is pending our verification.

8.7. Lodge a complaint with your local data protection authority

Subject to applicable data protection laws, you may have the right to submit your complaint to the local data protection authority where you reside if you consider that the processing of your personal data infringes any applicable data protection laws.

8.8. Other Rights

Depending on your jurisdiction, you may be entitled to additional rights in relation to your personal data. If you would like to contact us to exercise one or more of these rights, to ask a question about these rights or any other provision of this Policy or about our processing of your personal data, or to file a complaint about how we process your personal data, you may use the contact details provided in Section "Contact Us" below.

When submitting a right request, please specify the scope and basis of your request and provide us with the necessary information to verify your identity. We may contact you to confirm your identity in order to handle your request. We will respond to your request or complaint in due course under the applicable laws.

9. Additional U.S. State Disclosures

We collect personal data from and about you in the preceding 12 months as described in Section 1 above.

We disclose personal data with third parties for business purposes in the preceding 12 months as below:

To the extent provided for by local law and subject to applicable exceptions, you may have the following rights:

Opt-out of marketing communications. We provide marketing information through in-app notifications. If you do not wish to receive these notifications, you can disable them in your device settings.

Limit the Use of Sensitive Personal Data. You also have the right to request limitation of use and disclosure of your sensitive personal data, subject to certain exceptions. For sensitive personal data, please review the individual privacy policies associated with certain Services.

Do Not Sell or Share My Personal Data. As defined by relevant state laws, we "sell" or "share" your Device and Network Data and Usage Data for purposes of serving you advertisements based on your activity across other sites and services ("cross-context behavioral advertising" or "targeted advertising"). If you would like to opt out of the sale or sharing of your personal data, please navigating to "Do not sell or share my personal information" at the bottom of our website or contact us by details provided in Section "Contact Us" below.

Appeal. You may appeal our refusal to take action on a request by contacting us using the contact details provided in Section "Contact Us" below.

Direct Marketing. We do not disclose personal data to third parties for their direct marketing purposes.

10. Third Party Services

Our Services incorporate services and functions provided by third parties. When you choose to enable such third-party services, Wondershare may share your information with such third-party services, including your text, images and other information. Third-Party Services are not owned or controlled by Wondershare and may have their own policies and practices for its collection, use, and sharing of your personal information. Please check the permissions, privacy settings and privacy notices of these third-party services or contact the provider for any questions.

11. Update To This Policy

The Services and our business may change from time to time. We recommend checking this page to stay up to date with the latest changes. If there are any substantial changes to this Policy, depending on the nature of such changes, we will notify you in advance through pop-ups, push notifications, and other appropriate means.

12. Contact Us

For more information about your data subject rights, or how we process your personal data, please contact us by the information below.

Contact Person: Visto Privacy Team

Contact Details: privacy@visto.com