1. Privacy Overview
Realeyes OÜ (Vahe 15, Tallinn 11615, Estonia, registry code: 11730664; “Realeyes”) offers a mobile measurement service to enterprise customers based on patented facial feature tracking. This service is called RealView, which builds on information derived from users of our digital wellbeing mobile application, mindful.ly (also referred to as ‘mobile application’) to provide media measurement insights.
This Privacy Policy (“Policy”) describes how we collect and manage the Personal Information (aka ‘personal data’) that we collect from our participants while they use and interact with our mindful.ly mobile application (“Service”) and at the same time carrying out the measurement service.
Please read our Policy carefully to make sure that you understand our processing activities. When you download our mobile application or otherwise engage in the Service, you are agreeing to this Policy. We cannot provide you the Service without collecting some personal information from you, therefore, for you to be able to participate and use the Service, it is important that you understand the terms of this Policy.
Please note that Realeyes does not knowingly obtain Personal Information from any of our products, study data, or survey responses from participants under the age of 16. You must confirm that you are 16 years of age or older before consenting to our processing of your personal data in relation to the Realeyes mobile measurement. Should we discover that any data has been collected from a participant under the age of 16, we will immediately delete it.
Realeyes is the data controller for the data we collect. Our contact details are provided under Section 8 below.
2. Mindful.ly mobile app
This part of the Policy explains the personal information processing activities associated with our mobile application.
Please note that your use of our mobile application is voluntary. You should indicate your consent when starting to use our application by reading and accepting this Policy and by providing the necessary device permissions to utilize the features of the application.
If you do not grant permission for us to access your front facing camera on your mobile device, you cannot start using the mobile application and we will not collect your information. You may at any time withdraw your permission from us to process your personal information by following the instructions in Sections 2.3 and 7 below.
2.1. Information Categories
A) Information related to media measurement
(i) If you consent to participate in a measurement carried out by our mobile application, then we will collect the following information about your device:
- Telemetry events related to your device:
- device model;
- device brand;
- device operating system;
- device language;
- device time changes;
- device shutdown or reboot info;
- screen power state changes;
- information whether local storage is full;
- audio play state changes;
- device volume changes;
- screen orientation changes;
- your device’s battery consumption.
- Network connection related events:
- network connectivity changes;
- country code derived from IP address if network connectivity changes.
- Your unique resettable advertising ID & ad personalization preferences.
- For each app user, we use and store a tracking ID (PublicParticipantId) which enables us to assign a unique identifier to your mobile app. If you use multiple apps on different devices, the information associated with each app will be processed differently. The IDs we set are described in your mobile app settings and are used to link all measured data to a single device-app combination. Once you request the removal of your data, the link between the tracking ID and your device will be irrevocably deleted so the data collected from you cannot be again linked to you and your device.
(ii) For the mobile application to work as intended, we request your permission to use the front-facing camera on your mobile device. Our software then collects the following separate data-points:
- Telemetry events related to the camera of your device:
- camera available / unavailable;
- other camera information.
- Whether a face is detected and, if so, the position and orientation of the face relative to the screen.
- The extent to which the person in front of the device camera appears to be paying attention to the content.
- A numerical encoded reaction to the content (levels of overall emotion displayed, such as happiness, surprise, sadness, fear, confusion, contempt or disgust).
Please note - Realeyes does not store video or images from your camera on your device or our systems, servers or cloud storage, and the software is not used for facial recognition purposes. Any images accessed from the camera will be discarded immediately after processing it on your device, such processing should not take longer than 1 second at most. However, data derived from images may be stored on your device until you delete the mobile application, opt-out or request deletion of your data.
(iii) For the mobile application features to work, access to usage statistics of applications running on the device is required. Our software collects the following related data-points if you grant permission to such processing in your device operation system:
- Your interactions with various mobile applications via the device:
- Names of mobile apps used;
- Time spent on each mobile app.
- Mobile app related events:
- Measurement host app information
- Measurement host app start
- Measurement SDK initialization
- Available app permissions
- Measurement host app screen changes
- Foreground app changes
- Event count quality markers
B) Information related to YouTube feature
For the mobile application’s YouTube feature to work and provide insights on how your YouTube usage affects your emotions and mood, our software collects and processes the following information regarding your YouTube usage if you consent to such processing and grant our software accessibility permission:
- YouTube in-stream advertisement sessions;
- Various advertisement-related information such as call-to-action button label, display URL, timer progress, skip / play button interactions;
- Your YouTube account subscription type (standard/premium).
In addition to the above mentioned data, we also collect the following information through MediaController – if you consent to such processing – to enable the mobile application’s YouTube feature to provide even more accurate insights on how your YouTube usage affects your emotions:
- YouTube channel name;
- Video title;
- Video thumbnail;
- Video duration.
The data that we collect through MediaController is collected for the purpose of providing insights on the impact of your YouTube use has on your emotions and mood. However, such data only serves its intended purpose if we are also able to process your YouTube advertisement related information (as specified in the first part of this Section 2.1 (b)).
Please note - we do not directly associate any specific viewed content with your mobile application use. All the content you view on your mobile device remain unknown for Realeyes except for the content of the measurement host application.
For ultimate app experience, your age and gender data can be voluntarily provided by users to unlock additional features.
Additionally, if you want to send direct feedback to our application development department, you can optionally provide your email address which enables us to reply to your request.
2.2. Information Use
Realeyes specializes in market research and measures how people feel when they view on-screen media. We provide you insights with how the use of different mobile applications affect your emotions and awareness. If you have consented to such processing, we also analyze these reactions to help our customers improve their mobile application user experience, mobile application content and advertising. We process your personal data only if we have proper legal basis for that.
We may use collected information for the following purposes and on the following legal bases:
- For media measurement purposes, if you have consented to such processing, for instance to carry out analysis and produce reports for our clients who have commissioned us. The reports we give to our clients contain only aggregated, anonymized data, and we do not disclose data relating to any individual participant in our media measurement. The purposes for conducting the analysis include:
- benchmarking advertising campaigns within mobile applications against other comparable campaigns;
- helping clients improve their mobile application user experience;
- conducting academic or other research to benefit the public interest.
- To develop the Service that we provide, by helping our system to learn from the data we collect from you, and to make our system and Service more accurate, in which case the legal basis of processing is our legitimate interest to improve our Services to better meet the needs of our users;
- In certain circumstances to offer, manage and issue incentives to participate in media measurement, if you have consented to such processing;
- To manage and provide the Service and to complete a specific request, such as providing you with various types of emotional awareness data through our app, in which case the legal basis for processing is the need to perform the contract concluded between us;
- To send retargeted advertisements for advertisement performance optimization research, if you have consented to such processing;
- To prevent fraud or abuse of incentives and to ensure security, in which case the legal basis for processing is our legitimate interest to prevent fraud and ensure security of our service;
- To protect our legal rights, including file claims or protect us against claims, in which case the legal basis for processing is our legitimate interest to protect our rights;
- To perform our obligations arising from applicable legal acts.
In addition, if in relation with particular media measurement we want to use your personal information for specific purposes materially different from those specified here, we will request your consent.
If the legal basis for processing is your consent, you have the right to withdraw the consent at any time. Please note that the withdrawal of your consent does not affect the lawfulness of the processing carried out under the consent prior to the withdrawal and therefore does not apply retroactively. If the legal basis for processing is our legitimate interest, we have, as a result of weighing the relevant interests, come to the conclusion that in the particular case our legitimate interests override your interests, fundamental rights and freedoms which require protection of personal data. You have the right to file an objection at any time against such processing. If you object, we will refrain from further processing of your personal data, except if we prove that the personal data is being processed due to a compelling lawful reason which overrides your interests, rights and freedoms, or if we process your personal data for the purpose of preparing and filing legal claims or protecting against claims filed against us.
2.3. Your Controls
You can control or opt-out of our collection and processing of your unique mobile measurement information in the following ways:
- You can pause measurement by tapping on the Android top notification bar and navigating to the settings within the mobile application;
- You can pause measurement by launching the mobile application and navigating to the app settings;
- You can turn your front-facing camera off at any time. Turning your camera off will mean that we will no longer be deriving any data from images taken via your camera, but you will not be fully opted out and other data collection (e.g., app interactions and window events) will continue to be recorded. For Samsung Android users, you can control your camera by navigating to Settings/Privacy/Permission Manager/Camera;
Please note that if you disable access to your front-facing camera by default, you may be asked by the mobile application again on a periodic basis to resume access; - You can withdraw your consent concerning our processing activities relating to the YouTube feature (as described in detail under Section 2.1 (b) above) by navigating to the mobile application’s opt-out settings (Settings/Manage permissions) and then choosing ‘YouTube insights permissions’ option. After clicking on ‘YouTube insights permissions’ button, you will be taken into the settings of your device’s operation system, where you can withdraw the said permission. Please note that revoking your YouTube insights permission will also result that we stop processing the information about you that we collect through MediaController as specified under Section 2.1 (b) above.
- You can delete the mobile application from your device. However, any information collected will continue to be stored until the one-year inactivity period is reached.
Data retention measures are discussed in Section 6 of this Policy.
3. Information Sharing
When reporting the results of our mobile measurement activities to our enterprise customers, we will only share information in aggregated, anonymous form. We might share basic identification information (i.e. your ExternalParticipantID) with our third party service provider facilitating the payment of monetary incentives to provide such incentives if you have consented to them. For example, if as part of the media measurement we have collected data about whether you looked at a particular video, we might then explain in our report what percentage of the participants in the media measurement looked at the video concerned. In such a case where basic reporting information is shared, it will be devoid of any uniquely identifiable measurement information.
We may share your personal information with vendors or service providers where this is necessary to provide services to us, such as tasks that support us in providing measurement services. Such vendors and service providers act as data processors and process your personal information on behalf of us. In each such case, we will have a data processing contract in place with the vendor or service provider which protects your personal information against unauthorized use or disclosure and limits use in accordance with our instructions. We only use data processors that have provided us with a sufficient guarantee that they implement relevant technical and organizational measures to ensure the protection of your personal information. We remain liable for ensuring the protection of your personal information processed by our processors.
If we have a legal basis, we may share your personal data with third parties who act as independent data controllers. We may share your personal information with third parties to fulfil our obligation arising from legal acts. We may also share your information with affiliated companies or divisions of Realeyes, or if any of our business is purchased or otherwise transferred to another entity. In such an acquisition or transfer event, we will endeavor to require the transferee to continue to process it in accordance with this Policy, unless you provide consent for another use.
4. International Transfer of Personal Information
We may choose to host or transfer your Personal Information to countries outside of the European Economic Area (EEA). If these transfers are to a country for which the European Commission has not issued an adequacy decision (such as the US), Realeyes will either conclude contracts with the recipients including the EU standard contractual clauses adopted by the European Commission or will rely on Binding Corporate Rules.
5. Data Security
We use industry standard technical and organizational security measures designed to protect your data against unauthorized disclosure or processing. These measures vary depending on the sensitivity of the information we have collected from you. However, no method of transmission over the Internet or via mobile device, or method of electronic storage is absolutely secure. Therefore, while we strive to use commercially acceptable means to protect your information, we cannot guarantee its absolute security.
6. Data Retention
We will anonymize the personal information we collect from you during mobile media measurement following six months from the last date on which you participate in the mobile media measurement. If you choose to delete the measurement host app, please note we will continue to retain any information collected until the six months inactivity period is reached.
After the retention period, except any data that has been anonymized (which will no longer constitute personal information relating to you, and which we will retain), we will delete the relevant personal information. If, at any time, you withdraw your consent, or otherwise opt-out of, our processing your personal information, then we will anonymize or delete your personal information.
If you exercise your right to delete your personal information, we will do so as expeditiously as possible following your verification, unless otherwise stated here.
In all circumstances, we will not store your personal information for longer than necessary to fulfill the measurement or other purposes we collected it for, unless we are required to retain it to satisfy a legal, regulatory, tax, or accounting requirements.
7. Rights of Data Subjects
You are entitled to exercise the following rights with regards to your personal data to the extent prescribed in applicable law:
- Access your personal data: Any request to access your information shall be subject to providing the acceptable proof of identification. Once we have identified you, you will be provided with the copy of your personal data. If a person’s request for information or measures are clearly unjustified or excessive, a reasonable fee may be asked, or the action taken may be refused.
- Right of rectification/modification: You can have your personal data corrected at any time in case it is inaccurate or incomplete.
- Right of erasure/deletion: You can request to delete your personal data at any time.
- Right to restrict processing/object/opt-out: In certain circumstances, you have a right to restrict or block us from processing your personal data. We have referenced some of these options in the ‘Your Controls’ sections.
- Right to data portability: You have a right to request the personal data from us and reuse this data for other services. However, at this time, personal information processed through the Realeyes Service are proprietary in nature, and unavailable for portability.
- Right to lodge a complaint: If you think that the rights regarding your personal data have been breached, we ask you to notify us thereof using the contact details below. You also have the right to lodge a complaint with the competent supervisory authority (e.g. the Estonian Data Protection Inspectorate) or turn to the courts.
- Right to withdraw your consent: If the processing is done based on your consent, you have the right to withdraw your consent to processing of your personal data at any time. We have referenced some of these options in the ‘Your Controls’ sections.
You may exercise any of these rights at any time by emailing us at dpo@realeyesit.com with the unique identifiers associated with RealView mobile measurement, or ‘Participant ID’ found in the app privacy section of the settings menu.
8. Contacting us
Please contact us if you have any comments or questions about our Privacy Policy or about information that we hold.
- For European residents, send an email to dpo@realeyesit.com under the subject heading “Privacy Policy”.
- For non-European residents, send an email to privacy@realeyesit.com under the subject heading “Privacy Policy”.
- Write to us at 151 Wardour Street, London W1F 8WE, UK.
9. Changes to Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of changes by posting an announcement on our Service or Website. You are bound by any changes to our Privacy Policy when you use our Service after you are notified of these changes.
10. Disputes
The Privacy Policy is governed by legislation of Republic of Estonia. Any disputes in connection with this Policy shall be settled through negotiations. If the Parties fail to resolve the dispute through negotiation, the disputes shall be settled by Harju Maakohus (Harju County Court), pursuant to the procedure provided by the law of the Republic of Estonia.
11. Illinois Consumer Statement
In the course of providing our Service, Realeyes may collect and process “biometric information” as defined in the Illinois Biometric Information Privacy Act (BIPA). As defined under BIPA, “Biometric identifier” includes a scan of face geometry, but may not include photographs, demographic data, or physical descriptions. In addition, BIPA defines “Biometric information” as any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual.
If and to the extent that Realeyes may collect or otherwise processes Illinois consumers biometric information, Realeyes will:
- Inform users in writing, either through our own Privacy Policy or as contractually required with our enterprise customers, that biometric information may be processed;
- Inform users in writing of the specific purposes and retention periods in which the users biometric information may be processed; and
- Receive express consent authorizing Realeyes or our enterprise customers to process or disclose biometric information for the specific purposes disclosed in the Privacy Policy.
Any biometric information processed by Realeyes related to Illinois consumers is rendered anonymous or otherwise disclosed exclusively in the aggregate. Realeyes does not sell, lease, trade, or profit from Illinois consumers biometric identifiers or biometric information.
12. California Consumer Statement
12.1. Definitions
The terms “Business Purpose(s)”, “Personal Information”, “Sell” (or “Sale”), “Service Provider(s)” and “Third Parties” have the meanings given in the California Consumer Privacy Act of 2018 (CCPA). These term references and disclosures are limited to this section of the Privacy Policy and designated exclusively for California Consumers.
12.2. Categories of Personal Information
Encoded facial emotional identifiers, proprietary useridentifiers, mobile device identifiers, mobile ad IDs (IDFAs for iOS andAndroid Ad IDs), age, gender, timestamps, user agent strings, country codederived from IP addresses, optionally given email addresses.
12.3. Purposes for collection and use of Personal Information
We use Personal Information for the purposes as specified under 2.2 of this Policy above.
12.4. Categories of sources from which Personal Information is collected
Mobile applications in which RealView SDK has been integrated.
12.5. Categories of Personal Information we sell
We do not sell Personal Information.
12.6. Purposes of selling Personal Information
We do not sell Personal Information.
12.7. Categories of Third Parties to whom Personal Information is sold
We do not sell Personal Information.
12.8. Categories of third parties with whom information is shared for a business purpose
Mobile application management services, technology platforms, marketing services, incentive fulfillment services, mobile application analytics.
12.9. California Consumer Rights & Options
You can access or delete your personal data by sending an email to us at privacy@realeyesit.com. Please note we may not accept a request to access or delete your Personal Information where we cannot verify your Personal Information, where we require the Personal Information to comply with legal obligations or in case it is subject to any legal claim.
© 2021 Realeyes Data Services Ltd
