— LEGAL

Privacy Policy

EFFECTIVE DATE — APRIL 9, 2026

Passion Collective LLC, doing business as Concept

This Privacy Policy describes how Passion Collective LLC, doing business as Concept (“Concept,” “we,” “us,” or “our”), collects, uses, stores, shares, and protects your personal information when you use the Concept platform at conceptstudio.app and any related mobile applications (collectively, the “Service”).

We believe in being straightforward about data. This policy is written in plain language so you can understand exactly what happens with your information. If anything is unclear, contact us at app@conceptstudio.app.

1.1 Information You Provide Directly

• Account Information: When you create an account, we collect your phone number (required for verification) and your first name. You may optionally provide your last name, email address, profile picture, bio, location, Instagram handle, portfolio URL, and creative field or skills.
• Profile Information: Information you add to your creator profile, including your bio, skills, location, social links, and portfolio items. Your creator profile is publicly accessible by default.
• Project Content: Content you create within projects, including titles, descriptions, dates, role information, notes, checklists, and media files (images, video, audio, and documents) you upload.
• Messages: Text content and attachments you send through the Service’s direct messaging feature.
• Contact Information: Contact details you add to your studio phonebook, which may include names, phone numbers, email addresses, social links, and notes about other individuals.
• Payment Information: If you subscribe to a paid plan, your payment information is collected and processed directly by our payment processor. We never receive, access, or store your credit card number or full payment details. We receive only your subscription status, plan type, and billing cycle information.

1.2 Information Collected Automatically

• Activity Data: We log actions you take on the platform, such as creating projects, joining teams, sending messages, and updating your profile. This data is used to provide features like activity feeds and notifications.
• Device Information: If you enable push notifications, we collect a device token to deliver notifications to your device.
• Log Data: Our servers automatically record information about requests made to the Service, including request type, timestamps, and general diagnostic information. Log files are retained for one to two days and then automatically deleted.

1.3 Information We Do Not Collect

We want to be clear about what we do not do:

• We do not use analytics or tracking cookies. The only cookies we use are strictly functional — authentication tokens and security tokens required to operate the Service.
• We do not track you across other websites.
• We do not collect biometric data.
• We do not sell advertising or share your data with advertisers.
• We do not build behavioral profiles for advertising purposes.

We use your information for the following purposes:

• Providing the Service: To create and maintain your account, operate studio workspaces, deliver messages, manage projects, host your portfolio, and provide all core platform functionality.
• Communications: To send you transactional SMS messages, push notifications, and emails related to your account activity and project participation. See Section 5 for details.
• Authentication and Security: To verify your identity, protect your account, detect and prevent fraud, and maintain the security of the Service.
• Platform Features: To provide features such as activity feeds, contact organization, project coordination, and team management.
• Automated Organization: We may use automated tools to organize, categorize, index, and surface your content within the platform for your benefit — for example, suggesting tags, improving search results for your own work, or helping organize your phonebook and portfolio.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes, and to respond to lawful requests from authorities.
• Service Improvement and Model Training: To understand how the Service is used, diagnose technical issues, and improve platform functionality. We use aggregated and de-identified data for this purpose. We may also use your creative content (portfolio items, media files, and project uploads) and de-identified behavioral data — such as interaction patterns, connection activity, and feature usage — to train and improve internal models that enhance platform functionality, including connection recommendations, project matching, and design personalization. This use is limited to improving your experience on the Service. We do not use your creative content to generate new content, and we will never sell, license, or share your creative content or behavioral data with any third party for their training purposes or any other independent use.

We do not sell your personal information. We share your information only in the following circumstances:

3.1 With Other Users

• Your public profile information (name, username, bio, skills, portfolio, and profile picture) is visible to other users and may be visible to anyone on the internet, including via search engine indexing.
• When you participate in a project or join a team, your profile information is visible to other project participants and studio members.
• Messages you send are visible to the recipients of those messages.
• Project content you create is visible to project members and, if designated as public, to anyone with the share link.

3.2 With Service Providers

We share information with third-party service providers who help us operate the Service. These providers are contractually obligated to use your information only for the purposes of providing services to us and are prohibited from using it for their own purposes. Categories of service providers we work with include:

• Authentication and identity verification providers, who process phone numbers and verification credentials to confirm your identity
• Payment processors, who handle subscription billing entirely on our behalf — we never receive or store your payment card details
• Cloud storage providers, who store media files and user-uploaded content on our behalf
• Notification delivery providers, who deliver SMS messages and push notifications to your devices
• Error monitoring providers, who receive anonymized diagnostic data (never names, phone numbers, or emails) to help us identify technical issues
• Email delivery providers, who send transactional emails on our behalf

All providers are located in the United States. If you would like a current list of specific vendors, contact us at app@conceptstudio.app.

3.3 For Legal Reasons

We may disclose your information if we believe in good faith that disclosure is necessary to comply with applicable law, regulation, legal process, or governmental request; enforce our Terms of Service; protect the safety, rights, or property of Concept, our users, or the public; or detect, prevent, or address fraud, security, or technical issues. We review all legal requests for validity before complying.

3.4 Business Transfers

If Concept or Passion Collective LLC is involved in a merger, acquisition, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will notify you via the Service or email of any change in ownership or uses of your personal information.

4.1 Where Your Data Is Stored

All data is stored and processed in the United States. Our application servers, databases, and file storage are hosted in AWS data centers in the US East (Virginia) region.

4.2 Security Measures

We implement reasonable technical and organizational measures to protect your personal information, including:

• Encryption in transit using HTTPS/TLS for all data transmitted between your device and our servers, with HSTS enforced
• Secure authentication using time-limited tokens with HttpOnly and Secure cookie flags
• Phone verification hashed during the signup process
• Role-based access controls within studio workspaces
• Time-limited, signed URLs for all media file access
• CSRF protection on all state-changing requests
• PII excluded from error tracking

4.3 What We Cannot Guarantee

No method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials.

4.4 Messaging and Encryption

Direct messages sent through the Service are stored on our servers and are not end-to-end encrypted. This means we have the technical ability to access message content. We access message content only as necessary to provide the Service, enforce our Terms, or comply with legal obligations.

5.1 SMS Messages

By creating an account, you consent to receive SMS messages from Concept at the phone number you provide. Your consent is captured at the phone verification step during account registration. SMS messages are sent via our SMS provider from our toll-free number +1 (888) 652-3252 (this number may change or expand in the future). Messages include account verification codes, project updates, team notifications, schedule changes, and other Service-related communications.

Message frequency varies based on your platform activity and project participation. Message and data rates may apply depending on your carrier and plan. All SMS communications are transactional in nature and directly related to your use of the Service. You may reply HELP to any SMS message from us to receive support contact information.

5.2 SMS Blasts

Studio owners and administrators may send project-related SMS messages (“SMS Blasts”) to confirmed project participants. These messages relate to projects you have confirmed participation in. Your consent to receive SMS Blasts is established at the time you confirm participation in a project.

5.3 Opting Out

You may opt out of SMS messages at any time by:

• Replying STOP to any SMS message from us;
• Adjusting your notification preferences within the Service; or
• Contacting us at app@conceptstudio.app.

You may resume SMS messages by replying START or re-enabling SMS in your settings. Please note that opting out of SMS may limit certain platform functionality, as SMS is a core communication channel of the Service. Opting out does not affect account verification messages required for security purposes.

5.4 Push Notifications

If you grant permission through your device’s operating system, we send push notifications via our notification delivery provider. You can disable push notifications through your device settings at any time.

5.5 Email

We send transactional emails to the email address associated with your account, if provided. These include team invitations and Service-related notices. We do not send marketing or promotional emails.

We retain your information for as long as your account is active and as needed to provide the Service. Here is how we handle different types of data:

6.1 Account Data

Your account information is retained until you delete your account. Upon account deletion, your personally identifiable information — including your name, phone number, email address, profile information, and profile picture — is permanently deleted from our active systems.

Certain de-identified data derived from your account activity (such as anonymized interaction patterns, content engagement, and platform usage records) may be retained for internal purposes including platform improvement and model training. Before retention, this data is stripped of all direct identifiers and cannot reasonably be used to identify you. De-identified data is retained for no more than three (3) years following account deletion, after which it is permanently deleted.

6.2 User Content

When you delete content (projects, media files, messages), the content is removed from active use. Deleted content is permanently removed from our storage systems within forty-five (45) days of deletion. During this period, deleted content is not accessible through the Service.

6.3 Messages

When you delete a message, it is removed from your view immediately. The message content is permanently deleted from our systems within forty-five (45) days. Messages you have sent may remain visible to the recipients until they also delete them.

6.4 Activity Logs

We retain activity logs related to your use of the platform for service operation, security, and abuse prevention purposes. If you delete your account, your identifying information is removed from activity logs. Anonymized records of platform activity — stripped of all personal identifiers — may be retained as described in Section 6.1.

6.5 Server Logs

Technical server logs are automatically deleted after one to two days through log rotation.

6.6 Payment Data

Payment webhook event records are retained for ninety (90) days and then permanently deleted. Your subscription history and billing metadata are retained for as long as your account is active and for a reasonable period thereafter for accounting and legal purposes.

Depending on where you live, you may have certain rights regarding your personal information:

7.1 Access and Portability

You can access your profile information, project data, contacts, and messages through the Service at any time. If you need a copy of your data in a portable format, contact us at app@conceptstudio.app and we will provide it within a reasonable timeframe.

7.2 Correction

You can update or correct your personal information at any time through your account settings and profile editor.

7.3 Deletion

You can delete your account at any time. Upon deletion, we permanently remove your personally identifiable information from our active systems and delete your uploaded content from our storage systems within forty-five (45) days. De-identified data may be retained as described in Section 6.1.

7.4 SMS Opt-Out

You can opt out of SMS communications as described in Section 5.3.

7.5 Push Notification Control

You can control push notifications through your device’s operating system settings.

7.6 Do Not Track

We do not track you across third-party websites. Because we do not engage in cross-site tracking, we do not respond to Do Not Track (DNT) browser signals.

7.7 State Privacy Rights

If you are a resident of California, Virginia, Colorado, Connecticut, Texas, or another state with applicable privacy legislation, you may have additional rights under those laws, including the right to know what personal information we collect about you, the right to delete your personal information, the right to correct inaccurate personal information, and the right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising. We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

To exercise any rights available to you under applicable law, contact us at app@conceptstudio.app. We will respond to verified requests within forty-five (45) days as required by applicable law. We will not discriminate against you for exercising your privacy rights.

The Service allows you to store contact information about other individuals in your studio phonebook. We want to be transparent about how this data is handled:

• Contact data you add to your phonebook is stored in your studio workspace and is visible to studio owners and administrators.
• If a contact’s phone number matches a registered user, their phonebook entry may be linked to that user’s public profile.
• When you confirm participation in a project, the public profile information of other confirmed participants may be added to your phonebook, and your public profile may be added to theirs. This is a core platform feature that facilitates professional networking. All information shared through this mechanism is already publicly available on the platform.
• When you delete your account, your profile is removed from all user-facing surfaces immediately, including other users’ phonebooks. Contact data you added about others is also removed from your studio workspace upon account deletion.
• You are responsible for ensuring you have the right to store any contact information you add to the Service. Concept is not responsible for contact data provided by users.

If you are not a user of Concept and believe your contact information has been stored on the platform without your consent, please contact us at app@conceptstudio.app and we will promptly address your request.

The following information is publicly accessible on the Service:

• Your creator profile (name, username, bio, creative field, skills, profile picture, and social links).
• Your portfolio, if you have published portfolio items.
• Project content that has been designated as public by the project owner.

Content shared via public links is accessible to anyone with the link, including individuals who are not registered users of the Service. Public links do not expose any private account data — only content you explicitly designated as publicly shareable is accessible via public links.

Public profiles are indexed by search engines by default. There is no opt-out from search engine indexing available for public profiles. If you do not want certain information to be public, do not include it in your profile or public project sections. There are no private accounts on Concept — the platform is designed for creative professionals to showcase their work and connect with collaborators.

We use only strictly functional cookies required to operate the Service:

• Authentication Token: A secure, HttpOnly cookie that maintains your login session (expires after 30 minutes, with a refresh mechanism for extended sessions).
• Security Token: A CSRF protection token that prevents unauthorized requests.

We do not use analytics cookies, advertising cookies, tracking pixels, or any third-party cookies. We do not use cookies to build behavioral profiles or track you across websites.

The Service is not directed to individuals under the age of eighteen (18). We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take immediate steps to delete that information and terminate the associated account. If you believe a child under 18 has provided us with personal information, please contact us at app@conceptstudio.app.

Concept is operated from the United States and is intended for users located in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

We do not specifically direct the Service to users in the European Economic Area or United Kingdom. If you are located in those regions and choose to use the Service, you do so understanding that your data will be processed in the United States. For questions about cross-border data transfers, contact us at app@conceptstudio.app.

In the event of a data breach that compromises your personal information, we will notify affected users without unreasonable delay and in accordance with applicable law. Notification will be provided through the Service, via SMS or email to the contact information associated with your account, or through other appropriate means.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. If we make material changes, we will notify you through the Service or via the contact information associated with your account before the changes take effect. Your continued use of the Service after changes become effective constitutes your acceptance of the updated Privacy Policy.

We encourage you to review this Privacy Policy periodically. The effective date at the top of this document indicates when it was last updated.

If you have questions about this Privacy Policy, want to exercise your privacy rights, or have concerns about how your data is handled, please contact us:

We aim to respond to all privacy-related inquiries within thirty (30) days.