Privacy Policy

Effective date: September 4, 2026 Last updated: September 4, 2026

PicturePoppy is operated by PeopleStar Enterprises, Inc. ("PeopleStar", "we", "us"). This policy explains what we collect when you use PicturePoppy, why we collect it, who else sees it, how long we keep it, and what you can ask us to do about it. It covers picturepoppy.com, the PicturePoppy apps for iOS and Android, and the public tour pages we host on your behalf.

We wrote this to be read. If anything here is unclear, write to support@picturepoppy.com and we will answer in plain language.

---

1. Who this policy is about

PicturePoppy has two kinds of people in it, and they are treated differently.

Subscribers. Licensed real estate professionals who hold an account, upload photographs and send tours. Most of this policy is about you.

Tour recipients. The clients, buyers and colleagues a subscriber sends a tour link to. You do not need an account and we do not ask you for anything. A subscriber gave us your email address or mobile number so we could deliver what they asked us to send. Section 8 is about you.

2. Who is responsible for your information

For subscriber account data, PeopleStar Enterprises, Inc. is the controller.

For the content of a tour, including the property photographs, the property information and the recipient details a subscriber enters, the subscriber is the controller and PeopleStar is the processor acting on their instructions. If you are a tour recipient and you want a photograph or your contact details removed, the fastest route is the agent who sent it to you. You may also write to us and we will act, and will tell the agent we did.

3. Information you give us

Creating an account. Your first name, last name, mobile number, email address and a password. Your mobile number is your sign-in identity and is where we send a six-digit verification code. Your password is stored only as a salted hash and is never readable by us.

Verifying your license. Your real estate license number and the two-letter state that issued it. PicturePoppy is sold only to licensed real estate professionals. The submission goes to the central Poppy ID record shared by all five Poppy products, a person on our team confirms it, and the product opens when it is confirmed. We keep the license number and state, and the date and outcome of the review.

Signing in with Poppy ID. If you use Poppy ID single sign-on, we receive your Poppy ID identifier, name, email address and the plan you hold. We do not receive your Poppy ID password.

Building a tour. The property address, city, state and ZIP, a tour title, free-text notes about the property, room names, photo captions, and the photographs you upload. Property photographs frequently show the inside of someone's home. Only upload photographs you have the right to use and to share, and do not upload photographs of people who have not agreed to appear in them.

Sharing a tour. The email addresses or mobile numbers of the people you choose to send it to, the subject line and body of the email, and the text of any message.

Paying. Your name, email address and the plan you chose. Card numbers are entered on Stripe's own checkout page, or handled by Apple or Google in the apps. Card details never reach a PicturePoppy server and we never store them. We keep the subscription record: plan, status, trial end date, renewal date and payment history.

Contacting support. Whatever you write to us and how we answered.

4. Information we collect automatically

Server logs. Our web servers record the IP address, the request, the time, the browser or app version, and the response, the way every web server does. We use these to keep the service running, to diagnose faults, to detect abuse and to enforce rate limits. We keep them for a short period, ordinarily 30 days, after which they are discarded.

Usage counts. We count uploads and sends per account per month. This is how the Account screen shows you where you stand and how plan limits are enforced.

Cookies. We set a session cookie so you stay signed in, a cookie that remembers you if you ask us to, a short-lived cookie that prevents a single-sign-on loop, and a cookie that carries the anti-forgery token that protects forms. These are strictly necessary cookies. We set no advertising cookies and no analytics cookies.

What we do not do. There is no advertising network in PicturePoppy, no analytics SDK, no crash-reporting SDK, no advertising identifier and no device fingerprinting. We do not track you across other companies' apps or websites, and we do not build a profile of you for advertising. Because of that, the iOS app never presents the App Tracking Transparency prompt.

Location. We never ask for your device location. Maps and street view on a tour page are drawn from the address you type.

5. Why we use what we collect

| What we use it for | The information involved | | --- | --- | | Running your account and signing you in | Name, mobile number, email, password hash, user IDs | | Confirming you are a licensed professional | License number and state, name, email | | Building and hosting your tours | Property address and details, photographs, labels, captions, notes | | Labelling rooms and drafting your client messages | The photograph itself, and the property details used in the draft | | Delivering what you send | Recipient email addresses and mobile numbers, subject and body | | Showing property details on a tour page | The property address | | Billing you and honoring your plan | Name, email, subscription and payment records | | Answering support requests | Your messages to us | | Keeping the service secure and preventing abuse | IP addresses, request logs, verification attempts, rate-limit counters | | Telling you about the product | Email address, and only where you have not opted out | | Meeting legal and tax obligations | Billing and invoice records |

We do not sell your personal information. We do not share it for cross-context behavioral advertising. We do not use your photographs, your tours or your client information to advertise to you or to anyone else.

6. Third parties we actually use

These are the only companies that receive personal information from PicturePoppy in the ordinary running of the service. Each is a service provider processing on our behalf under contract, and each is limited to the purpose listed.

| Service | What it receives | Why | Its own policy | | --- | --- | --- | --- | | Stripe, Inc. | Card details, entered directly on Stripe; your name, email and subscription record | Payment processing and subscription billing on the web | stripe.com/privacy | | Apple Inc. and Google LLC | Purchase and subscription events | In-app purchase and subscription management in the apps | apple.com/legal/privacy, policies.google.com/privacy | | Twilio Inc. | Your mobile number and a six-digit code | Sending the SMS verification code at sign-up and password reset | twilio.com/legal/privacy | | Twilio SendGrid | The recipient's email address, the subject and body of a tour email, your name and your reply-to address | Delivering the emails you send | twilio.com/legal/privacy | | OpenAI, L.L.C. | One property photograph at a time for labelling; the property details used to draft an email or text | Generating room labels and drafting your client messages | openai.com/policies | | Google LLC (Maps Platform) | The property address you type | Address autocomplete, the map, and street view on a tour page | policies.google.com/privacy | | ATTOM Data Solutions | The property address | Public property details shown on a tour page | attomdata.com/privacy-policy | | DigitalOcean, LLC | All hosted data, as our infrastructure provider | Hosting the application, the database and the uploaded photographs | digitalocean.com/legal/privacy-policy |

About AI. Room labels and message drafts are generated by OpenAI's API. We use the API under commercial terms under which submitted content is not used to train OpenAI's models. AI output is a suggestion. Labels and drafts are shown to you and are editable, and nothing is sent to a client until you press Send. You remain responsible for what you send.

We do not use data brokers, do not participate in advertising exchanges, and have no affiliate or partner that receives your data for its own purposes.

We may also disclose information where the law requires it, to respond to a lawful request from a public authority, to enforce our terms, to protect the rights or safety of a person, or to a buyer or successor in the event of a merger, acquisition or sale of assets, in which case this policy continues to apply until the buyer gives you notice of a change.

7. Sharing that you control

The whole point of PicturePoppy is that you send a tour to someone. When you do:

• The recipient receives a link to the tour page.
• A tour page is public to anyone who has the link. It is not indexed by search engines and there is no directory of tours, but there is no password on it either, because your client is not asked to create an account. Treat a tour link the way you would treat any link you email: forwardable.
• The tour page shows the property photographs, the property address and details, and your name, email address and phone number as the listing agent. That is deliberate; it is how a client reaches you.

If you do not want a tour reachable at all, delete it. Deleting a tour breaks its link immediately.

8. If you received a tour link

You do not have an account with us and we did not choose to contact you. A subscriber entered your email address or mobile number and asked us to deliver a link.

• We use your address or number to deliver that message and to keep a delivery record. We do not add you to a marketing list and we do not sell your details.
• To be removed, reply to the agent who sent it, or write to support@picturepoppy.com and tell us the address or number to remove. We will remove it and tell the agent we did.
• If a photograph of your home or of you appears in a tour and you want it taken down, write to support@picturepoppy.com. We will remove it.

9. How long we keep things

| What | How long | | --- | --- | | Account record | While your account is open, then deleted or anonymized within 30 days of a deletion request | | Photographs and tours | For as long as your subscription is active | | Tours shared on Signature or Executive | Kept permanently, on purpose. A tour you shared while on Signature or Executive is flagged to be kept, so the link you sent a client keeps working even if you later cancel. That is a promise we sold you. If you want such a tour deleted anyway, delete it yourself or ask us, and the link will stop working. | | Photographs and tours after cancellation | Tours not covered by the promise above become inaccessible when the subscription lapses and are deleted within 90 days of cancellation | | Verification codes | Minutes. They expire and are then discarded | | Server access logs | Ordinarily 30 days | | Usage counts | 24 months | | Billing and invoice records | Seven years, as tax and accounting law requires | | Support correspondence | Three years |

10. Your choices and your rights

In the app, at any time: edit your name and email on the Account page, change your password, delete a photograph, delete a tour, archive a tour so its link keeps working without it counting against your plan, and open the Stripe billing portal to change your card, see invoices or cancel.

Deleting your account. Ask at https://picturepoppy.com/delete-account or write to support@picturepoppy.com from the email address on the account. We delete your account, your tours, your photographs and your usage records within 30 days, except for the records we are required by law to keep and, unless you tell us otherwise, tours covered by the keep-permanently promise in section 9. We will tell you exactly what was kept and why.

Access and correction. Ask us for a copy of what we hold about you, or ask us to correct it, at support@picturepoppy.com.

Marketing email. Every product email has an unsubscribe link. Service messages about your account, your billing and your security are not marketing and cannot be turned off while your account is open.

11. California residents

If you live in California, the California Consumer Privacy Act as amended by the CPRA gives you the following rights. We honor them for every user, in every state.

• The right to know what personal information we collect, why, where it came from, and who we disclose it to. Sections 3 through 6 answer this in full.
• The right to access a copy of your personal information.
• The right to delete your personal information, subject to the exceptions in section 10.
• The right to correct inaccurate personal information.
• The right to opt out of sale or sharing. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of and no "Do Not Sell or Share My Personal Information" link is required. We have not sold or shared personal information in the preceding twelve months, including that of anyone we know to be under 16.
• The right to limit the use of sensitive personal information. We do not collect sensitive personal information as the CCPA defines it.
• The right against retaliation. We will never deny you service, charge you a different price or give you a lesser experience for exercising any of these rights.

Categories collected in the last twelve months, in the statute's own terms: identifiers (name, email, phone, account and Poppy ID identifiers, IP address); commercial information (subscription and purchase records); internet activity (request logs and usage counts); professional information (real estate license number and state); geolocation only in the sense of a property address you type, never your device location; and visual information (the photographs you upload). Each is collected for the business purposes in section 5 and disclosed only to the service providers in section 6.

To exercise a right, write to support@picturepoppy.com or use https://picturepoppy.com/delete-account. We verify you by matching your request to the email address or mobile number on the account, and we respond within 45 days. An authorized agent may act for you with written permission that we can verify.

12. Security

Everything travels over HTTPS with TLS. Passwords are stored as salted hashes. Card details never touch our servers. Access to production systems is limited to the people who need it. Requests are rate limited and abuse is logged.

No system is perfect, and we will not pretend otherwise. If a breach affects your personal information we will notify you and the regulators the law requires us to notify, without unreasonable delay.

13. Children

PicturePoppy is a professional tool for licensed real estate agents. It is not for anyone under 18, we do not knowingly collect information from children, and we have no reason to. If you believe a child has given us information, write to support@picturepoppy.com and we will delete it.

14. Where your information lives

We operate in the United States and store data on servers in the United States. If you use PicturePoppy from outside the United States, you are sending your information to the United States, where privacy law differs from your own.

15. Changes to this policy

If we change this policy in a way that matters, we will update the date at the top and tell subscribers by email before the change takes effect. Continuing to use PicturePoppy after that means you accept the updated policy.

16. How to reach us

PeopleStar Enterprises, Inc. Attention: Privacy, PicturePoppy [MAILING ADDRESS] [CITY, STATE, ZIP] United States

Email: support@picturepoppy.com Web: https://picturepoppy.com

PicturePoppy is a product of PeopleStar Enterprises, Inc.