Agentia AI Experience Privacy Notice

Agentia AI Experience Privacy Notice

Effective Date: September 11, 2026

1. Purpose and Scope.

Copado, Inc. ("Copado," "we," "us," or "our") is committed to your privacy. We have created this Agentia AI Experience Privacy Notice ("Notice") to inform you about how we handle personal data collected through the Agentia AI Photo Booth installation at Dreamforce 2026, located at Sentro Filipino, 814 Mission St, San Francisco, CA 94103, September 15–17, 2026.

This Notice applies specifically to personal data collected through this installation and supplements Copado's general Privacy Policy at www.copado.com/legal/privacy. In the event of any conflict between this Notice and the general Privacy Policy in respect of data collected through this installation, this Notice prevails.

We refer to personal data and information in this Notice as "personal data." Copado, Inc. is the data controller for all personal data collected through this installation.

For data protection inquiries, please contact privacy@copado.com.

For general information about how Copado handles personal data across its products and services, please see our Privacy Policy at www.copado.com/legal/privacy.

2. Who Is Responsible for Your Personal Data.

Copado, Inc. is responsible for your personal data collected through this installation. Copado determines how and why your data is collected and used and is your point of contact for any privacy questions or requests. Yord s.r.o., our technology partner, handles your data on Copado's behalf and under Copado's instructions.

3. Categories of Personal Data That We Collect.

We may collect, store, and use personal data in the following categories in connection with this installation:

• Continuous video of you during your session, including your face, body, movement, clothing, and surroundings.
• Individual still frames captured during your session.
• Your AI-generated photos and videos (Output).
• Your email address, if you choose to provide it to receive your generated content or to sign up for marketing communications.
• Technical metadata including session ID, timestamp, and device identifiers.

4. How We Collect Personal Data.

Personal data is collected directly from you at the installation when you choose to participate in the Agentia AI experience. Participation is voluntary. You must provide your consent before any data is collected or transmitted.

5. How We Process Your Video — The Masking Safeguard.

Before any video is transmitted to any external service, our technology partner Yord s.r.o. applies a digital face masking process using MediaPipe BlazeFace, a pre-trained face detection model running entirely on Yord's own hardware at the booth. This process replaces your face with one of the Agentia character masks before any data leaves the booth equipment.

Please note that face detection technology is not 100% reliable. In rare edge cases, an unmasked frame may be transmitted to Decart.ai, Inc. By participating you acknowledge and accept this inherent limitation of the technology.

As an alternative, physical paper masks of the Agentia characters are available at the booth. If you prefer, you may wear a paper mask throughout the experience, in which case no face data of any kind will be transmitted to Decart.

6. How We Use and Share Personal Data.

Copado uses and shares personal data collected through this installation for the following purposes:

• To generate and deliver your personalized AI-generated content.
• To display selected content on screens at the venue and at Copado offices during the event, where you have consented to this use.
• For marketing, promotions, advertising, and other communications, where you have separately consented to marketing use.
• To send you marketing communications by email, where you have separately opted into email marketing.
• To interact with third-party service providers that support the operation of the installation, including Yord s.r.o., Decart.ai, Inc., Google LLC, and Amazon Web Services, Inc.
• To maintain audit records and comply with our legal obligations.

For those purposes, we share personal data with the following categories of third parties:

• Yord s.r.o. (Technology Partner): Yord operates the AI Photo Booth installation on Copado's behalf and acts as a data processor under Copado's instructions.
• Decart.ai, Inc. (AI Vendor — Video Transformation): Decart receives the masked video stream for real-time generative transformation.
• Google LLC (AI Vendor — Image Generation): Google receives your still images for generative image processing via the Gemini 3.1 Flash model accessed through the paid tier of the Gemini API. Google does not use your images to train, fine-tune, or improve its models under the Gemini API Additional Terms of Service applicable to paid services. Google processes data in the United States.‍
• Cloudflare, Inc. and Render Services, Inc. (Hosting): Cloudflare provides object storage for your generated photos and videos. Render hosts the application backend and database. Both are located in the United States, West US region. Neither provider uses your data for model training or generative AI processing.
• Copado Personnel and Designees: Copado's employees, contractors, and event agency may access the content hub dashboard to review and select sessions for display on screens at the venue and at Copado offices. Access is limited to content review and selection with no raw data export capability. Sessions where you have not consented to marketing use are flagged and cannot be selected for broadcast or marketing purposes.

Copado does not sell or share personal data for monetary or other consideration, nor does Copado share data for cross-context behavioral advertising.

No Training on Participant Data: Yord s.r.o. and Google LLC do not use your personal data, video, images, or generated content to train their AI models. The primary protection against your data being used by Decart is the face masking safeguard described in Section 5, which means Decart ordinarily receives only masked video in which your face has been replaced with a mascot face.

7. Marketing Use of Your Generated Content.

Marketing use of your generated content is entirely optional. You can participate in the experience without agreeing to marketing use.

If you consent to marketing use in Step 2 of the consent flow, Copado may use your AI-generated photos and videos for the following purposes:

• Display on screens at the Dreamforce venue and at Copado offices
• Publication on Copado's social media channels (LinkedIn, Instagram, X, Facebook, YouTube)
• Copado's website
• Paid digital advertising
• Press and media distribution
• Printed marketing collateral

Duration: Copado may use your content for the marketing purposes described above for a period of two (2) years from the date of this event. After that period, Copado will not make new uses of your content. Content that was published, broadcast, or distributed during that period does not need to be removed when the period expires.

Right of publicity: By consenting to marketing use, you grant Copado a two-year license to use your name, likeness, image, and AI-generated content for the marketing purposes described above, across all channels and territories worldwide. This release is intended to satisfy the requirements of California Civil Code Section 3344 and any other applicable right-of-publicity or likeness law.

The consent you provide in Step 2 of the consent flow at the installation constitutes the written release required under California Civil Code Section 3344 and any other applicable right-of-publicity or likeness law. By checking the OPT IN box in Step 2, you confirm that you are the person whose likeness appears in the generated content and that you have the legal capacity to grant this release.

Withdrawal: You may withdraw your marketing consent at any time by contacting privacy@copado.com. Copado will stop making new uses of your content from the date your withdrawal is received. Content already published, broadcast, or distributed by third parties cannot be recalled. Withdrawal of marketing consent does not affect your participation consent or your right to receive your own generated content.

8. Email Marketing.

Email marketing is entirely optional and separate from the delivery of your generated content.

If you opt into email marketing in Step 3 of the consent flow, Copado will use your email address to send you marketing communications including information about our products, services, events, websites, communities, training, and other business offerings approximately 2 to 3 times per month. Your email address will be stored in Copado's CRM systems (Salesforce and Pardot Account Engagement) for this purpose.

Providing your email address to receive your generated content does not automatically sign you up for marketing communications. These are separate and independent consents.

You may unsubscribe at any time by clicking the unsubscribe link in any email we send you or by contacting privacy@copado.com. Opt-out processes may take some time to complete, but we will work to meet your request as quickly as possible.

9. What Is the Legal Basis That Applies to Our Use of Personal Data.

The laws in some jurisdictions require data controllers to tell you about the legal grounds that allow them to use or disclose your personal data. Where those laws apply, our legal grounds are:

• Consent: We collect and process your video, images, and generated content on the basis of your consent, which you provide before the experience begins. You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Legitimate Business Interests: We process technical metadata such as session IDs and timestamps on the basis of our legitimate business interests in operating the installation, enabling deletion on request, and maintaining audit records.
• Legal Compliance: We may use and disclose personal data to comply with our legal obligations.

10. How Long Does Copado Store Personal Data.

We will retain personal data only as long as necessary to fulfill the purposes outlined in this Notice.

‍

11. How Do We Provide Security for Personal Data That We Handle and Store.

Copado takes the security of data seriously and has put in place physical, technical, and administrative safeguards designed to protect your personal data from unauthorized or illegal access, destruction, use, modification, or disclosure in accordance with applicable laws, including:

• No persistent storage of video on kiosk hardware. All capture and processing occurs in memory only.
• Server-side encryption at rest (AES-256) on the content hub media store.
• TLS 1.2 or higher for all data in transit.
• Multi-factor authentication on all administrative accounts with access to participant data.
• Access limited to a named project team with confidentiality obligations.
• Full disk wipe of kiosk hardware at teardown before the hardware leaves the venue.

12. Does the Personal Data Go to Other Countries.

The data collected through this installation is processed primarily in the United States. The content hub is hosted by Cloudflare, Inc. and Render Services, Inc. in the United States, West US region.

Where personal data is transferred from the European Economic Area to the United States or other third countries, Copado relies on Standard Contractual Clauses approved by the European Commission under Commission Implementing Decision (EU) 2021/914. Copies of the applicable Standard Contractual Clauses are available on request by contacting privacy@copado.com.

13. AI-Generated Content Disclosure.

The photos and videos created during this experience are artificially generated using AI technology. They do not represent unaltered recordings of you. This content has been produced using generative artificial intelligence and may depict you in a transformed or stylized form that does not reflect reality.

The AI generation process used in this installation involves automated processing of your video and images to produce transformed content. This processing does not involve automated decision-making that produces legal or similarly significant effects on you. The generated content is produced for entertainment and marketing purposes only.

In accordance with applicable AI transparency and synthetic media disclosure laws, including those enacted in California and Illinois, Copado discloses that the content produced through this installation is artificially generated using generative AI technology. The content has not been verified for accuracy and does not represent an unaltered recording of any person. Copado makes no representation about the accuracy or completeness of AI-generated content.

14. Age Restriction and Children's Privacy.

This installation is restricted to persons aged 18 and over. Participants must confirm they are at least 18 years of age before the experience begins. Copado Personnel are present throughout operating hours to enforce this restriction. We do not knowingly collect personal data from persons under the age of 18. If you believe a person under the age of 18 has participated in this installation, please promptly contact us at privacy@copado.com.

15. Bystander Capture.

This installation records video continuously while in use. At a public event, persons who are not active participants may be captured incidentally in the camera frame. Copado has implemented physical barriers and a backdrop behind the installation to minimize incidental capture. If you believe you have been captured incidentally and wish to request deletion of any data relating to you, please contact privacy@copado.com.

16. Your Rights Under Data Privacy Laws.

The California Privacy Rights Act of 2020 ("CPRA"), the Illinois Biometric Information Privacy Act ("BIPA"), the GDPR, and other data privacy laws may provide additional rights to residents of applicable jurisdictions regarding information collection and use practices.

• Right to Know. You have the right to know certain details about our data practices, including the categories of personal information we have collected about you, the sources from which it was collected, the purposes for which it is used, and the categories of third parties with whom it is shared.
• Right to Access. You have the right to review or obtain a copy of the specific personal information we have collected about you in a portable and usable format.
• Right to Delete. You may request deletion of your session and personal data at any time by contacting privacy@copado.com. We will action your request within five (5) business days of receiving sufficient identifying information. Please note that your right to deletion is subject to certain exceptions under applicable law.
• Right to Correct. You have the right to request that we correct inaccurate personal information that we attribute to you.
• Right to Non-Discrimination. You have the right not to receive discriminatory treatment by us for exercising any of your privacy rights.
• Right to Opt Out. You have the right to opt out of the sharing and processing of personal data for certain purposes, including targeted advertising and the sale of personal data. Copado does not sell or share personal data for monetary or other consideration, nor does Copado share data for cross-context behavioral advertising.
• Illinois Residents — BIPA Rights. For full details of your BIPA rights and Copado's biometric data retention and destruction policy, please see www.copado.com/legal/bipa-policy.

To exercise any of the rights described above, please submit a request to the relevant contact in Section 18 below. We will confirm receipt of your request within the legally permissible time period. We may require specific information from you to help us verify your identity and process your request. If we decline to act, we will notify you of our justification for denial and provide you with instructions for how to appeal our denial.

17. Changes to This Notice.

In the event of changes in the law, our data handling practices, or for other reasons, Copado reserves the right to update and change this Notice at any time by updating and publishing the revised Notice at www.copado.com/legal/agentia-ai-experience-privacy-notice.

18. How to Contact Us.

If you have any questions or wish to exercise your rights under the GDPR, United States state-specific privacy laws, or other applicable privacy laws, you may send notice by email at privacy@copado.com or if you are in the United States you may call our toll free telephone number: 1(888) 210-4282. You may also send a written notice to us at one of the following addresses:

United States:
Copado, Inc.
Attn: Legal Dept.
200 E Randolph St, Suite 6675
Chicago, IL 60601 United States

European Union:
Copado Netherlands B.V. Attn: Legal Dept.
Barbara Strozzilaan 201, 1083 HN Amsterdam The Netherlands

For general information about how Copado handles personal data, please see our Privacy Policy at www.copado.com/legal/privacy.

For Copado's biometric data retention and destruction policy, please see www.copado.com/legal/bipa-policy.