Agentia AI Experience Privacy Notice

Agentia AI Experience Privacy Notice

Effective Date: October 19, 2026
Installation: Agentia AI Photo Booth at Copado HQ

1. Purpose and Scope.

Copado, Inc. ("Copado," "we," "us," or "our") is committed to your privacy. We have created this Agentia AI Experience Privacy Notice ("Notice") to inform you about how we handle personal data collected through the Agentia AI Photo Booth installation at Copado HQ, located at 400 Poydras Street, Suite 600, New Orleans, LA 70130, whenever the installation is in operation. 

This Notice applies specifically to personal data collected through this installation and supplements Copado's general Privacy Policy at www.copado.com/legal/privacy. In the event of any conflict between this Notice and the general Privacy Policy in respect of data collected through this installation, this Notice prevails.

We refer to personal data and information in this Notice as "personal data." Copado, Inc. is the data controller for all personal data collected through this installation.

Copado has not appointed a Data Protection Officer. For data protection enquiries, please contact privacy@copado.com.

For general information about how Copado handles personal data across its products and services, please see our Privacy Policy at www.copado.com/legal/privacy.

2. Who Is Responsible for Your Personal Data.

Copado, Inc. is responsible for your personal data collected through this installation. Copado determines how and why your data is collected and used and is your point of contact for any privacy questions or requests. Yord s.r.o., our technology partner, handles your data on Copado's behalf and under Copado's instructions.

3. Categories of Personal Data That We Collect.

We may collect, store, and use personal data in the following categories in connection with this installation:

• Continuous video of you during your session, including your face, body, movement, clothing, and surroundings.
• Individual still frames captured during your session.
• Your AI-generated photos and videos (Output).
• Your email address, if you choose to provide it to receive your generated content or to sign up for marketing communications.
• Technical metadata including session ID, timestamp, and device identifiers.

4. How We Collect Personal Data.

Personal data is collected directly from you at the installation when you choose to participate in the Agentia AI experience. Participation is voluntary. You must provide your consent before any data is collected or transmitted.

5. How We Process Your Video — The Masking Safeguard.

Before any video is transmitted to any external service, our technology partner Yord s.r.o. applies a digital face masking process using MediaPipe BlazeFace, a pre-trained face detection model running entirely on Yord's own hardware at the booth. This process replaces your face with one of the Agentia character masks before any data leaves the booth equipment.

For the purposes of the Illinois Biometric Information Privacy Act, the specific purpose for which biometric data is collected through this installation is to apply a digital face mask to your video before transmission to third-party AI vendors for generative processing. No biometric identifier is extracted, stored, or transmitted by Yord's system as part of this process.

• Your identifiable face is not ordinarily transmitted to any external service.
• The masking process runs entirely on equipment at the booth. No face data is transmitted externally as part of the masking process itself.
• The masked video stream is then transmitted to Decart.ai, Inc. for real-time video transformation.
• Your still images are transmitted to Google LLC for image generation. Still images are not transmitted to Decart.

Please note that face detection technology is not 100% reliable. In rare edge cases, an unmasked frame may be transmitted to Decart.ai, Inc. By participating you acknowledge and accept this inherent limitation of the technology.

As an alternative, physical paper masks of the Agentia characters are available at the booth. If you prefer, you may wear a paper mask throughout the experience, in which case no face data of any kind will be transmitted to Decart.

6. How We Use and Share Personal Data.

Copado uses and shares personal data collected through this installation for the following purposes:

• To generate and deliver your personalized AI-generated content.
• To display selected content on screens at the venue and at Copado offices during the event, where you have consented to this use.
• For marketing, promotions, advertising, and other communications, where you have separately consented to marketing use.
• To send you marketing communications by email, where you have separately opted into email marketing.
• To interact with third-party service providers that support the operation of the installation, including Yord s.r.o., Decart.ai, Inc., Google LLC, and Amazon Web Services, Inc.
• To maintain audit records and comply with our legal obligations.

For those purposes, we share personal data with the following categories of third parties:

• Yord s.r.o. (Technology Partner): Yord operates the AI Photo Booth installation on Copado's behalf and acts as a data processor under Copado's instructions. Yord's project team in the Czech Republic may access the administrative dashboard and server logs for technical support and incident response. This access is protected by multi-factor authentication and is limited to a named project team.
• Decart.ai, Inc. (AI Vendor — Video Transformation): Decart receives the masked video stream for real-time generative transformation. Decart does not receive your still images. Decart does not use your data to train, fine-tune, or improve its AI models under the terms applicable to this deployment. Decart processes data primarily in the United States but may use infrastructure located outside the United States.
• Google LLC (AI Vendor — Image Generation): Google receives your still images for generative image processing via the Gemini 2.5 Flash Image model deployed through Vertex AI on a paid Google Cloud Platform project. Google does not use your images to train, fine-tune, or improve its models under Section 17 of the applicable Google Cloud Platform Terms of Service. Google processes data in the United States.
• Amazon Web Services, Inc. (Hosting): AWS hosts the content hub where your generated photos and videos are stored. AWS processes data in a United States region. AWS does not use your data for model training.
• Copado Personnel and Designees: Copado's employees, contractors, and event agency may access the content hub dashboard to review and select sessions for display on screens at the venue and at Copado offices. Access is limited to content review and selection with no raw data export capability. Sessions where you have not consented to marketing use are flagged and cannot be selected for broadcast or marketing purposes.
• The General Public: Where you consent to Marketing Use, your generated content may be published on Copado's social media channels, website, and other marketing materials, making it accessible to the general public.

Copado does not sell or share personal data for monetary or other consideration, nor does Copado share data for cross-context behavioral advertising.

No Training on Participant Data: Neither Copado nor its third-party AI providers use your personal data, video, images, or generated content to train their AI models under the terms applicable to this deployment.

7. Marketing Use of Your Generated Content.

Marketing use of your generated content is entirely optional. You can participate in the experience without agreeing to marketing use.

If you consent to marketing use in Step 2 of the consent flow, Copado may use your AI-generated photos and videos for the following purposes:

• Display on screens at the Copado HQ and at other Copado offices
• Publication on Copado's social media channels (LinkedIn, Instagram, X, Facebook, YouTube)
• Copado's website
• Paid digital advertising
• Press and media distribution
• Printed marketing collateral

Duration: Copado may use your content for the marketing purposes described above for a period of two (2) years from the date of this event. After that period, Copado will not make new uses of your content. Content that was published, broadcast, or distributed during that period does not need to be removed when the period expires.

Right of publicity: By consenting to marketing use, you grant Copado a two-year license to use your name, likeness, image, and AI-generated content for the marketing purposes described above, across all channels and territories worldwide, to the fullest extent permitted by law. This release is intended to satisfy the requirements of all applicable right-of-publicity, right-of-privacy, and likeness laws.

The consent you provide in Step 2 of the consent flow at the installation constitutes the written release required under those laws. By checking the OPT IN box in Step 2, you confirm that you are the person whose likeness appears in the generated content and that you have the legal capacity to grant this release.

Withdrawal: You may withdraw your marketing consent at any time by contacting privacy@copado.com. Copado will stop making new uses of your content from the date your withdrawal is received. Content already published, broadcast, or distributed by third parties cannot be recalled. Withdrawal of marketing consent does not affect your participation consent or your right to receive your own generated content.

8. Email Marketing.

Email marketing is entirely optional and separate from the delivery of your generated content.

If you opt into email marketing in Step 3 of the consent flow, Copado will use your email address to send you marketing communications including information about our products, services, events, websites, communities, training, and other business offerings approximately 2 to 3 times per month. Your email address will be stored in Copado's CRM systems (Salesforce and Pardot Account Engagement) for this purpose.

Providing your email address to receive your generated content does not automatically sign you up for marketing communications. These are separate and independent consents.

You may unsubscribe at any time by clicking the unsubscribe link in any email we send you or by contacting privacy@copado.com. Opt-out processes may take some time to complete, but we will work to meet your request as quickly as possible.

Every marketing email we send will include Copado's valid physical postal address and a clear and conspicuous unsubscribe mechanism in compliance with the CAN-SPAM Act.

9. What Is the Legal Basis That Applies to Our Use of Personal Data.

The laws in some jurisdictions require data controllers to tell you about the legal grounds that allow them to use or disclose your personal data. Where those laws apply, our legal grounds are:

• Consent: We collect and process your video, images, and generated content on the basis of your consent, which you provide before the experience begins. You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Legitimate Business Interests: We process technical metadata such as session IDs and timestamps on the basis of our legitimate business interests in operating the installation, enabling deletion on request, and maintaining audit records.
• Legal Compliance: We may use and disclose personal data to comply with our legal obligations.

10. How Long Does Copado Store Personal Data.

We will retain personal data only as long as necessary to fulfill the purposes outlined in this Notice.

‍

11. How Do We Provide Security for Personal Data That We Handle and Store.

Copado takes the security of data seriously and has put in place physical, technical, and administrative safeguards designed to protect your personal data from unauthorized or illegal access, destruction, use, modification, or disclosure in accordance with applicable laws, including:

• No persistent storage of video on kiosk hardware. All capture and processing occurs in memory only.
• Server-side encryption at rest (AES-256) on the content hub media store.
• TLS 1.2 or higher for all data in transit.
• Multi-factor authentication on all administrative accounts with access to participant data.
• Access limited to a named project team with confidentiality obligations.
• Kiosk reset after every session, and full disk wipe of kiosk hardware at teardown before the hardware leaves the premises.

12. Does the Personal Data Go to Other Countries.

The data collected through this installation is processed primarily in the United States. Yord's project team in the Czech Republic, which is within the European Economic Area, may access the administrative dashboard and server logs for technical support. To the extent this access constitutes a transfer of personal data under GDPR Chapter V, the parties have put in place appropriate safeguards including Standard Contractual Clauses.

Decart.ai, Inc. may process data on infrastructure located outside the United States. Copado has acknowledged this as an inherent characteristic of the services.

Where personal data is transferred from the European Economic Area to the United States or other third countries, Copado relies on Standard Contractual Clauses approved by the European Commission under Commission Implementing Decision (EU) 2021/914. Copies of the applicable Standard Contractual Clauses are available on request by contacting privacy@copado.com. 

13. AI-Generated Content Disclosure.

The photos and videos created during this experience are artificially generated using AI technology. They do not represent unaltered recordings of you. This content has been produced using generative artificial intelligence and may depict you in a transformed or stylized form that does not reflect reality.

The AI generation process used in this installation involves automated processing of your video and images to produce transformed content. This processing does not involve automated decision-making that produces legal or similarly significant effects on you. The generated content is produced for entertainment and marketing purposes only.

In accordance with applicable AI transparency and synthetic media disclosure laws, including those enacted in California and Illinois, Copado discloses that the content produced through this installation is artificially generated using generative AI technology. The content has not been verified for accuracy and does not represent an unaltered recording of any person. Copado makes no representation about the accuracy or completeness of AI-generated content.

14. Age Restriction and Children's Privacy.

This installation is restricted to persons aged 18 and over. Participants must confirm they are at least 18 years of age before the experience begins. Copado Personnel are present throughout operating hours to enforce this restriction. We do not knowingly collect personal data from persons under the age of 18. If you believe a person under the age of 18 has participated in this installation, please promptly contact us at privacy@copado.com.  

15. Bystander Capture.

This installation records video continuously while in use. The installation is located at Copado HQ and persons who are not active participants may be captured incidentally in the camera frame. Copado has implemented physical barriers and a backdrop behind the installation to minimize incidental capture. If you believe you have been captured incidentally and wish to request deletion of any data relating to you, please contact  privacy@copado.com.

16. Your Rights Under Data Privacy Laws.

The California Privacy Rights Act of 2020 ("CPRA"), the Illinois Biometric Information Privacy Act ("BIPA"), the GDPR, and other data privacy laws may provide additional rights to residents of applicable jurisdictions regarding information collection and use practices.

• Right to Know. You have the right to know certain details about our data practices, including the categories of personal information we have collected about you, the sources from which it was collected, the purposes for which it is used, and the categories of third parties with whom it is shared.
• Right to Access. You have the right to review or obtain a copy of the specific personal information we have collected about you in a portable and usable format.
• Right to Delete. You may request deletion of your session and personal data at any time by contacting privacy@copado.com. We will action your request within five (5) business days of receiving sufficient identifying information. Please note that your right to deletion is subject to certain exceptions under applicable law.
• Right to Correct. You have the right to request that we correct inaccurate personal information that we attribute to you.
• Right to Non-Discrimination. You have the right not to receive discriminatory treatment by us for exercising any of your privacy rights.
• Right to Opt Out. You have the right to opt out of the sharing and processing of personal data for certain purposes, including targeted advertising and the sale of personal data. Copado does not sell or share personal data for monetary or other consideration, nor does Copado share data for cross-context behavioral advertising.
• Illinois Residents — BIPA Rights. If you are an Illinois resident, you have rights under BIPA including the right to be informed before biometric data is collected, the right to a written release before collection, and the right to deletion. The length of term for which biometric data is collected, stored, and used in connection with this installation is set out in Section 10 of this Notice and in Copado's Biometric Data Retention and Destruction Policy at www.copado.com/legal/bipa-policy. In no event will biometric data be retained beyond the earlier of the date on which the purpose for collection has been satisfied or three years from your last interaction with Copado's systems. For full details of your BIPA rights and Copado's biometric data retention and destruction policy, please see www.copado.com/legal/bipa-policy.
• California Residents — Right to Limit Use of Sensitive Personal Information. Under the California Privacy Rights Act, biometric data and certain other categories of data collected through this installation may constitute sensitive personal information. You have the right to direct Copado to limit its use of your sensitive personal information to what is necessary to provide the experience you have requested. To exercise this right, please contact privacy@copado.com.
• EEA and UK Residents — GDPR Rights. If you are located in the European Economic Area or the United Kingdom, you have additional rights under the GDPR or UK GDPR including the right of access, rectification, erasure, restriction of processing, data portability, and the right to object. You have the right to lodge a complaint with your local data protection supervisory authority. If you are located in the European Union, you may contact the supervisory authority in your member state. A list of EU supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en. If you are located in the United Kingdom, you may contact the Information Commissioner's Office at https://ico.org.uk.

To exercise any of the rights described above, please submit a request to the relevant contact in Section 18 below. We will confirm receipt of your request within the legally permissible time period. We may require specific information from you to help us verify your identity and process your request. If we decline to act, we will notify you of our justification for denial and provide you with instructions for how to appeal our denial.

17. Changes to This Notice.

In the event of changes in the law, our data handling practices, or for other reasons, Copado reserves the right to update and change this Notice at any time by updating and publishing the revised Notice at www.copado.com/legal/agentia-ai-experience-privacy-notice.

18. How to Contact Us.

If you have any questions or wish to exercise your rights under the GDPR, United States state-specific privacy laws, or other applicable privacy laws, you may send notice by email at privacy@copado.com or if you are in the United States you may call our toll free telephone number: 1(888) 210-4282. You may also send a written notice to us at one of the following addresses: 

United States:
Copado, Inc.
Attn: Legal Dept.
200 E Randolph St, Suite 6675
Chicago, IL 60601 United States

European Union:
Copado Netherlands B.V.
Attn: Legal Dept.
Barbara Strozzilaan 201, 1083 HN Amsterdam
The Netherlands

For general information about how Copado handles personal data, please see our Privacy Policy at www.copado.com/legal/privacy.

For Copado's biometric data retention and destruction policy, please see www.copado.com/legal/bipa-policy.

Previous notice: Agentia AI Experience Privacy Notice (Dreamforce – September 2026) [PDF]