Privacy Policy

Effective: 10/13/2026

Introduction

The DAM Software Company, Inc. ("Mediagraph," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share information about you in connection with our websites mediagraph.io and tandemvault.com, including all subdomains and subdirectories (the "Sites"), and our digital asset management services (together with the Sites, the "Services").

We use the terms "user," "you," and "your" to mean any person using our Services, including any person using the Services on behalf of a company or organization.

The two roles we play

This Privacy Policy covers two different relationships, and your rights depend on which one applies to you.

• When we act on our own behalf. When you visit our Sites, contact us, request a demo, subscribe to our newsletter, or administer an account with us, we decide how and why your information is used. Under the European Union and United Kingdom General Data Protection Regulation ("GDPR") we are a controller for this information, and this Privacy Policy governs it.
• When we act on behalf of our customers. Our customers use Mediagraph and Tandem Vault to store and manage their own files, metadata, and user lists ("Customer Content"). We process Customer Content only on our customer's documented instructions, including instructions inherent in the customer's configuration and use of the Services. Under GDPR we are a processor for Customer Content, and under United States state privacy laws we act as a service provider or processor. Our customer's own privacy policy – not this one – governs that information, and our handling of it is set out in our Data Processing Agreement.

If you are an end user of a Mediagraph or Tandem Vault library operated by an organization and you want to exercise rights over Customer Content, please contact that organization directly. If you contact us instead, we will refer your request to them, as our agreement with them requires.

By using our Services, you agree to this Privacy Policy and our Terms of Service. If you have questions about this Privacy Policy or our data practices, contact us at support@mediagraph.io.

1. Collection of Information

We collect information in four ways: when you give it to us directly, automatically when you use the Services, from third-party sources, and as Customer Content uploaded by our customers.

1.1. Information You Provide to Us

We collect information you provide directly – for example, when you create an account, complete a form, request a demo, or otherwise communicate with us. This may include:

• Your name
• Email address
• Phone number
• Company name
• Company department or job title
• Payment information. When you provide financial information such as credit card details and a billing address, that information is transmitted directly to our third-party payment processor, Stripe. We do not store your full payment card number. We may access and retain limited billing information, such as the last four digits of the card, the card brand, and the billing address, through our payment processor.
• Referrals. If you use our email referral feature to tell someone about our products, we ask for that person's name and email address and use it to send a single one-time email. Neither we nor any third-party provider retains that information after the email is sent.
• Support and correspondence. Records of your communications with us, including support tickets and their contents.

1.2. Information We Collect Automatically

When you use our Services, we automatically collect certain information through cookies, local storage, pixel tags, and similar technologies. Our Cookie Policy describes each cookie we use, what it does, which category it belongs to, and how long it lasts, and explains how to change or withdraw your consent at any time. This automatically collected information relates only to our Sites and company‑operated interfaces. It does not include Customer Content, which we process solely as a processor.

In summary:

• Strictly necessary cookies and local storage. Session cookies authenticate you, keep you signed in, secure your session, and grant temporary access to specific lightboxes, shares, collections, and external uploads. Local storage remembers interface preferences such as your current sort order on a data table. These are required for the Services to function and cannot be switched off.
• Analytics. We use Google Analytics, Nutshell, and PostHog to understand how visitors and users interact with our Sites and Services so we can improve them.
• Customer relationship management. We use Nutshell to manage inquiries and sales correspondence. The Nutshell cookie is used to associate a website visit with a user and an inquiry you submit to us. It is not advertising and is not used for cross-context behavioral advertising.
• Pixel tags in email. Our newsletters and marketing emails may contain pixel tags (also called web beacons) that tell us whether a message was opened and which links were clicked. You can opt out by emailing support@mediagraph.io or by disabling remote images in your email client.

Information collected directly or indirectly through these technologies, including Nutshell, may include your IP address, name, email, company, title, LinkedIn information, internet service provider, browser type, operating system, date and time stamps, clickstream data, landing page, referring and exit pages, and referring URL.

We do not use advertising cookies, and we do not permit third parties to collect information through our Sites for cross-context behavioral advertising.

1.3. Information We Collect from Other Sources

If you choose to integrate your Google Drive account with your Mediagraph account in order to upload assets, we collect and store your Google account email address, and Mediagraph is able to:

• See, create, and delete its own configuration data in your Google Drive, including background colors, theme, and your language setting for the application;
• See, edit, create, and delete only the specific Google Drive files you open with the application, including uploading and downloading those files, seeing the names and email addresses of people you have shared them with, sharing and un-sharing them, and organizing them.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, and we do not sell it.

We use products and services provided by Nutshell, a customer relationship management software. Based on website use and the particular Nutshell product used, Nutshell may be able to connect user data with third-party data to identify your IP address, name, email, company, title, LinkedIn information, internet service provider, or other information.

1.4. Customer Content

Our customers upload files, metadata, and user information to their Mediagraph or Tandem Vault libraries. We process that Customer Content only to provide the Services and only on the customer's documented instructions, including instructions inherent in the customer’s configuration and use of the Services. In all jurisdictions where our customers act as controllers, we process Customer Content solely as a processor or service provider. Customer Content is not subject to analytics, cookies, CRM tracking, marketing technologies, or any other processing for which we act as a controller. Customers are solely responsible for the content they upload and for ensuring that their processing of personal data (including any data relating to children) complies with applicable laws. We do not use Customer Content for our own purposes; we do not sell it, and we do not use it to train artificial intelligence models. See Section 2.4 and Section 3 below.

2. Use of Information

2.1. Operating Our Services

We use information about you to:

• Provide, operate, and maintain our Services;
• Improve and expand our Services;
• Understand and analyze how our Services are used;
• Develop new products, services, features, and functionality;
• Process your transactions and manage billing;
• Find and prevent fraud and abuse; and
• Comply with legal obligations, enforce our Terms of Service and other legal rights, and respond to lawful requests from courts or government agencies.

These uses apply only to personal information for which we act as a controller. Customer Content is processed solely on the customer’s documented instructions.

2.2. Communicating With You

We use information about you to:

• Respond to your comments, questions, and requests and provide customer support;
• Send marketing and promotional messages in accordance with your preferences and applicable law; and
• Send technical notices, updates, security alerts, and administrative messages. These are not marketing messages, and you cannot opt out of them while you hold an account.

2.3. Legal Basis for Processing

Where GDPR applies, our legal basis for collecting and using personal information depends on the information concerned and the context in which we collect it. We normally rely on one of the following:

• Performance of a contract – where we need the information to provide the Services to you or to your organization, including under our Terms of Service;
• Legitimate interests – where processing is necessary for our legitimate interests in operating, securing, and improving the Services, responding to inquiries, and marketing to business contacts, and those interests are not overridden by your rights;
• Consent – where you have given consent, such as for non-essential cookies or newsletter subscriptions. You may withdraw consent at any time, and withdrawal does not affect processing carried out before you withdrew it; and
• Legal obligation – where we must process the information to comply with a legal, tax, or accounting requirement.

2.4. Artificial Intelligence Features

Mediagraph offers optional AI-powered features. These features are enabled by default on new accounts and existing accounts with AI features. They may be disabled in your account settings. When enabled, we use the following service providers:

• Amazon Bedrock, using models including Anthropic Claude, Amazon Nova, Mistral, and TwelveLabs Pegasus, depending on the feature and configuration including auto-keywording, auto-generated alt text, and custom AI actions, including video analysis;
• Amazon Rekognition – facial recognition, sensitive content warnings, and text extraction from images;
• Amazon Textract – optical character recognition and text extraction from documents; and
• Amazon Transcribe – transcription of audio and video.

When these features are active, only the asset data relevant to the requested function is processed. For example, the file itself for keywording or facial recognition, or extracted text for transcription and analysis. Both Amazon and Anthropic state in their commercial documentation that they do not retain or use customer data submitted through their commercial APIs for model training. Facial recognition data remains within Mediagraph's Amazon Web Services environment and is not shared with external parties.

We use automated tools, including AI‑based systems, to assist in reviewing and evaluating candidate resumes and comparing qualifications to job requirements. These tools help identify relevant skills and experience, but they do not make hiring decisions. All employment decisions are made by human reviewers who consider AI‑generated insights as one input among others. Candidates may contact us to exercise their data protection rights or request information about how these tools operate.

3. Sharing Your Information

3.1. We do not sell or share your personal information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under United States state privacy laws. We have not done so in the preceding twelve months. We do not disclose personal information for monetary or other valuable consideration.

3.2. Categories of recipients

We may share information in the following circumstances:

• Sub-processors. Vendors who perform services on our behalf, listed in Section 3.3. They receive only the information they need to perform their service, must keep it confidential, and are prohibited from using it for any other purpose.
• Corporate group. Our subsidiaries and divisions, for the purposes described in this Privacy Policy.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, or in the event of insolvency, bankruptcy, or receivership, information may be transferred as a business asset. We will notify affected customers as required by applicable law and our customer agreements.
• Legal and safety. To satisfy applicable law, regulation, legal process, or a governmental request; to enforce this Privacy Policy or our Terms of Service; to detect, prevent, or address fraud, security, or technical issues; and to protect the rights, property, or safety of Mediagraph, our users, or the public.
• With your consent. In any other case where you have directed or authorized us to share the information.

3.3. Sub-processors

A list of third-party sub-processors that process personal information on our behalf is available at https://trust.mediagraph.io/subprocessors.

4. Additional Information

4.1. Third-Party Services and Linked Websites

Our Services may link to websites operated by others, including our vendors and content providers, whose privacy practices differ from ours. We are not responsible for those practices and encourage you to review their policies before using them.

4.2. Social Media

We do not embed public social media widgets or tracking on our Sites.

4.3. Security

The security of your personal information is important to us, and we follow generally accepted industry standards to protect it. Information transmitted to and from our Services is encrypted in transit using Transport Layer Security. We maintain a SOC 2 Type II report, available to customers and prospective customers on request. No method of transmission or electronic storage is completely secure, so while we work to protect your personal information, we cannot guarantee absolute security.

4.4. Data Retention

We retain personal data for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Where deletion is not immediately possible, for example because the information is held in backup archives, we securely store it and isolate it from further processing until deletion is possible.

Retention of Customer Content is governed by our agreement with the relevant customer.

4.5. Accessing Your Information

If you hold an account, you can review and update much of your account information by signing in, or by emailing support@mediagraph.io. To protect your privacy and security, we may take reasonable steps to verify your identity before acting on a request.

Your ability to access or correct information may be limited where doing so would prevent us from complying with a legal obligation, interfere with our ability to investigate, bring, or defend legal claims, disclose personal information about another person, or breach a contract or reveal trade secrets or proprietary business information.

4.6. Your Rights Under the GDPR and UK GDPR

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights over personal information for which we are the controller:

• Access a copy of your personal information;
• Correct inaccurate or incomplete personal information;
• Request deletion of your personal information;
• Object to processing based on our legitimate interests;
• Request that we restrict processing;
• Request portability of information you provided to us, in a structured, commonly used, machine-readable format;
• Withdraw consent at any time, where processing is based on consent; and
• Opt out of marketing communications at any time, using the unsubscribe link in any marketing email or by contacting us.

To exercise any of these rights, email support@mediagraph.io. We respond to requests within the time required by applicable law. You also have the right to lodge a complaint with your local supervisory authority.

Where we process personal information as a processor on behalf of a customer, please direct your request to that customer; we will assist them in responding as our Data Processing Agreement requires.

For individuals in the European Economic Area and the United Kingdom, we have appointed Verasafe as our representative to act as your point of contact regarding our data‑protection obligations.

For individuals in the EU:

Please contact VeraSafe using this contact form:

https://verasafe.com/public-resources/contact-data-protection-representative

or via telephone at: +420 228 881 031

Alternatively, VeraSafe can be contacted at:

VeraSafe Netherlands BV

Keizersgracht 555

1017 DR Amsterdam

Netherlands

For individuals in the UK:

Please contact VeraSafe using this contact form:

https://verasafe.com/public-resources/contact-data-protection-representative

or via telephone at: +44 (20) 4532 2003

Alternatively, VeraSafe can be contacted at:

VeraSafe United Kingdom Ltd.

37 Albert Embankment

London SE1 7TL

United Kingdom

You may contact these representatives directly for questions or requests relating to our processing of personal data under the GDPR or UK GDPR.

4.7. Your Rights Under United States State Privacy Laws

Certain U.S. states, including California, Colorado, Connecticut, Texas, and Virginia, have enacted comprehensive privacy laws that provide certain rights to residents of those states, subject to applicable thresholds, exemptions, exclusions, and other limitations. The applicability of those laws and to particular categories of personal information depends on factors including our activities, the volume and nature of personal information processed, the context in which information is collected or used, and applicable statutory exemptions.

To the extent a U.S. state privacy law applies to us or to personal information processed by us, we will provide the rights required by that law, subject to the applicable exceptions and limitations. In addition, we may voluntarily extend certain privacy rights to individuals who are not otherwise entitled to them under applicable law. Nothing in this Privacy Policy is intended to expand the scope of any applicable law, waive any statutory exemption, or create rights beyond those expressly stated in this Privacy Policy.

4.8. Your Choices

Marketing email. You can unsubscribe from marketing email using the link in any marketing message, or by emailing support@mediagraph.io. You will continue to receive transactional and account messages such as billing notices and security alerts.

Cookies. You can change or withdraw your cookie consent at any time using the "Cookie Preferences" link in the footer of our Sites. You can also configure your browser to refuse cookies, though our Services may not function properly if strictly necessary cookies are blocked. See our Cookie Policy for full details.

Email pixels. To opt out of pixel tags in our emails, email support@mediagraph.io or disable remote image loading in your email client.

4.9. Children's Privacy

You must be at least 18 years old to use our Services. If you are under 18, you may use the Services only with the involvement of a parent or legal guardian.

Our Services are intended for business use and are not directed to children. We do not knowingly collect personal information from individuals under the age of 16 (or the age of digital consent in their jurisdiction). Our customers are prohibited from providing us with information that does not comply with applicable laws, including child privacy laws. If we learn that we have collected personal data from a child without appropriate authorization, we will delete it. If you believe we have collected information from a child, contact support@mediagraph.io, and we will delete it.

4.10. Questions and Complaints

If you have a question or concern about this Privacy Policy or how we handle your personal information, contact us at support@mediagraph.io. We will acknowledge your inquiry and work to resolve it.

If you are in the European Economic Area or the United Kingdom and we have not resolved your concern, you may lodge a complaint with your local data protection authority. If you are a California resident, you may contact the California Privacy Protection Agency or the California Attorney General.

4.11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. If the changes are material, we will provide additional notice by posting a prominent notice on our Sites or by email before the changes take effect. We encourage you to review this Privacy Policy periodically.

4.12. Contact Information

The DAM Software Company, Inc. d/b/a Mediagraph

PO Box 104

Seal Beach, CA 90740, USA

Email: support@mediagraph.io

Phone: 1-805-557-8407