Privacy Policy

This policy describes how Upperstate Inc., a California corporation doing business as Treats (“Treats,” “we,” or “us”), collects, uses, and shares personal information through treats.design and in connection with our treatment design services.

Types Of Information We Collect.

The following provides examples of the type of information that we collect from you, how we use that information, and what our interest or legal basis is in using it.

Project Inquiries and Bookings

When you contact us to start a pitch or book a project, we collect your name, email address, company, role, and the details of your project.
We use this information to respond to you and to perform our contract to provide the Products and/or Services.

Briefs, Scripts, and Other Client Materials

When you engage us, we receive the scripts, briefs, director’s notes, references, footage, and other materials you share with us. These materials may include personal information, such as names in a script or images of identifiable people.
We use these materials only to perform your project, and we keep them private and confidential.

Roster Designers and Applicants

If you work with us as a designer or apply to join the Treats roster, we collect your name, contact information, location, portfolio, rates, and the payment and tax information needed to pay you.
We use this information to manage our working relationship with you and to meet our legal, tax, and accounting obligations.

Subscriber Information

We collect the name, email and contact information, of our subscribers and their Company and possibly their employees with whom we may interact.
We have a legitimate interest in contacting our subscribers and communicating with them concerning normal administration.

Cookies and first party tracking

We use cookies, pixels, tags, software development kits (SDKs), local storage, and similar technologies. “Cookies” are small pieces of information that a website stores on your device; “pixels” and “tags” are small pieces of code embedded in a web page or email that record that the page or message was loaded. We use these technologies to operate the website, keep you signed in, remember your preferences, secure your account, and measure how the website performs.
We currently use only the cookies needed to operate the website, and we do not use third-party advertising or cross-site tracking cookies. If we add analytics or similar tools in the future, we will update this policy.
We have a legitimate interest in making our website operate efficiently.

Email Interconnectivity

If you receive email from us, we use certain tools to capture data related to when you open our message, click on any links or banners.
We have a legitimate interest in understanding how you interact with our communications to you.

Feedback/Support

If you provide us feedback or contact us for support we will collect your name and e-mail address, as well as any other content that you send to us, in order to reply.
We have a legitimate interest in receiving, and acting upon, your feedback or issues.

Mailing List

When you sign up for Notes from Treats or another mailing list, we collect your email address.
We have a legitimate interest in sharing information about our organization.

Mobile Devices

We collect information from your mobile device such as unique identifying information broadcast from your device when visiting our website.
We have a legitimate interest in identifying unique visitors, and in understanding how users interact with us on their mobile devices.

Payments

When you pay an invoice, our payment processor collects your payment and billing information directly. We receive limited details, such as your name, company, amount paid, and payment status, and we do not receive or store full card or bank account numbers.
We use your information to perform our contract to provide you with our Products and/or Services.

Website interactions

We use technology to monitor how you interact with our website. This may include which links you click on, or information that you type into our online forms. This may also include information about your device or browser.
We have a legitimate interest in understanding how you interact with our website to better improve it, and to understand your preferences and interests in order to select offerings that you might find most useful. We also have a legitimate interest in detecting and preventing fraud.

Web logs

We collect information, including your browser type, operating system, Internet Protocol (IP) address (a number that is automatically assigned to a computer when the Internet is used), domain name, click-activity, referring website, and/or a date/time stamp for visitors.
We have a legitimate interest in monitoring our networks and the visitors to our website. Among other things, it helps us understand which of our services is the most popular.

In addition to the information that we collect from you directly, we may also receive information about you from other sources, including third parties, partners, our affiliates, or publicly available sources.

Use and Processing of Information.

In addition to the purposes and uses described above, we use information in the following ways:

To identify you when you visit our website.
To provide services.
To prepare treatments, image research, copywriting, and other deliverables for your project.
To improve our service offerings.
To process payments, fulfill orders, and administer your purchases.
To conduct analytics.
To respond to inquiries related to support, employment opportunities, or other requests.
To send promotional materials, including information relating to our services or promotions.
For internal administrative purposes, as well as to manage our relationships.
To operate artificial intelligence and automated tools that support our business, such as drafting assistance, scheduling, transcription, summarization, customer support, and fraud detection.

Although the sections above describe our primary purpose in collecting your information, in many situations we have more than one purpose. For example, if you complete a purchase we collect your information to perform our contract with you, but we also retain your information because we have a legitimate interest in maintaining it after the purchase is complete so that we can respond quickly to any questions about your order. As a result, our collection and processing of your information is based, in different contexts, upon your consent, our need to perform a contract, our obligations under law, and/or our legitimate interest in conducting our business.

Sharing of Information.

In addition to the specific situations discussed elsewhere in this policy, we disclose information in the following situations:

Affiliates and Acquisitions. We may share information with our affiliates (e.g., parent organization, sister organization, joint ventures, or other organizations under common control). If another organization acquires, or plans to acquire, our Company, operations, or our assets, we will also share information with that organization, including at the negotiation stage.
Other Disclosures with Your Consent. We may ask if you would like us to share your information with other unaffiliated third parties who are not described elsewhere in this policy.
Other Disclosures without Your Consent. We may disclose information in response to subpoenas, warrants, or court orders, or in connection with any legal process, or to comply with relevant laws. We may also share your information in order to establish or exercise our rights, to defend against a legal claim, to investigate, prevent, or take action regarding possible illegal activities, suspected fraud, safety of person or property, or a violation of our policies, or to comply with your request for the shipment of products to or the provision of services by a third party intermediary.
Service Providers. We share your information with service providers. Among other things service providers help us to administer our website, conduct surveys, provide technical support, process payments, and assist in the fulfillment of Services.
Our Roster and Pitchflow. We share project materials with the Treats designers assigned to your project, who are bound by confidentiality obligations to us. We may host and share project files through Pitchflow, the pitch software operated by Upperstate Inc., which processes them as described in the Pitchflow Privacy Policy.
Share Links. A Pitchflow gallery or page shared by link can be viewed by anyone who has that link. You can add a password to a share link, rotate it, or disable it at any time, and the old link stops working immediately.
No Sale of Your Information. We do not sell your personal information or your Client Materials, and we do not share them with third parties except as described in this policy.

Artificial Intelligence and Automated Processing. We use third-party artificial intelligence and machine-learning tools in the ordinary course of operating our business. Where those tools process personal information, the provider acts as our service provider or processor, is contractually restricted to using the information only to provide the service to us, and is prohibited from using it to train or improve its own general-purpose models, except where we tell you otherwise. We do not use automated processing to make decisions that produce legal or similarly significant effects concerning you — such as decisions about credit, lending, housing, employment, education, or healthcare — without providing the notice, explanation, and opt-out that applicable law requires. If we begin to do so, we will update this policy and provide a pre-use notice before that processing begins. You may ask us how a particular automated tool is used in connection with your information by contacting us at hello@treats.design.

Your Choices.

You can make the following choices regarding your personal information:

Access to Your Personal Information. You may request access to your personal information by contacting us at the address described below. If required by law, upon request, we will grant you reasonable access to the personal information that we have about you. Note that residents of certain states may be entitled to ask us for a notice describing what categories of personal information (if any) we share with third parties or affiliates for direct marketing.
Changes to Your Personal Information. We rely on you to update and correct your personal information. Note that we may keep historical information in our backup files as permitted by law. If our website does not permit you to update or correct certain information contact us at the address described below.
Deletion of Your Personal Information. Typically we retain your personal information for the period necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required or permitted by law. You may, however, request information about how long we keep a specific type of information, or request that we delete your personal information by contacting us at the address described below. If required by law we will grant a request to delete information, but you should note that in many situations we must keep your personal information to comply with our legal obligations, resolve disputes, enforce our agreements, or for another one of our business purposes.
Objection to Certain Processing. You may object to our use of your personal information by contacting us at the address described below.
Online Tracking and Opt-Out Preference Signals. Our website does not respond to legacy “Do Not Track” browser signals, for which no common industry standard was ever adopted. We do treat a Global Privacy Control (GPC) signal, and any other opt-out preference signal recognized under applicable law, as a valid request to opt out of the sale or sharing of personal information and of processing for targeted advertising, applied to the browser or device transmitting it. Where required by applicable law, we will display confirmation that the signal has been processed. If you are signed in to an account when the signal is transmitted, we will also apply your choice to that account.
Revocation of Consent. If you revoke your consent for the processing of personal information then we may no longer be able to provide you services. In some cases, we may limit or deny your request to revoke consent if the law permits or requires us to do so, or if we are unable to adequately verify your identity. You may revoke consent to processing (where such processing is based upon consent) by contacting us at the address described below.
How We Verify and Respond to Requests. To protect your information, we will take reasonable steps to verify your identity before acting on a request, which may include asking you to confirm information already in our records or to respond from the email address associated with your account. We will not require you to create an account solely in order to make a request. An authorized agent may submit a request on your behalf with proof of authorization, and we may require you to verify your identity directly with us. We will respond within the time required by applicable law. If we decline your request, our response will explain why and, where applicable law provides an appeal right, how to appeal that decision. If we deny an appeal, you may contact your state attorney general.

How We Protect Personal Information

No method of transmission over the Internet, or method of electronic storage, is fully secure. While we use reasonable efforts to protect your personal information from unauthorized access, use, or disclosure, we cannot guarantee the security of your personal information. In the event that we are required by law to inform you of a breach to your personal information we may notify you electronically, in writing, or by telephone, if permitted to do so by law.

Each project lives in its own private workspace, in Pitchflow or in your own tools, and is not listed or searchable. Files are encrypted in transit and at rest, and we will sign a non-disclosure agreement you send with your brief before work begins. If your team has formal security requirements, you may send a vendor questionnaire to hello@treats.design.

How Long We Keep Personal Information

We retain personal information only for as long as reasonably necessary for the purposes described in this policy. We apply the following general criteria to determine how long we keep each category of information:

Client and Project Records. Retained for the duration of the project and the client relationship and for up to seven (7) years afterward, in order to administer the relationship, resolve disputes, and satisfy tax, accounting, and recordkeeping obligations.
Client Materials. Retained while your project is active and for as long as needed to support follow-up work on it. When your project wraps, you may ask us to delete the project and its files, and we will do so except for limited records we must keep under the criteria below.
Payment and Transaction Records. Retained for seven (7) years from the date of the transaction to satisfy tax and financial recordkeeping requirements. We do not store complete payment card numbers; those are handled by our payment processor.
Marketing and Mailing List Data. Retained until you unsubscribe or ask us to delete it, and thereafter only as needed to honor your choice — for example, keeping your email address on a suppression list.
Website, Analytics, and Advertising Data. Retained for twenty-four (24) months from collection, or for the retention period set by the applicable analytics or advertising provider, whichever is shorter.
Support and Correspondence. Retained for three (3) years after the matter is closed.
Backups and Legal Holds. Information may persist in routine backups for a limited period after deletion from active systems. Where information is subject to a litigation hold, regulatory inquiry, or other legal obligation, we retain it until that obligation ends, notwithstanding the periods above.

Sensitive Personal Information

Some information we collect may be treated as “sensitive personal information” or “sensitive data” under applicable state privacy laws. Depending on the Products and/or Services you use, this may include account log-in credentials, a financial account number in combination with a required security or access code, precise geolocation, or the contents of your communications with us where we are not the intended recipient.

We collect and use sensitive personal information only as reasonably necessary to provide the Products and/or Services you have requested, to secure your account, to detect and prevent fraud and unlawful activity, and for other purposes for which applicable law provides no right to limit. We do not use or disclose sensitive personal information for the purpose of inferring characteristics about you, and we do not sell it or share it for cross-context behavioral advertising.

Where applicable law requires your consent before we process sensitive data, we will obtain that consent first. You may ask us to limit our use of sensitive personal information, or withdraw a consent you previously gave, by contacting us using the details below.

Your State Privacy Rights

Depending on where you live, state privacy laws (including those of California, Colorado, Connecticut, Oregon, Texas, Virginia, and other states) may give you the right to know about and access the personal information we hold about you, to correct it, to delete it, to receive a copy in a portable format, and to opt out of the sale of your personal information, targeted advertising, and certain profiling. You may also have the right to appeal our decision on a request. Whether or not your state's law applies to us, you may contact us at hello@treats.design to make any of these requests.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising or for profiling that produces legal or similarly significant effects. We do not disclose personal information to third parties for their own direct marketing purposes, as described in California Civil Code Section 1798.83. We will not discriminate against you for exercising any of your privacy rights.

Children’s Privacy

We do not intentionally collect personal information from children under the age of 13, and our Products and/or Services are not directed to children under 13. If you are under the age of 13, you may view our website, but you should not make a purchase, register, or submit personal information to us. We do not knowingly sell or share the personal information of consumers under the age of 16. We do not process the personal information of a consumer we know to be at least 13 and under 16 for purposes of targeted advertising, sale, or profiling without that consumer’s affirmative authorization, and we do not do so for a consumer we know to be under 13 without authorization from a parent or guardian. If you believe we have collected information from a child or teen, please contact us at hello@treats.design so that we can take appropriate action.

Users Outside the United States

If you are a non-U.S. user of the Site, by visiting the Site and providing us with data, you understand and agree that the data you provide to us may be processed for the purposes listed in this Policy. You also understand and agree that the data you provide to us may be processed in the United States. U.S. laws regarding the processing of data may be less stringent than the laws of your country. By providing your data, you consent to this processing.

Our Products and/or Services are directed to, offered to, and intended for residents of the United States. We do not target, market to, or knowingly offer the Products and/or Services to individuals located in the European Economic Area, the United Kingdom, or Switzerland, we do not monitor the behavior of individuals located in those jurisdictions, and we do not accept orders placed from them. We do not intend, by operating a website accessible worldwide, to subject ourselves to the laws of any jurisdiction other than the United States.

If you are located in the European Economic Area, the United Kingdom, or Switzerland and you nonetheless choose to contact us or use the Products and/or Services, you do so on your own initiative, and you understand that your information will be transferred to and processed in the United States. If you believe we hold personal data about you and you wish to access, correct, or delete it, contact us at hello@treats.design and we will respond to your request.

Miscellaneous

The following additional information relates to our privacy practices:

Transmission of Information to Other Countries. As a company located in the United States, we process personal information in the United States. If you provide your personal information to us your information will be processed in the United States where privacy laws may be less stringent than the laws in your country. By submitting your personal information to us you agree to the transfer, storage and processing of your information in a country other than your country of residence including the United States.
Third Party Applications/Websites. We have no control over the privacy practices of websites or applications that we do not own.

Changes to This Privacy Policy. We may change our privacy policy and practices over time. To the extent that our policy changes in a material way, the policy that was in place at the time that you submitted personal information to us will generally govern that information unless we receive your consent to the new privacy policy. We review this policy at least once every twelve (12) months and update the “Last Updated” date below whenever it changes.

Contact Information. If you have any questions, comments, or complaints concerning our privacy practices please contact us at the appropriate address below. We will attempt to respond to your requests and to provide you with additional privacy-related information.

hello@treats.design

Upperstate Inc. (Treats), 3344 Glenhurst Avenue, Los Angeles, California 90039

Last Updated: October 22, 2026