Privacy

1.Who is responsible

The NALL Institute LLC, an Alabama limited liability company wholly owned by the Troy University Foundation.

414 Equality StreetFairhope, Alabama 36532info@thenallinstitute.com

2.What we collect

Information you give us

Information collected automatically

IP address, browser and device type, operating system, referring page, pages viewed, time on page, and general location inferred from IP (city or region level, not precise). Collected through cookies and similar technologies — see Part 4 — Cookie Notice.

Information we do not collect

We do not knowingly collect personal information from anyone under 13. We do not collect precise geolocation. We do not buy personal information from data brokers. We do not collect information about your race, ethnicity, religion, health, sexual orientation, union membership, or political views.

3.How we use it

• To operate the website, the chat, the portrait tool, and the boutique
• To fulfill orders, process returns, and provide customer support
• To respond to inquiries about artworks, exhibitions, licensing, and the collection
• To send newsletters and updates, if you asked for them (unsubscribe any time)
• To monitor abuse, prevent fraud, and secure the Services
• To understand aggregate site usage and improve the experience
• To keep records required by law and to establish or defend legal claims

Model training

We do not use your chat transcripts or uploaded photographs to train, fine-tune, or develop any artificial intelligence model, and we have contractually required our AI vendors not to do so either.

Advertising

We run paid advertising for the Institute on platforms including Meta and Google. To measure whether those ads work, we use advertising and conversion technologies on this site. With your consent, this means personal information — typically an online identifier, the pages you viewed, and whether you purchased — is shared with those platforms. Under California law this is "sharing for cross-context behavioral advertising"; under Colorado, Connecticut, Texas, Oregon, Montana, and Virginia law it is "targeted advertising."

We never sell your personal information for money.

We never send these platforms your biometric information, your uploaded photographs, or the contents of your conversations with A-EYE NALL. Advertising and conversion tags are disabled entirely on the A-EYE NALL Studio. See Part 4 — Cookie Notice.

You can turn this off at any time — see Your choices and rights below.

4.Who we share it with

We share personal information only with service providers who need it to do a job for us, under contracts that limit them to that job.

We may also disclose information when required by law, valid legal process, or a government request; to protect our rights, safety, or property or those of others; or in connection with a reorganization or transfer of the Institute's assets.

Troy University and the Troy University Foundation

As the Institute's owner, the Foundation may receive aggregate and financial reporting. Neither Troy University nor the Foundation receives your chat transcripts or uploaded photographs.

5.How long we keep it

6.Your choices and rights

Regardless of where you live, you may ask us to:

• Access the personal information we hold about you
• Correct anything inaccurate
• Delete your personal information
• Opt out of marketing email (also: the unsubscribe link in any message)
• Opt out of targeted advertising — use the Your Privacy Choices control in the site footer, or send a Global Privacy Control signal, or email us
• Receive a copy in a portable format

Email info@thenallinstitute.comwith the subject line "Privacy Request." We will verify your identity before acting — usually by confirming control of the email address on file — and respond within 45 days. If we need longer, we will tell you why.

We will not discriminate against you for exercising these rights.

Authorized agents

You may use an authorized agent. We will require written proof of authorization and may verify directly with you.

Appeals

If we decline a request, you may appeal by replying with the subject line "Privacy Appeal." We will respond in writing. If we deny the appeal, you may contact your state Attorney General.

If you live in a state with a comprehensive privacy law

Residents of California, Colorado, Connecticut, Virginia, Texas, Oregon, Montana, and other states with comprehensive privacy statutes have the rights listed above and, depending on the state, additional rights regarding sensitive data and profiling.

We do not sell personal information for money. We do share it for targeted advertising, with your consent, as described in Section 3 — and you can opt out at any time. We do not use personal information for profiling that produces legal or similarly significant effects.

Biometric information — including any scan of face geometry derived from a photograph you upload — is sensitive personal information under these laws. We process it only with your separate, specific, opt-in consent, and only for the purpose you requested. See the Biometric Data Policy.

Global Privacy Control

We honor the Global Privacy Control (GPC) browser signal as a valid opt-out of the sale and sharing of personal information.

California

You may also request the specific categories of personal information collected, the sources, the business purpose, and the categories of third parties to whom it was disclosed. All of that is in Sections 2 through 4 above. In the preceding 12 months we have disclosed the categories in Section 2 to the vendor categories in Section 4, for the purposes in Section 3, and have not sold or shared personal information.

Nevada

Nevada residents may submit a verified request that we not sell covered information. We do not sell it, but you may confirm at info@thenallinstitute.com.

Outside the United States

The Services are operated from, and directed exclusively to, the United States. We ship only to U.S. addresses, we price only in U.S. dollars, and we do not market or offer goods or services to people outside the United States.

The site is reachable from anywhere, and you are welcome to read it. If you access it from outside the U.S., your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live. By using the Services from outside the United States, you understand and accept that transfer.

7.Security

We use administrative, technical, and physical safeguards reasonably designed to protect personal information: encryption in transit, access controls limiting personal information to personnel who need it, vendor due diligence, and prompt deletion of data we no longer need.

No system is perfectly secure and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the appropriate authorities as required by law.

1.What we collect and why

To generate a portrait, our image generation system must analyze the photograph you upload. That analysis may derive a scan of face geometry — a mathematical representation of the spatial relationships between facial features — which is a "biometric identifier" under Illinois law.

We collect it for exactly one purpose: to respond to what you asked for — either to answer your question about the image, or to generate the pencil-and-charcoal style portrait you requested — and to return that response to you.

We do not use it to identify you. We do not use it to recognize you across sessions. We do not compare it against any database. We do not use it for security, access control, fraud detection, advertising, or any analytical purpose.

2.How long we keep it

We do not retain it.

The uploaded photograph and any biometric identifier or biometric information derived from it are processed in volatile memory for the duration of a single generation request and are permanently destroyed on completion of that request. Neither is written to persistent storage, backup media, log files, or any archive.

In no circumstance do we retain any biometric identifier or biometric information beyond the earlier of:

1. the moment the initial purpose for collecting it — generating your portrait — has been satisfied; or
2. three (3) years after your last interaction with the Institute.

This satisfies the destruction schedule required by 740 ILCS 14/15(a).

Under the Texas Capture or Use of Biometric Identifier Act, we destroy biometric identifiers within a reasonable time and in no event later than one (1) year after the purpose for collection expires.

The generated portrait itself is returned to you and is not retained by us after your session ends, other than in ordinary transient system logs that do not contain the source photograph or any biometric identifier.

3.How it is destroyed

Destruction is permanent and irreversible. Source images and derived biometric data are held only in volatile memory and are released at the end of the request. Nothing is copied to disk, object storage, backup, or archive, so there is nothing to purge on a schedule and no restoration path.

If any biometric data is ever written to persistent storage as a result of a system error or configuration fault, it will be permanently deleted upon discovery, and this policy will be revised to describe the corrected architecture.

4.Consent

We do not collect any biometric identifier without your prior, separate, written consent.

Before you upload a photograph, we present a consent notice that tells you:

1. that a biometric identifier or biometric information is being collected or stored;
2. the specific purpose for collecting it;
3. the length of time it will be collected, stored, and used.

You must affirmatively check a box giving your consent. That box is unchecked by default, it is separate from your acceptance of our general Terms of Use, and the upload function does not operate until you check it. We record the date, time, and version of the notice you accepted.

Accepting our Terms of Use does not constitute biometric consent. Only the separate consent given at the point of upload does.

You may withdraw consent at any time by emailing info@thenallinstitute.comwith the subject line "Biometric Deletion." Because we do not retain biometric data, there is normally nothing to delete — but we will confirm that in writing, and we will not process any further uploads from you.

5.Age restriction

Uploading any photograph to the A-EYE NALL Studio is restricted to users 18 and older. Anyone 13 and older may use the conversation feature; only adults may send images.

We do not knowingly collect a biometric identifier from any person under 18, and we do not permit the upload of a photograph depicting any person under 18, whoever is uploading it — including a person appearing incidentally in the background of an image.

Before uploading, you must confirm you are 18 or older and that any person shown in the photograph is 18 or older and has consented.

If we learn that a photograph depicting a minor was uploaded, we will delete everything associated with it immediately and may block the account or device. A parent or legal guardian may contact us at info@thenallinstitute.comwith the subject line "Parental Request."

6.Photographs of other people

Do not upload a photograph of another person unless that person is an adult and has given you express permission to upload their photograph to an artificial intelligence portrait service that will process their facial image.

Biometric privacy rights belong to the person depicted, not to the person holding the photograph. Owning a photograph, or having taken it, does not give you the right to consent on someone else's behalf.

7.We do not sell or profit from biometric data

We do not sell, lease, trade, or otherwise profit from any biometric identifier or biometric information. This is required by 740 ILCS 14/15(c) and it is our policy everywhere.

We do not disclose biometric identifiers to any third party except:

1. to Anthropic (Claude), our conversational AI vendor, solely to process an image you send as part of a conversation;
2. to Stable Diffusion XL (SDXL), our image generation vendor, solely to generate the portrait you requested;
3. as required by a valid subpoena, warrant, or court order;
4. with your separate written consent.

The first two disclosures are described here and in the consent notice presented before you upload. Our agreements with both vendors prohibit retention of submitted images, use for model training, and any use beyond responding to your request.

We do not disclose biometric data to Troy University, the Troy University Foundation, the Sorrell College of Business, advertisers, data brokers, or any other party.

8.Security

Biometric data is transmitted over encrypted connections, processed in isolated memory, never written to persistent storage, and accessible to no one at the Institute in the ordinary course of operations. We apply the reasonable standard of care required by 740 ILCS 14/15(e), which is at least as protective as the standard we apply to other confidential and sensitive information.

9.Your rights

You may:

• Ask what we hold.Email "Biometric Request." Under this policy the answer will normally be "nothing."
• Withdraw consent.Email "Biometric Deletion."
• Request deletion. Same subject line. We will confirm in writing.
• Decline entirely. Sending a photograph is entirely optional. The A-EYE NALL Studio works as a conversation without one, and nothing else on the site requires an image. Declining costs you no access to anything.

We respond within 45 days.

1.Our age limits, in one place

The portrait generator is closed to minors entirely. It processes facial images, which are biometric information under federal and state law. We do not accept a photograph from a minor, and we do not accept a photograph of a minor from anyone, including a parent.

2.This site is not directed to children

thenallinstitute.com presents the work, life, and archive of the artist Fred Nall Hollis. It is written for a general adult audience — collectors, scholars, students, museum visitors, and people who knew his work. It does not use animated characters, games, child-oriented music, or activities designed to appeal to children, and we do not advertise to children.

We recognize that art museum sites attract school groups and young visitors. That is welcome. This notice explains where the limits are.

3.Children under 13

We do not knowingly collect personal information from children under 13.

Under the federal Children's Online Privacy Protection Act (COPPA) and its implementing Rule, "personal information" includes name, email address, phone number, photographs and video containing a child's image or voice, persistent identifiers, and — as of the Rule's most recent amendments — biometric identifiers, including facial templates and faceprints.

If you are under 13, please do not use the chat, do not enter your name or email anywhere on the site, and do not upload any photograph.

If we learn we have collected personal information from a child under 13 without verifiable parental consent, we will delete it promptly and terminate the associated session.

4.If you are a parent or guardian

You have the right to:

• Know whether we have collected personal information from your child
• Review that information
• Delete it
• Refuse any further collection or use

To exercise any of these, email info@thenallinstitute.com with the subject line "Parental Request." Tell us what happened and roughly when. We will verify your identity — and, where practical, your relationship to the child — before acting, and we will respond within 30 days. Verification steps are proportionate to the sensitivity of what is involved; for a request to delete a photograph, expect us to ask for more.

There is no charge, and you do not need to give a reason.

If you believe a photograph of your child was uploaded to the portrait generator, email us immediately with the subject line "Parental Request — Urgent." We will act on it as a priority. Under our Biometric Data Policy uploaded photographs are not retained, so in most cases there will be nothing left to delete — but we will confirm that in writing.

5.Users between 13 and 18

If you are 13 to 17, you may browse the site and use A-EYE NALL. Please review these Terms with a parent or guardian first.

Do not upload a photograph. The portrait feature is not for you, and this is not a rule we bend.

Purchases must be made by an adult. If you want something from the boutique, ask a parent or guardian to complete it.

Several states give people aged 13 to 17 additional privacy protections, including restrictions on targeted advertising and the sale of personal information. We do not sell personal information at any age, and we do not knowingly use targeted advertising for anyone under 18.

6.A-EYE NALL and younger users

If a minor uses the chat, understand what it is:

• It is software, not Nall and not a person. It says so at the start, and it repeats that reminder during longer conversations.
• It gets things wrong, confidently. It can invent quotations, dates, and biographical detail. It is not a research source, and it should not be cited in schoolwork.
• It will not produce sexual content for anyone, of any stated age.
• It has a crisis protocol. If a conversation suggests someone may be at risk of self-harm, the system stops the persona and provides crisis resources. See our AI Systems Disclosure and Safety Protocol.

Nall's life and work included difficult subject matter — illness, loss, war, addiction, and the AIDS epidemic among them. Conversations may touch on those subjects. Teachers and parents planning to use the site with students should review it first.

7.For schools and teachers

We do not currently offer a classroom product, and we do not rely on school-based consent under COPPA.

If you are planning to use thenallinstitute.com with students under 13, contact us at info@thenallinstitute.com before you do. We would rather help you set it up correctly than find out afterward. Practical guidance: browsing and gallery content is fine for any age. The chat should be used on a shared classroom display driven by the teacher rather than on individual student accounts. The portrait feature is not appropriate for classroom use at any grade level.

8.What we do not do

• We do not sell personal information from anyone, at any age
• We do not knowingly use targeted advertising for anyone under 18
• We do not use personal information from minors for advertising or profiling
• We do not condition a child's participation in any activity on disclosing more information than is reasonably necessary
• We do not retain personal information from minors longer than needed to fulfill the purpose it was collected for

1.What cookies are

Cookies are small text files a site stores on your device. We also use similar technologies — pixels, local storage, and software development kits inside embedded services — and this notice covers all of them.

2.What we use, by category

Strictly necessary — always on

These make the site work. They cannot be turned off and they do not require consent.

Analytics — consent required

Aggregate understanding of how the site is used: which pages get read, where people arrive from, where they leave.

We use analytics in aggregate. We do not use it to build a profile of you or to target advertising.

Functional — consent required

Advertising and measurement — consent required

We run paid advertising for the Institute. These technologies tell us whether an ad led to a visit or a purchase, and allow the platforms to show our ads to relevant audiences.

These do not fire until you accept them. Decline, or send a Global Privacy Control signal, and they never load.

Three things they never touch:

1. The A-EYE NALL Studio. Advertising and measurement tags are disabled site-wide on /chat and on every page where a photograph can be uploaded. No ad platform receives any signal from those pages.
2. Your photographs or biometric information. Never, under any circumstance, with or without consent.
3. The contents of your conversations.

We do not use session replay, screen recording, or keystroke capture anywhere on this site.

3.Third-party services embedded on this site

Some cookies are set by services we embed rather than by us. When you interact with them, their own privacy terms apply in addition to ours.

• Shopify — the NALL Boutique and checkout
• Printful — print-on-demand fulfillment
• YouTube — embedded video
• OpenSea — linked from the digital collectibles pages. Following that link takes you to a third-party marketplace we do not operate or control.

4.Your choices

On-site controls

Use the cookie banner on your first visit, or the "Cookie Preferences" link in the footer at any time, to accept or decline analytics and functional cookies. Strictly necessary cookies stay on.

Global Privacy Control

We honor the GPC browser signal. If your browser or extension sends GPC, we treat it as a valid opt-out of the sale and sharing of personal information and as a decline of non-essential cookies. You do not need to do anything else. Learn more at globalprivacycontrol.org.

Browser settings

Every major browser lets you block or delete cookies. Blocking strictly necessary cookies will break the cart and checkout.

Do Not Track

Browsers vary in how they implement DNT and there is no common standard for responding to it. We honor GPC instead, which is standardized and enforceable.

5.Consent records

When you make a cookie choice we record the choice, the date and time, and the version of this notice — so we can honor it and demonstrate that we did. Withdrawing consent is as easy as giving it.