Privacy Policy

I. Introduction

Hong Kong Liushui Technology Limited (hereinafter referred to as "we," "our," or "us") values your privacy. This Privacy Policy ("Privacy Policy") outlines our data protection practices and explains the types of personal information we may process when you install and/or use the ChatLulu mobile software application (hereinafter referred to as "App" or "this App").

When we refer to "personal data" (or "personal information"), we mean any information that is related to an identified or identifiable natural person, either directly or indirectly, that can be used to identify them.

This Privacy Policy applies to all individuals who access or use this App (hereinafter referred to as "users").

Please carefully read the following terms of this Privacy Policy. By using this App, you indicate that you have read, understood, and agreed to be bound by its terms.

Special Notice for California Residents：

Under the California Consumer Privacy Act of 2018 (CCPA), California residents have the right to request:

1. The categories of personal information being processed;
2. The categories of sources of personal information;
3. The purposes for processing personal information;
4. The list and categories of third parties with whom we may share your personal information;
5. Access to specific personal information we may hold about a particular user (provided that the request contains enough information for us to verify the user's identity).

Please use the following links to quickly navigate to relevant sections of this policy:

• Personal Information — Categories, Sources, and Purposes of Processing >>
• Sharing — How We Share Your Information >>
• Opt-Out Options — How to Limit or Withdraw Consent >>

Note: Under the CCPA, "personal information" does not include de-identified or aggregated consumer information.

Please be aware that all third parties involved in processing user data are service providers who use such information based on agreements and for business purposes.

Requests

To submit a verifiable consumer request for access, portability, or deletion of personal data, please contact us through the contact form. In the body of your request, please specify "Your rights under California privacy laws."

When submitting a verifiable request, you should be prepared to:

Provide sufficient information for us to reasonably verify that you are the person whose personal information we have collected, or an authorized representative. This information may include: name, address, city, state/province, postal code, and email address. We may use this information to ask you a series of security questions to verify your identity. If you are submitting a request through an authorized agent acting on your behalf, the agent must provide a written authorization or power of attorney signed by you.

Provide a detailed description of your request so that we can properly understand, evaluate, and respond.

If we are unable to: (i) verify your identity or the authority of the person submitting the request; or (ii) confirm that the personal information is related to you, we will not be able to respond to your request or provide personal information. We may ask you to provide additional information or documents to verify your identity. Before taking any action on your personal information, we may also verify it, including using third-party identity verification services. This is a safeguard to prevent your personal information from being disclosed due to fraudulent or deceptive requests.

We ensure that the personal information provided in verifiable consumer requests is only used to verify the identity of the requester or the authority of the request, and not for any other purpose. We will retain this information for a reasonable period necessary to fulfill the above purposes and delete it once the purpose is achieved.

We aim to respond to a verifiable consumer request within forty-five (45) days of receiving it. If more time is needed, we will inform you in writing of the reason and the extension period. Please note that we are only required to respond to two requests per customer per year.

Equal Rights

Any actions we take in response to your requests should not be interpreted as discrimination. This means that if you choose to exercise your rights, we will not provide you with different prices or products, or different levels or qualities of services. However, in certain cases, if you choose to delete your personal information from our records, we may not be able to provide you with certain services.

Data Sales

We do not sell any of your personal data to third parties.

II. Information We Process

Functional Information

The following information will be requested and processed when you use the App. This information is necessary to fulfill our contract with you and to provide the full functionality of the App. Without this information, we will not be able to offer you complete services.

There are several types of information we may process:

• Email Address
  • If you purchase a subscription on chatlulu.com (the "App Website") and wish to use premium features, you must log in to your existing ChatLulu account or create a new account within the App.
  • When you choose to create a ChatLulu account by entering your email address and complete the verification process, we will record your email address.
  • You can also log in using your Google account by selecting the "Sign in with Google" button; in this case, only the authentication credentials provided by Google will be used.
  • We do not access, use, store, or share your Google user data. The authorization process is completed through OAuth 2.0, a secure protocol implemented by Google.
  • We use your email address to identify your subscription purchase and send you invoices; this email address may also be used for other purposes as described in the "Email Communication" section.


• User Content（ (i.e., the text you enter in the message box, any files you attach and send, and any text, images, or videos generated through the App's AI features). You are free to use, share, or otherwise dispose of your user content, provided that you comply with the relevant rules and restrictions in the Terms of Use. However, the risks and responsibilities associated with the content remain with you.
  You are responsible for ensuring compliance with applicable laws when using user content. We engage third-party service providers (including OpenAI L.L.C., Stability AI Ltd., Anthropic PBC, etc.) to process and generate AI user content (text, images, and videos).
  If you enable the "Ask the Web" feature, your input will also be processed by Microsoft Corporation and Google LLC to obtain internet search results and update the output content accordingly. Please refer to Section IV for the privacy policies and practices of the respective third parties.


• Contact Information(name, email, and any other information you provide through email or the in-App support form). We collect, store, and process this information in collaboration with our cloud storage provider, Amazon.com, Inc., in order to respond to your inquiries, fulfill your requests, send communications you have requested, and provide the relevant services.

Automatically Processed Information

With your authorization, we use third-party automated data processing technologies (advertising/analytics tools) to analyze specific information sent from your device via the App (including advertising identifiers such as AAID).

Certain integrated advertising or analytics tools (see Section IV) may automatically process your personal data, including "profiling": evaluating characteristics related to your personal preferences, interests, behaviors, location, or movement through automated means.

• Once you permit the App to collect statistics, automatic processing will begin. You can withdraw your authorization at any time — please refer to the opt-out options in Section VIII.
• Based on legitimate interests, we may also process certain device and user behavior information in aggregate form to improve the App and provide the best experience.

Examples of information that may be automatically collected and processed include (list remains consistent with the English original):

1. Device Details: device type, operating system type and version, model and manufacturer, screen size and density, screen orientation, volume, battery status and life, load time, latency, frame rate, memory usage, etc.;
2. Network Connection Information: mobile carrier, network provider, network type, IP address, session timestamps and duration, speed, browser type, etc.;
3. Location Information: IP address, country/region/state/city associated with the SIM card or device, language settings, time zone, nearby points of interest (e.g., cafes, etc.);
4. Other Device Identifiers: such as user identifiers set by the app developer, etc.;
5. App Information: app name, API keys, version and attributes; some services may record a list of other apps/processes installed or running on the device;
6. Cookies and Similar Technologies: pixels, web beacons, scripts, etc., used to track user visits to specific areas or functions, etc.;
7. Log File Information: automatic logging of startup/stop times, interaction methods, etc., during each visit to the App;
8. Advertising-Related Information: ad display times and dates, click or conversion records, ad content and type, ad placement information, etc.;
9. In-App Events: tutorial steps, upgrades, payments, in-app purchases, custom events, progress events, and methods to restrict user data processing, etc.

The above information is typically collected automatically by third parties, and we do not directly control how it is processed; therefore, the responsibility for processing such information lies with the relevant third parties. Some third parties may associate this data with user information already known in their databases (e.g., age, gender, etc.) using their technologies. We are not responsible for controlling, supervising, or guaranteeing this processing.

Payment Information

Our e-commerce provider, Google LLC, handles in-app purchase billing and processes payments through Google Play Billing, securely storing the relevant personal information. We do not have access to or use your credit card or debit card information.

Email Communication

If you purchase a subscription on chatlulu.com and activate it by signing in with your Google account, we may, based on legitimate interests, use your email address to send you communications (newsletters) that include special subscription offers, feature and service updates, and other messages related to the App.

You are also aware and agree that we may process certain personal data (such as name, subscription purchase date, geographic location data, activity information, etc.) in market analysis activities, in order to send you targeted communications that are more tailored to your needs and interests.

You can unsubscribe at any time by using the "unsubscribe" link in any email we send. Your unsubscribe request will be processed within a reasonable period.

III. Purposes for Processing Personal Data

Our mission is to continuously improve the App and provide you with new experiences. The primary purposes for which we use your information include:

• Providing Services: Using functional information and automatically processed information to offer you the features you require;
• Improving, Testing, and Monitoring App Efficiency: Analyzing automatically processed information to better understand user behavior and trends, detect potential issues, and optimize the App;
• Providing Interest-Based Advertising or Other Targeted Content: Showing you advertisements or content that better match your interests;
• Communication with You: For example, sending newsletters, marketing activities, user feedback, policy and terms updates, etc.;
• Preventing Fraud and Spam, Enforcing the Law: Ensuring the App's security, preventing fraud, protecting trademarks, and enforcing the Terms of Use.

If new purposes for processing arise in the future, we will notify you by modifying this Privacy Policy. All processing purposes will remain consistent with the categories disclosed in the Google Play Data Security form.

IV. Information Sharing

We only share your information with third parties in the manner described in this Privacy Policy. We comply with the Digital Advertising Alliance (DAA) Mobile Environment Self-Regulation Principles. We adhere to the third-party sharing restrictions and disclosure requirements set forth in Google's Play User Data Policy.

Security and Responsibility：When integrating external services, we choose third-party providers that can demonstrate they have implemented the necessary technical and organizational measures to protect user data. However, we cannot guarantee the absolute security of data during transmission from us to third parties and are not responsible for any accidental loss or unauthorized access caused by third parties.

We do not rent or sell your personal data, but we may share cookie data, log files, device identifiers, and location information with third-party organizations that provide automated data processing technologies. These third parties may subsequently use this information to serve targeted ads to you.

Below is a list of major third-party service providers that offer infrastructure, functionality, or service improvements for the App (if any new AI video generation service providers are added in the future, we will update the list accordingly):

Entity Name	Service Provided	Entity Location	Privacy Policy Link
Amazon.com, Inc.	Cloud Storage	United States	https://aws.amazon.com/privacy/
Amplitude Inc.	Analytics Service	United States	https://amplitude.com/privacy
Anthropic PBC	AI-Generated Content	United States	https://console.anthropic.com/legal/privacy
Adjust Inc.	Analytics Service	United States	https://www.adjust.com/terms/privacy-policy/
Adjust Inc.	User Authentication, Analytics & Marketing	United States	https://www.adjust.com/terms/privacy-policy/
Fireworks AI Inc.	AI Model Deployment Cloud Platform	United States	https://fireworks.ai/privacy-policy
Microsoft Corporation	Internet Search Results Provider	United States	https://privacy.microsoft.com/en-us/privacystatement
OpenAI, L.L.C.	AI-Generated Content	United States	https://openai.com/privacy/
Stability AI Ltd.	AI-Generated Content	United Kingdom	https://stability.ai/privacy-policy
Qonversion Inc.	In-App Subscription Implementation & Analytics	United States	https://qonversion.io/page/privacy

For privacy options (including opt-out mechanisms), please refer to the respective links.

We may disclose your personal information in the following circumstances:

• As required by law or regulation;
• To protect the rights, property, or safety of ourselves, you, or others, or to investigate fraud;
• In the event of a merger, acquisition, or sale of assets, we will provide prominent notice of any changes in ownership or information usage within the App, as well as any choices you may have.

V. International Data Transfers

We operate globally and provide services for this App to users worldwide. We and third-party service providers or advertising partners that provide automated data processing technologies for this App may transfer automatically processed information across borders — that is, from your country or jurisdiction to other countries or jurisdictions around the world.

If you are located in the European Union or other regions where data processing regulations differ from those in the United States, please note: we may transfer information (including personal information) to countries or jurisdictions that do not have equivalent data protection laws to those in your region.

This means that your personal information may be transferred to a third country, a region within a third country, or one or more specific departments, or it may be transferred to an international organization. The data protection and confidentiality regulations of such countries/regions/organizations may not provide the same level of personal data protection as those in your jurisdiction.

We will take reasonable steps to ensure that any party receiving personal data provides appropriate protection for the data in accordance with current personal data protection laws. By using this App, you consent to the transfer of your personal data in the manner described above.

For data storage purposes, we rely on hosting providers that have passed our security and reliability audits; where feasible, personal data will be encrypted before transfer.

VI. Data Retention Period

We generally retain your personal information only for the period necessary to provide the functionality of this App and to comply with legal obligations. If you no longer wish us to continue using and storing the information we can access, you may request that we delete your personal information and close your account.

However, some data may still need to be retained for a certain period for purposes such as complying with legal obligations (e.g., tax, accounting, or auditing), maintaining security and data backups, preventing fraud, or other malicious activities, but such data will not be retained for longer than necessary for the storage purposes.

VII. Exercising Your Rights

Applicable data protection laws grant you several rights regarding your personal information. For the personal information we collect about you, you may:

• Data Access and Portability:Request a copy of your personal information;
• Data Modification or Correction:If you are unable to update your data through your account, you can request us to correct, modify, update, or rectify your data;
• Data Retention and Deletion:Request us to delete all or part of the personal data we hold;
• Restriction of Processing:In certain circumstances, limit how we use your personal information;
• Knowledge of Data Sharing: Inquire whether your data has been shared with third parties (for details, see Section IV of this Privacy Policy).

To exercise any of the above rights, please contact us through the support form in the App. Please note that we can only ensure the exercise of these rights concerning the information we actually have access to and store.

If you believe that your rights under applicable data protection laws have been violated, you also have the right to file a complaint with your local data protection or supervisory authority.

If you are located in the European Union, you may also contact our representative for privacy matters: Nick, via email at [email protected].

VIII. Opt-Out Options

Opt-Out of Marketing Tracking

You can manage the permissions for activity tracking on your own. For example, if you do not want third-party service providers to deliver personalized ads based on your interests, you can follow these steps:

• Android 12 and above: Settings > Privacy > Ads > Delete Ad ID (or Reset Ad ID)
• Android 11 and below: Settings > Google > Ads > Turn off Ad Personalization

For more information, please visit Google Ads Policies.

Even if you opt-out of certain interest-based ads, you may still receive context-based or aggregated ads (based on non-personal information).

Opt-Out of Location Data Processing

If you do not wish third-party service providers to use your precise location data or street-level location information, you can follow these steps:

Settings > Location > App Location Permission — Select Deny or Allow only while using the app. You can also long press the App icon > App Info > Permissions > Location to make adjustments.

IX. Security

We take the security of your personal information seriously and follow industry-recognized standards to protect the personal information you submit during transmission and after we receive it. We implement reasonable and appropriate measures to prevent the loss, misuse, unauthorized access, disclosure, alteration, or destruction of personal information, considering the processing risks and the nature of the personal data.

We have implemented appropriate technical and organizational measures to apply data protection principles (e.g., data minimization) and integrate necessary safeguards during processing. Where feasible, personal data will be encrypted during transmission and storage (including hashing).

We comply with Google Play security compliance requirements (such as Play App Signing, Play Integrity API) to protect the integrity of the App.

However, no method of internet transmission or electronic storage can be guaranteed to be 100% secure. In the event of a security breach that threatens your personal information, we will notify you promptly in accordance with applicable laws.

If you have any questions about the security of this App, you can contact us at any time through the support form in the App.

X. Children's Privacy

This App is not intended for children, and it is not part of the Google Play Families program. For the purposes of this policy, the definition of "children" will be determined based on the applicable data protection laws. In general, we consider individuals under the age of 16 to be "children" (unless local laws or verified parental consent stipulate otherwise).

We do not knowingly or intentionally collect personal information from children. Without verifiable parental consent, users who are considered "children" may not provide personal information to the App.

If we discover that we have collected personal information from a child without verifiable parental consent, we will promptly delete the relevant content. If you believe we hold information about a child, please contact us immediately.

XI. Changes to the Privacy Policy

This Privacy Policy will be periodically updated. Whenever we make changes to this policy, we will post the revisions on this page and other locations we deem appropriate. If applicable, we will also provide additional notifications.

XII. Contact Us

If you have any questions about this Privacy Policy, please contact us through the support form in the App or email us at [email protected].