Privacy Policy

Introduction (California Region Notice)

Hong Kong Endless Flow Technology Limited("we," "our," or "the Company") values your privacy. This Privacy Policy (“Privacy Policy”) outlines our data protection practices and explains the types of personal information we may process when you install and/or use the ChatLulu mobile software application (the “App” or “this App”).

When we refer to personal data (or personal information), we mean any information that relates to an identified or identifiable natural person, either directly or indirectly.

This Privacy Policy applies to all individuals who access or use the App (“users”).

I.Please read the following Privacy Policy carefully. By using the App, you acknowledge that you have read, understood, and agreed to be bound by its terms.

California Residents – Special Notice

Under the California Consumer Privacy Act of 2018 (CCPA), California residents have the right to request:

1. Disclosure of the categories of personal information being processed;
2. Disclosure of the categories of sources from which personal information is collected;
3. Disclosure of the purposes for processing personal information;
4. A list and categories of third parties with whom we may share your personal information;
5. Access to the specific pieces of personal information we may hold about a particular user (provided the request includes sufficient information to allow us to verify the user's identity).

Please use the following links to quickly navigate to the relevant sections of this Policy:

• Personal Information — Categories, Sources, and Purposes of Processing >>
• Sharing — How We Share Your Information >>
• Opt-Out Options — How to Limit or Withdraw Consent >>

NOTE: Under the CCPA, "personal information" does not include de-identified or aggregated consumer data.

Please also note that all third parties involved in processing user data are service providers who use such information based on agreements and for business purposes.

REQUESTS

To submit a verifiable consumer request for access, portability, or deletion of personal data, please contact us via the contact form. In the body of your message, please include the phrase “Your California Privacy Rights.”

When submitting a verifiable request, you should be prepared to:

Provide sufficient information to allow us to reasonably verify that you are the person whose personal information we collected, or an authorized representative. This may include your name, address, city, state/province, ZIP code, and email address. We may use this information to present you with a series of security questions to verify your identity. If you are submitting the request through an authorized agent acting on your behalf, that agent must provide written authorization or a power of attorney signed by you.

Please clearly describe your request so that we can properly understand, evaluate, and respond to it.

If we are unable to: (i) verify your identity or the authority of the person submitting the request; or (ii) confirm that the personal information is related to you, we will not be able to respond to your request or provide personal information. We may ask you to provide additional information or documents to verify your identity. Before taking any action on your personal information, we may also verify it, including using third-party identity verification services. This is a safeguard to prevent your personal information from being disclosed due to fraudulent or deceptive requests.If we are unable to: (i) verify your identity or authority to make the request; or (ii) confirm the personal information relates to you, we will not be able to respond to your request or provide you with personal information. We may request additional information or documentation to verify your identity. Before taking any action on your personal information, we may also conduct verification, including the use of third-party identity authentication services. This is considered a safeguard to prevent your personal information from being disclosed in response to a fraudulent or deceptive request.

We ensure that any personal information provided in a verifiable consumer request will be used solely to verify the requester’s identity or authority to make the request and for no other purpose. We will retain this information for only as long as reasonably necessary for the purposes described above, and delete it once those purposes have been fulfilled.

We aim to respond to verifiable consumer requests within forty-five (45) days of receipt. If more time is needed, we will inform you in writing of the reason and extension period. Please note that we are only required to respond to two requests per customer per year.

EQUAL RIGHTS

The manner in which we handle your requests shall not be interpreted as discriminatory. This means that if you choose to exercise your rights, we will not treat you differently in terms of pricing, products, or levels or quality of service. However, in certain cases, if you choose to have your personal information deleted from our records, we may be unable to provide certain services.

DATA SALES

We do not sell any of your personal data to third parties.

II. INFORMATION WE PROCESS

FUNCTIONAL INFORMATION

The following information is requested and processed when you use the App. This type of information is necessary to fulfill the contract between you and us and to provide the full functionality of the App. Without this information, we would not be able to offer you the complete service.

Several categories of information may be processed.

• EMAIL ADDRESS
  • If you purchase a subscription on >chatlulu.com (the “App Website”) and wish to access premium features, you must log into an existing ChatLulu account or create a new one within the App.
  • When you choose to create a ChatLulu account by entering your email and completing the verification process, we record your email address.
  • You may also log in using the “Sign in with Apple” or “Sign in with Google” buttons, in which case only the authentication credentials provided by Apple or Google will be used.
  • We do not access, use, store, or share your Google user data. The authorization process is completed via OAuth 2.0, a secure protocol implemented by Google.
  • We use your email address to identify your subscription purchase and send you invoices; it may also be used for other purposes as described in the “Email Communications” section.


• USER CONTENT (i.e., the text you enter in the message box, files you attach and send, and any text, images, or videos generated through the App’s AI features). Subject to the relevant rules and restrictions in the Terms of Use, you are free to use, share, or otherwise manage your User Content, but you assume all related risks and responsibilities.
  You are responsible for ensuring your use of User Content complies with applicable laws. We engage third-party service providers—including OpenAI L.L.C., Stability AI Ltd., and Anthropic PBC—to process and generate AI User Content (text, images, and video).
  If you enable the “Ask the Web” feature, your input will also be processed by Microsoft Corporation and Google LLC to retrieve internet search results and update the output accordingly. See Section IV for more information on the privacy policies and practices of these third parties.


• CONTACT INFORMATION(name, email address, and any other information you provide via email or the in-app support form). We collect, store, and process this information in collaboration with the cloud storage provider Amazon.com, Inc. in order to respond to your inquiries, fulfill your requests, send requested communications, and deliver the corresponding services.
• FACIAL DATA (ON-DEVICE PROCESSING)To provide the real-time avatar animation feature, the App may request access to your device's TrueDepth camera. When you grant permission, the App uses the TrueDepth camera to analyze your facial expressions in real-time.

AUTOMATICALLY PROCESSED INFORMATION

With your consent, we use third-party automated data processing technologies (advertising/analytics tools) to analyze certain information transmitted from your device via the App, including your advertising identifier (IDFA).

Some integrated advertising or analytics tools (see Section IV) may automatically process your personal data, including “profiling”: automated evaluation of characteristics related to your personal preferences, interests, behavior, location, or movement.

• Automated processing begins once you allow the App to track your activity. You can revoke consent at any time—see the Opt-Out Options in Section VIII.
• Based on legitimate interest, we may also process certain device and user behavior data in aggregated form to improve the App and provide the best experience.

The following are examples of information that may be automatically collected and processed (list consistent with the original English version):

1. Device Details: Device type, operating system and version, model and manufacturer, screen size and density, screen orientation, volume, battery status and life, load time, latency, frame rate, memory usage, etc.;
2. Network Connection Info: Mobile carrier, network provider, network type, IP address, session timestamps and duration, speed, browser type, etc.;
3. Location Information: Country/region/state/city associated with IP address, SIM card, or device, language settings, time zone, nearby points of interest (e.g., coffee shops);
4. Other Device Identifiers: Such as app developer–assigned user identifiers;
5. App Information: App name, API key, version and attributes—some services may log a list of other apps/processes installed or running on the device;
6. Cookies and Similar Technologies: Pixels, web beacons, scripts, etc., used for statistics such as user visits to specific areas or features;
7. Log File Information: Automatically recorded data such as app start/stop time and interaction types during each session;
8. Advertising-Related Information: Time and date of ad impressions, click or conversion records, ad content and type, ad placement info, etc.;
9. In-App Events: Tutorial steps, upgrades, payments, in-app purchases, custom events, progress events, and methods for limiting user data processing.

The above information is typically collected automatically by third parties, and we do not have direct control over their processing methods. Therefore, responsibility for processing such data lies with the respective third parties. Some of these third parties may use their own technologies to link this data with known user information (e.g., age, gender), over which we have no control, oversight, or guarantee.

PAYMENT INFORMATION

Our e-commerce provider, Apple, is responsible for billing, processing, and charging in-app purchases, and securely stores the related personal information. We do not have access to or use your credit or debit card information.

EMALL COMMUNICATIONS

If you purchase a subscription on chatlulu.com and activate it using “Sign in with Apple,” we may, based on legitimate interest, use your email address to send you communications (newsletters), which may include: special subscription offers, updates on features and services, and other messages related to the App.

You also acknowledge and agree that we may process certain personal data (such as your name, subscription purchase date, geographic data, and activity information) as part of market analysis activities to deliver more relevant and targeted communications based on your needs and interests.

You may unsubscribe at any time by clicking the “Unsubscribe” link included in any of our emails. Your unsubscribe request will be processed within a reasonable timeframe.

III. PURPOSES OF PROCESSING PERSONAL DATA

Our mission is to continuously improve the App and deliver new experiences for you. The primary purposes for which we use your information include:

• Providing Services: Using functional and automatically processed information to deliver the features you request;
• Improving, Testing, and Monitoring App Performance: Analyzing automatically processed information to better understand user behavior and trends, detect potential issues, and optimize the App;
• Delivering Interest-Based Advertising or Other Targeted Content: Showing you ads or content that better match your interests;
• Communicating with You: For example, sending newsletters, marketing campaigns, user feedback requests, policy and terms updates, etc.;
• Preventing Fraud and Spam, and Enforcing the Law: Ensuring App security, preventing fraud, protecting trademarks, and enforcing the Terms of Use.

If new purposes for processing arise in the future, we will notify you by updating this Privacy Policy.

IV. INFORMATION SHARING

We only share your information with third parties as described in this Privacy Policy. We adhere to the Digital Advertising Alliance (DAA) Self-Regulatory Principles for the Mobile Environment.

Security and Responsibility：When integrating external services, we select third parties that can demonstrate the use of appropriate technical and organizational measures to protect user data. However, we cannot guarantee absolute security during the transmission of data to third parties and are not responsible for any accidental loss or unauthorized access resulting from third-party actions. We do not share any facial data with third parties, as all facial processing occurs exclusively on your device and no facial data is collected or stored by us.

We do not rent or sell your personal data, but we may share cookie data, log files, device identifiers, and location information with third-party organizations that provide automated data processing technologies. These third parties may subsequently use this information to serve you targeted advertising.

Below is a list of key third-party service providers that support the App’s infrastructure, functionality, or service enhancements. (If new providers are added in the future, such as for AI video generation, we will update this list accordingly):

Entity Name	Service Provided	Entity Location	Privacy Policy Link
Amazon.com, Inc.	Cloud Storage	USA	https://aws.amazon.com/privacy/
Amplitude Inc.	Analytics Service	USA	https://amplitude.com/privacy
Anthropic PBC	AI-Generated Content	USA	https://console.anthropic.com/legal/privacy
AppsFlyer Inc.	Analytics Services	USA	https://www.appsflyer.com/legal/services-privacy-policy/
Adjust Inc.	User Authentication, Analytics & Marketing	USA	https://www.adjust.com/terms/privacy-policy/
Fireworks AI Inc.	AI Model Deployment Cloud Platform	USA	https://fireworks.ai/privacy-policy
Meta Platforms Inc.	Analytics / Ad Management	USA	https://www.facebook.com/privacy/explanation
Google LLC	Internet Search Results	USA	https://policies.google.com/privacy
Microsoft Corporation	Internet Search Results	USA	https://privacy.microsoft.com/en-us/privacystatement
OpenAI, L.L.C.	AI-Generated Content	USA	https://openai.com/privacy/
Stability AI Ltd.	AI-Generated Content	UK	https://stability.ai/privacy-policy
Qonversion Inc.	In-App Subscription Implementation & Analytics	USA	https://qonversion.io/page/privacy

To learn about each service’s privacy options, including opt-out mechanisms, please refer to the respective links.

We may disclose your personal information under the following circumstances:

• To comply with legal or regulatory obligations;
• To protect the rights, property, or safety of ourselves, you, or others, or to investigate fraud;
• In the event of a merger, acquisition, or sale of assets, we will prominently notify you within the App of any change in ownership or use of your information, as well as any choices you may have.

V. INTERNATIONAL DATA TRANSFERS

We operate globally and provide this App to users around the world. We, along with third-party service providers or advertising partners that deliver automated data processing technologies for the App, may transfer automatically processed information across borders—that is, from your country or jurisdiction to other countries or jurisdictions around the world.

If you are located in the European Union or other regions with data protection laws that differ from those in the United States, please note that we may transfer information (including personal information) to countries or jurisdictions that may not provide the same level of data protection as your own.

This means your personal information may be transferred to a third country, a region within that third country, one or more specific sectors, or to an international organization where the laws on data protection and confidentiality may not provide the same level of protection as those in your jurisdiction.

We will make every effort to ensure that any party receiving personal data provides adequate protection for that data in accordance with applicable data protection laws. By using the App, you consent to the transfer of your personal data as described above.

For data storage purposes, we rely on hosting providers that have passed our security and reliability assessments; where feasible, personal data is encrypted prior to transfer.

VI. DATA RETENTION PERIOD

We generally retain your personal information only for as long as necessary to provide functionality and services through the App and to comply with legal obligations. If you no longer wish for us to use the information we have actual access to and store, you may request that we delete your personal information and close your account.

However, some data may need to be retained for a certain period for purposes such as compliance with legal obligations (e.g., tax, accounting, or auditing), maintaining security and data backups, and preventing fraud or other malicious activities. Such data will never be retained beyond the duration necessary to fulfill its storage purpose.

Facial data is not retained. The numerical coefficients generated from facial expression analysis exist only in active memory during your App session and are immediately deleted when the session ends. We do not store any facial data on our servers or your device.

VII. EXERCISING YOUR RIGHTS

Applicable data protection laws grant you several rights regarding your personal information. For the personal information we collect about you, you may:

• Data Access and Portability:Request a copy of your personal information;
• Modify or Correct Data:If you are unable to update your data through your account, you may request that we correct, modify, update, or rectify it;
• Data Retention and Deletion:Request us to delete all or part of the personal data we hold;
• Restriction of Processing:Under certain circumstances, restrict how we use your personal information;
• Know About Data Sharing: Learn whether your data has been shared with third parties (see Section IV of this Privacy Policy for details).

To exercise any of the above rights, please contact us via the in-app Support Form. Please note that we can only guarantee the fulfillment of these rights for data we actually access and store.

If you believe your rights under applicable data protection laws have been violated, you also have the right to file a complaint with your local data protection or supervisory authority.

If you are located in the EU, you may also contact our representative for privacy-related matters:**Nick**Email: [email protected]

VIII. OPT-OUT OPTIONS

Opting Out of Marketing Tracking

You can manage activity tracking permissions on your own. For example, if you do not want third-party service providers to deliver personalized ads based on your interests, you can take the following steps:

• Go to Settings > Privacy & Security > Tracking, and disable or enable “Allow Tracking” for specific apps. You can also control whether apps are allowed to request to track your activity.
• If you do not want the App to access your device’s advertising identifier (IDFA), go to Settings > Privacy & Security > Tracking and turn off the switch for “Allow Apps to Request to Track.”

For more information, visit https://support.apple.com/en-us/HT212025.

Please note that even if you opt out of certain interest-based advertising, you may still receive contextual ads (based on non-personal information).

Opting Out of Location Data Processing

If you do not want third-party service providers to use your precise location data or street-level location information, you can take the following steps:

iOS 11 or later: Go to Settings > Privacy > Location Services, turn off location services for the relevant product. Then select this App and set Share My Location to Never.

IX. SECURITY

We take the security of your personal information very seriously and follow industry-standard practices to protect the personal data you submit, both during transmission and once received. We implement reasonable and appropriate measures, aligned with the risks and nature of the personal information processed, to prevent loss, misuse, unauthorized access, disclosure, alteration, or destruction.

We have put in place suitable technical and organizational measures to uphold data protection principles (such as data minimization) and incorporate necessary safeguards throughout processing. Where feasible, personal data is encrypted (including hashing) during both transmission and storage.

However, no method of internet transmission or electronic storage is 100% secure. In the event of a security breach that compromises your personal information, we will notify you promptly in accordance with applicable law.

If you have any concerns about the App’s security, you may contact us at any time via the in-app Support Form.

X. CHILDREN'S PRIVACY

This App is not intended for use by children. Under this policy, the definition of “children” is determined according to the applicable data protection laws. In general, we consider individuals under the age of 16 to be “children” (unless otherwise specified by local law or with verified parental consent).

We do not knowingly or intentionally collect personal information from children. No user considered a “child” may provide personal information to the App without verifiable parental consent.

If we become aware that we have collected personal information from a child without parental consent, we will promptly delete such data. If you believe we may be holding information about a child, please contact us immediately.

We do not process facial data from children. If we become aware that a child has used the facial animation features, we will immediately terminate the session and ensure no data is retained.

XI. CHANGES TO THE PRIVACY POLICY

This Privacy Policy will be updated periodically. Whenever we make changes to the policy, we will post the revised version on this page and in other places we deem appropriate; where applicable, we will also provide additional notice.

XII. CONTACT US

If you have any questions about this Privacy Policy, please contact us via the in-app Support Form or by sending an email to [email protected].