AI Services and Data Processing Agreement

Chapter 1 Definitions and Scope

1.1“Interaction Data” means content you generate or submit when using AI features, including text messages, voice input, images you send, and the historical conversation fragments and companion memory attached in order to maintain context. Interaction Data does not include your account profile, login credentials, payment records or device identifiers.

1.2“Model service provider” means a technology service provider that supplies us with large language model inference, speech recognition, speech synthesis, voice cloning, image understanding or similar capabilities.

1.3“De-identification” means the removal or replacement of direct and indirect identifiers so that the data cannot be linked to a specific individual without additional information, and we do not retain any mapping that could be used for re-identification. The specific measures are set out in Section 4.3.

1.4This Agreement governs the transmission, processing, retention and service-improvement use of Interaction Data in AI features. The general rules on the processing of personal information are governed by the Privacy Policy.

1.5This Agreement applies to text chat, group chat, voice input, read aloud, photo scan, translate, live call, and the model inference involved in custom companions and voice cloning.

1.6The terms “companion”, “custom companion”, “points”, “quota”, “points that never expire”, “Points Pack”, “30-Day Pass”, “Subscription Center” and “voice cloning” used in this Agreement have the same meanings as in Section 1.8 of the Terms of Service.

Chapter 2 Third-Party Processing Necessary for the Service

2.1Our AI capabilities are delivered through the interfaces of third-party model service providers. To generate replies and to run content safety checks, Interaction Data must be transmitted to those providers for processing. Content safety checking is an integral part of generating a reply: it is carried out within the same processing flow as inference, by the same provider in the same region, it does not constitute a separate purpose of processing, and it does not expand the categories of data transmitted. This is a technical precondition of the AI features and the features cannot be provided without such transmission.

2.2The main model service providers and their uses as at the date of this Agreement. For every model and voice capability we use a service endpoint located in the Singapore region (or outside mainland China); we do not call servers located in mainland China and do not engage service providers located in mainland China to process Interaction Data. The providers listed below are the main ones as at the effective date of this Agreement. The complete list (including each provider's processing purpose, location and retention period) is set out on the Sub-processors page, which is maintained in step with this Agreement and prevails over it in the event of any inconsistency:

(a)Alibaba Cloud Model Studio (DashScope), Singapore region: Qwen family large language model inference (text chat, group chat, companion decision-making), speech recognition (ASR), speech synthesis (TTS), real-time voice interaction and voice cloning. Data processed: conversation text and context, voice audio, text to be synthesised, voice samples.

(b)DeepSeek family models: these are open-source models developed by DeepSeek, but we do not call DeepSeek's official interface; we obtain inference capability through the model hosting service (MaaS) of Alibaba Cloud Model Studio (Singapore region). The endpoint is a model service address in the Singapore region, and computing and inference take place in the Singapore region. As the model developer, DeepSeek does not receive your Interaction Data as a result of those calls, and we do not transmit data to its servers. Uses: text chat, group chat decision-making, content safety checks before reply generation. Data processed: conversation text and context.

(c)Microsoft Azure: AI Speech (Southeast Asia / Singapore region) is used for speech synthesis for some voice profiles, and the data processed is the text to be synthesised; AI Translator (a global-region resource, not Azure China operated by 21Vianet) is used for text translation, and the data processed is the text to be translated.

(d)Alibaba Cloud (Singapore region): hosts the cloud infrastructure and data storage for the calls described above (cloud servers, object storage, backups). Data processed: account data, conversation records, media files and backups.

(e)Alibaba Cloud Model Studio (Singapore region) vision understanding model (Qwen-VL): recognises the content of images you send. Data processed: the images you upload and the prompt text.

(f)None of the providers listed above processes Interaction Data within mainland China. If a processor located in mainland China is genuinely required in future, we will update this Agreement and obtain your separate consent before implementation; you may refuse without affecting your use of other features.

2.3We may add, replace or reduce model service providers. Where such a change occurs, we will update the Sub-processors page and Section 5.2 of the Privacy Policy at least 30 days before it takes effect and notify you through in-app messages; such updates do not constitute an amendment to the body of this Agreement. Where a change involves a new purpose of processing, an expansion of the scope of processing, or a new processor located in mainland China or in another new country or region, we will obtain your consent separately.

2.3.1Upgrades to models and inference engines: we continuously upgrade or replace the underlying models, inference engines and voice and image engines, including version iterations of a provider's models, replacement of a provider, or a move to self-hosted inference. Such upgrades do not change the purposes, data categories or protection standards under this Agreement; they do not expand the scope of data transmitted and do not alter the retention periods or processing locations set out in Chapters 5 and 10. Where an upgrade leads to a substantive change in the manner of processing (new data categories, a new processing location, a new retention period or a new purpose), we will update the list under Section 2.3 and obtain consent separately in accordance with law.

2.4We enter into data processing terms with model service providers requiring them to: (a) process Interaction Data only on our instructions; (b) not use the data to train their general models (as provided in the commercial terms); (c) apply appropriate security measures; and (d) delete or return the data after the service ends.

2.5Minimisation before transmission: we transmit only the content necessary for generating a reply and for content safety checks, and we do not send your email address, account ID, payment information or device identifiers with a request. To reduce linkage risk, requests carry a temporary session identifier rather than an account identifier. Data used for service improvement follows the same principle, as set out in Chapter 4.

2.6Some features have a minimum membership tier. The specific thresholds and tier settings are those displayed in the app and may be adjusted under Section 8.17 of the Terms of Service. Where your tier does not meet the requirement, the request is not sent and we do not collect the samples required for that feature.

Chapter 3 Data Flows and Processing Partners

3.1You are the originator of Interaction Data. We determine the purposes and means of processing Interaction Data as a data controller (GDPR) or a business (CCPA).

3.2Model service providers process Interaction Data as our processor or service provider, acting only on our instructions.

3.3Processing chain: your device → our servers (Singapore) → model service provider interface → result returned → our servers → your device. We retain conversation records on the server side for displaying history and maintaining context memory.

3.4Voice chain: voice input is converted in format on our servers and then transmitted to the speech recognition service; the recognised text then enters the conversation chain. Speech synthesis processes only the text to be read aloud and does not involve your voiceprint. Voice cloning additionally requires your separate consent, as set out in the Companion Creation and Voice Cloning Agreement (UD-VRC-01).

3.5Billing chain: to calculate points consumption, we record on the server side the event type, timestamp and points consumed for each AI call. That record does not contain the body of the conversation and is retained solely as billing evidence (see Section 7.1(e) of the Privacy Policy).

Chapter 4 Service Improvement and De-identified Use

4.1We use your Interaction Data after de-identification to improve this service. Improvement is limited to: (a) reply quality and context understanding; (b) the accuracy of safety filtering and content risk control; (c) prompting strategy and conversation flow; (d) the accuracy of speech recognition and speech synthesis; (e) translation quality; and (f) fault reproduction and performance optimisation.

4.2Boundaries of use: the data described above is used only for this service. It is not used to develop other products unrelated to this service, is not provided to third parties for training their models, is not used for advertising targeting, the sale of personal information or credit assessment, and is not used to evaluate, score or classify you or to make automated decisions producing legal or similarly significant effects on you. We do not use the conversation understanding formed in your conversations with a companion to train models. Samples from persons below the age of majority for this service are not included in those data sets; once we become aware of them we remove them from the pending batch.

4.3Specific de-identification measures. We apply both structural measures (the form of the data) and content measures (the text); both are required:

(a)Structural measures: data sets used for improvement do not record your account identifier, login credentials, device identifiers, IP address, precise geolocation or precise timestamps. Each batch contains only the conversation text, the identifier of the companion or group to which the conversation belongs (the identifier itself contains no account information), and the year and month (not the day or time). For companions you create, the creator identifier is not recorded; file naming and indexing of the data also contain no account identifier.

(b)Content measures: direct identifiers appearing in the text are replaced with placeholders or removed. The scope is grouped by category and is updated as Service Regions are added or removed; the following examples are not exhaustive:

1) Contact details: telephone numbers (including international formats and the local formats used in each Service Region, such as forms with brackets, hyphens or spaces), email addresses, delivery and residential addresses (including unit numbers and street names, in any language or writing system), and postal codes;

2) Identity documents: national identity cards, resident registration numbers, social security numbers, tax numbers, passport numbers and driving licence numbers in each country, as well as identifiers commonly used in each jurisdiction (such as the Korean resident registration number, Singapore NRIC/FIN, Japanese My Number, Taiwan region identity card number, Hong Kong, China identity card number, Malaysian MyKad, and Mexican CURP/RFC);

3) Financial data: bank card numbers (including forms separated by spaces or hyphens), international bank account numbers (IBAN) and crypto-wallet addresses;

4) Identity and online identifiers: the name you give us and any name you state in the conversation, usernames, social platform accounts and profile links, and web addresses;

5) Device data: device identifiers (IMEI, MAC address, device UUID).

The guiding principle is to replace rather than miss: over-replacement costs only a small amount of corpus, whereas under-replacement can create irreversible identification risk. To preserve the usability of the corpus, for categories that are easily confused with order numbers, amounts or plain digit strings (such as document numbers and bank card numbers), we replace only where two conditions are both met: a contextual keyword and a format check. We maintain an auditable internal rule list and review its coverage quarterly.

(c)Quasi-identifier suppression: for fields such as occupation, city, age band and interests that could, in combination with other information, re-identify an individual, we generalise. Occupations are mapped to broad categories, and specific job titles, employers and establishments are not retained; locations are generally not more precise than city level, cities with small populations are merged into the provincial or national level, and city-states retain only the country; ages are expressed as bands and precise dates of birth are not used; interests are normalised against a controlled vocabulary, free text that does not match the vocabulary is not retained, and the number of interest items per record is capped; combinations with too few samples (for example, too few samples in the same broad occupational category, city and age band) are either not retained or the city is merged into a higher level.

(d)Irreversibility: de-identified data is stored separately from the original data, we do not retain any mapping table that could be used for reverse linkage, and we do not attempt, manually or automatically, to re-link that data to any specific individual.

4.4On the nature of de-identified data: our objective in applying the measures above is to make the data incapable of identifying a specific individual. Jurisdictions differ, however, on whether de-identified data remains personal information, so we do not assert that such data is necessarily outside the scope of personal information; whatever the legal characterisation, we protect it to the standard applicable to personal information.

4.5Basis of use and objection: the use described in this Chapter forms part of the service. Its basis is processing necessary to provide and improve the service; it does not require your separate consent, and it does not constitute your authorisation for the third-party transfers described in Chapter 2 (the basis for Chapter 2 is set out in Section 2.1). We do not make your acceptance of the use described in this Chapter a condition of providing the service. If you do not wish your Interaction Data to be included in future batches, you may make a request using the contact details in Section 16 of the Privacy Policy, and we will give effect to it in the next batch after verification; that choice does not affect your continued use of this service.

4.6Consequences and technical limits of stopping inclusion: once you make the request, we stop including the Interaction Data of that account in future batches. De-identified data, however, is no longer linked to your account, so we cannot locate and separately delete your portion from existing batches; improvements already made to the models cannot be reversed either. We state this honestly and do not promise that such data can be deleted in full.

4.7Relationship with Chapter 2: the transmission of data to model service providers in order to generate replies (Chapter 2) is a technical precondition of the AI features and is not the improvement use described in this Chapter. If you refuse that transmission, we cannot provide the AI chat and voice features (see Section 6.4).

4.8We do not currently train foundation models ourselves; the use described above is limited to optimising prompting strategy, reply quality, safety filtering, and voice and translation performance. If we undertake foundation model training in future, we will obtain your separate consent and describe the data scope and measures in this Agreement.

Chapter 5 Retention and Deletion

5.1We retain data in tiers according to its purpose, and the periods differ between tiers. The periods below run from the occurrence of the relevant event:

(a)Production environment (Singapore servers): Interaction Data is retained while the account exists, for displaying history and maintaining context. After you delete a single conversation, or a conversation with a particular companion, we delete that part from the production environment within 30 days;

(b)Daily backups (Singapore object storage, encrypted at rest): these contain only accounts, binding relationships, orders, points and entitlement ledgers, subscriptions, coupons and operational configuration; they do not contain the body of conversations or memory. Backups rotate in three tiers: one copy per day for the last 30 days, one copy per month for the following 12 months, and one copy per year for the following 7 years, with anything beyond that erased automatically. Conversation content therefore produces no backup copies; after ledger-type data is deleted, it disappears with the daily backups within about 30 days, with the monthly backups within 12 months, and with the yearly backups within 7 years;

(c)De-identified data sets (Singapore object storage): generated under Chapter 4 and stored by batch, retained for 24 months from the date of generation and deleted on expiry;

(d)Signature records (evidence of consent): each time you sign an agreement we keep a record containing the signing time, account identifier, contact details, a snapshot of the text of the agreement as shown to you at the time, and a tamper-evident checksum. The record evidences that we obtained your consent in accordance with law and is retained for 7 years after account closure;

(e)Risk-control and dispute files: where fraud, card misuse, chargebacks, refund disputes, abuse or complaints are involved, we retain the minimum necessary records for 3 years after the matter is closed;

(f)Payment and transaction records, points ledgers, orders and entitlement ledgers: retained in accordance with tax and accounting law for 7 years from the year in which the transaction occurred;

(g)Other categories, such as account information, server and security logs, customer service tickets and appeal records, de-identified aggregate statistics and the minimal trace retained after account closure, are retained in accordance with Section 7.1 of the Privacy Policy, which uses the same four tiers as this Section (12 months, 24 months, 3 years and 7 years).

5.2After account closure, processing is carried out separately by data type:

(a)Interaction Data (conversations, memory, conversation understanding, uploaded images and voice): deleted from the production environment on closure. This category is outside the backup scope and produces no backup copies. Batches already included in the de-identified data sets cannot be traced back to the account and are therefore not deleted on closure; they expire naturally under Section 5.1(c);

(b)Voice models and voice profiles: on closure we call the voice service provider to delete all cloned voice profiles for that account and delete the local register;

(c)Account, binding relationships and custom companions: deleted from the main account table. To prevent repeated registration to obtain new-user gifts, to handle refund disputes and to cooperate with regulators, we retain one minimal trace record containing the closure reference, an irreversible checksum (used to check whether the same credential has previously registered), the masked contact details, the closure time and the closure method, without any conversation content. It is retained for 12 months after closure, or 3 years where a risk-control matter under Section 5.1(e) is involved;

(d)Signature records: retained until 7 years after closure under Section 5.1(d);

(e)Payment and transaction records: retained under Section 5.1(f).

5.3Model service providers process request data in accordance with their commercial retention terms. We select providers on the basis that they do not train their general models on request data and that shorter retention periods are preferred.

5.4Voice samples: the original voice sample is deleted within 48 hours (whether or not the voice model is generated successfully) and is not included in any backup. The generated voice model is deleted when you delete the companion, when the account is closed, or when the companion is reclaimed for inactivity under Section 5.5, and in any event no later than 30 days after the relevant request.

5.5Storage cost and risk control: to control storage costs and reduce the risk of holding data for long periods, we may, where an account has been inactive for a long time, delete conversation records, companion personas, memory and conversation understanding, and delete the associated voice profiles; the account, companion instances not reclaimed for inactivity, orders and points records are retained. If you have made no operation on a custom companion for 30 consecutive days (chatting with that companion and editing its character settings both count as operations), we may reclaim that companion instance and delete its associated data (see Section 7.7 of the Terms of Service). We may give notice through in-app messages or other means before cleanup, but we do not guarantee delivery; failure to receive notice does not affect the validity of the cleanup. The period of 12 months accords with the shortest tier in Section 7.1 of the Privacy Policy.

5.6The minimum copies necessary to comply with legal obligations, resolve disputes or enforce this Agreement may be retained for the period necessary; where the law requires a longer period, that period applies.

5.7The periods above describe our retention ceilings and do not constitute a precise commitment that deletion will occur immediately on expiry; actual deletion follows our batch cleanup cycle and is usually completed within 30 days after the period expires.

Chapter 6 Your Rights

6.1You have the right to access, correct and delete your Interaction Data and to obtain a copy of it. The means of exercise are set out in Section 9 of the Privacy Policy.

6.2You have the right at any time to require that your Interaction Data no longer be included in future batches, by making a request through the contact details in Section 16 of the Privacy Policy; we will give effect to it in the next batch after verification, without affecting your continued use of this service. For other processing based on consent (such as voice cloning or marketing messages) you may withdraw that consent at any time, and withdrawal does not affect the lawfulness of processing carried out before withdrawal. The part already included in de-identified data sets cannot be deleted separately, for the reasons given in Section 4.6.

6.3You have the right to object to processing based on legitimate interests, or to request restriction of processing.

6.4Because the AI features depend on the third-party transfers described in Chapter 2, if you refuse those transfers we will be unable to provide the AI chat and voice features, although you may still use features that do not depend on model inference, such as account management and browsing companions.

6.5If the law of your location gives you the right to object to automated processing or to request human intervention, you may contact us; we will explain the processing logic and provide review as required by law.

Chapter 7 AI Output and Labelling

7.1Replies generated from Interaction Data after model processing (“AI Output”) are produced by algorithms. They are not created by a real person and do not represent our views.

7.2We label AI Output in the app and to the extent technically available, including companion labels, notices on the conversation screen and machine-readable metadata. You must not remove or alter those labels, or present AI Output as the work of a real person, as a record of real events, or as another person's statement.

7.3In accordance with applicable law, app store rules and our platform rules, we disclose to you that you are interacting with an artificial intelligence system and not with a natural person. This disclosure is presented prominently in the app.

7.4AI Output may contain factual errors, inconsistencies or inappropriate content. You should not rely on it as a basis for facts or as professional advice. See Chapter 5 of the Terms of Service for details.

Chapter 8 Security and Incident Notification

8.1We protect Interaction Data through measures including encryption in transit, access control, key isolation and log auditing.

8.2If a security incident affecting Interaction Data occurs, we notify you and the competent authorities in accordance with Section 8.2 of the Privacy Policy.

8.3Please do not submit passwords, payment card numbers, social security numbers, passport numbers, medical records or other highly sensitive information in conversations. AI conversations are not a suitable channel for confidential information.

Chapter 9 Governmental and Third-Party Requests

9.1If we receive legal process requiring disclosure of Interaction Data, we will review its lawfulness and scope to the extent permitted by law and, where permitted, notify you so that you may seek legal remedies.

9.2We do not provide Interaction Data to third parties for commercial purposes.

Chapter 10 Cross-Border Transfers

10.1Interaction Data is processed in the Singapore region: our servers, object storage and all language model endpoints are located in the Singapore region (Alibaba Cloud Singapore region, ap-southeast-1); speech synthesis for some voice profiles is processed in the Azure Southeast Asia region; text translation uses Azure global-region resources (not Azure China operated by 21Vianet). All of this processing takes place outside mainland China, and we do not transmit Interaction Data to servers or service providers located in mainland China for processing. The cross-border transfer mechanisms are set out in Chapter 6 of the Privacy Policy.

10.2On the location of the operator: our operator is an individual developer located in China. The operator does not download or copy Interaction Data to information systems within mainland China, and accesses the management console located in Singapore remotely from China only when handling your appeal, a security incident or a lawful investigation, subject to access controls and audit logs. Remote access by the operator's personnel from outside the country does not constitute a transfer of data to that country; in jurisdictions that require remote access to be explained, we disclose that fact under Section 6.2 of the Privacy Policy.

10.3For jurisdictions such as Japan and Korea that require separate notice and consent for transfers abroad, we inform you during the registration process of the recipient, the regime of the destination country and the means of refusal; the legal consequences of refusing such transfers are set out in Section 6.4.

Chapter 11 Miscellaneous

11.1Matters not provided for in this Agreement are governed by the Terms of Service and the Privacy Policy.

11.2This Agreement takes effect on the date you confirm it in the registration process and has the same effect as the Terms of Service.

11.3This Agreement is executed in English, which version prevails; translations into other languages are provided for reference only.

11.4If you have any question about this Agreement, please contact: hallo.uooda@gmail.com.