Summary

We collect device identifiers, subscription data, usage data, and conversations / chats to provide Chat AI 5, including AI-powered conversations, file analysis, image and video generation, search, voice input, email drafting, and AI Scheduler (iOS only; synced with Apple Calendar). The App uses third-party AI service providers and AI service platforms, including OpenAI, Anthropic Claude, Google Gemini, xAI Grok, DeepSeek, Seedance, Flux, OpenRouter, Replicate, and Coze, depending on the model, feature, and routing method used. Your conversations / chats may be uploaded, transmitted, processed, and stored with encryption and may be used to generate a personalized User Memory where enabled. You can access, delete, or limit your data (including User Memory) by contacting support@chataivoice.com or by deleting your saved conversations / chats in the App. We aim to comply with applicable data protection laws in the regions where we operate, including GDPR, CCPA, APPI, PIPA, PDPA, and PIPL. Review the full policy below.

In this Privacy Policy, "conversations" and "chats" have the same meaning. They include the content you submit, upload, generate, or share in the App, including text messages, prompts, uploaded files, documents, PDFs, images, videos, audio, voice inputs, screenshots, extracted text, previous chat context, generated outputs, and related technical metadata needed to process your request.

1. Introduction

Alzor Labs Company Limited ("we," "our," "the company") is committed to protecting your privacy. This Privacy Policy ("Privacy Policy") explains how we collect, use, share, and safeguard your personal information when you use our product Chat AI 5 ("the App").

The App may allow users to sign in with Apple, Google, or other supported login methods. When you sign in, we receive the account information permitted by you or provided by the login provider, such as a user identifier and, where authorized or made available by the provider, your email address or display name. We do not receive your Apple or Google account password.

2. Information We Collect

2.1 Categories of Personal Information

In the past 12 months, we have collected the following categories of personal information through the App, supported login methods, subscription services, analytics, attribution, and AI-powered features:

• Identifiers: IP address, device identifiers, analytics identifiers, advertising identifiers where permitted, and login provider identifiers where you sign in.
• Commercial Information: Subscription status, transaction identifiers, product identifiers, purchase dates, renewal status, and related subscription records.
• Internet Activity Information: Features used, access records, operation times, attribution events, install events, conversion events, and product interaction data.
• Geolocation Data: General location derived from IP address.
• Audio, Electronic, or Visual Information: Conversations / chats and user-generated content within the App, including text, files, images, videos, audio, screenshots, extracted text, previous context, and generated outputs.
• Calendar Information: Where you enable AI Scheduler (iOS only) and grant permission, calendar events from Apple Calendar, such as event titles, dates, times, and related details.
• Inferences: Limited inferences used for personalization, User Memory, safety, analytics, and service improvement. Not used for advertising profiling.

Specifically, we collect:

• Account Information: Login provider user identifiers and, where authorized or made available by the provider, your email address or display name. We do not receive your Apple or Google account password.
• Subscription Information: Apple / RevenueCat subscription records and, for web products where available, Stripe / PayPal subscription status, transaction identifiers, product identifiers, purchase dates, renewal status, and related records.
• Transaction Information: Records of subscriptions or purchases, including subscription status, transaction identifiers, product identifiers, purchase dates, renewal status, and related records. We do not receive full payment card details.
• Device Information: Device model, operating system, app version, system version, device identifier, advertising identifier where permitted, IP address, and related technical data.
• Usage Data: Automatically generated data, such as features used, access records, and operation times, analytics events, attribution events, install events, conversion events, and performance data, to improve user experience and performance.
• Conversations / Chats: Content you submit, upload, generate, or share in the App, including text messages, prompts, uploaded files, documents, PDFs, images, videos, audio, voice inputs, screenshots, extracted text, previous chat context, generated outputs, and related technical metadata needed to process your request.
• Calendar Data: With your permission, we access calendar events from Apple Calendar (such as event titles, dates, times, locations, participants, notes, and related details) to provide AI Scheduler — our AI calendar feature, which is currently available on iOS only and is not available on web — and to keep your schedule in sync between Apple Calendar and Chat AI 5. Where AI processing is needed, relevant calendar event information may be sent to third-party AI service providers as part of your request. We use your calendar data only to provide AI Scheduler and related scheduling features; we do not use it for advertising, advertising targeting, profiling, or any commercial purpose unrelated to this feature, and we do not sell or share it for cross-context behavioral advertising. You can grant or revoke calendar access at any time in your device settings; if access is not granted, calendar features will be unavailable.
• User Memory Data: Summaries of your preferences, interests, topics discussed, and interaction patterns derived from your conversations / chats. This data is generated by our systems to personalize your experience in future conversations (see Section 3.1 for details).

2.2 Collection of Sensitive Personal Information

In the past 12 months, we have collected the following sensitive personal information (as defined under California law and other jurisdictions like Saudi Arabia PDPL):

• Contents of private communications within the App, including conversations / chats.
• Potentially, data related to religious beliefs, health, racial or ethnic origins, or biometric data, if included by you in conversations / chats or other user-generated content.

If you include such sensitive information in your conversations / chats, it will be transmitted to the third-party AI service providers listed in Section 7.1 as part of your request. We recommend avoiding sensitive personal information in your conversations where possible.

Note: We do not receive your Apple or Google account password, full payment card details, App Store subscription credentials, Google sign-in credentials, or payment credentials. Sensitive personal information is used only for necessary service provision and as permitted by law, with additional safeguards (see Section 15.2).

3. How We Use Your Information

3.1 Purposes of Processing

We use your personal information to:

• Provide and maintain services: Deliver features (e.g., conversations, file analysis, image and video generation, search, voice input, email drafting, AI Scheduler, and other AI-powered features) by sending necessary conversations / chats and related context to third-party AI service providers and AI service platforms and receiving generated responses or outputs.
• Transaction management: Process subscriptions through Apple In-App Purchase (iOS) and, for web products where available, Stripe or PayPal. We maintain Apple / RevenueCat subscription records and Stripe / PayPal web subscription and transaction records where applicable, including subscription status, transaction identifiers, product identifiers, purchase dates, renewal status, and related records.
• User behavior analysis: Analyze device information, operation records, and usage data to improve service quality and user experience.
• Personalized services: Offer tailored services (e.g., content recommendations, optimized feature displays) based on usage patterns. We do not use your conversations / chats, uploaded files, images, videos, audio, screenshots, or AI-generated content for advertising targeting, cross-app tracking, or cross-context behavioral advertising. You can opt out of non-essential processing via in-app settings (see Section 18).
• User Memory: Analyze your conversations / chats to extract and store key information — such as your preferences, interests, frequently discussed topics, and interaction patterns — as a persistent User Memory profile. This profile is used to provide more relevant and personalized responses in future conversations. If User Memory is enabled, relevant memory entries may be included in future AI requests sent to third-party AI providers to personalize responses. Conversations / chats used for this purpose are uploaded and stored with encryption on our servers (see Section 8). You can request to access, export, or delete your User Memory, or opt out of User Memory generation entirely, by contacting support@chataivoice.com (see Sections 10.5 and 18). Additionally, deleting your saved conversations / chats in the App will also remove any associated User Memory entries.
• Security and fraud prevention: Use device identifiers to monitor unusual activities, prevent unauthorized use, and ensure account/payment safety.

3.2 How We Obtain Consent

We obtain your consent in two stages:

1. Launch screen notice. When you first launch the App, we display a notice on the launch screen stating: "By continuing, you agree to our Privacy Policy and Terms of Use. This app sends your conversations to third-party AI providers (e.g., OpenAI, Google) to generate responses." This notice also provides a link to this Privacy Policy.

2. Consent dialog before your first message. Before you send your first message, the App displays an in-app consent dialog that, prior to any content being sent, explains: (a) what data we collect; (b) what data will be sent; (c) the third-party AI service providers and platforms the data will be sent to; and (d) the purposes for which the data is collected and sent. Your conversations / chats are sent to third-party AI providers only after you tap "Agree and Continue" in this dialog.

By tapping Continue on the launch screen and "Agree and Continue" in the consent dialog, you acknowledge these notices and allow us to send your conversations / chats to third-party AI providers as described in this Privacy Policy. If you do not tap "Agree and Continue," your conversations / chats will not be sent to third-party AI providers, and AI features that require third-party AI processing will not be available.

Because the core AI features require third-party AI processing, these features cannot be provided without sending the necessary conversations / chats to third-party AI providers. Non-essential processing, such as analytics, attribution, or personalization where applicable, may be limited or disabled as described in this Privacy Policy.

3.3 Legal Bases for Processing

Under applicable laws, particularly GDPR, we process personal data based on:

• Consent: For explicit consent to processing.
• Contractual Necessity: For performing a contract (e.g., providing services via API calls).
• Legal Obligation: For compliance with legal requirements.
• Legitimate Interests: For our or a third party's legitimate interests, unless overridden by your rights.
• Vital Interests: To protect your or another's vital interests.
• Public Interest: For tasks in the public interest.

Where processing is based on consent, you may withdraw consent at any time (see Section 10). Withdrawing consent does not affect processing that occurred before withdrawal, and some features may be limited or unavailable if consent is needed to provide them.

4. International Data Transfers

We provide the App globally, meaning your personal data, including conversations / chats sent to third-party AI service providers and AI service platforms, may be transferred to and stored in countries with different data protection standards. Transfer locations may depend on your region, the feature used, the selected model, routing method, and the service providers involved. Depending on the providers and models involved, these transfers may include regions such as the United States, the European Union, Singapore, and China.

4.1 Cross-Border Transfer Mechanisms

We implement safeguards for international transfers:

• EEA (including Norway, Iceland, Liechtenstein), UK, Switzerland: Standard Contractual Clauses (SCCs), Data Processing Agreements (DPAs), and other appropriate safeguards where required.
• Israel: Compliance with the Protection of Privacy Law, including contractual safeguards and obtaining user consent where required.
• Switzerland: Compliance with the Federal Act on Data Protection (FADP), ensuring transfers meet local standards.
• Brazil: Compliance with LGPD, including appropriate legal bases and safeguards for transfers.
• Japan: Compliance with the Act on the Protection of Personal Information (APPI).
• South Korea: Compliance with the Personal Information Protection Act (PIPA).
• Other countries: Contractual safeguards and technical measures, with appropriate review of DPAs/SCCs where required.

4.2 Data Localization Compliance

Where required by applicable law, we apply appropriate localization, transfer, contractual, technical, or organizational safeguards. Actual storage locations may depend on your region, the feature used, and the service providers involved.

Where required by applicable law, we rely on appropriate legal mechanisms, safeguards, or user consent before transferring personal data internationally.

5. Cookies and Similar Technologies

Where applicable, our web products may use cookies or similar technologies. We request consent for non-essential cookies where required by applicable law and provide available controls to manage cookie preferences. Manage preferences via:

• iOS: Settings > Privacy & Security > Tracking.
• Web: Available cookie preference controls.

Our website (chat.chatai5.com). The website uses a cookie consent tool provided by CookieYes, which keeps your cookie choices in a cookie on your device. It also uses Google Analytics to understand how the website is used, and Google Ads and the Meta Pixel to measure whether our ads lead to sign-ups and purchases; our server also reports purchases to Meta through Meta's Conversions API (see Section 7.3). Whether we ask first depends on where you are:

• In the European Economic Area, the United Kingdom, Switzerland and Canada, analytics and advertising cookies are used only after you accept them in the cookie banner.
• In the United States, these cookies may be used unless you opt out of the sale or sharing of personal information for advertising, which you can do in the cookie banner.
• Elsewhere, we may use these cookies without asking first.

Before you accept, Google's tag runs in a restricted mode: it does not set or read analytics or advertising cookies, and it sends only limited signals without cookie identifiers, namely the website events described in Section 7.3 (for example a page view, or a purchase and its price), together with the time, browser and device information, whether you arrived from an ad, and your consent status. As with any internet connection, Google also receives your IP address. Google uses these signals to estimate, in aggregate, visits and ad results it cannot measure directly. The Meta Pixel is not loaded at all until advertising cookies are allowed for your browser, and our server reports a purchase to Meta only while they are allowed. If your browser sends a Global Privacy Control (GPC) signal, the website keeps all advertising signals off for your browser (no advertising cookies and no hashed email address), wherever you are. Where a cookie choice is offered, you can change it later with the website's cookie preference controls (when signed in: Settings > General > Cookie Preferences).

If you open the support chat on our website, Crisp stores a cookie in your browser to keep your conversation (see Section 7.3). It is set only after you open the chat, is needed for the chat to work, and is removed when you sign out.

If you come to our website through a link from one of our affiliate partners, Dub, which runs our partner programme, helps us credit that partner. Dub's script is an advertising technology: like the Meta Pixel, it is not loaded until advertising cookies are allowed for your browser, and never while your browser sends a Global Privacy Control signal. Once loaded, it records your visit from the partner's link and keeps it in two cookies, dub_id and dub_partner_data, for up to 90 days; for the same period our website remembers in your browser that a partner referred you. If you then create an account, our server tells Dub, so that the partner is credited for your sign-up. We also report each purchase on our website, and any refund of it, to Dub, which uses it only if a partner referred your account: to pay the partner a commission, or to withdraw it after a refund (see Section 7.3).

6. How We Share Your Information

6.1 Data Sharing Practices

We do not sell personal information. We may share limited device, usage, subscription, analytics, attribution, and conversion data with analytics, attribution, advertising, subscription, cloud, and infrastructure providers to operate, measure, secure, improve, and market the App, as described in this Privacy Policy. We do not use conversations / chats for advertising targeting.

We disclosed the following for business purposes to service providers and third parties:

Refund requests. If you request a refund from Apple for a purchase made in the App, we may share information about your use of the purchased service with Apple — such as how long you have had your account, the extent to which you have used the features included in the purchase, and your purchase history — to help Apple evaluate the refund request, as part of Apple’s standard refund process.

• Identifiers.
• Commercial Information.
• Internet Activity Information.
• Geolocation Data.
• Conversations / chats.
• Audio, Electronic, or Visual Information.
• Calendar information (where you use AI Scheduler).
• Analytics, attribution, advertising, subscription, and conversion data.

We share information with:

• Apple, Google, and Login Providers: Account identifiers and login information where you sign in. We do not receive your Apple or Google account password.
• Payment and Subscription Providers: Subscription or transaction records from Apple In-App Purchase (iOS) and, for web products where available, Stripe or PayPal. We do not receive full payment card details.
• Third-Party AI Service Providers and AI Service Platforms: Conversations / chats and related context are sent via APIs to providers and platforms including OpenAI, Anthropic Claude, Google Gemini, xAI Grok, DeepSeek, Seedance, Flux, OpenRouter, Replicate, and Coze to generate replies, understand user input, analyze uploaded content, generate image or video content, route model requests, call AI models, and provide other AI-powered features.
• Data, Subscription, Analytics, Attribution, Cloud, and Infrastructure Providers: Limited device, usage, subscription, analytics, attribution, conversion, cloud hosting, network, security, and performance data may be shared with providers such as Mixpanel, Singular, RevenueCat, Google Cloud, Microsoft Azure, Amazon Web Services (AWS), Cloudflare, Meta/Facebook, TikTok, Sentry, OneSignal, Google Analytics for Firebase and, for our website, CookieYes, Google Analytics, Google Ads and Meta (the Meta Pixel and Conversions API), as described in Sections 5 and 7.3.
• Customer Support Provider: When you open the support chat in the App or on our website, your messages, any files you attach, and the account details described in Section 7.3 are processed by Crisp so that our support team can answer you.
• Affiliate Partner Programme: Our affiliate partner programme is run by Dub. We share the information described in Sections 5 and 7.3 with Dub so that partners can be credited and paid a commission for the customers they refer; a partner sees the sign-ups and purchases of the customers it referred in Dub's partner dashboard. We do not share your payment card details.
• Legal Requirements: When required by law or to enforce legal obligations.

6.2 Third-Party AI Data Processing

When you use Chat AI 5, your conversations / chats are processed as follows:

• Pre-Processing: We may apply automated safety, formatting, or filtering measures before transmission. These measures are best-effort and may not remove all personal or sensitive information. You should avoid including sensitive personal information in your conversations where possible.
• Data Transmission: Conversations / chats are sent to third-party AI service providers and AI service platforms with secure encryption (TLS 1.2 or higher), selected model or feature information, routing information where applicable, and technical metadata needed to process the request.
• Real-Time Voice, Camera, and Screen Sharing: When you start a Voice Chat, audio from your microphone is streamed through our servers to a third-party AI provider for as long as the session is running. If you turn on the camera during a Voice Chat, still images from the camera are sent about once per second for as long as it stays on. If you start screen sharing during a Voice Chat, still images of your device screen are sent about once per second for as long as it stays on; iOS captures the entire screen, so these images can include content from other apps and notifications that are visible at that time. iOS requires you to start screen sharing yourself from the system prompt, shows a recording indicator while it is running, and lets you stop it at any time from Control Center.
• AI Note Recordings: When you record a note, the audio file is uploaded to our servers and forwarded to a third-party AI provider (OpenAI) to produce a text transcript; the transcript may then be sent to an AI provider to be organized into a note. The note and its transcript are stored on your device. If you record a conversation that includes other people, their voices are part of what is uploaded — you are responsible for obtaining any consent that applies where you are before recording them.
• Conversations / Chats Storage and User Memory: Your conversations / chats may be uploaded and stored with encryption on our servers (see Section 8). If User Memory is enabled by you or with your consent, your conversations / chats may be analyzed to generate User Memory — a persistent profile of your preferences and interaction patterns used to personalize future conversations. If User Memory is enabled, relevant memory entries may be included in future AI requests sent to third-party AI providers to personalize responses. You can manage your User Memory by contacting support@chataivoice.com (see Sections 10.5 and 18).
• Data Control: Third-party providers may process data per their privacy policies (see Section 7.1), and we require privacy and security protections as described in Section 7.
• Data Deletion: Upon deletion requests, we delete data from our systems (including conversations / chats and associated User Memory entries) and request deletion from providers where feasible, though some may retain anonymized data per their policies. You may also delete your saved conversations / chats directly in the App, which will automatically remove any User Memory entries derived from those conversations / chats.

7. Third-Party Service Providers

We work with third-party providers to deliver, secure, measure, and improve the App. We require third-party service providers that process personal data for us to maintain privacy and security protections that are the same as or equivalent to those described in this Privacy Policy and required by applicable law, including confidentiality, purpose limitation, secure transmission, access controls, retention limits, breach notification where required, and assistance with user rights requests.

7.1 Third-Party AI Service Providers

7.2 Third-Party AI Service Platforms

7.3 Data, Subscription, Analytics, Attribution, Cloud, and Infrastructure Providers

Hashed Contact Information for Advertising Measurement. If you sign in to the App, we may derive a one-way hashed (SHA-256) value from your account email address and share that hashed value — never the plain-text email address — with our attribution provider (Singular) and advertising partners (Meta, TikTok) for the sole purposes of advertising conversion matching, campaign measurement, and attribution. Hashing is performed on your device or within our systems before any sharing occurs. These partners can only recognize the hashed value if the same email address is already associated with an account on their platform; they cannot reverse the hash to obtain your email address. You can prevent future sharing by signing out of the App, and you may exercise your privacy rights as described in Sections 10 and 18. On our website, if you are signed in and advertising cookies are allowed for your browser (see Section 5), your browser computes the same kind of one-way hashed value and provides it to Google through the Google tag, for conversion matching and measurement in Google Analytics and Google Ads. It also provides that value, and a one-way hashed value of our internal account ID, to Meta through the Meta Pixel, and our server sends the same hashed values with a purchase through Meta's Conversions API, for conversion matching and measurement of Meta ads. You can stop this by signing out, by refusing or withdrawing advertising cookies where a cookie choice is offered, or by turning on Global Privacy Control.

We use analytics and attribution providers, including Mixpanel, Singular, and Google Analytics for Firebase, to understand product usage, measure app performance, attribute installs, measure advertising campaign performance, and analyze subscription or conversion events. Where applicable, attribution data may be shared with advertising networks such as Meta/Facebook, TikTok, or other campaign partners to measure campaign performance and optimize advertising. On iOS, we ask for your permission through Apple's App Tracking Transparency prompt before your device's advertising identifier is used for cross-app tracking. The analytics and attribution SDKs described above are built into the App and start together with the App; the App does not currently provide a separate in-app setting to switch them off individually. You can change your tracking permission at any time in iOS Settings > Privacy & Security > Tracking, delete your stored conversations / chats in the App's settings, and exercise your privacy rights as described in Sections 10 and 18. On our website we also use Google Analytics, Google Ads and the Meta Pixel with Meta's Conversions API (see Section 7.3). Consent controls for non-essential cookies and similar technologies in our web products are described in Section 5.

We do not send your Apple ID, Google account password, full payment card details, App Store subscription credentials, Google sign-in credentials, payment credentials, or advertising identifiers to third-party AI providers unless they are included by you in your conversations / chats.

We do not use your conversations / chats, uploaded files, images, videos, audio, screenshots, or AI-generated content for advertising targeting, cross-app tracking, or cross-context behavioral advertising.

8. Data Security

We implement technical and organizational measures to protect your data, including:

• Encrypted transmission: SSL/TLS encryption for sensitive data, subscription records, login identifiers, conversations / chats, and API calls.
• Encrypted storage (at rest): We use industry-standard encryption and appropriate technical safeguards for stored conversations / chats and User Memory data where applicable.
• Access control: We limit access to authorized personnel and service providers who need access for permitted business, security, support, legal, or operational purposes.
• Security reviews: We review and update security measures as appropriate to reduce the risk of unauthorized access, loss, misuse, or alteration.

No transmission or storage method is 100% secure, but we strive to protect your data.

9. Data Storage and Retention

9.1 Storage Locations

Data is stored on secure servers and service provider infrastructure. Actual storage locations may depend on your region, the feature used, the selected model, routing method, and the service providers involved. Where required by applicable law, we apply appropriate localization, transfer, contractual, technical, or organizational safeguards.

For data localization laws, see Section 4.2.

9.2 Retention Periods

• Apple / RevenueCat Subscription Records and Stripe / PayPal Web Transaction Records: Subscription status, transaction identifiers, product identifiers, purchase dates, renewal status, and related records, retained for 7 years where needed for legal, tax, accounting, financial, or dispute-resolution obligations.
• Device/Usage/Analytics/Attribution Data: 2 years for analytics, attribution, security, product improvement, and campaign measurement, or until deletion request where applicable.
• Conversations / Chats: 1 year for service continuity, or until deletion request, unless a longer period is required or permitted by law.
• Calendar Data: Calendar events accessed through AI Scheduler are retained only while you keep calendar access granted and the feature enabled, or until you revoke access in your device settings or request deletion. This describes retention within our systems; calendar event information sent to third-party AI providers as part of processed API requests is subject to the retention policies of those providers (see Section 10.4).
• User Memory Data: Retained for as long as your account is active or until you request deletion by contacting support@chataivoice.com. When you delete specific conversations / chats in the App, any memory entries derived solely from those conversations / chats will also be removed. If you delete all saved conversations / chats or request full account deletion, associated User Memory data will be deleted subject to legal, security, backup, or technical retention requirements.
• Consumer Request Records: 24 months for compliance, in a secure environment.

10. Your Rights

10.1 General Privacy Rights

Depending on your location, you may have rights to:

• Access.
• Rectification.
• Erasure.
• Restrict processing.
• Data portability.
• Object.
• Withdraw consent.

10.2 How to Exercise Your Rights

Contact us via:

• Email: support@chataivoice.com.
• In-App: Settings > Contact Us (online form).

Response times:

• GDPR: Within 30 days, unless an extension is permitted by law.
• CCPA/CPRA: Within 45 days, unless an extension is permitted by law.
• Japan (APPI): Within a reasonable period required by applicable law.
• South Korea (PIPA): Without undue delay and within the period required by applicable law.
• Saudi Arabia (PDPL): Within the period required by applicable law.

If additional time is needed, we will inform you. Electronic requests receive electronic responses unless specified otherwise.

10.3 Verification Process

To protect your data, we verify requests:

• Basic Requests (e.g., opt-out): Via email or device identifier.
• Sensitive Requests (e.g., access/deletion):
  • Verified through account identifiers, login provider information where available, transaction identifiers, subscription status, device identifiers, or other information you provide to help us locate your records.
  • If no subscription or login record is available: Verified via device/usage details, signed declaration, or recent conversation snippets provided via support@chataivoice.com.

Data access requests are provided in portable formats (e.g., CSV, JSON). No fees are charged unless requests are excessive, with prior cost estimates.

10.4 Third-Party AI Provider Data Rights

For data processed by third-party AI providers:

• Access: We provide data in our systems and details of providers who processed your conversations / chats.
• Deletion: We delete data from our systems and forward deletion requests to providers where feasible, though some may retain anonymized data.
• Limitation: Complete deletion of derivatives from AI models may not be possible.
• Direct Rights: Exercise rights directly with providers using their privacy policy contacts.

10.5 Your Rights Regarding User Memory

You have the following rights over your User Memory data. To exercise any of these rights, contact us at support@chataivoice.com:

• Access and Export: Request a copy of your User Memory data to review what information has been stored about your preferences and interaction patterns. We will provide the data in a portable format (e.g., JSON) within the applicable response timeframe (see Section 10.2).
• Deletion: Request deletion of specific memory entries or your entire User Memory. You may also delete your saved conversations / chats directly in the App, which will automatically remove any User Memory entries derived from those conversations / chats.
• Opt-Out: Request to disable User Memory generation entirely. Once disabled, no new memory entries will be created from your conversations / chats. If User Memory is enabled, relevant memory entries may be included in future AI requests sent to third-party AI providers to personalize responses. Existing memory data will be retained until you separately request its deletion or delete your saved conversations / chats.

11. Special Notice for California Residents

11.1 California Consumer Rights

Under CCPA/CPRA, you have rights to:

• Know: Categories, sources, purposes, third parties, and specific pieces of personal information collected (past 12 months).
• Delete: Request deletion, subject to exceptions.
• Correct: Request correction of inaccurate data.
• Opt-Out of Sale/Sharing: Opt out of applicable sharing of limited device, usage, analytics, attribution, advertising, subscription, or conversion data where required by law.
• Limit Sensitive Information: Limit use to necessary services.
• Non-Discrimination: No denial, price differences, or reduced service quality for exercising rights.

11.2 Authorized Agent

Use an authorized agent with written permission and direct identity verification. Contact support@chataivoice.com.

11.3 Do Not Sell or Share My Personal Information

We do not sell personal information. We may share limited device, usage, subscription, analytics, attribution, and conversion data with analytics, attribution, advertising, subscription, cloud, and infrastructure providers to operate, measure, secure, improve, and market the App, as described in this Privacy Policy. We do not use conversations / chats for advertising targeting. Opt out via:

• Email: support@chataivoice.com ("Do Not Sell or Share My Personal Information").
• In-App: Settings > Contact Us.
• Website: the cookie banner on chat.chatai5.com, or a Global Privacy Control signal from your browser (see Section 5).

11.4 Notice of Financial Incentive

We do not offer financial incentives for retaining or selling personal information.

12. Special Notice for EU, EEA, and UK Residents

12.1 GDPR Compliance

Under GDPR/UK GDPR, you have rights (per Section 10) plus:

• Lodge a complaint with a supervisory authority.
• Object to processing based on legitimate interests.
• Object to direct marketing.
• Rights against automated decision-making/profiling.

12.2 Data Protection Officer

Contact our DPO:

• Email: support@chataivoice.com.
• Postal: Data Protection Officer, Alzor Labs Company Limited, 21/F, 14 Tai Koo Wan Road, Quarry Bay, Hong Kong.

12.3 EU Representative

For EU users (GDPR Article 27):

• EMCI Sp. z o.o., ul. Chalubinskiego 8, 00-613 Warszawa, Mazowieckie, Poland.
• Contact: Alice Hill.
• Email: biuro@emci.eu.
• Phone: +48 535 040 040.

12.4 UK Representative

For UK users (UK GDPR):

• BRITCORP SOLUTIONS LTD, 167-169 Great Portland Street, London, W1W 5PF, England, United Kingdom.
• Contact: Marie Dubois.
• Email: MarieDubois@britcorpltd.com.
• Phone: +44 7395 178678.

13. Special Notice for Asian Jurisdictions

13.1 Japan (APPI Compliance)

Where applicable, we aim to comply with applicable requirements of APPI:

• Notify purpose of use at collection.
• Limit use to necessary scope without prior consent.
• Respond to disclosure requests within 2 weeks.
• Contact: support@chataivoice.com.

13.2 South Korea (PIPA Compliance)

Where applicable, we aim to comply with applicable requirements of PIPA:

• Obtain separate consent for sensitive/unique identifying information.
• Destroy data after purpose fulfillment or retention period.
• Contact: support@chataivoice.com.

13.3 Singapore (PDPA Compliance)

Where applicable, we aim to comply with applicable requirements of PDPA:

• Collect/use/disclose data for reasonable purposes.
• Protect data from unauthorized risks.
• Contact: support@chataivoice.com.

13.4 China (PIPL Compliance)

Where applicable, we aim to comply with applicable requirements of PIPL:

• Apply appropriate localization, transfer, contractual, technical, or organizational safeguards where required by applicable law.
• Conduct security assessments for cross-border transfers where required.
• Appointed a personal information protection officer.
• Contact: support@chataivoice.com.

14. Special Notice for Middle East Jurisdictions

14.1 United Arab Emirates (UAE)

Where applicable, we aim to comply with applicable requirements of Federal Decree-Law No. 45 of 2021. UAE users may have rights to:

• Access/correct data.
• Request deletion.
• Withdraw consent.
• Object to automated decision-making.
• Contact: support@chataivoice.com.

14.2 Saudi Arabia

Where applicable, we aim to comply with applicable requirements of PDPL. Saudi users may have rights to:

• Be informed about processing.
• Access/correct/delete data.
• Withdraw consent.
• Object to automated decision-making.
• Contact: support@chataivoice.com.

14.3 Qatar

Where applicable, we aim to comply with applicable requirements of Data Protection Law No. 13 of 2016. Contact: support@chataivoice.com.

14.4 Israel

Where applicable, we aim to comply with applicable requirements of the Protection of Privacy Law, 1981, including user rights to access and correct data. Contact: support@chataivoice.com.

14.5 Cultural and Religious Sensitivities

In the UAE, Saudi Arabia, Qatar, and Israel, we take steps to protect sensitive data (e.g., religious beliefs, cultural practices) per local laws and customs. We apply appropriate safeguards where required by applicable law.

15. AI Transparency and Ethics

15.1 AI-Specific Disclosures

Chat AI 5 uses third-party AI service providers and AI service platforms, including OpenAI, Anthropic Claude, Google Gemini, xAI Grok, DeepSeek, Seedance, Flux, OpenRouter, Replicate, and Coze, to power features like conversations, file analysis, image and video generation, search, voice input, email drafting, AI Scheduler, and other AI-powered features. Conversations / chats are sent to these providers and platforms via secure APIs to generate responses, analyze uploaded content, route model requests, call AI models, and generate related AI outputs.

• Nature of AI Interaction: Responses are generated based on statistical patterns, not human understanding.
• AI Limitations: May produce inaccurate, incomplete, or biased content, dependent on third-party models; not suitable for critical decisions without oversight.
• Limited Authorized Access: We do not routinely review your conversations manually. Limited authorized access may occur only when necessary for user support, security, troubleshooting, legal compliance, or to respond to your request.
• AI Decision-Making: We use automated decisions (e.g., recommending topics based on conversations / chats or User Memory) affecting displayed content/features, without legal/significant effects. Rights include:
  • Human intervention.
  • Expressing your view.
  • Contesting decisions.
  • Contact: support@chataivoice.com.

15.2 Conversation Processing and Protection

We route conversations / chats to the most appropriate AI model based on:

• Request type, language, and complexity.
• Selected features (e.g., conversation vs. email drafting).
• Content safety and regional availability.
• Performance optimization.

The model used may depend on the feature, selected option, availability, and routing logic. We protect sensitive information with:

• Pre-Processing Measures: We may apply automated safety, formatting, or filtering measures before transmission. These measures are best-effort and may not remove all personal or sensitive information. You should avoid including sensitive personal information in your conversations where possible.
• Transmission Controls: Secure encryption (TLS 1.2 or higher), API authentication, and periodic credential rotation.
• Safety Notices: We may provide safety notices where available.

15.3 Third-Party Provider Roles

Depending on the service and applicable law, third-party AI providers may act as processors under Data Processing Agreements (DPAs) or as independent controllers under their own privacy policies. We maintain appropriate contractual arrangements with each provider and cooperate to fulfill user rights requests.

16. Children's Privacy

The App is not intended for children. We do not knowingly collect data from children. Age thresholds may vary by jurisdiction, including under 13 in the United States and other ages where required by applicable law.

If we learn a child has provided data without required parental consent, we will delete it promptly. Contact support@chataivoice.com if you believe a child has provided data.

For California residents, we do not sell/share data of users under 16 without affirmative authorization (from users 13–16 or parents for under 13).

17. Links to Third-Party Websites/Services

The App may link to third-party sites/services. Their privacy practices may differ from ours when you access them directly. Review their policies before providing data.

18. How to Opt-Out

Opt out of data collection/processing via:

18.1 iPhone Devices and App Tracking Transparency

Where required by Apple's App Tracking Transparency framework or applicable law, we request your permission before accessing the device advertising identifier or using data to track your activity across apps and websites owned by other companies. If you deny tracking permission, we will not access the device advertising identifier for tracking purposes and will use only permitted, aggregated, or privacy-preserving measurement methods where available.

• Disable Tracking:
  1. Settings > Privacy & Security > Tracking.
  2. Turn off "Allow Apps to Request to Track."
• Disable Personalized Ads:
  1. Settings > Privacy & Security > Apple Advertising.
  2. Turn off "Personalized Ads."

18.2 In-App and Support

For non-essential processing (e.g., analytics, attribution, advertising campaign measurement, or personalization where applicable):

• In-App: Settings > Contact Us.
• Website: Help > Contact Us (support chat).
• Email: support@chataivoice.com.

Core AI features (e.g., conversations, file analysis, image and video generation, search, voice input, email drafting, AI Scheduler, and other AI-powered features) require third-party AI processing and cannot be provided without sending the necessary conversations / chats to third-party AI providers or platforms. Non-essential requests are processed within 15 days (GDPR/UK GDPR) or 45 days (other jurisdictions).

To opt out of User Memory generation, or to request access, export, or deletion of your User Memory data, email support@chataivoice.com with the subject line "User Memory Request." You may also delete your saved conversations / chats in the App, which will automatically remove any User Memory entries derived from those conversations / chats.

18.3 Do Not Sell or Share My Personal Information

We do not sell personal information. We may share limited device, usage, subscription, analytics, attribution, and conversion data with analytics, attribution, advertising, subscription, cloud, and infrastructure providers to operate, measure, secure, improve, and market the App, as described in this Privacy Policy. We do not use conversations / chats for advertising targeting. Opt out via:

• Email: support@chataivoice.com ("Do Not Sell or Share My Personal Information").
• In-App: Settings > Contact Us.
• Website: the cookie banner on chat.chatai5.com, or a Global Privacy Control signal from your browser (see Section 5).

18.4 Limit Sensitive Personal Information

Limit use to necessary services via:

• Email: support@chataivoice.com ("Limit Sensitive Personal Information").
• In-App: Settings > Contact Us.

18.5 Global Privacy Control (GPC)

Where required by applicable law and technically feasible, we honor Global Privacy Control (GPC) signals as opt-out requests for applicable sale or sharing of personal information. You may enable GPC through supported browser extensions or privacy browsers.

19. Data Breach Notification

If a data breach affects the security of your personal data, we will assess the incident and notify affected users and regulators where required by applicable law. Notice may be provided by email, in-app notification, website notice, or other reasonable means and may include information about the incident, data involved, protective steps, and contact information where appropriate.

Report suspected breaches to support@chataivoice.com.

20. Dispute Resolution and Governing Law

20.1 Dispute Resolution Process

For disputes regarding your personal data:

• Initial Contact: Email support@chataivoice.com.
• Escalation:
  • Acknowledgment within 5 business days.
  • Initial response within 15 business days.
  • Resolution proposal within 30 business days.
• Alternative Dispute Resolution:
  • EU/EEA: Mediation via local data protection authority.
  • Others: Voluntary mediation through an independent third party.

20.2 Governing Law and Jurisdiction

• EU/EEA Residents: Claims may be brought in your country of habitual residence, work, or alleged infringement.
• Non-EU/EEA Residents: Disputes are governed by Hong Kong law, with courts in Hong Kong having non-exclusive jurisdiction, unless prohibited by local law.

21. Changes to This Privacy Policy

We may update this policy for business, product, legal, or security reasons. When required by applicable law or when changes are material, we will provide notice through reasonable means, such as in-app notice, email, or an updated posting of this Privacy Policy.