Privacy Policy of Stylor App

Effective Date: [24/03/2026]

Data Controller: Baoding Chongchi Electronic Technology Co., Ltd. (hereinafter referred to as "we", "us", or "the Company") is the exclusive data controller for the personal information collected through the Stylor App. As the data controller, we are fully responsible for the collection, use, storage, protection, sharing, transfer and other processing activities of your personal data in accordance with applicable laws and regulations around the world. For any questions related to the data controller’s responsibilities and obligations, you can contact us through the official channels specified in Article X of this Policy.

Developer and Operator: Baoding Chongchi Electronic Technology Co., Ltd. (hereinafter referred to as "we", "us", or "the Company")

Contact Address: Room 302, Unit 3, Building 12, Hongyang Residential Community, No. 525 Hongyang Avenue, Lianmeng Road Subdistrict, Lianchi District, Baoding City, Hebei Province

Official Contact Email: santosefertimothyk@gmail.com

Data Protection Officer (DPO): [Name], Dedicated Contact Email: santosefertimothyk@gmail.com

Welcome to Stylor (hereinafter referred to as "the App"), an AI conversational hair care tool developed and operated independently by Baoding Chongchi Electronic Technology Co., Ltd. The App is exclusively designed for users aged 18 and above who are troubled by hair problems. It does not require registration or login. You can use all the App's services and functions after checking and agreeing to this Privacy Policy (hereinafter referred to as "this Policy") and the Stylor Terms of Service.

This Policy aims to clearly inform you of the basic principles, specific operational procedures for us to collect, use, store, protect, and disclose your personal data, as well as the various data-related rights you are entitled to in accordance with the law. This Policy is formulated in strict compliance with the current effective data protection laws, regulations, and industry standards in various regions around the world, including but not limited to the European Union's General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) of the United States, the Virginia Consumer Data Protection Act (VCDPA) of the United States, Brazil's Lei Geral de Proteção de Dados (LGPD), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the United Kingdom's Data Protection Act 2018, and Australia's Privacy Act, to ensure adequate and effective protection of your personal data.

Please carefully read and fully understand all the contents of this Policy before using the App for the first time, especially the key clauses marked in bold. By clicking the "Agree" button, using, or continuing to use any service or function of the App, you are deemed to have fully understood, comprehended, and agreed to our processing of your personal data in accordance with the provisions of this Policy. If you disagree with any content of this Policy, please immediately stop using the App.

I. Applicable Legal Basis

All our processing of your personal data strictly complies with the core data protection laws, regulations, and relevant industry standards in various regions around the world. For users in different regions, we will fulfill our data protection obligations and protect your statutory rights in accordance with the exclusive laws and regulations of the local region. The core applicable laws and regulations and corresponding compliance requirements are as follows:

1. European Union's General Data Protection Regulation (GDPR): If you are a resident of the European Union, or if our personal data processing activities involve providing services to EU residents or monitoring the use behavior of EU residents, we will strictly comply with all requirements of the GDPR, implement the privacy-by-design and privacy-by-default principles, protect your statutory rights as a data subject (such as the right of access, right to rectification, right to erasure, right to data portability, etc.), and fulfill the legal obligation of reporting data breaches within 72 hours.

2. California Consumer Privacy Act (CCPA)/California Privacy Rights Act (CPRA) of the United States: If you are a resident of California, USA, we will, in accordance with the provisions of the CCPA/CPRA, clarify your rights to inquire about, delete, and opt out of data sales/sharing, regulate the collection, use, sharing, and retention period of personal data, and at the same time restrict the behavior of cooperative service providers in processing the personal data of California residents to ensure that it complies with relevant restrictive requirements.

3. Virginia Consumer Data Protection Act (VCDPA) of the United States: If you are a resident of Virginia, USA, we will comply with all compliance requirements of the VCDPA regarding consumers' data rights, data processing restrictions, data breach notifications, and third-party sharing, to protect your privacy rights and interests. In particular, in accordance with the mandatory requirements of the VCDPA, we clearly specify the specific methods and procedures for you to exercise your opt-out rights, including opt-out of targeted advertising, opt-out of personal data sales (if applicable), and opt-out of profiling that supports decisions that produce legal or similarly significant consequences for you, which are detailed in Article VI (IX) of this Policy.

4. Brazil's Lei Geral de Proteção de Dados (LGPD): If you are a resident of Brazil, we will carry out data processing activities in strict accordance with the provisions of the LGPD, fulfill the authorization obligation for cross-border data transmission, implement the requirement of promptly notifying Brazil's National Data Protection Authority (ANPD) and affected users in case of data breaches, and protect all your statutory data rights.

5. Canada's Personal Information Protection and Electronic Documents Act (PIPEDA): If you are a resident of Canada, we will comply with the compliance requirements of PIPEDA regarding the collection, storage, cross-border transmission, and third-party sharing of personal data, ensuring that data processing activities comply with the principles of "minimum necessity" and "legality and propriety".

6. Applicable Laws and Regulations in Other Regions: For users in regions such as the United Kingdom, Australia, and Singapore, we will comply with the core local data protection laws and regulations, including the United Kingdom's Data Protection Act 2018, Australia's Privacy Act, and Singapore's revised Personal Data Protection Act, respectively; at the same time, we will strictly comply with the special provisions on the protection of minors' personal data in various regions. Since the App is only for users aged 18 and above, we will not actively collect any personal data of minors.

II. Scope of Personal Data We Collect

To provide you with stable and high-quality core AI hair care services and ensure your use safety and experience, we only collect personal data that is necessary and within the minimum scope to realize the service functions. All data is voluntarily provided by you or obtained with your explicit authorization. Failure to enable relevant permissions or actively provide data will not affect the use of the App's basic functions. The personal data we collect is divided into the following four categories, with no hidden or mandatory collection:

(I) Personal Data Voluntarily Provided by You

1. Information related to hair quality and hair care needs: Text information you actively input during conversations with the AI hair stylist, such as your hair condition (e.g., dry and frizzy, dyed and damaged, oily and flat, etc.), hair care pain points (e.g., itchy scalp, split ends, oilier after washing, etc.), hair care products used, and daily hair care habits.

2. Feedback-related information: Problem descriptions and suggestions you submit through the App's "Feedback" function, as well as hair-related pictures and voice recordings you voluntarily upload to assist in explaining the problems.

3. Profile avatar information: Avatar image information you actively choose to take or select from your album and submit to improve your personal use interface. This information is only used for personal profile display within the App and has no other purposes.

(II) Personal Data Automatically Obtained When You Use the Services

1. Usage behavior information: Your operation records when using various functions of the App, including but not limited to conversation records with the AI hair stylist, viewing/saving/exporting records of hair care plans, click records of functional modules, and the duration and frequency of App use. This information is only used to optimize the AI algorithm and improve service professionalism.

2. Basic device and App information: To ensure the normal operation of the App, troubleshoot faults, and adapt to device models, we will automatically obtain your basic device information, including device model, operating system version, App version number, unique device identifier, network connection status (WiFi/mobile network), App installation/uninstallation time, etc. We will not obtain any data from other apps on your device.

(III) Personal Data Obtained Based on Your Permission Authorization

Permissions such as camera, photo album, microphone, external storage, and App information reading of the App are all independently enabled/disabled by you on your device. We only obtain relevant data within the function usage scenario after you enable the corresponding permission, and immediately stop data collection after the permission is disabled. The details are as follows:

1. Camera permission: We only obtain image data you take with the camera when you use the "Take Avatar" function. After taking the photo, you can choose whether to submit it independently. Unsubmitted data will not be stored.

2. Photo album (image) permission: We only obtain single or multiple image data you independently select when you use the "Select Avatar from Album" or "Upload Image for Feedback" function. Other images in the album that you do not select will not be accessed or read.

3. Microphone permission: We only obtain your real-time audio data when you use the "AI Voice Conversation" or "Submit Recording for Feedback" function, and convert the audio into text data for conversation interaction/problem feedback. After the voice/audio conversation/feedback is completed, you can choose whether to save the data.

4. External storage permission: We only write relevant data to your device's external storage when you use functions such as "Save Hair Care Plan", "Export Conversation Records", and "Save Avatar". At the same time, we only read relevant data saved by the App to the external storage and do not access other storage files on the device.

5. App information reading permission: We only read the installation package information, operation status, version update information, etc., of the App to ensure the stable operation of the App and push version update reminders. We do not read any information from other apps on the device.

6. Advertising identifier permission: We obtain the advertising identifier (ADID) of your device only to implement personalized advertising recommendations. You can turn off the advertising identifier in your device settings at any time. After turning it off, we will push non-personalized general advertisements, which will not affect the core hair care services of the App.

(IV) Personal Data Not Collected

The App will not collect any personal data irrelevant to core services, such as your name, mobile phone number, ID card number, bank card number, email address, geographic location, address book, call records, and text message content. There is no background silent collection or excessive collection.

III. Purposes of Using Personal Data

All personal data we collect is only used to realize the core AI hair care services and related auxiliary functions of the App, with no other purposes. We strictly follow the principle of "limited collection purpose" and will not use the data for any behavior irrelevant to the collection purpose. The specific purposes of use are as follows:

1. Provide and optimize core hair care services: Based on the hair quality information, hair care needs, and conversation records you provide, the AI hair stylist will customize exclusive daily care plans for you and answer your hair care questions; by analyzing your usage behavior information, we will optimize the professionalism and accuracy of the AI algorithm, improve the conversation interaction experience, and iterate and upgrade functional modules.

2. Realize personal profile and personalized functions: Use the avatar image you took/selected for personal profile display within the App; recommend suitable hair care knowledge and care suggestions for you according to your hair care preferences.

3. Handle your feedback and inquiries: Based on the feedback information, problem descriptions, and related pictures/recordings you submit, we will promptly troubleshoot and solve the problems you encounter when using the App, reply to your inquiries, and continuously improve service quality.

4. Ensure the safe and stable operation of the App: Through basic device and App information, troubleshoot App operation faults, fix program vulnerabilities, prevent malicious program attacks, and ensure the normal operation of the App on your device; identify abnormal usage behaviors, prevent false operations, malicious feedback, etc., and maintain the normal operation order of the App.

5. Realize local storage and export of data: Through external storage permission, save your hair care plans, conversation records, avatar images, and other data to your device for your convenient viewing and use at any time; support you to export relevant data to realize independent management of personal data.

6. Provide compliant advertising recommendation services: Push personalized advertisements related to hair care for you through the advertising identifier. If you turn off the advertising identifier, non-personalized general advertisements will be pushed. All advertisements do not involve the disclosure of your personal data.

7. Fulfill legal and contractual obligations: Within the scope stipulated by laws and regulations, reasonably use relevant personal data to fulfill the mandatory requirements of judicial organs and administrative organs and protect the legitimate rights and interests of us, you, or third parties.

Important Note: We will not use your personal data for behaviors irrelevant to core services such as algorithm training and data modeling; all conversation records with the AI hair stylist are only for your personal exclusive hair care reference and will not be displayed or shared with any third party.

IV. Storage and Protection of Personal Data

(I) Storage of Personal Data

We follow the principles of "shortest storage period" and "compliant regional storage" to store your personal data, strictly set the storage period in accordance with the requirements of laws and regulations in various regions, and promptly delete or anonymize the data after the expiration of the period. The specific storage rules are as follows:

1. Storage Region: Your personal data will be mainly stored on servers in China that meet global data security standards; if cross-border transmission of personal data of users in regions such as the European Union, Brazil, California/Virginia in the United States, and Canada is involved, we will strictly comply with the requirements of the corresponding regional laws and regulations, take compliant measures such as encrypted data transmission and signing Standard Contractual Clauses (SCCs), disclose the purpose, recipient, and security measures of cross-border transmission to you in advance, and protect your cross-border data-related rights.

2. Storage Period

- Basic device and App information: From the date you first use the App to 6 months after you uninstall the App, it will be automatically deleted; if you reinstall the App, this type of information will be collected again.

- Voluntarily provided hair quality and hair care needs information, conversation records: Stored until you actively delete or uninstall the App, after which it will be automatically deleted from the server; if you save relevant data to the device's external storage, you can manage it manually.

- Avatar images, feedback-related pictures/recordings: Stored until you actively replace/delete or uninstall the App, after which it will be deleted from the server and the relevant directories of the App; if you have saved the pictures/recordings to the local device, you can delete them manually.

- Microphone audio and converted text data: If you do not choose to save after the voice conversation/feedback recording is completed, the data will be automatically deleted within 24 hours after the conversation ends; if you choose to save, it will be stored until you actively delete or uninstall the App.

- Advertising identifier-related data: Stored until you turn off the advertising identifier in the device settings or uninstall the App, after which it will be automatically deleted.

- Usage behavior information: Stored until 3 months after you uninstall the App, after which it will be anonymized (the processed data cannot be associated with your device and personal usage behavior).

3. Storage Format: All personal data is stored in an encrypted format, including transmission encryption (SSL/TLS) and storage encryption (AES-256), to ensure that the data is not illegally accessed or tampered with during storage.

(II) Protection of Personal Data

We attach great importance to the security of your personal data and have established a data security protection system that meets global industry standards and the requirements of laws and regulations in various regions. We take strict protection measures from technical, organizational, and management aspects to prevent your personal data from being illegally accessed, used, disclosed, tampered with, leaked, or lost. The specific protection measures are as follows:

1. Technical Protection Measures

- SSL/TLS encryption technology is adopted for the entire data transmission process to ensure that the data is not stolen or intercepted during transmission;

- Personal data storage adopts the AES-256 encryption algorithm, which can only be accessed by authorized personnel through exclusive keys, and the keys are updated regularly;

- Multi-layer firewall protection is implemented for servers, security vulnerability scans and penetration tests are carried out regularly, and potential security risks are repaired in a timely manner;

- Desensitization processing is performed on sensitive data such as unique device identifiers to avoid direct association with your device;

- A data operation log is established to record all data access and processing behaviors, and the log is kept for no less than 1 year for traceability and verification.

2. Organizational and Management Protection Measures

- A strict employee data access management system is formulated. Only employees in positions related to core services are authorized to access necessary personal data, implementing the principle of "minimum authority";

- All employees who have access to personal data receive regular data protection compliance training and security awareness training, sign confidentiality agreements, and clarify the legal liability for data leakage;

- A dedicated Data Protection Officer (DPO) is appointed to supervise the compliance of data processing behaviors, handle your data-related requests, and communicate with data protection regulatory authorities in various regions;

- A data security management system is established to clarify the full-process operation specifications for data collection, use, storage, and protection, and regular data security risk assessments are carried out.

3. Special Protection Obligations Under Laws and Regulations in Different Regions

- For GDPR: If a personal data breach that may affect your rights and interests occurs, we will report it to the relevant EU data protection regulatory authorities within 72 hours and notify you in a timely manner if feasible, and take remedial measures at the same time;

- For LGPD: If a data breach occurs, we will promptly notify Brazil's National Data Protection Authority (ANPD) and you, the affected party, after discovery, take necessary remedial measures, and keep records;

- For VCDPA/CCPA/CPRA: If a data breach that may cause harm to consumers' rights and interests occurs, we will promptly notify the Virginia Attorney General/California Consumer Privacy Protection Agency and you, the affected party, after confirmation, disclosing the type of leaked data, the scope of impact, and remedial measures;

- For PIPEDA: Strictly follow the "accountability" principle of data protection, ensure that the entire data processing process is traceable, and assume the ultimate responsibility for data security.

Important Note: Although we have taken the above comprehensive security protection measures, due to the limitations of network transmission and storage technology, no protection method can guarantee 100% absolute security. If personal data leakage occurs due to force majeure, hacker attacks, equipment failures, or other non-subjective faults of ours, we will activate the emergency response mechanism immediately, take remedial measures, and fulfill the notification obligation, but will not bear corresponding liability for compensation.

V. Sharing, Transfer, and Sale of Personal Data

We strictly follow the principles of "minimum sharing" and "legality and propriety", will not arbitrarily share or transfer your personal data to any third party, and have never and will never sell your personal data in any form, ensuring your right to know, right to object, and other legitimate rights throughout the process. The specific provisions are as follows:

(I) Sharing of Personal Data

We will only share your personal data within the necessary scope in the following legal or agreed circumstances, and all sharing behaviors will take strict security measures to restrict the data processing behaviors of third parties:

1. Obtain your explicit written consent: Before sharing any personal data, we will clearly and explicitly disclose the purpose of sharing, the name and qualification of the third party, the type and scope of shared data, the use method and storage period of the third party, and the possible impact to you through pop-ups in the App, written notifications, etc. We will only share the data after you explicitly agree by clicking confirmation, written reply, etc.; you have the right to refuse before sharing, and also have the right to withdraw the consent at any time in accordance with the requirements of laws such as GDPR. The process of withdrawing consent is the same as that of giving consent, and the withdrawal does not affect the validity of the sharing behavior based on legal consent before.

2. Comply with legal and regulatory requirements or mandatory requirements of judicial/administrative organs: To fulfill the obligations stipulated by laws and regulations and respond to the legitimate mandatory requirements of judicial organs and administrative organs (such as court subpoenas, procuratorate notices, regulatory investigation orders, etc.), we will disclose your personal data to relevant departments within the legal scope; in this case, we will notify you in advance as much as possible within the scope permitted by law, unless prohibited or required to be kept confidential by law.

3. Necessary circumstances to protect legitimate rights and interests: To protect the legitimate rights and interests of us, you, or third parties (such as preventing fraud, maintaining public safety, protecting personal or property safety, etc.), share your personal data within a reasonable and necessary scope. For example: disclose the device information and behavior records of those who maliciously attack the App or submit false feedback to relevant regulatory authorities.

4. Limited sharing with cooperative service providers: To realize the core service functions of the App (such as server hosting, technical maintenance, cloud storage services, advertising agency, etc.), we may share minimum necessary personal data with strictly selected third-party service providers; we will sign strict Data Processing Agreements and Confidentiality Agreements with all cooperative service providers, clarify their rights, obligations, and security protection responsibilities in data processing, require them to only use the shared data for the agreed service purposes, not process it beyond the scope, and not share it with any other third parties; at the same time, we will conduct continuous supervision and auditing on the data processing behaviors of the service providers. If the service provider violates the agreement, we will immediately terminate the cooperation and require it to bear corresponding legal liabilities. For laws and regulations in different regions, we will sign exclusive cooperation agreements that comply with the requirements of GDPR, LGPD, CCPA/CPRA, VCDPA, PIPEDA, etc., to ensure that the sharing behavior is compliant.

5. Circumstances of enterprise subject change: If the Company undergoes enterprise subject changes such as merger, division, acquisition, asset transfer, or bankruptcy liquidation, your personal data may be transferred to the successor entity as part of the business assets; before the transfer, we will clearly disclose the name, contact information, and data processing arrangements of the successor entity to you through pop-ups, announcements, etc., in the App, ensuring that the successor entity continues to comply with the provisions of this Policy and relevant laws and regulations, and protects your data rights; if the successor entity changes the purpose or method of data processing, it will re-obtain your explicit consent.

(II) Transfer of Personal Data

Except for the above "circumstances of enterprise subject change", we will not transfer your personal data to any third party; if there is a need for transfer under other special circumstances, your explicit written consent must be obtained, and the requirements of relevant laws and regulations must be strictly followed.

(III) Sale of Personal Data

We explicitly prohibit the sale, rental, transaction, or other forms of your personal data, and have never engaged in such behaviors. In accordance with the requirements of laws and regulations such as CCPA/CPRA and VCDPA, you have the right to choose not to allow any entity to sell your personal data. If you find any entity selling your personal data in any form, you can raise an objection to us through the email specified in this Policy or complain to the relevant regulatory authorities. You can exercise your opt-out right of personal data sale through the methods specified in Article VI (IX) of this Policy at any time, and we will process your opt-out request in a timely manner in accordance with the law.

(IV) Your Core Rights in Data Sharing/Transfer

In accordance with the applicable laws and regulations in various regions, you are legally entitled to the following core rights in the data sharing/transfer link of ours, and we will provide you with full convenience for exercising your rights:

1. Right to know: You have the right to inquire at any time whether we have shared/transferred your personal data, as well as the name of the sharing/transfer object, the type and scope of data, the purpose, legal basis, storage period, and other information; you can submit an inquiry request through the method specified in Article VII of this Policy, and we will reply clearly and completely within the period stipulated by the law.

2. Right to object: If you believe that our sharing/transfer behavior violates the laws and regulations or the provisions of this Policy, or have objections to the sharing/transfer behavior, you have the right to raise a written objection to us. We will verify and handle it in a timely manner after receiving the objection and feedback the result to you; for the sharing/transfer behavior based on your consent, you have the right to withdraw the consent at any time.

3. Right to rectification/deletion: If you find that the personal data being shared/transferred is incorrect or incomplete, or the sharing/transfer behavior is no longer necessary, you have the right to require us to correct the incorrect data and delete the relevant data, and we will coordinate with third-party cooperative service providers (if feasible) to cooperate.

4. Right to claim compensation: If your legitimate rights and interests are damaged due to our illegal sharing/transfer behavior, you have the right to require us to bear corresponding liability for compensation in accordance with the applicable laws and regulations.

(V) Prohibited Sharing/Transfer Behaviors

We strictly prohibit any of the following personal data sharing/transfer behaviors that violate laws, regulations, and this Policy:

- Sharing/transferring personal data to third parties beyond the purpose or scope agreed in this Policy;

- Sharing/transferring personal data to third parties without legal qualifications or without signing confidentiality agreements and data processing agreements;

- Illegally transferring personal data in the form of sale, rental, transaction, etc. (except for the "sale" behavior as defined by CCPA, and if such behavior is involved, we will clearly inform you in advance and provide the right to opt out);

- Sharing/transferring your sensitive personal data (such as avatar images, voice recordings, etc.) to third parties without your consent;

- Other sharing/transfer behaviors that violate laws and regulations and damage your legitimate rights and interests.

VI. Your Legally Entitled Personal Data Rights

In accordance with the core data protection laws and regulations in various regions around the world, such as GDPR, CCPA/CPRA, VCDPA, LGPD, PIPEDA, and the United Kingdom's Data Protection Act 2018, you, as the data subject, are legally entitled to all the following data rights. We will strictly follow the requirements of the law to provide you with simple, convenient, and unobstructed channels for exercising your rights, and will not discriminate against you (such as refusing to provide services, raising service standards, reducing service quality, etc.) because you exercise the above rights.

(I) Right of Access

You have the right to inquire about and obtain your personal data and relevant processing information from us, including but not limited to: copies of your personal data such as hair quality information, conversation records, and avatar images that you actively provided; the purpose, method, and scope of our collection, use, storage, and sharing of your personal data; relevant information of third-party cooperative service providers, etc.

Applicable Legal Basis: GDPR Article 15 (EU residents), CCPA/CPRA §1798.100 (California residents, USA), VCDPA (Virginia residents, USA), PIPEDA (Canadian residents), UK Data Protection Act 2018 (UK residents), LGPD (Brazilian residents), Australia's Privacy Act (Australian residents).

(II) Right to Rectification

If you find that the personal data we collected and stored about you is incorrect or incomplete (such as incorrect hair quality information filling, missing conversation records, etc.), you have the right to submit a rectification application to us, requiring us to correct the incorrect data and supplement the incomplete data. We will verify it in a timely manner after receiving the application, and complete the rectification within the period stipulated by the law after confirmation.

Applicable Legal Basis: GDPR Article 16 (EU residents), CCPA/CPRA §1798.101 (California residents, USA), VCDPA (Virginia residents, USA), PIPEDA (Canadian residents), UK Data Protection Act 2018 (UK residents), LGPD (Brazilian residents), Australia's Privacy Act (Australian residents).

(III) Right to Erasure (Right to Be Forgotten)

In circumstances stipulated by laws and regulations, you have the right to require us to delete your personal data. We will promptly take deletion measures after verification and coordinate with third-party cooperative service providers (if feasible) to cooperate with the deletion. The specific applicable circumstances include:

- Your personal data is no longer necessary for the purpose of use agreed in this Policy;

- You have withdrawn your consent to the processing of personal data, and there is no other legal basis for processing;

- Our personal data processing behavior violates laws, regulations, or the provisions of this Policy;

- Other circumstances where deletion is required by laws and regulations.

Important Note: Canada's PIPEDA does not grant individuals the "right to be forgotten", but you can request correction of inaccurate personal data in accordance with PIPEDA.

Applicable Legal Basis: GDPR Article 17 (EU residents), CCPA/CPRA §1798.105 (California residents, USA), VCDPA (Virginia residents, USA), UK Data Protection Act 2018 (UK residents), LGPD (Brazilian residents).

(IV) Right to Manage Permissions

You have the right to independently adjust, enable, or disable permissions such as camera, photo album, microphone, external storage, and advertising identifier through your device system settings (such as mobile phone settings, tablet settings) at any time; after the permission is disabled, we will immediately stop collecting relevant data corresponding to the permission, and will not refuse to provide the core hair care services of the App because you disable non-core permissions (for example, disabling the camera permission only prevents you from taking avatars, but does not affect text conversations with the AI hair stylist).

At the same time, you have the right to withdraw your consent to our processing of personal data at any time. The process of withdrawing consent is the same as that of giving consent, and the withdrawal of consent does not affect the validity of the personal data processing behavior based on legal consent before.

Applicable Legal Basis: GDPR Article 7(3) (EU residents), CCPA/CPRA (California residents, USA), VCDPA (Virginia residents, USA), LGPD (Brazilian residents), and other applicable data protection laws and regulations in other regions.

(V) Right to Data Portability

You have the right to require us to provide you with the personal data you actively provided (such as hair quality information, conversation records, hair care plans, etc.) in a structured, commonly used, and machine-readable format (such as JSON, CSV, TXT, etc.), or directly transmit it to other data controllers designated by you if technically feasible. We will provide the data in an interoperable standard format in accordance with the requirements of the law, and will not set any unreasonable obstacles to hinder you from exercising this right.

Applicable Legal Basis: GDPR Article 20 (EU residents), CCPA/CPRA (California residents, USA), VCDPA (Virginia residents, USA), PIPEDA (Canadian residents), UK Data Protection Act 2018 (UK residents), LGPD (Brazilian residents), Australia's Privacy Act (Australian residents).

(VI) Right to Restrict Processing

In specific circumstances stipulated by laws and regulations, you have the right to require us to restrict the processing of your personal data. We will suspend the relevant processing behavior (except for necessary storage behavior) after verification. The specific applicable circumstances include:

- You have raised an objection to the accuracy of the personal data, and we need time to verify;

- Our personal data processing behavior is illegal, but you disagree with the deletion of the data and require restriction of processing;

- Your personal data is no longer necessary for the agreed purpose, but you need to retain it for rights protection, litigation, and other purposes;

- You have raised an objection to our personal data processing behavior, and we need time to verify whether there is a legal basis for processing.

Applicable Legal Basis: GDPR Article 18 (EU residents), UK Data Protection Act 2018 (UK residents), LGPD (Brazilian residents), VCDPA (Virginia residents, USA).

(VII) Right to Object

You have the right to raise a written objection to our personal data processing behavior based on legitimate interests based on your special personal circumstances; we will verify it in a timely manner after receiving the objection, and if it is confirmed that your special circumstances are established, we will immediately stop the relevant data processing behavior. At the same time, you have the right to raise objections to our advertising recommendations, data sharing, and other behaviors, and we will make adjustments according to your requirements.

Applicable Legal Basis: GDPR Article 21 (EU residents), LGPD (Brazilian residents), VCDPA (Virginia residents, USA).

(VIII) Right to Object to Automated Decision-Making

The automated decision-making behaviors such as the customization of AI hair care plans in the App are all based on the hair quality information and conversation records you actively provided, and you can independently choose whether to adopt the decision results. In accordance with the requirements of laws and regulations such as GDPR and FADP, you have the right to raise an objection to our automated decision-making behaviors and require us to review and adjust them manually. We will arrange professional hair care personnel to handle them manually in a timely manner after receiving the request.

(IX) Right to Opt-Out

In accordance with the requirements of the Virginia Consumer Data Protection Act (VCDPA) and other applicable laws and regulations, you have the right to opt out of the following data processing behaviors, and we have formulated clear, simple and operable methods for you to exercise this right, ensuring that you can easily and free of charge exercise your opt-out right at any time:

1. Opt-out of targeted advertising: Targeted advertising refers to the personalized advertising recommendations we push to you based on your personal data (such as advertising identifier, usage behavior information, hair care preferences, etc.). You can exercise your opt-out right in two ways: (1) Through your device system settings: Find the "advertising identifier" (ADID) setting in your device settings, turn off the advertising identifier, and after turning it off, we will no longer obtain your advertising identifier or push targeted advertising, and will only push non-personalized general advertisements; (2) Through the App: Enter the "Settings - Privacy Settings - Opt-Out of Targeted Advertising" module in the App, click the "Opt-Out" button, and the opt-out will take effect immediately. After opt-out, we will not resume targeted advertising push unless you actively cancel the opt-out.

2. Opt-out of the sale of personal data: As clearly stated in Article V (III) of this Policy, we will never sell your personal data in any form. If in the future we need to carry out data sale behaviors as defined by laws and regulations such as CCPA/CPRA (if permitted by law), we will clearly inform you of the purpose, scope, and recipient of the sale in advance, and provide you with a prominent opt-out channel. You can opt out of the sale of your personal data through the "Settings - Privacy Settings - Opt-Out of Data Sale" module in the App or by sending an email to our official contact email, and we will process your opt-out request within 15 working days and confirm the result to you.

3. Opt-out of profiling that supports decisions that produce legal or similarly significant consequences: Profiling refers to the behavior of us analyzing your personal data (such as hair quality information, usage behavior, etc.) to form a user profile, which may be used to support decisions related to your use of the App (such as whether to provide certain personalized services). If such profiling may produce legal or similarly significant consequences for you, you have the right to opt out of such profiling. You can submit an opt-out application through the official email specified in this Policy or the "Settings - Privacy Settings - Opt-Out of Profiling" module in the App, clearly stating that you want to opt out of such profiling. We will stop the relevant profiling behavior within 15 working days after receiving your application and feedback the processing result to you. At the same time, we will not use the previously formed profile to make decisions that have legal or similarly significant consequences for you.

Important Note: The exercise of your opt-out right will not affect your use of the core hair care services of the App, and we will not discriminate against you because you exercise the opt-out right (such as reducing service quality, refusing to provide core services, etc.).

VII. Methods and Procedures for Exercising Personal Data Rights

If you need to exercise any of the personal data rights agreed in Article VI of this Policy, including the opt-out right specified in Article VI (IX), you can submit an application through the following official and legal channels. We will process your application within the period stipulated by the laws and regulations of various regions and feedback the processing results. Applications not submitted through the following channels will not be accepted.

(I) Application Submission Methods

You can choose any of the following methods to submit an application for exercising your rights. Both methods are official channels and have the same legal effect:

1. Email application: Send a written application email to us or the Data Protection Officer (DPO) through the official email specified in this Policy (santosefertimothyk@gmail.com);

2. In-App application: Fill in the application information and submit it in accordance with the prompts on the page in the "Settings - Privacy Settings - Data Rights Application" module of the App. This method is more convenient and efficient in processing.

(II) Required Application Materials

To ensure the security of your personal data and prevent others from exercising rights in your name, we will verify the identity of the applicant. You need to provide the following necessary materials in the application (all materials are strictly confidential and only used for identity verification, and will be deleted in a timely manner after verification):

1. Identity verification materials: Your unique device identifier (which can be found in "Settings - About Us" of the App, which is a device-specific identifier with no other purposes); if your application involves sensitive data (such as avatars, voice recordings), you can supplement it with a screenshot of your device (including the device model).

2. Application description materials: Clearly and explicitly explain the type of right you need to exercise (such as right of access, right to erasure, right to rectification, opt-out right, etc.), specific request matters, and basis for the application (such as incorrect data, expiration of storage period, desire to opt out of targeted advertising, etc.).

3. Supplementary materials: If you exercise the right to data portability, you need to explain the format of the data to be received (such as JSON, CSV) and the receiving method (such as email, in-App export); if you entrust others to apply on your behalf, you need to provide your written power of attorney, and the unique device identifiers of the principal and the agent.

(III) Application Processing Procedures

1. Material Receipt and Preliminary Review: We will complete the preliminary review of the completeness of the application materials within 3 working days after receiving your application; if the materials are incomplete, we will inform you of all the contents to be supplemented at one time through the contact information you left (such as email), without making multiple requests.

2. Identity Verification and Formal Processing: After the preliminary review of the materials is passed, we will complete the identity verification within 1 working day; after the verification is passed, we will formally process your application within the period stipulated by the laws and regulations of various regions:

- EU GDPR: Generally no more than 1 month, which can be extended to 3 months in special cases, and the extension will be notified in advance;

- US CCPA/CPRA: Generally no more than 45 calendar days, which can be extended by 45 calendar days in special cases, and the extension will be notified in advance;

- US VCDPA/Brazil LGPD: Generally no more than 15 working days, which can be appropriately extended in complex cases, and the extension will be notified in advance;

- Other regions: Processed within the shortest period stipulated by the local applicable laws and regulations.

3. Feedback of Processing Results: After the application is processed, we will feedback the processing results in written form through the contact information you left (such as email, in-App message); if your application is partially or fully rejected, we will clearly and detailedly explain the reasons for the rejection and inform you of the subsequent remedies.

(IV) Other Relevant Instructions

1. Fee Instructions: We provide free services for you to exercise your statutory personal data rights and will not charge any unreasonable fees; if your application is obviously beyond a reasonable scope (such as repeatedly submitting the same application, submitting a large number of applications without legal basis, etc.), we will charge a reasonable administrative cost in accordance with the applicable laws and regulations and clearly inform you of the fee standard and basis in advance.

2. Right Protection: We will not set any unreasonable conditions or obstacles to restrict or refuse you from exercising your statutory personal data rights; if you believe that our processing results have infringed your legitimate rights and interests, you can complain to the data protection regulatory authority in your region.

3. Handling of Special Cases: If you are unable to provide the above application materials due to equipment failure, operational difficulties, etc., you can negotiate with us through the official email, and we will provide you with other reasonable identity verification methods on the premise of ensuring data security.

VIII. Update and Notification of the Privacy Policy

We have the right to modify, supplement, and update the contents of this Policy in accordance with the update of laws and regulations, the iteration and upgrade of the App's service functions, the adjustment of industry standards, or operational needs. The update of this Policy will strictly follow the requirements of laws and regulations in various regions to ensure that the update behavior is legal and transparent. The specific update rules are as follows:

1. Update Announcement: For any update of this Policy, we will publicly display the revised complete content and effective date through pop-ups in the App, announcements in the App, and other prominent ways, and highlight the core modified content for your convenience to review.

2. Consent for Core Changes: If the update of this Policy involves your core data rights (such as expanding the scope of data collection, changing the sharing method, extending the storage period, modifying the opt-out method, or changing the data controller's information, etc.), we will re-obtain your explicit consent through pop-up check, written confirmation, etc., in accordance with the requirements of laws and regulations such as GDPR, CCPA/CPRA, VCDPA, and LGPD. The updated Policy will only take effect for you after you agree.

3. Effectiveness and Retroactivity: The updated Privacy Policy will take effect officially from the announced effective date, and only has binding force on the personal data processing behaviors after the effective date, without retroactivity; if you have objections to the updated Policy, you can immediately stop using the App. If you continue to use it, you are deemed to agree to the updated Policy.

4. Retention of Historical Versions: We will retain all historical versions of this Policy in the "Settings - Privacy Policy - Historical Versions" module of the App, and you can check them at any time to understand the change track of the Policy.

IX. Protection of Minors' Data

The App is only for adult users aged 18 and above, and strictly complies with the special laws and regulations on the protection of minors' (children's) personal data in various regions around the world, including but not limited to: the provisions on the protection of children's data under the age of 14 in GDPR, the provisions on the protection of children's data under the age of 13 in the US COPPA, the provisions on the protection of minors' data under the age of 16 in CCPA/CPRA, and the special provisions on the protection of minors' data in LGPD.

We will not actively collect or process any personal data of minors; if you are under 18 years old, please do not use any service functions of the App. If we collect personal data of minors under 18 years old without knowing it, we will immediately stop all relevant data processing behaviors after discovery, and take remedial measures such as deleting data and clearing relevant records in accordance with the requirements of applicable laws and regulations.

For the legal guardians (parents/guardians) of minors, if you find that we have collected personal data of your ward, you have the right to exercise the following rights to us through the method specified in Article VII of this Policy:

- Right to know: Inquire whether we have collected and processed personal data and relevant records of your ward;

- Right to object: Raise an objection to our processing of your ward's personal data;

- Right to erasure: Require us to delete all personal data of your ward;

- Right to withdraw consent: If you have previously agreed to our processing of relevant data, you have the right to withdraw the consent at any time.

When you exercise the above rights, you need to provide your identity verification materials, guardianship relationship certification materials (such as birth certificate, household registration book, etc.), and the unique device identifier of the ward. We will process and feedback the results immediately after verifying the authenticity of the materials.

X. Contact Us

If you have any questions, objections to the contents of this Policy, or need to exercise your personal data rights (including the opt-out right), submit complaints and suggestions, or have inquiries about the data controller (Baoding Chongchi Electronic Technology Co., Ltd.), you can contact us through the following official channels. We will communicate with you and properly solve the relevant problems within 15 working days after receiving your request:

1. Official Contact Email: santosefertimothyk@gmail.com (can be used for submitting applications, complaints, inquiries, objections, and all other matters, including inquiries about the data controller);

2. Dedicated Email for Data Protection Officer (DPO): santosefertimothyk@gmail.com (specifically for handling matters related to the exercise of personal data rights and data protection compliance);

3. In-App Feedback: The "Settings - Feedback" module of the App can be used to submit simple inquiries and suggestions, and we will reply within 7 working days.