Summary

We collect device IDs, subscription data, and chat logs to provide ChatQ AI, powered by third-party AI model APIs (e.g., ChatGPT, Claude, Deepseek). Your data is shared with trusted providers (e.g., Apple, AWS, AI providers) via secure APIs to enable features like conversations and email advisors. You can access, delete, or limit your data by contacting [email protected] or using in-app settings. We comply with global data protection laws, including GDPR, CCPA, APPI, PIPA, PDPA, PIPL, and others. Review the full policy below.

1. Introduction

HONG KONG HAPPY MOBILE TECHNOLOGY LIMITED ("we," "our," "the company") is committed to protecting your privacy. This Privacy Policy ("Privacy Policy") explains how we collect, use, share, and safeguard your personal information when you use our product ChatQ AI ("the App").

The App does not require a login account, but we may link your subscription and account information with your Apple ID. By using the App, you acknowledge that you have read, understood, and agreed to this Privacy Policy.

2. Information We Collect

2.1 Categories of Personal Information

In the past 12 months, we have collected the following categories of personal information through Apple's integration and subscription services:

• Identifiers: IP address, device identifiers (we do not access your Apple ID or email address; this is managed securely by Apple).
• Commercial Information: Subscription type, transaction date, order number, payment method (handled by Apple; we only receive subscription status confirmation).
• Internet Activity Information: Features used, access records, operation times.
• Geolocation Data: General location derived from IP address.
• Audio, Electronic, or Visual Information: User-generated content within the App.
• Inferences: Drawn from the above information to create user profiles.

Specifically, we collect:

• Subscription Information: Confirmation of subscription status (e.g., type, transaction date, order number) via Apple, without access to your Apple ID or email.
• Transaction Information: Records of subscriptions or purchases, including type, date, order number, and payment method.
• Device Information: Device model, operating system, app version, system version, device identifier (e.g., IDFA or OAID), IP address, and related technical data.
• Usage Data: Automatically generated data, such as features used, access records, and operation times, to improve user experience and performance.
• User-Generated Content: Content you upload or generate, such as chat logs, files (e.g., PDFs), and other data.

2.2 Collection of Sensitive Personal Information

In the past 12 months, we have collected the following sensitive personal information (as defined under California law and other jurisdictions like Saudi Arabia PDPL):

• Contents of private communications within the App (chat logs).
• Potentially, data related to religious beliefs, health, racial or ethnic origins, or biometric data, if included in user-generated content.

Note: We do not collect or store your Apple ID or login credentials. Apple securely manages authentication and payment processing, and we do not access this information. Sensitive personal information is used only for necessary service provision and as permitted by law, with additional safeguards (see Section 15.2).

3. How We Use Your Information

3.1 Purposes of Processing

We use your personal information to:

• Provide and maintain services: Deliver features (e.g., conversations, email advisors) by sending user inputs to third-party AI model APIs (e.g., ChatGPT, Claude, Deepseek) and receiving responses, using Apple's subscription status confirmation (without accessing your Apple ID).
• Transaction management: Process subscriptions through Apple's payment system and maintain secure transaction records.
• User behavior analysis: Analyze device information, operation records, and usage data to improve service quality and user experience.
• Personalized services: Offer tailored services (e.g., content recommendations, optimized feature displays) based on usage patterns, without personalized ads. You can opt out via in-app settings (see Section 18).
• Security and fraud prevention: Use device identifiers to monitor unusual activities, prevent unauthorized use, and ensure account/payment safety.

3.2 How We Obtain Consent

When you use the app for the first time, we will provide a checkbox at the bottom of the page to let you choose whether to agree to the User Terms, Privacy Policy, and allow us to process data for personalized services or analysis. Core features (such as conversations, email advisors) require data transmission to third-party AI APIs, and you will not be able to opt out without stopping the use of these features. You can modify non-essential preferences at any time in the App's settings (Settings > Contact Us) or by contacting [email protected]. Consent is not a condition of using essential App features.

3.3 Legal Bases for Processing

Under applicable laws, particularly GDPR, we process personal data based on:

• Consent: For explicit consent to processing.
• Contractual Necessity: For performing a contract (e.g., providing services via API calls).
• Legal Obligation: For compliance with legal requirements.
• Legitimate Interests: For our or a third party's legitimate interests, unless overridden by your rights.
• Vital Interests: To protect your or another's vital interests.
• Public Interest: For tasks in the public interest.

You may withdraw consent at any time (see Section 10).

4. International Data Transfers

We provide the App globally, meaning your personal data, including user inputs sent to third-party AI APIs (e.g., OpenAI in the USA, Deepseek in China, Coze in Singapore), may be transferred to and stored in countries with different data protection standards.

4.1 Cross-Border Transfer Mechanisms

We implement safeguards for international transfers:

• EEA (including Norway, Iceland, Liechtenstein), UK, Switzerland: Standard Contractual Clauses (SCCs) approved by the European Commission and Data Processing Agreements (DPAs) with AI providers (e.g., OpenAI's US servers, Deepseek's China servers, Coze's Singapore servers).
• Israel: Compliance with the Protection of Privacy Law, including user consent for data exports recorded via in-app pop-ups.
• Switzerland: Compliance with the Federal Act on Data Protection (FADP), ensuring transfers meet local standards.
• Brazil: Compliance with LGPD, including explicit user consent for transfers recorded via in-app pop-ups.
• Japan: Compliance with the Act on the Protection of Personal Information (APPI).
• South Korea: Compliance with the Personal Information Protection Act (PIPA).
• Other countries: Contractual safeguards and technical measures, with regular audits of DPAs/SCCs.

4.2 Data Localization Compliance

For countries with data localization requirements:

• China: Data stored in mainland China per the Personal Information Protection Law (PIPL).
• Russia: Data stored in Russia per Federal Law No. 152-FZ.
• India: Compliance with the Digital Personal Data Protection Act for critical data.
• Brazil: Compliance with LGPD for data transfers.
• Indonesia: Critical personal data stored locally per the Personal Data Protection Law (PDP), with contractual safeguards for transfers.
• Saudi Arabia: Sensitive data prioritized for local storage per PDPL, with SCCs for transfers.
• South Africa: Cross-border transfers justified per POPIA, with appropriate safeguards.

By using the App, you agree to data transfers to third countries or organizations per these safeguards.

5. Cookies and Similar Technologies

We use cookies and similar technologies only with consent (where required). Non-essential cookies (e.g., for advertising) are disabled by default for EU users. Manage preferences via:

• iOS: Settings > Privacy & Security > Tracking.
• Web: Cookie consent banner with granular opt-in/opt-out options.

6. How We Share Your Information

6.1 Data Sharing Practices

In the past 12 months, we have not "sold" personal information (per CCPA/CPRA) but have "shared" certain data for cross-context behavioral advertising:

• Internet Activity Information.
• Device Identifiers.
• Usage Data.

We disclosed the following for business purposes to service providers and third parties:

• Identifiers.
• Commercial Information.
• Internet Activity Information.
• Geolocation Data.
• User-Generated Content.
• Audio, Electronic, or Visual Information.

We share information with:

• Apple: Transaction information for subscriptions, necessary for functionality (not a "sale" or "sharing" per California law). We do not access your Apple ID or email.
• Third-Party AI Providers: User-generated content (e.g., chat logs, inputs for email advisors) sent via APIs to providers like OpenAI, Anthropic, and Deepseek to enable core features. This is necessary for service delivery and governed by Data Processing Agreements (DPAs).
• Service Providers: For cloud storage, payment processing, etc., with secure handling requirements.
• Third-Party Analytics/Advertising Partners: Device identifiers and internet activity for analytics/advertising, constituting "sharing" under California law (see Section 11 for opt-out).
• Legal Requirements: When required by law or to enforce legal obligations.

6.2 Third-Party AI Data Processing

When you use ChatQ AI, your queries are processed as follows:

• Pre-Processing: We may remove personally identifiable information, apply content filters, and format queries to optimize responses.
• Data Transmission: Queries are sent to third-party AI APIs with secure encryption (TLS 1.2 or higher), minimal context, and anonymous session identifiers.
• Data Control: Third-party providers may process data per their privacy policies (see Section 7.1), which we do not control. We use DPAs to ensure secure handling.
• Data Deletion: Upon deletion requests, we delete data from our systems and request deletion from providers where feasible, though some may retain anonymized data per their policies.

7. Third-Party Service Providers

We work with third-party providers to deliver and improve services. We select and monitor AI providers based on:

• Initial Assessment: Data security, privacy compliance, content moderation, performance, and local law adherence (e.g., Deepseek complies with PIPL and SCCs for EU data).
• Contractual Safeguards: DPAs requiring security measures, limited processing, breach notification, and compliance.
• Ongoing Monitoring: Regular security reviews, automated tracking of policy changes (e.g., OpenAI privacy updates), and performance monitoring.
• Provider Replacement: If providers fail to meet standards or change practices significantly.

7.1 AI Services (Conversation and Content Generation)

7.2 Search Services

7.3 Infrastructure and Analytics

Providers are required to maintain confidentiality and process data per our instructions. Review their privacy policies for details. We are not responsible for their practices.

8. Data Security

We implement technical and organizational measures to protect your data, including:

• Encrypted transmission: SSL/TLS encryption for sensitive data (e.g., payment, Apple ID data, API calls).
• Access control: Limited to authorized personnel with strict monitoring.
• Regular audits: Security system reviews to prevent breaches.

No transmission or storage method is 100% secure, but we strive to protect your data.

9. Data Storage and Retention

9.1 Storage Locations

Data is stored on secure servers in:

• United States (AWS US-East).
• European Union (AWS EU-West for EU users).
• Singapore (AWS Asia Pacific for Asia Pacific users).
• China (Aliyun for mainland China users).

For data localization laws, see Section 4.2.

9.2 Retention Periods

• Apple ID Information/Transaction Records: 7 years for legal/financial obligations.
• Device/Usage Data: 2 years for analytics, or until deletion request.
• User-Generated Content: 1 year for service continuity, or until deletion request.
• Consumer Request Records: 24 months for compliance, in a secure environment.

10. Your Rights

10.1 General Privacy Rights

Depending on your location, you may have rights to:

• Access.
• Rectification.
• Erasure.
• Restrict processing.
• Data portability.
• Object.
• Withdraw consent.

10.2 How to Exercise Your Rights

Contact us via:

• Email: [email protected].
• In-App: Settings > Contact Us (online form).

Response times and consequences for non-compliance:

• GDPR: Within 30 days; non-compliance may lead to fines or regulatory action.
• CCPA/CPRA: Within 45 days; non-compliance may result in penalties.
• Japan (APPI): Within 2 weeks for disclosure requests; non-compliance may lead to sanctions.
• South Korea (PIPA): Within 10 days; failure to comply may result in fines under PIPA Article 64.
• Saudi Arabia (PDPL): Promptly, typically within 30 days; non-compliance may lead to penalties.

If additional time is needed, we will inform you. Electronic requests receive electronic responses unless specified otherwise.

10.3 Verification Process

To protect your data, we verify requests:

• Basic Requests (e.g., opt-out): Via email or device identifier.
• Sensitive Requests (e.g., access/deletion):
  • Active subscription: Verified via Apple ID and transaction details.
  • No subscription: Verified via device/usage details, signed declaration, or recent conversation snippets provided via [email protected].

Data access requests are provided in portable formats (e.g., CSV, JSON). No fees are charged unless requests are excessive, with prior cost estimates.

10.4 Third-Party AI Provider Data Rights

For data processed by third-party AI providers:

• Access: We provide data in our systems and details of providers who processed your queries.
• Deletion: We delete data from our systems and forward deletion requests to providers where feasible, though some may retain anonymized data.
• Limitation: Complete deletion of derivatives from AI models may not be possible.
• Direct Rights: Exercise rights directly with providers using their privacy policy contacts.

11. Special Notice for California Residents

11.1 California Consumer Rights

Under CCPA/CPRA, you have rights to:

• Know: Categories, sources, purposes, third parties, and specific pieces of personal information collected (past 12 months).
• Delete: Request deletion, subject to exceptions.
• Correct: Request correction of inaccurate data.
• Opt-Out of Sale/Sharing: Opt-out of sharing for cross-context behavioral advertising.
• Limit Sensitive Information: Limit use to necessary services.
• Non-Discrimination: No denial, price differences, or reduced service quality for exercising rights.

11.2 Authorized Agent

Use an authorized agent with written permission and direct identity verification. Contact [email protected].

11.3 Do Not Sell or Share My Personal Information

Our data practices with analytics/advertising partners may constitute "sharing" under California law. Opt out via:

• Email: [email protected] ("Do Not Sell or Share My Personal Information").
• In-App: Settings > Contact Us.
• Website: https://www.chatq.co/privacy-choices.

11.4 Notice of Financial Incentive

We do not offer financial incentives for retaining or selling personal information.

12. Special Notice for EU, EEA, and UK Residents

12.1 GDPR Compliance

Under GDPR/UK GDPR, you have rights (per Section 10) plus:

• Lodge a complaint with a supervisory authority.
• Object to processing based on legitimate interests.
• Object to direct marketing.
• Rights against automated decision-making/profiling.

12.2 Data Protection Officer

Contact our DPO:

• Email: [email protected].
• Postal: Data Protection Officer, HONG KONG HAPPY MOBILE TECHNOLOGY LIMITED, 21/F, 14 Tai Koo Wan Road, Quarry Bay, Hong Kong.

12.3 EU Representative

For EU users (GDPR Article 27):

• RENJUNPROFESSIONALCOMPLYFINANCEANDTAXLTD, 17 RUE SAINT-FIACRE, 75002 Paris, France.
• Email: [email protected].

12.4 UK Representative

For UK users (UK GDPR):

• EVATOST CONSULTING LTD, Office 101, 32 Threadneedle Street, London, EC2R 8AY, United Kingdom.
• Email: [email protected].

13. Special Notice for Asian Jurisdictions

13.1 Japan (APPI Compliance)

We comply with APPI:

• Notify purpose of use at collection.
• Limit use to necessary scope without prior consent.
• Respond to disclosure requests within 2 weeks.
• Contact: [email protected].

13.2 South Korea (PIPA Compliance)

We comply with PIPA:

• Obtain separate consent for sensitive/unique identifying information.
• Destroy data after purpose fulfillment or retention period.
• Contact: [email protected].

13.3 Singapore (PDPA Compliance)

We comply with PDPA:

• Collect/use/disclose data for reasonable purposes.
• Protect data from unauthorized risks.
• Contact: [email protected].

13.4 China (PIPL Compliance)

We comply with PIPL:

• Store Chinese user data in mainland China.
• Conduct security assessments for cross-border transfers.
• Appointed a personal information protection officer.
• Contact: [email protected].

14. Special Notice for Middle East Jurisdictions

14.1 United Arab Emirates (UAE)

We comply with Federal Decree-Law No. 45 of 2021. UAE users have rights to:

• Access/correct data.
• Request deletion.
• Withdraw consent.
• Object to automated decision-making.
• Contact: [email protected].

14.2 Saudi Arabia

We comply with PDPL. Saudi users have rights to:

• Be informed about processing.
• Access/correct/delete data.
• Withdraw consent.
• Object to automated decision-making.
• Contact: [email protected].

14.3 Qatar

We comply with Data Protection Law No. 13 of 2016, ensuring data subject rights and secure processing. Contact: [email protected].

14.4 Israel

We comply with the Protection of Privacy Law, 1981, including database registration and user rights to access and correct data. Contact: [email protected].

14.5 Cultural and Religious Sensitivities

In the UAE, Saudi Arabia, Qatar, and Israel, we protect sensitive data (e.g., religious beliefs, cultural practices) per local laws and customs, using content filters to restrict processing of such data.

15. AI Transparency and Ethics

15.1 AI-Specific Disclosures

ChatQ AI uses third-party AI model APIs (e.g., ChatGPT, Claude, Deepseek) to power features like conversations and email advisors. User inputs are sent to these providers via secure APIs to generate responses.

• Nature of AI Interaction: Responses are generated based on statistical patterns, not human understanding.
• AI Limitations: May produce inaccurate, incomplete, or biased content, dependent on third-party models; not suitable for critical decisions without oversight.
• Human Review: Conversations may be reviewed by our team or providers for service improvement, with strict privacy procedures.
• AI Decision-Making: We use automated decisions (e.g., recommending topics based on chat history) affecting displayed content/features, without legal/significant effects. Rights include:
  • Human intervention.
  • Expressing your view.
  • Contesting decisions.
  • Contact: [email protected].

15.2 Query Processing and Protection

We route queries to the most appropriate AI model based on:

• Query type, language, and complexity.
• Selected features (e.g., conversation vs. email advisor).
• Content safety and regional availability.
• Performance optimization.

Users can view which model processed each response and select features using different models in Settings > Contact Us. We protect sensitive information with:

• Pre-Processing Filters: AI-based scanning for personal identifiers, health, religious beliefs, or high-risk content using pattern recognition (e.g., regex for names, addresses).
• Transmission Controls: Secure encryption (TLS 1.2 or higher), API authentication, and periodic credential rotation.
• User Notifications: In-app warnings when potentially sensitive data (e.g., health information) is detected.

15.3 Joint Controller Relationships

We may be a joint controller with third-party AI providers:

• Responsibilities: We handle data collection; providers process data via APIs. We cooperate to fulfill user rights.
• Transparency: Joint controller arrangements are available upon request via [email protected].

16. Children's Privacy

The App is not intended for children. We do not knowingly collect data from children, defined as:

• United States: Under 13 (per COPPA).
• EU/EEA: Under 16 (per GDPR).
• Japan: Under 20, with parental consent for under 15 (per APPI).
• South Korea: Under 14, with parental consent (per PIPA).
• Canada: Under 19 in certain provinces (e.g., British Columbia, per PIPEDA).
• UAE, Saudi Arabia, Qatar: Under 18, with additional safeguards per local laws.
• Israel: Under 18, per Protection of Privacy Law.

16.1 Parental Consent

For users under the above ages, we verify parental consent via email, payment method, or identity document verification (e.g., in British Columbia for <19). We use age verification prompts at onboarding and AI-based pre-processing filters to scan for sensitive content in API data transmissions (e.g., chat logs) to prevent unauthorized access.

If we discover a child's data without verified parental consent, we delete it promptly. Contact [email protected] if you believe a child has provided data.

For California residents, we do not sell/share data of users under 16 without affirmative authorization (from users 13–16 or parents for under 13).

17. Links to Third-Party Websites/Services

The App may link to third-party sites/services. We are not responsible for their privacy practices. Review their policies before providing data.

18. How to Opt-Out

Opt out of data collection/processing via:

18.1 iPhone Devices

• Disable Tracking:
  1. Settings > Privacy & Security > Tracking.
  2. Turn off "Allow Apps to Request to Track."
• Disable Personalized Ads:
  1. Settings > Privacy & Security > Apple Advertising.
  2. Turn off "Personalized Ads."

18.2 In-App and Support

For non-essential processing (e.g., analytics, personalization):

• In-App: Settings > Contact Us.
• Email: [email protected].

Core features (e.g., conversations, email advisors) require API data transmission, which cannot be opted out without ceasing use. Processed within 15 days (GDPR/UK GDPR) or 45 days (other jurisdictions).

18.3 Do Not Sell or Share My Personal Information

Opt out via:

• Email: [email protected] ("Do Not Sell or Share My Personal Information").
• In-App: Settings > Contact Us.
• Website: https://www.chatq.co/privacy-choices.

18.4 Limit Sensitive Personal Information

Limit use to necessary services via:

• Email: [email protected] ("Limit Sensitive Personal Information").
• In-App: Settings > Contact Us.

18.5 Global Privacy Control (GPC)

We respect GPC signals, treating them as "Do Not Sell or Share" requests, applied automatically. Enable via browser extensions or privacy browsers.

19. Data Breach Notification

In a data breach affecting your data's security, we will notify you after confirming the breach:

• When to Notify:
  • EU/UK/EEA: Within 72 hours (GDPR/UK GDPR).
  • South Korea (PIPA): Within 24 hours.
  • Japan (APPI): Promptly, typically within 72 hours.
  • Australia (NDB): Within 30 days.
  • Canada (PIPEDA): As soon as feasible.
  • UAE: Within 72 hours (Federal Decree-Law No. 45 of 2021).
  • Saudi Arabia: Within 72 hours (recommended per PDPL).
  • Israel: Within 48 hours per Protection of Privacy Law guidelines.
  • Switzerland: As soon as practicable per FADP.
  • Others: Within 45 days, unless shorter periods apply.
• Method: Email, in-app notification, website notice, or direct mail.
• Content: Incident description, data involved, protective steps, user actions, resources, contact info.
• Regulatory Notification: As required by law.

Report suspected breaches to [email protected].

20. Dispute Resolution and Governing Law

20.1 Dispute Resolution Process

For disputes regarding your personal data:

• Initial Contact: Email [email protected].
• Escalation:
  • Acknowledgment within 5 business days.
  • Initial response within 15 business days.
  • Resolution proposal within 30 business days.
• Alternative Dispute Resolution:
  • EU/EEA: Mediation via local data protection authority.
  • Others: Voluntary mediation through an independent third party.

20.2 Governing Law and Jurisdiction

• EU/EEA Residents: Claims may be brought in your country of habitual residence, work, or alleged infringement.
• Non-EU/EEA Residents: Disputes are governed by Hong Kong law, with courts in Hong Kong having non-exclusive jurisdiction, unless prohibited by local law.

21. Changes to This Privacy Policy

We may update this policy for business/legal changes, notifying you via email or in-app. We review it at least every 12 months. For significant changes (e.g., new data sharing), we monitor third-party policy updates and notify users within 30 days via in-app alerts or email.

22. Multi-Language Support

Available in:

• English.
• French.
• Korean.
• Japanese.
• Chinese (Simplified).
• Chinese (Traditional).
• Spanish.
• German.
• Italian.
• Dutch.
• Spanish (Mexico).
• Swedish.
• Danish.
• Finnish.
• Irish.
• Polish.
• Icelandic.
• Russian.

All language versions are reviewed by legal professionals to ensure consistency with the English version, which prevails in discrepancies. Request other languages or language-specific support via [email protected].

23. Other Jurisdictions

For users in Malaysia, Philippines, Thailand, Indonesia, Israel, Canada, Australia, New Zealand, South Africa, Chile, Uruguay, Panama, and Mauritius, we comply with local laws (e.g., Indonesia's PDP, South Africa's POPIA, Canada's PIPEDA). Rights are per Section 10. Contact: [email protected].

23.1 Latin America

• Chile: We comply with Law No. 19,628 (updated 2023), ensuring user rights to access, correct, and delete data. Contact: [email protected].
• Uruguay: We comply with Law No. 18,331 (2008), including data protection registry requirements. Contact: [email protected].
• Panama: We comply with Law No. 81 (2019), ensuring secure data processing. Contact: [email protected].

23.2 Africa

• South Africa: We comply with POPIA, ensuring justified cross-border transfers and user rights. Contact: [email protected].
• Mauritius: We comply with the Data Protection Act (2017), including data security and user rights. Contact: [email protected].

23.3 Additional Representatives

• Switzerland (FADP): Email: [email protected].
• Australia (Privacy Act): Email: [email protected].
• Canada (PIPEDA): Email: [email protected].
• New Zealand (Privacy Act): Email: [email protected].

24. How to Contact Us

• Company: HONG KONG HAPPY MOBILE TECHNOLOGY LIMITED.
• DPO Email: [email protected].
• Support Email: [email protected].
• Postal: 21/F, 14 Tai Koo Wan Road, Quarry Bay, Hong Kong.
• Accessing This Policy: Via App (Settings > Privacy Policy), or App Store listings.

For region-specific inquiries, use the relevant email addresses above.