Last updated: September 20, 2026

1. Introduction

1.1 Thank you for using the [ToonBox] platform and related services (collectively, "[ToonBox]" or the "Services") provided by Spark Deep Intelligence Technology Co., Limited (hereinafter "we" or the "Company"). When you use [ToonBox], we may collect and process your personal data in accordance with this Policy and applicable law. This Policy is intended to help you understand how we collect, use, store, share, transfer, and protect your personal data, as well as the rights and choices you have with respect to such personal data. We value your privacy and will protect your personal data and privacy security in accordance with applicable law.

1.2 This ToonBox User Privacy Policy (hereinafter the "Policy") forms part of, and is governed by, the Platform User Agreement, and applies to [ToonBox] and the related services and content. This Policy describes our collection, use, disclosure, or other processing, in accordance with applicable laws and regulations, of the personal data of users with whom we have contracted and which we own or control.

1.3 Please read carefully and understand this ToonBox User Privacy Policy in its entirety before using [ToonBox]. We will process your personal data on appropriate legal bases under applicable law, such as performing a contract, fulfilling legal obligations, protecting legitimate rights and interests, or obtaining your consent. For processing activities that require consent under the law, we will provide you with the necessary information and obtain your explicit consent before processing; where sensitive personal data, personalized advertising, cross-border transfers, or minors' data are involved, we will also perform additional notice, separate consent, or other compliance obligations under applicable law. If you do not agree to the provisions of this Policy relating to necessary services, please do not register for, log in to, access, or use [ToonBox]; with respect to non-essential data processing, you may choose whether to consent or to withdraw your consent through this Policy and the settings provided in the product.

1.4 Age Restrictions: [ToonBox] and the related services are available only to adults aged 18 or above. Minors under the age of 18 may not register for, log in to, access, or use [ToonBox] or the related services, nor may they provide us with any personal data. By using the Services, you represent and warrant that you are at least 18 years old. If we discover that a person under the age of 18 has provided personal data to us, we will close the relevant account and delete such personal data. For further requirements on age restrictions and the protection of minors' data, please refer to Article 8 of this Policy.

1.5 If you have any questions about this ToonBox User Privacy Policy or about personal data and data protection, you may contact us through the contact methods set out in this Policy.

1.6 This ToonBox User Privacy Policy informs you of the following:

(1) Customer information we collect

(2) Purposes for which we collect and use personal data

(3) How we share and disclose your personal data

(4) Personalized advertising services

(5) Cookies and similar technologies

(6) How we store and protect your personal data

(7) Your rights and choices

(8) Age restrictions

(9) Account deletion

(10) Special notice regarding popular public characters

(11) Miscellaneous

(12) Contact and complaints

2. Customer Information We Collect

We collect data that you actively provide when using the Services, as well as data generated through automated or other means in the course of your use of the relevant features of [ToonBox] or when you receive the Services, including but not limited to:

2.1 Account Data:

2.1.1 We collect the personal data you provide during registration/login/use, including your mobile phone number or email address, gender, nickname, profile picture, and other data. You should ensure the accuracy of the data you provide. We collect this data to provide you with account registration and login services, to complete your online identity information, and to safeguard your account security.

2.1.2 If you choose to log in to [ToonBox] through a third-party platform account (e.g., Facebook/Google/Apple ID), with your consent, we will obtain the public account data you registered on the third-party platform (including your name, profile picture, mobile phone number, email address, and other data you authorize), and use it to link to your [ToonBox] account so that you can log in to [ToonBox] directly and use the related services.

2.2 User Content and AI Inputs and Outputs:

2.2.1 When you use the AI-related features provided by [ToonBox] (e.g., creating automated AI characters, interacting with characters, generating content such as text, images, audio, or video), we collect the AI input data you submit, including but not limited to the content of your chats with AI characters, voice recordings you submit, reference images, prompts, and information relating to the characters you create.

2.2.2 We also collect the corresponding output content generated based on your AI inputs (hereinafter, together with the AI input data, the "AI Inputs and Outputs"), which is used to provide you with AI features, to improve service quality, and for other purposes described in this Policy.

2.2.3 We take reasonable security measures, such as encryption, to protect your private information (including the content of your chats with characters, voice messages, viewing history, private memories and characters, image generation records, etc.) in order to protect your privacy.

2.3 Camera or Photo Album Permissions: When you set or change your profile picture, or use other related features, we need to obtain the camera or photo album permission on your device and access data such as photos and images. If you refuse to grant such device permissions, you will not be able to use such features, but this will not affect your normal use of the other features of [ToonBox] and/or the Services.

2.4 Calendar Permission: When you use the appointment reminder or check-in feature (if available), we will request the calendar permission. If you refuse to grant it, you will not be able to use this feature, but this will not affect your normal use of the other features of [ToonBox].

2.5 Clipboard Permission: With your explicit authorization, we may access content on your device's clipboard (such as text, images, or videos). Such access is limited to operations you actively trigger, such as pasting clipboard content onto the Platform. We will not read, store, or upload clipboard content without your authorization or without an operation initiated by you, nor will we use it for any purpose unrelated to your request.

2.6 Device Data and Log Data:

2.6.1 In order to ensure the secure operation, quality, and efficiency of our software services, we collect your device model, operating system version number, device identifiers [for Android, such as IMEI, Android ID, GAID; for iOS, such as IDFV, IDFA; different identifiers may differ in terms of validity period, whether they can be reset by the user, and how they are obtained], network interface card address (device MAC address), IP address, network access method, type, and status, network quality data, and operation, usage, and service logs.

2.6.2 In order to bring you a better product and services, and to ensure the playback and usage performance when you use the product, we may obtain system data from your device such as screen status and system volume.

2.6.3 We also collect data related to application error reports and performance monitoring, including but not limited to account registration/login time, language, access date and time, application source, application version number, running process data, stack trace data at the time of system crashes, crash reports, and abnormal process logs. Collecting this data helps us better understand the status of your device, improve application performance, optimize the user experience, and locate faults, so as to improve service quality and provide you with more stable and personalized services.

2.7 Security-Related Data: We collect and properly process data directly related to the protection of your account and the security of your use of the Services. This includes, but is not limited to, records of your password changes, a history of login attempts (including details of successful and failed logins), and other data that may reveal abnormal account activity. We may use your account data, device data, service log data, and data that our affiliates and partners may provide after obtaining your authorization or as permitted by law, to assess account status and transaction security, perform identity verification, identify violations of laws and regulations, detect and prevent security incidents, and take necessary recording, analysis, and response measures in accordance with the law. The collection of such data is intended to ensure the security of the Platform, prevent unauthorized access, detect potential security threats, and respond in a timely manner to any risks that may compromise the security of your account or of the Platform as a whole.

2.8 Usage Data: When you use the [ToonBox] Services, we automatically collect data on the videos you watch, your browsing history, the keywords you search, the number of times you view ads and your interaction frequency, the time and frequency of your use of [ToonBox], your interactions with other users, your transaction data, the data you favorite/share, and/or other interaction data generated during your use of [ToonBox].

2.9 Payment Data: If you purchase our membership services or other paid content, we may need to collect your payment data in order to process your purchase and related activities. Third-party payment service providers with which we cooperate (such as Apple Pay, Google Pay, etc.) will provide us with your payment data to verify your payment status and provide you with purchase services. Please note that we collect your purchased item data, payment transaction IDs, channel IDs, etc., and do not collect any of your bank card account numbers, payment passwords, or other payment credentials.

2.10 Service Data: When you request our technical support and/or customer service support, and in the course of your exercising your rights as a data subject in accordance with laws and regulations, we may ask you to provide the necessary personal data to match and verify your user identity. We will collect the relevant data you provide when communicating with our customer service, including but not limited to the details of your service request, contact information, communication/call records, and any additional data necessary to resolve your issue. This is to ensure that we can respond to your needs effectively and provide accurate and attentive service support.

2.11 Personalized Advertising Data and Recommendation Services: After obtaining the consent required by applicable law or having other lawful bases for processing, we may process the advertising identifiers on your device (such as IDFA, AAID, etc., depending on the operating system), as well as your interests, browsing and search history, device data, usage habits, approximate location data, and order data, for the purpose of providing personalized content or advertising, measuring advertising effectiveness, and controlling ad frequency. We limit the scope of processing in accordance with the principle of data minimization and will not make decisions that produce legal effects concerning you or similarly significantly affect you based solely on automated processing. You may turn off personalized recommendations, limit ad tracking, or withdraw the relevant consent through the privacy or advertising settings within [ToonBox], your device system settings, or the contact methods listed in Article 12 of this Policy; after turning them off, you may still see non-personalized ads or general content recommendations.

2.12 Survey and Promotional Data: If you choose to participate in our surveys, promotions, marketing, or other activities, we will collect the data you provide and your participation data, including your name, email address, mobile phone number, nickname, and country or region.

2.13 Circumstances in which consent is exempted by law for the collection and use of personal data:

Please understand that, in the following circumstances, in accordance with laws and regulations, relevant national standards, and the requirements of market regulatory authorities and judicial authorities, we may collect, use, disclose, share, and transfer your personal data without obtaining your prior authorization and consent:

(1) Where it is related to our performance of obligations stipulated by laws and regulations;

(2) Where it is necessary for the conclusion or performance of a contract to which you are a party;

(3) Where it is directly related to public security, public health, or major public interests;

(4) Where it is directly related to criminal investigation, prosecution, criminal trial, and execution of judgments;

(5) Where it is directly related to civil litigation, civil trial, and execution of judgments;

(6) Where it is directly related to market regulation, administrative penalties, and enforcement of administrative penalties;

(7) Where it is necessary to protect your or another person's life, property, or other major legitimate rights and interests, but it is difficult to obtain the person's consent in a timely manner;

(8) Personal data that you have voluntarily made public to the public;

(9) Data collected from legally publicly disclosed sources, such as government public data and public data on social media platforms.

(10) Where it is necessary to maintain the secure and stable operation of the software and related services, such as detecting and handling failures of the software and related services;

(11) Where it is necessary for lawful news reporting;

(12) Where academic research institutions conduct statistical or academic research in the public interest, and where the personal data contained in the results has been de-identified when the results of the academic research or descriptions are provided externally;

(13) Other circumstances stipulated by applicable laws and regulations.

2.14 Other data requiring special notice: For certain specific services we provide, we may collect data other than that described above to support their distinctive features or services. In such cases, we will formulate a separate privacy notice or policy for the specific service, explaining how we collect, use, store, and protect your personal data when you use that service. If the privacy notice for a specific service differs from this general Privacy Policy, the specific service's personal privacy notice shall prevail.

2.15 You understand and agree that, in certain circumstances, after collecting the relevant data, we will de-identify and anonymize the data by technical means. The processed data cannot be directly or indirectly linked to you or any other person, and therefore it no longer constitutes personal data directly or indirectly related to you or others. On this basis, we reserve the right, subject to compliance with applicable laws and regulations, to use such anonymous data for activities such as data analysis, market trend research, and enhancement of the value of the user database, so as to continuously optimize our services and user experience while ensuring that personal privacy is fully protected.

2.16 Notice on Use of the Floating Window Permission: This application will request the "Display over other apps" floating window permission, which is used solely for small-window video playback. This permission is used only to continue playing videos after you exit the playback page, and will not collect, store, or transmit any personal data. You may enable or disable this permission at any time in your system settings; disabling it only affects small-window playback and does not affect other features of the application.

3. Purposes for Which We Collect and Use Personal Data

3.1 Where it is necessary to conclude, perform, and execute agreements with you;

3.2 To help you create, log in to, and manage your account and maintain your personal data; and to use our various services and Platform-related features through your account;

3.3 To enable us to provide, manage, process, maintain, develop, and improve the Services (including optimizing playback features such as video content and picture-in-picture, advertising, paid services, system administration, user services, archiving and/or backup purposes, etc.);

3.4 To communicate with you and provide personalized recommendation services (including video content and advertising), including sending you commercial marketing materials and delivering advertisements that may be relevant to your interests, notifications of promotional activities, notices of updates to agreement texts, or other materials related to our Services;

3.5 To evaluate your applications relating to the [ToonBox] Services and respond to your questions/inquiries/feedback/disputes;

3.6 To verify and execute transactions related to your online payments;

3.7 To monitor, prevent, or investigate any fraudulent conduct, abuse, security risks, and technical problems that may harm [ToonBox], you, or the public, verify the authenticity of account owners, protect the security of your account, [ToonBox] platform users, the [ToonBox] Services, and systems, and improve the security and reliability of the [ToonBox] Services;

3.8 To analyze, profile, segment, combine, and/or update all collected data (whether in aggregate or personalized form) to improve service quality and provide a better experience;

3.9 To respond to requests from government authorities or fulfill obligations under applicable laws and regulations;

3.10 Other purposes disclosed to you separately when we collect your data, or other purposes for which your consent has been obtained.

3.11 For the above purposes, our affiliates may be commissioned to process your data, provided that such affiliates comply with the provisions of this ToonBox User Privacy Policy.

For the purposes of this ToonBox User Privacy Policy, "affiliates" means entities that directly or indirectly control, are directly or indirectly controlled by, or are under common control with Spark Deep Intelligence Technology Co., Limited.

4. How We Share and Disclose Your Data

Except as expressly stated otherwise in this Policy, as actively requested or consented to by you, or as otherwise provided by applicable law, we will not share or disclose your personal data. We may share or disclose your personal data in the following circumstances:

4.1 Your own disclosure and sharing of your data

4.1.1 Personal data that you set and publicly display on your personal profile page on [ToonBox] (which may include your gender, nickname, profile picture, etc.).

4.1.2 You may share your personal data or other data with third parties (including unspecified recipients) based on the [ToonBox] Services. When you use the sharing feature of [ToonBox], you may choose to share the relevant data through the means permitted by the Platform (for example, email, SMS, social applications such as Facebook, or other applications). Once data leaves [ToonBox] and is received by a third party, that third party will independently process the relevant data in accordance with its own terms of service and privacy policy. We recommend that you carefully confirm the recipients, scope, and third-party rules before sharing. We will bear corresponding responsibility in accordance with the law for the sharing features and data processing activities we provide; risks arising from the independent processing by third parties or from your own public sharing will be handled in accordance with applicable law and the scope of each party's responsibilities.

4.2 Our disclosure and sharing of your data

Where one or more of the following circumstances exist with respect to your personal data, we will disclose or share your data with the following third parties in compliance with the legal requirements applicable to this Policy:

4.2.1 Where you actively request sharing, or where sharing occurs after obtaining your consent;

4.2.2 To announce penalties against violating accounts, fraudulent conduct, etc.; or where relevant data needs to be displayed when announcing lists of prize winners;

4.2.3 Data sharing with business partners:

You understand and acknowledge that some of our services may be provided by business partners, or jointly by us and business partners. We will only provide the necessary personal data to the following partners for the purposes described in this Policy, on appropriate legal bases, in compliance with the principle of data minimization, and with necessary protective measures; where required by applicable law, we will separately inform you of the recipients, types of data, and purposes of processing, and obtain your consent:

(1) Service providers, such as marketing agencies providing marketing services, payment institutions providing payment services, logistics service providers, and other partners providing support for service functions.

(2) Data processors (including data processors providing services such as online advertising data monitoring, data statistics, and data analysis). To analyze/maintain/improve our services and provide you with better content, we may share your relevant data with the designated partners providing such services.

(3) Advertising partners. In the course of our advertising cooperation with partners, we will share with them data such as device IDs, advertising device identifiers, user age and gender tags, and IP addresses, to help them make advertising or decision recommendations, improve the effective reach of advertising, and further understand user needs.

You may limit ad tracking through your device settings, or reset the advertising identifier on your Apple or Android device, to manage your personalized advertising preferences. For more information on how to change the relevant settings, please refer to:

• iOS: Please refer to the advertising and privacy settings instructions provided by Apple

• Android: https://support.google.com/ads/answer/2662922

Please note: Adjusting your preference settings does not mean you will no longer receive ads. It only means that the ads you see will be less relevant to your interests. Our advertising partners will still use your device's advertising ID to deliver ads to you that may be less relevant to you; for example, we may use this feature for frequency capping (in other words, controlling the maximum number of times you see the same ad from us). You may also reset the advertising ID associated with your device by following the instructions provided by your device manufacturer or operating system developer.

(4) Promotional activity service partners, such as sharing data of prize winners in joint marketing activities (e.g., your name and other data) with third parties so that they can distribute prizes/gifts to you in a timely manner.

(5) Third-party SDK service providers: Our products may contain third-party software development kits (SDKs), application programming interfaces (APIs), or other similar components. The relevant components may directly collect or process necessary data according to their functions. We will conduct necessary security and compliance assessments of third parties in accordance with applicable law, restrict the purposes, scope, and retention periods of their processing through contracts, and obtain your consent where required by law. The activities of third parties processing data as independent data controllers are governed by their own privacy policies; we will nevertheless bear corresponding responsibility under the law for our own acts of selecting, integrating, and managing third-party components. We recommend that you read their privacy policies before enabling the relevant features; if you discover that a relevant component poses a risk, please stop using it and contact us.

When you use our AI-related features, your AI Input and Output data may be shared with third-party AI service providers that provide generative AI and large language model (LLM) services, for purposes such as text generation, image generation, voice generation, and content safety review. The directory of the relevant third-party AI service providers is set out in Appendix 1 to this Policy.

Third-Party SDK Directory

SDK Name: Facebook Login SDK

Purpose of Use: User account registration and login

Privacy Policy Link:

https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0

SDK Name: Google Sign-In SDK

Purpose of Use: User account registration and login

Privacy Policy Link: https://policies.google.com/privacy?hl=ja

SDK Name: AppsFlyer SDK

Purpose of Use: Advertising attribution and deep link acquisition for media platforms (redirect to a specified page)

Privacy Policy Link: https://www.appsflyer.com/legal/privacy-policy/

SDK Name: Firebase SDK

Purpose of Use: Push notifications and collection of application exceptions

Privacy Policy Link: https://firebase.google.com/support/privacy?hl=ja

SDK Name: Apple Pay SDK

Purpose of Use: Apple Pay payments (iOS only)

Privacy Policy Link: https://www.apple.com/legal/privacy/

SDK Name: Sign in with Apple SDK

Purpose of Use: Sign in with Apple (iOS only)

Privacy Policy Link: https://www.apple.com/legal/privacy/

SDK Name: Skyengine Analytics SDK

Purpose of Use: Application analytics services, enabling us to obtain and collect statistical data about the usage of our application so that we can better understand how users use our application. To this end, we collect your device information (Android ID/IDFA/IDFV/UUID), the type and version of the operating system ("OS"), the OS language, your unique device ID, your time zone, and your device's screen size through the Skyengine Analytics SDK. Skyengine Analytics

SDK will process your non-identifiable user ID.

Privacy Policy Link: https://privacypolicysdk.skyengine.com.cn/privacypolicy/index.html

SDK Name: MPABTestSDK

Purpose of Use: Application experimentation and optimization services, enabling us to conduct A/B testing and randomly assign users to different experiment groups so that we can compare the effectiveness of different features, interfaces, or recommendation strategies, helping us optimize the app experience and business performance.

Privacy Policy Link:

https://abtest-console.skyengine.com.cn/ab-sdk-privacy-policy/index.html

SDK Name: Volcengine SDK

Purpose of Use: Used for video stream decoding and playback.

Privacy Policy Link: https://www.volcengine.com/docs/4/108995

SDK Name: BytePlus TTS SDK

Purpose of Use: Converts user-input text into voice audio in real time. This SDK only sends the text content used for speech synthesis to BytePlus servers and does not proactively collect sensitive personal data such as user identity data, contacts, or location. The text data used for synthesis is used solely for performing real-time voice conversion; under the provider's current rules, BytePlus does not permanently store such text by default. You may turn off the voice reading feature at any time to terminate the relevant data transmission.

Privacy Policy Link: https://docs.byteplus.com/en/docs/legal/docs-privacy-policy

Third-Party Application Interaction Notice

We provide you with the convenient feature of "quickly following a designated account," and our application may invoke third-party applications installed on your device (including Instagram, YouTube, and TikTok). This launch action only redirects you to the designated account's follow page in the corresponding application, and will not collect, store, or transmit any of your personal information (such as account, device identifier, browsing history, etc.).

After the redirect, your actions within the third-party application (including following, logging in, etc.) will be governed by that application's own privacy policy and user agreement. We neither participate in nor interfere with the relevant actions of third-party applications.

(6) Other business partners, etc.

You understand and agree that such third-party business partners (hereinafter "third parties," "contractors") may use cookies, web beacons, and/or other tracking technologies to collect, receive, process, and retain data about you. For example, users purchasing and/or subscribing to products or services will need to provide the third-party payment contractor with additional data such as a valid credit card number and expiration date in order to process payments and resolve subsequent payment disputes and inquiries. We likewise participate in this process and may receive, process, and store data provided by you and/or such third-party contractors in order to confirm payments, keep records of services such as purchase history, and/or protect our legitimate interests when resolving subsequent related services, payment disputes, and inquiries.

Where a specific third party collects or processes data, please refer to the privacy policy on its official website for details of its data processing rules.

4.2.4 Disclosure or sharing of your data as required by law or regulatory requirements:

(1) Necessary disclosure to comply with court judgments or other legal process provisions, to comply with the requirements of relevant government agencies or legally authorized organizations, and for other reasonable grounds such as legal requirements. In certain circumstances, in accordance with legal provisions and the requirements of government departments and regulatory authorities, we may share your personal data with third parties (such as judicial authorities, law enforcement agencies, government agencies, or other similar third parties) in order to protect the legitimate rights and interests of you, other Platform users, and us, or to protect social and public interests, property, or safety from harm.

(2) In certain circumstances, sharing your personal data is the only way to realize the functions of our Services or provide the services you need, or to resolve disputes or controversies relating to you;

(3) Sharing your personal data in accordance with legal documents such as the agreements signed between you and us (e.g., online agreements, Platform rules, etc.);

(4) The data we share is de-identified data and the third party receiving the shared data cannot re-identify the data subject, or the personal data was made public by you yourself, or was collected by us from lawful public channels;

(5) Other circumstances stipulated by laws and regulations or required by regulatory authorities.

4.2.5 In accordance with applicable laws and regulations, if we determine in good faith that disclosing such data is indispensable for the following purposes, we reserve the right to disclose or share your personal data in specific circumstances without your authorization:

(1) You have breached any agreement between you and us, including the Terms of Service or this ToonBox User Privacy Policy, or caused damage to our legitimate interests;

(2) Your conduct infringes the intellectual property rights or other rights and interests of third parties;

(3) Circumstances related to Section 2.13 of Article 2 of this Policy.

4.2.6 Where public disclosure is truly necessary on other reasonable grounds, we will inform you of the purposes and types of the data to be publicly disclosed before the disclosure, and will only make the public disclosure after obtaining your authorization and consent.

5. Cookies and Similar Technologies

5.1 A cookie is a small data file stored on your device by us or third-party service providers through network services. When you log in to and use a website or other online content, we or our third-party partners may use related technologies to send one or more cookies or anonymous identifiers to your device, stored in your computer, mobile device, or other device (usually encrypted), in order to collect, identify, and store data when you access and use this product, and to keep such data as records. Cookie-like technologies are other technologies that can be used for purposes similar to cookies, such as embedded scripts. In this Policy, we refer to all such technologies collectively as "cookies."

5.2 We use cookies to optimize our Services, enhance the user experience of the product, and for various other purposes, including:

(1) Recording you and your IP address to simplify operations (such as keeping you logged in);

(2) Protecting the secure and efficient operation of your account data and our products and services;

(3) Collecting technical data about the devices and software you use to access the [ToonBox] Services;

(4) Measuring and analyzing the content you click on and how you use the Platform;

(5) Retaining the preferences or data you previously provided so as to recommend, display, and push content that may interest you;

(6) Monitoring visitor traffic on our Platform, operating, measuring, analyzing, and optimizing the advertising performance of our Platform, and improving Platform performance, etc.;

(7) Other related functions or purposes stipulated in this Policy.

5.3 If you do not wish to accept cookies, or wish to be notified when a cookie is placed, you may manage or clear stored cookies through the relevant functions provided in your browser, device, or the product. Necessary cookies are used for login, security protection, and core functions; disabling them may cause some services to fail to operate normally. Analytical, advertising, and other non-essential cookies will be used only with your consent as required by applicable law, and you may withdraw or adjust your choices at any time through the cookie settings. Withdrawal of consent does not affect the lawfulness of processing activities carried out before the withdrawal.

5.4 Do Not Track signals: The Internet industry has not yet established a unified technical standard for Do Not Track (DNT) signals. Accordingly, we do not currently respond to DNT signals sent by browsers, nor will we change the way we process your personal data because you have enabled DNT signals. Once the industry establishes a recognized and enforceable standard for DNT signals, we will assess and adjust the relevant practices in due course.

6. How We Store and Protect Your Personal Data

6.1 Storage Location

The current server locations for the [ToonBox] Services include: Japan. At the same time, in view of future expansion plans, this Policy also covers server locations that may be added, and data storage or transfer on servers will be completed securely in accordance with local regulatory requirements.

6.2 Third-Party Sharing and Cross-Border Data Transfer

To provide global services, we may transfer your personal data to our business operations departments, engineering and technical teams, affiliates, third-party service providers, and partners operating worldwide, after having appropriate legal bases and fulfilling the notice, impact assessment, competent authority approval, or consent procedures required by applicable law. The recipients may be located outside the above storage locations or outside your jurisdiction, and local data protection laws there may differ from those of your location. We will adopt cross-border transfer mechanisms and security measures required by applicable law, and will only transfer the data necessary to achieve the specific purposes.

When processing data across borders, we will comply with applicable laws and regulations and take necessary protective measures to ensure data security, for example:

(1) Adopting the Standard Contractual Clauses (SCCs) approved by the European Commission as part of the data transfer agreement to ensure that data processors comply with EU data protection standards.

(2) Where applicable, adopting cross-border transfer mechanisms recognized by competent authorities, such as binding corporate rules, adequacy decisions, approved certification mechanisms, or other lawful transfer tools, and conducting necessary assessments of the recipients' data protection capabilities.

(3) We adopt security technologies and management measures no less stringent than those required by the data protection laws applicable in the Hong Kong Special Administrative Region of China, including encryption, access control, tiered permissions, and data segregation, to protect the security of personal data.

(4) The Company has established strict internal data transfer management systems, including but not limited to the formulation of data protection agreement systems and data transfer approval procedures, to ensure the lawfulness and security of data transfers and protection.

6.3 Retention Period

Generally, we only store your personal data for the period necessary to provide the Services, or for a longer period as stipulated by law. After the above retention period is exceeded, we will delete or anonymize your personal data in accordance with the requirements of relevant laws and regulations.

However, we may need to adjust the retention period of personal data as required by law in the following circumstances:

(1) To comply with applicable laws, regulations, and other relevant provisions;

(2) To comply with court judgments, rulings, or other legal process provisions;

(3) To comply with the requirements of relevant government agencies or legally authorized organizations;

(4) We have reason to believe that extending the data retention period is necessary to comply with laws and regulations or to protect legitimate rights and interests;

(5) To enforce the User Agreement or this Policy, or for the purposes of safeguarding social and public interests, or protecting the personal and property safety and other legitimate rights and interests of us, our affiliates, partners, other users, or employees.

(6) If our products or services cease operations, we will notify you by push notifications, announcements, or other means, and will delete or anonymize your personal data within a reasonable period.

6.4 Special notice for Canadian users: After making a decision that directly affects you using your personal data, we undertake to retain such data for at least one year, in order to provide you with a sufficient opportunity to access the data on which the relevant decision was based. This means that, even if you subsequently withdraw or change your authorization and consent for us to collect, process, share, or publicly disclose your personal data, we reserve the right to continue to retain such data where there is a lawful basis.

6.5 Our measures for protecting personal data:

6.5.1 We adopt security technical measures, encryption technologies, and other reasonable and feasible means that meet industry standards, and establish relevant security departments, management systems, and processes to protect the security of your personal data and to minimize the risk of your data being leaked, damaged, misused, accessed without authorization, disclosed without authorization, or altered, including but not limited to:

(1) Where, in accordance with laws, regulations, and this Policy, your re-authorization and consent is required before sharing your data with third parties, we will inform you of the types of data to be shared, the purposes, and the recipients before sharing, and will share only after obtaining your authorization and consent;

(2) We will bind partners' obligations and legal responsibilities for personal data protection through agreements;

(3) Our security team will conduct security assessments and processing of the output form, flow, and use of data, etc., and will anonymize personal data as much as possible;

(4) If, in connection with the sharing and disclosure described in this Policy, your data may be transferred to other countries or regions, whether transferred to our affiliates or third-party business partners, we will comply with applicable laws so that all such cross-border data transfers meet the requirements of the data protection laws applicable in the local jurisdiction.

6.5.2 Please understand that the Internet environment has inherent risks and no system can guarantee absolute security. Although we will take reasonable protective measures that comply with applicable law and industry standards, hacker attacks, technical vulnerabilities, accidents, or other security incidents may still occur. If a security incident such as a leak, damage, or loss of personal data occurs or may occur, we will take remedial measures in accordance with the law, assess the possible impact, and report to the competent authorities and notify affected users where required by applicable law. We will bear corresponding liability under the law for damage caused by our own violations of law, intent, or negligence.

Therefore, we strongly recommend that you take proactive measures, such as using complex passwords and not performing sensitive operations on insecure networks in public places, to maintain your account security together with us. If you discover that your personal data has been leaked, please contact us immediately so that we can take appropriate measures to protect your data security and personal privacy.

6.5.3 We take additional security measures, such as encryption, to protect your private information (including the content of your chats with AI characters, voice messages, viewing history, private memories and characters, image generation records, status updates, etc.) in order to protect your privacy.

7. Your Rights and Choices

7.1 Notification and Choice

You understand and agree that, when you use the [ToonBox] Services, we may use the contact information you provide (including but not limited to your contact phone number, email address, etc.) to send you various notices and materials for the purposes of user information notification, identity verification, security verification, user experience surveys, advertising push, or marketing activities.

You may stop receiving marketing or promotional messages through the unsubscribe link in the relevant materials, the system interface settings, or other operating instructions we provide. Non-marketing necessary notifications, such as those concerning transactions, security, service status, or material updates to agreements, may not be affected by marketing unsubscribe settings; if you turn off device-level push notifications, you may not receive such important notifications in a timely manner.

7.2 Right to Access and Manage Personal Data

You may view on the personal data page the types of personal data we collect, the purposes of collection, the collection status, and the specific content of the data, such as your basic data and transaction records; you may also view your usage data through the relevant product pages, such as your favorites, viewing history, and offline download records (if the offline download feature is provided).

You have the right to correct/modify some of your personal data in our Services in accordance with the operating instructions and settings provided on the product function pages.

7.3 Right to Withdraw Authorization and Consent

Certain business functions and services require your personal data to be completed. After you withdraw your consent or authorization, we will no longer be able to provide you with the functions and services corresponding to the withdrawn consent or authorization, and will no longer process the corresponding personal data. However, your decision to withdraw consent or authorization will not affect the processing of personal data we previously carried out based on your authorization.

7.4 Right to Request Deletion of Personal Data

7.4.1 You have the right to delete your personal data stored by us in the Services. You may exercise this right by deleting some of your usage data yourself through the built-in deletion function of [ToonBox] or by contacting us, or by canceling your account. Please note, however, that data shared by others about you does not form part of your account data and is therefore not within the scope of deletion.

Before formally executing the cancellation operation, we may need to verify your identity, account security status, and associated device data to ensure the security of the operation. After you cancel your account, we will delete or anonymize your relevant data, unless otherwise provided by laws and regulations. You understand and agree that, once an account is canceled, the account and all corresponding data cannot be recovered, and you will lose access to the relevant services, account data, subscription content, comic drama data, and personal related data, and you will not be able to access other services through that account.

7.4.2 You understand and agree that, due to technical and legal limitations, after you delete data, the data in backup systems may be retained temporarily, but we will store such data in isolation until it is securely deleted or anonymized when the backup is updated.

7.4.3 In specific circumstances, such as where it is necessary to fulfill legal obligations, resolve disputes, or enforce agreements, we may retain some data for a period permitted by law.

7.5 Right to Restrict or Object to Processing

In the circumstances provided by applicable law, you have the right to request that we restrict the processing of your personal data, or to object to our processing based on legitimate interests, including objecting to the use of your personal data for direct marketing. Upon receiving your request, we will assess and process it in accordance with applicable law; if we have sufficient grounds to continue processing under the law, we will explain them to you.

7.6 Right to Data Portability

In the circumstances provided by applicable law, you have the right to obtain the personal data you have provided to us in a structured, commonly used, and machine-readable format, or to request that we transmit such data directly to a third party designated by you where technically feasible.

7.7 Rights Relating to Automated Decision-Making

If we make decisions that produce legal effects concerning you or similarly significantly affect you solely through automated processing, you may, in accordance with applicable law, request that we provide the relevant explanations, conduct a manual review, allow you to express your views, or object to the decision.

7.8 Right to Lodge a Complaint

If you believe that the way we process your personal data violates applicable law, you may first contact us through the methods set out in Article 12 of this Policy, and you may also lodge a complaint with the data protection supervisory authority in your location or the relevant jurisdiction in accordance with the law.

7.9 Verification of and Response to Rights Requests

To protect the security of your account and personal data, we may verify your identity and authorization relationship before processing your request. We will generally respond within the period prescribed by applicable law; if an extension is needed due to the complexity or volume of requests, we will notify you in accordance with applicable law. Except for exceptions permitted by law, we will not, in principle, charge a fee for reasonable rights requests.

7.10 Authorized Agent

You may, in accordance with applicable law, designate an authorized agent to exercise the rights described in this Policy on your behalf. To verify the authority of the authorized agent, you need to provide the authorized agent with a signed written permission or power of attorney. Where permitted by applicable law, we may also verify your identity by further confirming with you before processing the authorized agent's request.

7.11 Non-Discrimination

You have the right not to be discriminated against for exercising the rights described in this Policy (as provided by applicable law). We will not refuse to provide you with products or services, or treat you differently in an unreasonable manner, because you exercise rights such as access, deletion, withdrawal of consent, or objection to processing, unless otherwise provided by applicable law.

7.12 Opting Out of the "Sale" of Personal Data

If applicable law (including the consumer privacy protection laws of your location) grants you the right to opt out of our "sale" or "sharing" of your personal data, you have the right to exercise such rights. We currently do not sell your personal data to third parties without your consent.

8. Age Restrictions

8.1 Minors under the age of 18 may not register for, log in to, access, or use [ToonBox] and the related services, nor may they provide us with any personal data, including but not limited to their name, address, phone number, and email address. By using the Services, you represent and warrant that you are at least 18 years old.

8.2 All purchases and payment activities related to the Services must be carried out by adults. Minors under the age of 18 may not make any purchases or payments related to the Services.

8.3 To confirm whether a user meets the above age requirements, we may take age verification measures that are reasonable and proportionate to the risk, to the extent permitted by applicable law. If the necessary age verification cannot be completed, we may refuse to create an account, restrict relevant features, or cease providing the Services.

8.4 If we discover or have reasonable grounds to believe that we have collected the personal data of a minor under the age of 18, we will take reasonable measures to close the relevant account and delete or anonymize such data as soon as possible, except where retention is required by law.

8.5 If you are the parent or legal guardian of a minor and discover that the minor is improperly using [ToonBox] or has provided personal data to us, please contact us as soon as possible through the contact methods set out in this Policy so that we can take appropriate measures (including closing the account and deleting the relevant data).

8.6 If you believe that we have improperly collected or hold the personal data of a minor, please contact us as soon as possible through the contact methods set out in Article 12 of this Policy. We will process the relevant request in accordance with applicable law after verifying the applicant's identity and their relationship with the minor.

9. Account Deletion

9.1 Account deletion is an irreversible, permanent operation, different from logging out. Once an account is deleted, it cannot be recovered, and the following consequences will apply:

9.1.1 Irreversible loss: Deleting your account will result in the permanent loss of access to all products and services associated with that account. Your account will no longer be recoverable.

9.1.2 Deletion of data and assets: All personal data, in-service assets, favorites, memories, search history, chat records with AI characters, interaction data, and order records will be permanently deleted. Even if you re-register with the same account credentials, such data cannot be recovered.

9.1.3 Ownership of characters: After account deletion, your ownership of any characters you created will be relinquished, and the creator identity will be displayed as "Deleted Account."

9.1.4 Immediate effect: Account deletion will take effect immediately upon your confirmation, resulting in the termination of the account and all associated data, which cannot be recovered.

9.2 We recommend that you carefully consider the above consequences before proceeding with account deletion. If you have any questions about account deletion, you may contact us through the methods set out in Article 12 of this Policy.

10. Special Notice Regarding Popular Public Characters

10.1 If a character you create is set to "Public" and reaches a certain popularity threshold, we reserve the right to retain the characteristics of that character and keep the character active on the Services, even if you separately delete your data or account.

10.2 We do this to avoid affecting the experience of other users, because highly popular characters are, by definition, actively interacting with a large number of users.

10.3 To ensure that we do not retain personal information about you in such circumstances, if you are creating a "Public" character, please avoid submitting any information that can identify you personally during the character creation process.

11. Miscellaneous

11.1 Scope of This Policy

This ToonBox User Privacy Policy applies only to data processing activities carried out by us as the data controller or as the entity responsible under the law, and does not apply to third-party products or services that expressly display or reference other privacy policies. Our Services may integrate or link to third-party platform resources, such as third-party features, advertisements, applications, or websites. Third parties will independently process the relevant data in accordance with their own privacy policies; we do not control their independent processing activities, but we will nevertheless bear corresponding responsibility under the law for our acts of selecting, integrating, or providing data to third parties. We recommend that you read and understand a third party's privacy policy before providing personal data to that third party.

11.2 Special Notice on Regional Applicability

Our Services are intended for users worldwide. Data protection laws in different countries or regions may differ. To the extent required by applicable law, we will provide you with corresponding rights and protections in accordance with the data protection laws applicable to your location. If the laws of your location grant you additional rights or protections (for example, rights regarding access to, deletion of, withdrawal of consent for, portability of, and objection to the processing of personal data), you may make requests to us in accordance with such laws, and we will respond to the extent required by applicable law. This Policy does not limit any non-waivable rights you enjoy under the mandatory laws of your location.

11.3 Updates to This Policy

We may update this ToonBox User Privacy Policy from time to time and will notify you by appropriate means such as announcements, pop-up windows, push notifications, or email in accordance with applicable law. If an update involves material changes such as the purposes of processing, types of data, recipients of sharing, methods of cross-border transfer, or your rights, we will explain the changes in a prominent manner; if re-consent is required by law, we will obtain your consent separately before the relevant processing begins. You can determine whether revisions have been made by the last updated date stated in this Policy, and you may decide whether to continue using the relevant services based on the options provided by the product and applicable law.

11.4 Data Transfer

If we undergo a merger, acquisition, reorganization, division, bankruptcy, asset transfer, or similar event, your personal data may be transferred to the successor. We will notify you and require the successor to continue to comply with and perform this Policy. If the successor needs to process your personal data beyond the scope authorized by this ToonBox User Privacy Policy, the successor shall assume responsibility, inform you of the details of its intended processing of your personal data, and obtain your consent anew or again in accordance with applicable laws and regulations. Where minors are involved, the successor will also need to obtain the consent of their parents or legal guardians.

11.5 Governing Law and Dispute Resolution

The interpretation, performance, and dispute resolution of this ToonBox User Privacy Policy shall be governed by the laws of the Hong Kong Special Administrative Region of China, provided that this shall not deprive you of the rights you enjoy under the mandatory consumer protection or data protection laws of your location. If a dispute arises between you and us, the parties shall first negotiate in good faith; if negotiation fails, the dispute may be submitted to the Hong Kong International Arbitration Centre to the extent permitted by applicable law, in accordance with the arbitration rules in effect at the time of the application for arbitration. If applicable law grants you non-waivable rights to file complaints or lawsuits with the courts, competent authorities, or data protection institutions of your location, this Article does not limit such rights.

12. Contact and Complaints

12.1 If you have any questions, comments, or suggestions regarding this ToonBox User Privacy Policy, or any questions about the protection of your personal data, or if you wish to exercise the rights set out in this Policy, please contact us through the following methods:

Email address: [service@toonbox.com]. We will review the issues involved as soon as possible and reply in a timely manner after verifying your user identity.

Appendix 1: Directory of Third-Party AI Service Providers

When you use our AI-related features, your AI Input and Output data may be shared with the following third-party AI service providers, for purposes such as text generation, image generation, voice generation, and content safety review:

For the privacy policy links of the above third-party AI service providers, please refer to their respective official websites. The processing activities of the relevant providers with respect to your data are governed by their own privacy policies.