PRIVACY POLICY

1. HeyCyan AS THE DATA CONTROLLER

1.1 This Privacy Policy applies to the User's access and use of HeyCyan (hereinafter referred to as “Platform”), as well as to the use of (which includes any participation in) the Services.

1.2 This Privacy Policy is incorporated as part of the Terms of Services, accessible at www.qlifesnap.com.

1.3 The User's privacy is important to HeyCyan, and HeyCyan has adopted this Privacy Policy to inform the User of how HeyCyan as the Data Controller collect, process, use and disclose the User's Personal Data derived from the User's access and use of the Platform and the Services.

1.4 If the User has any questions about this Privacy Policy, or if the User wishes to access, update or correct the User's Personal Data or withdraw the User's consent to the use, collection and disclosure of the User's Personal Data in accordance with this Privacy Policy, please email HeyCyan's DPO at qcfeature@gmail.com

1.5 Certain terms apply to Users in certain jurisdictions, as set out in the Schedules to this Privacy Policy. Users in such jurisdictions agree that such additional terms are incorporated into and form part of this Privacy Policy.

2. GENERAL DEFINITIONS

2.1 In this Privacy Policy, unless the context otherwise requires, the following general definitions apply:

(a) "Data Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data, including the security measures concerning the operation and use of the Platform and the Services.
(b) "Data Protection Laws" means applicable laws and regulations relating to the use and/or processing of personally identifiable information and data and privacy.
(c) "Personal Data" means:
1. data, whether true or not, about an individual who can be identified:
  1. from that data; or
  2. from that data and other information to which HeyCyan has or are likely to have access; and
2. any data that is analogous to the foregoing, as defined in Data Protection Laws.
(d) "Purposes" means the purposes for which HeyCyan collects the User's Personal Data as set out in this Privacy Policy.

2.2 Except as otherwise defined above, capitalised terms in this Privacy Policy have the same meanings as those given in the Terms of Service.

2.3 Unless otherwise stated, this Privacy Policy does not cover any collection, use or disclosure by third-parties, including through any applications, websites, products or services that HeyCyan does not control or own.

3. COLLECTION OF PERSONAL DATA

3.1 HeyCyan may collect and process the following Personal Data pertaining to the User when the User:

(a) uses the Platform and/or any of the Services (including but not limited to off-Platform interactions such as onboarding launch surveys via third-party service providers);
(b) register for any participation in any of the Services; and/or
(c) contact or engage with HeyCyan for any of the Purposes.

3.2 In connection with the User's use of the Platform or the Services, HeyCyan may collect the following Personal Data from the User:

(a) When you use the Platform, you may provide your email address, phone number, username, user profile picture, password, account type and registration channel to register an account.
(b) To comply with legal obligations and to protect the rights of users/minors and determine whether your age meets the usage criteria, you may provide your date of birth.
(c) To provide you with the audio recording and transcription feature on the Platform, we may collect your record data, including Audio record, transcribed text, other information related to your recordings (e.g. date, ID, type, duration, start time, upload time, end time, original language, and language translated into).
(d) To provide you with related product feature on the Platform, we may collect the information about your headphone habit settings, including settings on display address, enable dictation, distinguish speakers, enable subtitles, automatic recording.
(e) To help you add location information to your audio records when the records are created and enable you to know the specific location where the recording was completed, we may automatically collect your location (the latitude and longitude).
(f) To determine the country or region you reside in and provide you with localized services, we may collect your IP address.
(g) When you access and use the Platform, we may collect the duration and frequency of your headphone usage, device information when you connect the headphones (including phone brand, model), to detect bugs and conduct data statistics to refining products; we may collect the information about your use of the headphone, the information about your use of the Platform (including App version, duration of transcription usage, the frequency of using to-do/summary/translation features, start dates and end dates of subscription) to detect bugs, record the feature usage and conduct data statistics to refining products; and you may provide your log messages to us for detecting bugs.
(h) To diagnose issues and provide you with after-sales service, we may need to collect information about the problems you report.
(i) To facilitate and complete in-earphone recharge transactions, we will collect your order transaction ID.

Use of SMS, Incoming Call, and Contact Information

To display SMS notifications and incoming call alerts on the user's connected optical waveguide glasses device, HeyCyan may access the following information after the user has granted explicit authorization:

SMS information: including the sender's phone number, SMS content, and time of receipt. This information is used only to display SMS notifications on the glasses device.
Phone state information: including incoming call status and incoming phone number. This information is used only to display incoming call alerts on the glasses device.
Contact information: including contact names and phone numbers. This information is used only to match incoming call numbers or SMS numbers with contact names, so that users can identify the source of incoming calls or SMS messages.

The above information is used only for HeyCyan's core device companion functions. HeyCyan will not use SMS content, incoming phone numbers, call status, or contact information for advertising, user profiling, marketing analysis, or any purpose unrelated to these functions.

Unless otherwise stated in this Privacy Policy or separately agreed by the user, the above SMS, phone, and contact information is processed only locally on the user's mobile phone and displayed through the user's connected glasses device. HeyCyan will not actively upload SMS content, contacts, or call status information to HeyCyan's servers.

Users may disable the relevant permissions at any time through Android system settings. If SMS permissions are disabled, the SMS notification display function will be unavailable; if phone state permission is disabled, the incoming call alert function will be unavailable; if contact permission is disabled, incoming call or SMS alerts may display only the phone number instead of the contact name.

3.3 In connection with the Services, and to the extent permitted by applicable laws (including Data Protection Laws), HeyCyan may also be collecting from sources other than the User, the User's Personal Data, for one or more of the Purposes, and thereafter using, disclosing and/or processing such Personal Data for one or more of the Purposes.

3.4 HeyCyan may combine information it receives from other sources with information the User gives to HeyCyan and information HeyCyan collect on the User. HeyCyan may use this information and the combined information for the Purposes (depending on the types of information HeyCyan receives). If the User suspects that any of the User's Personal Data has not been lawfully disclosed to HeyCyan, please contact HeyCyan (details are set out in clause 1.4 of this Privacy Policy).

3.5 Other than as stated in this Privacy Policy, HeyCyan does not collect or process any other Personal Data.

3.6 HeyCyan uses Amazon Web Services (AWS) and Alibaba Cloud for cloud infrastructure. Our overseas backend is hosted on AWS in the United States. Microsoft and Agora processing locations depend on the services and deployments used and are not determined by the location of our AWS backend. See Sections 5 and 7.

3.7 HeyCyan shall only retain the User's Personal Data for so long as it is necessary. Such Personal Data may be archived for as long as the purpose for the said Personal Data still exists. HeyCyan will put in place measures such that the User's Personal Data in HeyCyan's possession or under HeyCyan's control is destroyed and/or anonymised as soon as it is reasonable to assume that (i) the purpose for which the User's Personal Data was collected is no longer being served by the retention of such Personal Data; and (ii) retention is no longer necessary for any other legal or business purposes.

3.8–3.9 AI and Microsoft Speech / Translation

When you choose to enable and use AI features, HeyCyan uses Microsoft-provided generative AI services to provide voice Q&A, image understanding and summaries. Depending on the feature, the request includes your question, relevant conversation context, transcribed speech, selected images, language settings, and account/device information needed by our backend to authorize and route the request. Technical identifiers used by our backend are not necessarily included in the model prompt.

Backend-mediated AI request route: your device/app → HeyCyan backend → Microsoft's AI service → HeyCyan backend → your app/device. Content is processed transiently to return the requested result. HeyCyan does not persistently store AI request or response content on its backend. This statement concerns content; account, device and necessary operational records are separate categories.

We do not use your AI content to train our own models. Microsoft's processing, safety monitoring and any service-side retention depend on the applicable service terms and deployment configuration. Our backend non-storage statement is not a promise that Microsoft has no retention. See Microsoft's Azure-hosted model data privacy documentation. For models hosted by Microsoft in Azure, Microsoft's service is distinct from the consumer ChatGPT application.

Speech recognition and translation: HeyCyan integrates the Microsoft Speech SDK. Audio, recognition results and source/target language information are processed by Microsoft's speech/translation services to return recognized or translated text, and speech output when requested. SDK requests may go directly from the app to Microsoft. Microsoft describes real-time speech recognition and speech translation as not retaining customer content; this does not extend automatically to batch or custom services. See Microsoft Speech data privacy documentation.

Your choice: choosing “Not now” leaves AI disabled. You may later enable it from the AI page. Remembering your choice does not authorize additional purposes. To stop further AI processing, stop using AI features and end any active session; you may also revoke relevant device permissions or contact us to withdraw consent. Withdrawal does not undo processing already carried out. Local history and recordings are described in Section 3.12.

Real-time conversations additionally use Agora as described in Section 3.10; the backend-mediated route above does not describe every real-time media stream.

3.10 Agora Real-Time Conversations

When you start a real-time conversation, HeyCyan uses the Agora RTC/RTM SDK and associated conversation services to establish the session, transmit real-time voice and exchange session messages with the conversation agent. This involves audio from the active session, user/session identifiers such as UID and channel identifiers, authentication tokens, and necessary device, network and service-quality information. When the conversation service processes recognized text, generated responses or images you choose to share, those contents may also be processed by the configured conversation pipeline.

The app obtains session authorization from the HeyCyan backend, then communicates with Agora’s services. Agora may connect the session to configured AI/speech providers to return a response. Where contextual features are used, the app may also send city or location information to the HeyCyan backend; this does not mean every such field is sent to Agora.

Agora’s real-time transport, conversation features and diagnostic logs may have different retention rules. Our backend non-storage statement does not mean that every Agora service retains no data. Any service-side recording, transcript, session-log or diagnostic retention depends on the enabled product, configuration and agreement. See Agora’s privacy policy. End the conversation to stop further active-session transmission.

3.11 Firmware Updates (OTA)

To check for compatible firmware and obtain the appropriate update package, the app sends technical information such as the application identifier/version, hardware version, installed firmware version, operating-system identifier, Bluetooth device address, country/region setting and update channel to our update service. The service also receives the network information needed to deliver the request or download.

We use this information to identify the correct firmware and deliver updates. Firmware update checks do not require sending your AI conversations, photos, recordings, SMS messages or contacts. Update information is operational data and is separate from AI content.

3.12 Clarification of AI Content Retention

AI content on our backend: transient processing without persistent storage of prompts, submitted AI images, AI-related audio content or generated answers. This is separate from Microsoft-side practices described above.

On your phone or glasses: conversations, recordings, transcripts, translations or media may be saved locally for the features you use. These local records are not covered by the backend non-storage statement. Manage them using the available history/media controls or device settings.

Other records: account/binding data, update-related technical records and necessary service/security records may remain for the period needed to operate the service, resolve issues or satisfy applicable obligations. We delete or anonymize these records when those purposes no longer apply. Account deletion does not itself guarantee removal of files stored on a disconnected device or in an independent backup.

4. USE OF PERSONAL DATA

4.1 The purposes for which User's Personal Data may be used by HeyCyan in the jurisdictions in which the relevant services operate shall include:

(a) to enable you to register an account to access and use the Platform;
(b) to comply with legal obligations and to protect the rights of users/minors and determine whether your age meets the usage criteria;
(c) to provide you with the audio recording and transcription feature on the Platform;
(d) to help you add location information to your audio records when the records are created and enable you to know the specific location where the recording was completed;
(e) to determine the country or region you reside in and provide you with localized services;
(f) to detect bugs and conduct data statistics to refining products;
(g) purposes directly related or incidental to the above.

4.2 HeyCyan may collect, use, disclose or process the User's Personal Data for other purposes that do not appear in this Privacy Policy. However, HeyCyan will notify the User of such other purposes at or before the time of obtaining the User's consent, unless processing of the User's Personal Data without the User's consent is permitted by Data Protection Laws.

4.3 HeyCyan's legal basis to process and use the Personal Data of Users as the Data Controller is where:

(a) Users have given their consent for one or more specific purposes (such as the Purposes).
(b) Data Protection Laws permit a Data Controller to process Personal Data until the User objects to such processing (also known as opting-out), without having to rely on consent or any other legal basis. Note that this does not apply, whenever the processing of Personal Data is subject to the General Data Protection Regulation governing the Personal Data of Users from the European Union.
(c) Processing and use of Personal Data is necessary for:
1. the performance of an agreement with the User and/or for any pre-contractual obligations thereof;
2. for any services in relation to the provision of the Platform or Services to the User, including payment processing, account administration and after sales support;
3. the establishment, exercise or defence of legal claims or proceedings;
4. compliance with a legal and regulatory obligation to which the Data Controller is subject.
(d) Processing is related to a task that is carried out in the public interest or in the exercise of official authority vested in the Data Controller.
(e) Processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third-party.
(f) Where otherwise permitted or not prohibited under Data Protection Laws.

5. DISCLOSURE OF PERSONAL DATA

5.1 HeyCyan may need to disclose the User's Personal Data to trusted third-parties, whether located within or outside the User’s jurisdiction, for one or more of the Purposes, as such third-parties, would be processing your Personal Data for one or more of the above Purposes ("Third-Party Processors"). In this regard, the User hereby acknowledges, agrees and consents that HeyCyan is permitted to disclose the User's Personal Data to such Third-Party Processors (whether located within or outside the User’s jurisdiction) for one or more of the above Purposes and for the Third-Party Processors to subsequently collect, use, disclose and/or process the User's Personal Data for one or more of the above Purposes. Without limiting the generality of the foregoing, such Third-Party Processors include:

(a) any of HeyCyan's agents, contractors or third-party service providers that process or will be processing the User's Personal Data on HeyCyan's behalf including but not limited to those which provide payment processing, account administration, after sales support or other services to HeyCyan;
(b) HeyCyan's professional advisers, for example, HeyCyan's auditors and lawyers, as well as HeyCyan's insurers;
(c) third-parties to whom disclosure by HeyCyan is for one or more of the Purposes and such third-parties would in turn be collecting and processing the User's Personal Data for one or more of the Purposes;
(d) any actual or proposed assignee or transferee of the business of HeyCyan, or a merged entity in the event HeyCyan is merged to create the said merged entity.

5.2 Where HeyCyan discloses the User's Personal Data, HeyCyan will do so only in accordance with Data Protection Laws. This includes taking steps to ensure the security and privacy of the User's Personal Data, and where required, it will be subject to contractual terms ensuring the security and protection of any Personal Data under any sub-processor or data intermediary, whether within or outside the User’s jurisdiction.

5.3 Cloud, AI and Real-Time Service Providers

Microsoft: AI inference, speech recognition and translation; processes the input and output necessary for those requested features, as described in Sections 3.8–3.9.
Amazon Web Services (AWS): hosting infrastructure for the overseas backend in the United States; processes the backend requests and technical information handled by that infrastructure.
Alibaba Cloud: additional cloud infrastructure used by HeyCyan. It processes information required to operate the services deployed on that infrastructure. Alibaba Cloud infrastructure is not described here as an additional large-language-model provider. See its published privacy information; processing of customer workloads is also governed by the applicable service agreement.
Agora: real-time conversation SDK and associated communication/conversation services; processes active-session content and necessary identifiers, device/network information and diagnostics, as described in Section 3.10.

These providers perform distinct roles. The data received by each depends on the feature used and the actual processing route; not all providers receive all categories of personal data.

6. PROVISION OF THIRD-PARTY PERSONAL DATA

6.1 The User should only provide HeyCyan with Personal Data of third-parties where expressly permitted by HeyCyan. Should the User provide HeyCyan with Personal Data of any individual other than the User, the User represents, undertakes and warrants to HeyCyan that:

(a) for any Personal Data of individuals that the User discloses to HeyCyan, HeyCyan would have prior to disclosing such Personal Data to HeyCyan obtained consent from the individuals whose Personal Data are being disclosed, to:
1. permit the User to disclose the individuals' Personal Data to HeyCyan for the Purposes;
2. permit the User to collect, use, disclose and/or process the individuals' Personal Data for the Purposes;
(b) at HeyCyan's request, the User will use such form(s) or document(s) provided by HeyCyan in obtaining such consents from the individuals in question (for the avoidance of doubt, HeyCyan is under no obligation to you to create any such form(s) or document(s));
(c) any Personal Data of individuals that the User discloses to HeyCyan are accurate; and
(d) for any Personal Data of individuals that the User discloses to HeyCyan, that the User is validly acting on behalf of such individuals and that the User has the authority of such individuals to provide their Personal Data to HeyCyan and for HeyCyan to collect, use, disclose and process such Personal Data for the Purposes.

6.2 Should the User provide HeyCyan with Personal Data of the User's child or children, the User confirms, declares and agrees that the User is the parent and/or legal guardian of such child/children, and that HeyCyan may collect, use and/or disclose the User's child's or children's Personal Data for the Purposes and in the manner as set out in this Privacy Policy.

7. TRANSFER OF PERSONAL DATA OUTSIDE THE COUNTRY YOU RESIDE

Our overseas backend processes requests on AWS infrastructure in the United States. We also use Alibaba Cloud. Information may also be processed by Microsoft and Agora in locations applicable to their configured services. Consequently, information may be transferred outside the country or region where you reside. Backend location, SDK routing and model-processing location are distinct; the use of an overseas domain does not by itself establish the location of every processing activity.

8. SECURITY

8.1 All Personal Data the User has provided to HeyCyan is stored in a cloud-based environment which is highly secure, scalable, and redundant by design. Where HeyCyan has given the User (or where the User has chosen) a password which enables the User to access certain parts of the Platform, the User is responsible for keeping this password confidential. The User should not share a password with any other person. Regular patching and security upgrades are performed on the infrastructure components. All publicly accessible endpoints are protected using data encryption security protocols and are enabled with intrusion detection and DDoS protection.

8.2 Data encryption is enabled for storage of data. Direct access to the data storage system is strictly prohibited. Data in flight is always encrypted using HTTPS/SSL/TLS protocols. Passwords and authentication secrets must not be written to diagnostic logs. Diagnostic content must be minimized and access restricted. The statement about non-storage of AI content concerns our backend; local app history and any local diagnostic records are separate and are described in Section 3.12.

8.3 HeyCyan shall do its best to protect the User's information, but cannot guarantee the security of the User's Personal Data transmitted on the Platform; any transmission is at the User's own risk and the User agrees not to hold HeyCyan responsible for any breach of security while accessing the internet that is out of HeyCyan's control.

8.4 In the event of a breach of the confidentiality or security of the User's information, HeyCyan shall reasonably attempt to notify the User as necessary so that the User can take the appropriate protective steps. Unless the User indicates otherwise, HeyCyan may notify the User under such circumstances using the User's most current email address on record.

9. COOKIES

9.1 The Platform uses cookies to distinguish the various Users of the Platform. This helps HeyCyan provide the User with the best experience when browsing the Platform and also allows HeyCyan to improve the Platform. By continuing to browse the Platform, the User is hereby agreeing to HeyCyan's use of cookies.

9.2 A cookie is a small file of letters and numbers that HeyCyan stores on the User's browser or on the User's device. Cookies contain that is transferred to the User's device.

9.3 HeyCyan uses the following cookies:

(a) Strictly necessary cookies. These are cookies that are required for the operation of the Platform. They include, for example, cookies that enable HeyCyan to log into secure areas of the Platform, use a shopping cart or make use of e-billing services.
(b) Analytical/performance cookies. These cookies allow HeyCyan to recognise and count the number of Users and to see how Users navigate the Platform. This helps HeyCyan improve the manner by which the Platform is operated, including ensuring that Users are able to conveniently access their required resource and/or service.
(c) Functionality cookies. These are used to recognise the User when the User returns to the Platform. This enables HeyCyan to personalise its content to the User, to greet the User by name and remember the User's preferences (for example, the User's choice of language or region).

9.4 Please note that third-parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which HeyCyan has no control. These cookies are likely to be analytical/performance cookies or targeting cookies.

9.5 The User blocks cookies by activating the setting on the User's browser that allows the User to refuse the setting of all or some cookies. However, if the User uses browser settings to block all cookies (including essential cookies) the User may not be able to access all or parts of the Platform.

10. THIRD-PARTY WEBSITES

When the User uses the Platform or the Services, they may be directed to other third-party sites outside of their control. This may include links from advertisers, sponsors, and partners that may use HeyCyan's logo. Such third parties may treat the User's personal data in accordance with their own privacy policy and the User's direct agreement with them. HeyCyan is not responsible for any third-party use of personal data where they were provided by the User to such third party. The User is solely responsible for their legal relationship with any such third parties.

11. USERS' RIGHTS IN RESPECT OF THE PERSONAL DATA

11.1 If the User has any questions about the processing of the User's Personal Data or about this Privacy Policy, if the User does not accept an amended Privacy Policy, if the User wishes to withdraw any consent the User has given HeyCyan at any time, or if the User wishes to update or have access to the User's Personal Data, the User is welcome to contact HeyCyan through the contact details listed at clause 1.4 of this Privacy Policy.

11.2 The User has the right to access and/or correct any Personal Data that HeyCyan hold about the User, subject to exceptions under the law. This right can be exercised at any time by contacting HeyCyan through the contact details listed at clause 1.4 of this Privacy Policy. HeyCyan will need enough information from the User in order to ascertain the User's identity as well as the nature of the User's request, so as to be able to deal with the User's request. All requests for correction or for access to the User's Personal Data must be in writing. HeyCyan will endeavour to respond to the User's request within 30 days, and if that is not possible, HeyCyan will inform the User of the time by which HeyCyan will respond to the User.

11.3 HeyCyan may be prevented by law from complying with any request that the User may make. HeyCyan may also decline any request that the User may make if the law permits HeyCyan to do so.

11.4 In many circumstances, HeyCyan need to use the User's Personal Data in order for HeyCyan to enable the User's use of the Platform and the Services. If the User does not provide HeyCyan with the required Personal Data, or if the User does not accept an amended Privacy Policy or withdraw the User's consent to HeyCyan's use and/or disclosure of the User's Personal Data for the Purposes, it may not be possible for HeyCyan to continue to enable the User's use of the Platform and the Services.

11.5 HeyCyan may charge the User with a fee for responding to the User's request for access to the User's Personal Data which HeyCyan holds, or for information about the ways in which HeyCyan has (or may have) used the User's Personal Data. If a fee is to be charged, HeyCyan will inform the User of the amount beforehand and respond to the User's request after payment is received.

11.6 HeyCyan is fully committed to protecting the User's Personal Data and ensuring that the User is able to enjoy all the rights granted to the User in relation to the User's Personal Data under Data Protection Laws. Nothing in this Privacy Policy should be construed as limiting any of the User's rights prescribed for under Data Protection Laws.

11.7 AI Choices, Account Deletion and Device Unbinding

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection to processing, and withdraw consent. Contact qcfeature@gmail.com. We may verify your identity using proportionate information and respond within the period applicable to your request. You may also contact your competent data-protection authority.

You can request account deletion through the app's account-security settings. Device unbinding removes the account/device association through the available connection flow; it is distinct from account deletion and from deleting locally saved media. If a device is offline or unreachable, device-side changes cannot be guaranteed until the device is reached or reset.

Where processing relies on consent, that consent is specific to the stated purpose. Other processing may be needed to provide a service you request, protect the service or meet legal obligations, as permitted by applicable law.

12. CHANGES TO THIS PRIVACY POLICY

12.1 HeyCyan reserves the right to make changes to this Privacy Policy at any time by giving notice to Users on this page and possibly within the Platform and/or, as far as technically and legally feasible, sending a notice to Users via any contact information available to HeyCyan. Significant changes will go into effect 30 days following such notification. Non-material changes or clarifications will take effect immediately. It is strongly recommended to review the Platform and this Privacy Policy periodically for updates.

12.2 Should the changes affect the processing activities performed on the basis of the User's consent, HeyCyan shall collect consent from the User, where required.

13. LOCAL SPECIAL TERMS

For users in EU, Canada, Japan and US, in the event of any inconsistency or conflict between the General Terms of the Privacy Policy (the “General Terms”) and SCHEDULE - Privacy Policy for EU, and Special Terms for Canada and Japan and US (the “Schedules”), the provisions of the Schedules shall prevail.

SCHEDULE – Privacy Policy for EU

For any User in EU, this Schedule: (a) is incorporated into this Privacy Policy, (b) applies to the User’s use of the Platform and the Services, and (c) overrides the terms of this Privacy Policy to the extent of any inconsistency or conflict.

1. Definitions

‘Personal data’ (Art. 4 No. 1 of the GDPR) means any information relating to an identified or identifiable natural person (‘data subject’). A person is identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, an online identifier, location data or by reference to their physical, physiological, genetic, mental, economic, cultural or social identity characteristics. Identifiability may also be possible by linking such information or other additional knowledge. The origin, form or embodiment of the information is not important (photos, video or sound recordings may also contain personal data).

‘Controller’ (Art. 4 No. 7 GDPR) means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

‘Third party’ (Art. 4 No. 10 GDPR) means any natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or processor, are authorised to process the personal data; this also includes other legal entities belonging to the group.

‘Processor’ (Art. 4 No. 8 GDPR) means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller, in particular in accordance with the controller's instructions (e.g. IT service providers). In the context of data protection law, a processor is in particular not a third party.

‘Consent’ (Art. 4 No. 11 GDPR) of the data subject refers to any voluntary, informed and unequivocal expression of will in the form of a statement or other unambiguous confirmatory act by which the data subject indicates that they consent to the processing of their personal data.

2. Controller

The person responsible within the meaning of Art. 4 No. 7 GDPR and other relevant data protection provisions are:

E-mail: qcfeature@gmail.com

3. Contact details of the data protection officer

Controller has appointed a data protection officer who can be contacted as follows:

E-mail: qcfeature@gmail.com

4. Legal bases of data processing

In principle, any processing of personal data is prohibited by law and is only permitted if the data processing falls under one of the following justifications:

Art. 6 para. 1 sentence 1 lit. a GDPR ("consent"): If the data subject has voluntarily, in an informed and unambiguous manner, by means of a statement or other unambiguous affirmative act, indicated that they consent to the processing of their personal data for one or more specific purposes;

Art. 6 para. 1 sentence 1 lit. b GDPR: If the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

Art. 6 para. 1 sentence 1 lit. c GDPR: If processing is necessary for compliance with a legal obligation to which the controller is subject (e.g. a legal obligation to retain data);

Art. 6 para. 1 sentence 1 lit. d GDPR: If processing is necessary in order to protect the vital interests of the data subject or another natural person;

Art. 6 para. 1 sentence 1 lit. e GDPR: If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or

Art. 6 para. 1 sentence 1 lit. f GDPR ("Legitimate interests"): If the processing is necessary for the purposes of the legitimate (in particular legal or economic) interests pursued by the controller or by a third party, except where such interests are overridden by the interests or rights of the data subject (in particular where the data subject is a minor).

For any User in Germany, the storage of information in the end user's terminal equipment or access to information that is already stored in the terminal equipment is only permitted if it is covered by one of the following justifications according to the German Act on Data Protection and the Protection of Privacy in Telecommunications and Digital Services (TDDDG):

Section 25 (1) TDDDG: If the end user has consented on the basis of clear and comprehensive information. Consent must be given in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR;

Section 25 (2) no. 1 TDDDG: If the sole purpose is to carry out the transmission of communication via a public telecommunications network or

Section 25 (2) no. 2 TDDDG: where the storage of information in the end-user's terminal equipment or access to information already stored in the end-user's terminal equipment is strictly necessary to enable the provider of a digital service to provide a digital service explicitly requested by the user.

For the processing operations we carry out, we indicate the applicable legal basis in each case below. Processing can also be based on several legal bases.

5. Data erasure and storage duration

Unless an explicit storage period is specified in this Privacy Policy, your personal data will be deleted or blocked as soon as the purpose or legal basis for storage no longer applies. However, data may be stored beyond the specified period in the event of an (impending) legal dispute with you or other legal proceedings or if storage is provided for by statutory provisions to which we as the controller are subject. If the storage period prescribed by the statutory provisions expires, the personal data will be blocked or deleted unless further storage by us is necessary and there is a legal basis for this.

6. Data security

We use suitable technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or against unauthorised access by third parties (e.g. TLS encryption for our website), taking into account the state of the art, the implementation costs and the nature, scope, context and purpose of the processing as well as the existing risks of a data breach (including its probability and effects) for the data subject. Our security measures are continuously improved in line with technological developments

7. No obligation to provide personal data

As a customer, you are under no legal or contractual obligation to provide us with your personal data; however, certain features of the App may be limited or unavailable if you choose not to provide the information or permissions required for their operation. This may affect functionalities such as Bluetooth device connection, AI-powered voice interactions, real-time translation, photo and video synchronization, audio recording management, and related services.