How we handle your data

1. Data Controller and Data Protection Officer (DPO)

1. Data Controller: EverLuu Technology Co., Ltd. (together, “we,” “us,” or “our”) is the sole data controller for personal-data processing connected with the App, and independently bears the related legal responsibilities under applicable law.
2. Registered Address: 1st Floor, No. 95 Nguyen Cong Tru Street, Saigon Ward, Ho Chi Minh City, Vietnam
3. Official Contact Email: [email protected]
4. Data Protection Officer (DPO): You may write to the Data Protection Officer at the official email above about compliance, privacy rights, and any data-processing matter. We will reply within the time limits required by applicable law.

2. Scope of Application and Service Description

1. Applicable scenarios: This Policy covers every situation in which you download, install, and use AI Syrup through Google Play, including free features (if any), paid in-app purchases (if any), AI image and video creation, and other App-related activities.
2. Product positioning: AI Syrup is an AI image and video creation tool. You do not need photography, editing, or professional creative experience. By uploading local image materials and choosing a style, you can generate images, videos, and other creative visual works through AI algorithms, giving everyday visuals a new look.
3. Account mechanism: The App has no registration, login, or account-binding features. You are not required to submit a phone number, email address, password, or other identity details. After you check the box to accept this Privacy Policy and the Terms of Service, you may use all basic features.
4. Payment mechanism (if any): The App may offer paid in-app purchases. You may voluntarily buy add-on services such as exclusive creation entitlements, premium style templates, and high-definition export permissions. In-app purchase transaction data is used only for order verification, entitlement fulfillment, and after-sales support.

3. Types of User Data We Collect and Purposes of Collection

We follow “minimum necessity” and “purpose limitation.” We collect only what is needed to deliver core features, keep the service stable, improve the experience, and complete in-app purchases. We do not collect extra user data unrelated to the services. Categories and purposes are as follows:

(A) Device and App Information

1. Data collected: Device model, system version, unique device identifiers, App installation information, running logs, network access status, hardware parameters, and other basic device information the App reads.
2. Purposes: To launch and run the App reliably; to diagnose crashes and lag; to improve compatibility and stability; to reduce security risks from malicious devices or abnormal operations; and to protect user security.

(B) Photo Library and External Storage Data

1. Data collected: After your affirmative authorization, we may access image materials in the device photo library and visual media files on external storage. We only access content you actively select and upload for AI creation. We do not privately read or scan your other private files.
2. Purposes: This permission is necessary for core services: material upload, AI image and video creation, work preview, local saving and export, and related creation features.

(C) Service Interaction and Transaction Data

1. Data collected: Feature operation records, style-selection preferences, creation records, in-app purchase order information (if any), payment credentials or proof of purchase (if any), service-usage duration, and other interaction data.
2. Purposes: To record creation preferences so we can refine AI algorithms and styles; to activate in-app purchase entitlements; to verify orders and handle after-sales questions; and to analyze usage for product iteration.

(D) User-Initiated Inquiry Data

1. Data collected: Message content and contact details you voluntarily send when you write to the official email for feedback.
2. Purposes: To respond accurately to inquiries, complaints, and rights requests, and to complete after-sales coordination.

4. Legal Bases for Data Processing

All personal-data processing is carried out under commonly recognized global compliance frameworks and applicable national laws. The core legal bases are:

1. Your explicit consent: Your affirmative acceptance of this Policy, authorization of device permissions, upload of materials, and initiation of in-app purchases form the primary legal basis for most processing.
2. Necessity for contract performance: Processing is needed to perform the service agreement, deliver core creation services, and fulfill in-app purchase entitlements.
3. Legitimate interests: Without undermining your fundamental privacy rights, we may process data as reasonably necessary to keep the App secure, improve products, and prevent abuse or attacks.
4. Legal obligations: We process data as required to meet statutory duties, including data retention, preservation of transaction records, and compliance assessments.

5. Data Sharing, Sale, and User Opt-Out Mechanisms

This section describes your core data rights and is designed to align with GDPR, LGPD, CCPA, CPRA, VCDPA, and similar laws, so that you remain in control of your personal data.

(A) Data Sharing Rules

We do not share personal data without limits. We share data with compliant third parties only in the lawful situations below, and those parties have signed confidentiality agreements and must follow global privacy laws:

1. Hosting and technology providers: Partners that support App operation, AI computing, and data storage. They receive only the minimum data needed to provide the service and may not use it for other purposes.
2. Payment and transaction providers: Compliant payment institutions that process in-app purchases and order verification. They handle only transaction-related data and do not retain your creative materials or private content.
3. Legal and regulatory situations: Disclosure required by lawful instructions of judicial or regulatory authorities, or as needed to comply with laws, legal proceedings, or industry rules.

Except for the situations above, we will not share or disclose your personal data to any commercial entity or third-party organization.

(B) Data Sale Rules and User Opt-Out Rights

We strictly prohibit selling, renting, or trading personal data in any form. We will not use your personal information, creative materials, device information, usage records, or similar data for commercial sale or profit.

For activities that some regional laws may treat as “data sharing” or “commercial transfer,” you may opt out and refuse at any time, without conditions, and may stop all sharing and transfer of your personal data at any time.

(C) How to Opt Out of Data Sharing / Sale

You may exercise opt-out rights and stop data sharing in any of the following ways:

1. On-device actions: In your phone’s system settings, turn off the App’s access to the photo library, storage, and device information. That immediately stops the related collection and sharing. Uninstalling the App fully ends local data collection and cloud synchronization.
2. Manual request: Email the official contact address ([email protected]) with the wording “Terminate Data Sharing / Opt Out of Data Transfer,” and include relevant device identifiers. We will finish verification within 15 business days and permanently end all sharing and transfer of that user’s data.

6. Region-Specific Privacy Rights for Global Users

The App is designed to accommodate privacy laws in multiple regions. Users in different places may have additional statutory rights. Exercising these rights is free and without barriers; you are not required to complete complex, repeated identity checks.

1. European Union (GDPR): EU users have rights of access, rectification, erasure, restriction of processing, data portability, withdrawal of consent, and the right to lodge a complaint. You may request access to, export of, or deletion of all of your personal data, and may withdraw previously granted privacy consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.
2. Brazil (LGPD): Brazilian users may inquire into processing details, correct inaccurate data, delete redundant data, and limit the scope of processing. You have the right to complete information on purposes, retention periods, and third-party sharing, and may object to processing based on legitimate interests.
3. California, United States (CCPA/CPRA): California users have rights to know, delete, and access data, and to opt out of the sale of personal data. You may request, free of charge, details of the categories we collect, the purposes of use, and the parties with whom data is shared. You may request complete deletion of personal-data records, permanently refuse any sale of personal data, and will not be discriminated against or have service entitlements restricted for exercising privacy rights.
4. Virginia, United States (VCDPA): Virginia users may access, correct, and delete personal data; opt out of personalized processing and data sharing; obtain explanations related to automated decision-making; and not be subjected to discriminatory treatment in services.
5. Other regions: Users elsewhere may enjoy equivalent rights under locally applicable personal-data laws. We will adapt to the corresponding regional compliance requirements to protect your lawful interests.

7. Data Storage, Retention Periods, and Security

(A) Data Storage and Retention Periods

1. Material data: Creative materials you upload and AI-generated works are stored only on your local device. The cloud temporarily caches data solely for real-time AI creation. After creation finishes, cloud cache is automatically cleared. We do not retain your original materials long-term.
2. Operational and transaction data: Running logs, interaction records, and in-app purchase order data are kept only for as long as needed for service continuity and compliance. After you uninstall the App or request deletion, we will thoroughly clear cloud-retained data within the time limits required by law.
3. Compliance retention data: Certain transaction and log data may be kept for the minimum statutory period required for legal, regulatory, and audit obligations, and will be permanently destroyed when that period ends.

(B) Data Security Measures

We use industry-standard encryption, secure transmission protocols, and cloud data-isolation mechanisms to protect user data against leakage, alteration, loss, and unauthorized access. We also maintain internal access controls so that only authorized personnel may access user data, and only when needed for work, to prevent internal misuse.

You are responsible for safeguarding your personal device and App environment, managing device permissions carefully, and avoiding privacy risks from device theft or leakage.

8. Users’ Rights to Lodge Complaints with Supervisory Authorities

If you believe our data processing violates this Policy or applicable local privacy laws, or if you object to our privacy handling or after-sales response, you have the statutory right to lodge a complaint or appeal with your local data-protection supervisory authority.

You may also contact us first through the official email. We will promptly handle disputes, cooperate with investigations by supervisory authorities, and fully remediate any non-compliant processing.

9. Special Statement on In-App Purchase Data Processing

1. During in-app purchase transactions, we do not collect bank card numbers, payment passwords, or other core payment privacy information. Payment is completed by official, compliant payment providers. We obtain only necessary transaction data such as order numbers, payment status, and entitlement activation status.
2. Transaction data is used only for entitlement verification, order after-sales support, and compliance bookkeeping. It will not be used for marketing push, third-party sharing, or commercial sale.
3. You may request to inquire into or delete your personal in-app purchase transaction records at any time. We will respond promptly, subject to compliance requirements.

10. Updates to This Privacy Policy and Notice

We may revise this Privacy Policy from time to time based on product changes, business adjustments, updates to laws and regulations, and changes in Google Play compliance requirements.

After an update, we will notify you through in-App pop-ups and/or page notices. The updated Policy takes effect on the publication date. Continued use of the App after an update constitutes acceptance of the revised Policy. If you do not agree, you may stop using the App immediately and uninstall it.

11. Disclaimer

1. We assume no responsibility for data leakage caused by your own disclosure of personal data, your own authorization of third parties to obtain data, or illegal intrusion into your devices.
2. Changes to data-processing rules that result from adjustments to laws, regulations, or regulatory policy, or from force majeure, do not constitute a violation by us.
3. All privacy risks and liabilities arising from a minor’s use of the App by concealing their age shall be borne by the user and their guardian.