Privacy Policy

This Privacy Policy describes how NATUREAI TECHNOLOGY PTE. LTD. ("NATUREAI", "we", "us", or "our") collects, uses, discloses, and otherwise processes personal data in connection with the Maybee mobile application (the "Service"). This policy applies to data collected through the Service and through other interactions you have with us, such as when you contact our support team or report content through the in-app reporting tool.

Your privacy is important to us, and we have prepared this Privacy Policy in compliance with the laws of the United States, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), and with the General Data Protection Regulation (Regulation (EU) 2016/679) (the "GDPR"), as well as the United Kingdom GDPR and the Swiss Federal Act on Data Protection, where applicable to ensure the safety of your data. Where we refer to "personal data", we mean "personal information" as defined under the CCPA, and where we refer to "data subject", we mean a "consumer" as defined under the CCPA.

If you have any questions about this Privacy Policy or our processing of your personal data, please contact our Data Protection Officer at maybee88866@gmail.com.

1. Personal Data We Collect

We collect personal data only where it is necessary for the purposes described in this Privacy Policy. The categories of personal data we collect are as follows.

1.1. Account and authentication data

When you create an account, we collect your sign-in identifier and the profile information returned to us by your chosen sign-in provider (Apple ID, Google, the email provider of your choice etc.). If you sign in with email, we collect your email address and an authentication token. If you sign in with Apple ID or Google, we receive only the unique identifier and (where you permit it) your display name.

1.2. Device and technical data

When you use the Service, we automatically receive your Internet Protocol (IP) address, operating system (OS) and version, system language, device model, keyboard layout, application version, and the date and time of each request. We use this data to operate the “Service”, to prevent abuse, and to diagnose technical issues.

1.3. Location

We derive your country of access from your IP address using a coarse, city-level geolocation database. We do not collect precise GPS coordinates, and we do not collect any data that would allow us to identify your physical address. The country data is used solely to confirm that the” Service” is being used from a supported region, and to provide relevant services that comply with local applicable law and regulations.

1.4. In-app purchase data

When you purchase Charms, the transaction is processed by Apple Inc. through the Apple App Store. Apple returns to us the product identifier (SKU), the quantity purchased, the transaction identifier, and a subscription status flag. NATUREAI does not receive or store your payment card number, expiration date, or any other financial account information.

1.5. User input and interaction data

When you send a text message to a story, we may collect the text of that message, the identifier of the story and character to which it is directed, the timestamp, and the AI-generated response. We retain this data for the operation of the Service, training purposes, for safety and abuse prevention, and to comply with our legal obligations. You may choose to delete the data and or manage the data, for more information, please refer to chapter 6 “Data Retention”, 7 “Your Rights Under GDPR” and 8 “You Rights Under the CCPA and other US State Laws”.

1.6. Support and reporting data

When you contact our support team, submit a report through the in-app reporting tool, or otherwise communicate with us, we collect the content of your communication and data such as your user ID and email to provide necessary service.

2. How We Use Personal Data

We use the personal data we collect for the following purposes: to create and authenticate your account; to operate, maintain, secure, and improve the Service; to provide the interactive AI-story features that is essential to the Service; to process in-app purchase; to detect, prevent, and address fraud, abuse, security incidents, and violations of our Terms; to respond to your support requests and reports; to comply with our legal obligations and to respond to applicable law and regulations and lawful requests from competent authorities; and, where you have provided your consent, to send you service-related notices and (if applicable) promotional communications that you may withdraw at any time.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects concerning you, we do not sell your data, and we do not engage in profiling within the meaning of Article 22 of the GDPR or the equivalent rules under the CCPA. The service does not contain advertising, does not display personalized recommendations, does not host chat or comment functions between users, and does not include any social features.

3. Legal Bases for Processing under the GDPR

Where the GDPR applies to our processing of your personal data, we rely on the following legal bases. We process your account and authentication data, your in-app purchase data, your user input and interaction data, and your support and reporting data on the basis that it is necessary for the performance of the contract between you and NATUREAI, namely these Terms and our provision of the Service (Article 6(1)(b) GDPR). We process your data on the basis of our legitimate interests in operating, securing, and improving the Service (Article 6(1)(f) GDPR), balanced against your rights and freedoms. We process personal data to comply with our legal obligations where applicable law requires us to do so (Article 6(1)(c) GDPR). Where we rely on your consent for any optional processing, such as the sending of promotional communications, you may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal (Article 6(1)(a) GDPR).

4. How We Disclose Personal Data

We do not sell personal data, and we do not share it in exchange for monetary or other valuable consideration. We disclose personal data only as described below.

4.1. Service providers

We disclose personal data to selected service providers that act as processors on our behalf under written agreements that restrict their use of the data to our documented instructions. These include Apple Inc. (operating system, authentication, in-app purchase, and notification infrastructure); our cloud hosting providers; our AI model providers, Software Development Kit (SDK) providers, to the extent that user input is transmitted to them to generate responses; and our customer-support and analytic providers. Apple Inc. may act as an independent controller for certain of its own processing activities, in which case its own privacy policy applies.

4.2. AI model providers

When you send a text message to a story, the message, the relevant content and identifiers, and the conversation text are transmitted to one or several third-party AI model providers to generate the AI response. The providers will only utilize the anonymize data under your consent and applicable laws for AI training.

4.3. Legal and compliance

We may disclose personal data where we believe in good faith that such disclosure is necessary to comply with a legal obligation, to respond to a lawful request from a competent authority, to protect our rights, property, or safety, or to protect the rights, property, or safety of our users or third parties.

4.4. Corporate transactions

We may transfer personal data to a successor entity in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business. We will notify you in the communication method of your choice (email, in-app notification) before your personal data becomes subject to a different privacy policy.

5. International Data Transfers

NATUREAI is headquartered in Singapore, and we use cloud service providers in the United States and other jurisdictions. When we transfer your personal data outside the country in which it was collected, we rely on appropriate safeguards, including (for transfers from the European Economic Area, the United Kingdom, or Switzerland) the European Commission's Standard Contractual Clauses and the United Kingdom International Data Transfer Agreement, supplemented by additional technical and organizational measures as appropriate. A copy of the relevant safeguards is available on request.

6. Data Retention

• We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, after which we delete or anonymize.
• Account and authentication data are retained for the duration of your account and for up to thirty (30) days after account deletion to allow recovery.
• In-app purchase records are retained for the duration of your account and may be kept for up to ten (10) years thereafter as required by tax and accounting law of applicable jurisdictions.
• User input and interaction data is retained for up to ninety (90) days for safety and abuse-prevention purposes and is then deleted, unless we are legally required to retain it for longer to comply with a local law and policies.
• Device and technical data are retained for up to thirteen (13) months in aggregated form.
• Support and reporting data are retained for up to two (2) years from the date of last interaction, unless a longer retention period is required by law or is necessary for legal claims.
• Aggregated, irreversibly anonymized data may be retained and archived for a year for analytical, studying, researching purposes in accordance to storage requirements of GDPR and CCPA. If you want to have your data omitted.

7. Your Rights under the GDPR

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights with respect to your personal data: the right to confirm whether we process your personal data and to access that data (Article 15 GDPR); the right to rectify inaccurate or incomplete personal data (Article 16 GDPR); the right to request deletion of your personal data, subject to the exceptions in Article 17 GDPR (Article 17 GDPR); the right to restrict the processing of your personal data in the circumstances set out in Article 18 GDPR (Article 18 GDPR); the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller (Article 20 GDPR); the right to object to processing based on our legitimate interests or to direct marketing (Article 21 GDPR); and the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects concerning you (Article 22 GDPR). You also have the right to lodge a complaint with the supervisory authority in your country of habitual residence, place of work, or place of the alleged infringement (Article 77 GDPR).

To exercise any of these rights, please contact maybee88866@gmail.com, or reach out to a competent local authority organization. We will usually respond within 5 business days, processing may take up to one month, extendable by two further months where the request is complex, in accordance with Article 12(3) GDPR. We may need to verify your identity before responding.

8. Your Rights under the CCPA and other U.S. State Laws

If you are a resident of California, or of another U.S. state with comparable privacy legislation, you have the following rights with respect to your personal information:

• The right to know what personal information we have collected about you, including the categories, sources, purposes, and categories of recipients (Cal. Civ. Code § 1798.110 and § 1798.115).
• The right to delete personal information that we have collected from you, subject to the exceptions in Cal. Civ. Code § 1798.105.
• The right to correct inaccurate personal information (Cal. Civ. Code § 1798.106).
• The right to opt out of the sale or sharing of personal information, although as stated in Section 5 above we do not sell or share personal information (Cal. Civ. Code § 1798.120).
• The right to limit the use and disclosure of sensitive personal information to that which is necessary to perform the services you have requested (Cal. Civ. Code § 1798.121).
• The right not to receive discriminatory treatment and retaliation for exercising your privacy rights (Cal. Civ. Code § 1798.125).

To exercise any of these rights, please write to maybee88866@gmail.com or use the in-app privacy-request function. We will respond within forty-five (45) days, as required by Cal. Civ. Code § 1798.130 and process your request charge-free. Where you act through an authorized agent, we will require proof of authorization and may need to verify your identity directly with you.

9. AI-Generated Content and EU AI Act Transparency

All character dialogue and narrative passages presented within the Service are produced, in whole or in part, by artificial intelligence. The Service clearly identifies, within its user interface, that each story and each character interaction is AI-generated, in compliance with Article 50 of Regulation (EU) 2024/1689 (the EU AI Act) and with the U.S. state laws requiring disclosure of AI-generated content.

We retain AI-generated content only for the period described in Section 6. We do not use your text input to train general-purpose AI models, and our AI model providers are contractually bound by the same restriction. Where you encounter AI-generated output that you consider to be unlawful or otherwise objectionable, you may report it directly within the Application or by writing to maybee88866@gmail.com.

10. Children

The Service is intended for users who are at least eighteen (18) years of age. NATUREAI does not knowingly collect personal data from individuals under that age. If we become aware that we have collected personal data from an individual under the age of majority, we will delete it as soon as possible. If you believe that we have collected personal data from a minor, please contact us at maybee88866@gmail.com.

11. Security

We employ appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures include data encryption, access controls that limit access to personal data to personnel and service providers who need it to operate the Service; regular review of our security practices; and incident-response procedures designed to address suspected personal-data breaches. For more detailed information or concerns please contact maybee88866@gmail.com. In the event of a personal-data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the competent supervisory authority without undue delay in accordance with Articles 33 and 34 of the GDPR and the analogous requirements of applicable U.S. state law.

12. Third-Party Services

The Service relies on certain third-party services, including but not limited to the Apple App Store, our cloud hosting providers, our AI model providers, and our analytics providers. NATUREAI is not responsible for the privacy practices of these third-party services. When you utilize third party services, data and information may be subjected to a new jurisdiction and a separate private policy. We strongly encourage you to read the privacy policies of any third-party services that you access. The Service does not contain links to third-party websites or services.

13. Changes to this Privacy Policy

NATUREAI may revise this Privacy Policy from time to time. Where a revision is material, we will provide reasonable advance notice within the Application, by email, or by other means reasonably calculated to reach you. The notice will indicate the date on which the revised Privacy Policy will take effect, which will not be sooner than thirty (30) days from the date of notice unless the change is required by law. Your continued use of the Service after the effective date constitutes your acceptance of the revised Privacy Policy. If you do not agree to a revision, you must stop using the Service and may close your account.

14. Contact Us

If you have any questions about this Privacy Policy, please contact us:

Company: NATUREAI TECHNOLOGY PTE. LTD.

Email: maybee88866@gmail.com