PRIVACY POLICY

Welcome to Mosi's multimodal AI products and services!

Shanghai Mosi Intelligent Technology Co., Ltd. (“Mosi”, “we”, “us” or “our”) is committed to protecting your personal data and privacy. This Privacy Policy explains how we collect, use, store, disclose and otherwise process your personal data, the rights you have in relation to your personal data, and how you can exercise those rights.

This Privacy Policy applies to the multimodal AI generation and processing products and services lawfully owned and operated by Mosi, including websites, client applications, mobile applications, mini-programs, API platforms and other forms of service delivery (collectively, the “Mosi Products”, “Products” or “Services”). Depending on the specific services you use, the Mosi Products offer features for generating and processing text, images, audio and video, as well as voice cloning, voice conversion and other functions.

Mosi is responsible for the personal data processing activities described in this Privacy Policy for which we determine the purposes and means of processing. If you have any questions about how we use your personal data, please contact us at mosi@mosi.cn or using the contact details provided in the “How to Contact Us” section of this Privacy Policy.

Depending on your country or region, the relevant jurisdiction-specific supplemental terms set out in the Annexes may also apply to you. Please read this Privacy Policy together with any supplemental terms that apply to you. In the event of any inconsistency, the applicable jurisdiction-specific supplemental terms shall prevail, subject to any mandatory provisions of applicable law.

If you use systems or applications developed by third-party developers using the Mosi Open Platform or API services, or access or connect to third-party services through the Mosi Products, the relevant developers’ or third parties’ privacy policies shall govern any processing of your personal data for which they independently determine the purposes and means. We encourage you to review those policies.

Personal data is information that can directly or indirectly identify you. We follow the principle of data minimization and collect only the data necessary for the purposes described in this Privacy Policy. We collect your personal data in three ways: information you provide directly to us, information we collect automatically, and information we obtain from other sources, as explained below.

• Account Information: When you register or log in to an account, we collect information you provide, such as your email address, verification code, and password.
• Profile Information: You may choose to provide additional information, such as a profile picture or nickname, or link a third-party account to personalize your profile.

• Inputs, Outputs, and Generation Records: We provide services for generating, understanding and processing text, images, audio and video using multimodal AI models. To fulfill your requests, we process the prompts, text, images, recordings, audio, videos, files, reference materials, parameters and instructions that you submit, upload or import, together with the resulting outputs, task identifiers, task statuses and related history. The specific information processed depends on the features and settings you use. When processing voice materials, we may analyze voice characteristics and voice parameters to provide the features you request. When you use certain video features, we may also analyze facial features in the images or videos you provide to create the special-effects videos you request. We extract and compare these characteristics only where necessary to provide the requested features, such as voice cloning, voice conversion and special-effects video generation, and shall not use this information to identify you.
• We use this information to perform generation or editing tasks, deliver and display results, provide access to relevant history, troubleshoot issues and maintain the security of our Services. We do not use this information for general-purpose model development, training or evaluation. Further details are provided in Section 3 of this Privacy Policy.
• When using the Services, you shall comply with applicable law and our terms. Please see our Terms of Service for details.

• Contact and Communication Information: When you contact us with inquiries, feedback, complaints, or business cooperation proposals, we may collect your name, contact details (such as your email address or phone number), account information, the content of your communication, and any other information you provide to verify the matters you raise. We use this information to contact you, verify and resolve issues, handle complaints, provide support, improve our Products, and explore a potential business relationship.
• Feedback-Related Records: When you submit comments, reviews or feedback about an issue, we may also process the relevant task records, inputs, outputs, and activity logs to investigate the matter, provide support and improve the Services in accordance with applicable law.

• Transaction and Payment Information: When you purchase credits, usage quotas, subscriptions, resource packages, paid models, or other paid services, we collect your order and payment information, as well as information relating to your third-party payment accounts, to facilitate ordering and payment, provide customer support and post-purchase support.
• Invoice Information: If you request an invoice, we will collect the information required for the type of invoice requested, including the name to appear on the invoice (your name or organization name), tax identification number and email address for delivery, as applicable.

• Developer and Business Account Information: To provide our Open Platform and API services, authenticate accounts, grant access permissions, verify identities and maintain security, we may collect your developer account information, name, email address, phone number and other necessary information relating to your identity or legal entity. If you use these services on behalf of a business, we may also collect the business name, registration number, verification documents, and the names and contact details of its designated contacts or administrators.
• Note: Our Open Platform and API services do not currently require individual identity verification or business entity verification. If we introduce such requirements or features in the future as our business needs change, we will notify you separately and obtain your consent where required by applicable law.
• Service Notifications and Commercial Communications: We may collect and use your email address, phone number or other contact details to send you information relating to our Open Platform and API services, including feature updates, product announcements, security alerts, billing notices, service change notifications and commercial communications. For commercial communications, we shall provide you with a means to unsubscribe or opt out as required by applicable law.

• Clipboard: Where necessary to provide a particular feature, we may recognize links, invitation codes, API keys or content for quick import that you have voluntarily copied and provided to us.

• To manage accounts, generation tasks, API calls, and service security, we may process account identifiers, task or request identifiers, and session information and access credentials necessary to provide the relevant services.
• To protect account security, service stability, content safety, transaction security, and operational quality, we may collect device information, browser information, operating system version, device identifiers, IP addresses, network status, language settings, access times, click records, feature usage records, generation task status, error logs, crash logs, performance data, risk-control records, and records of violations. We use this information for authentication, risk detection, fraud prevention, content safety, troubleshooting, statistical analysis, and security audits.

• API Usage Information: To enable API calls, manage access permissions and usage quotas, handle billing and settlement, operate and maintain our Services, manage security risks, troubleshoot issues, resolve disputes, and comply with legal obligations, we may collect and use information such as your API keys, API call logs, call times, models called, request statuses, token and quota usage, error logs, bills, orders, and transaction information.

• Cookies and Similar Technologies: We may use cookies and similar tracking technologies to operate and provide our Services, including to maintain login sessions, protect security, and better understand how our Services are used. For further details, please see our Cookie Policy.

• Login, Registration, and Linked Services: If you choose to register for or log in to our Services using a third-party service, such as Google, or link your account to a third-party service, we may collect personal data from that service, such as access tokens, third-party account identifiers, email addresses, profile pictures, and nicknames. The specific information depends on what the third party displays on its authorization page and what you actually authorize.
• Publicly Available and Licensed Sources: We may use publicly available online materials, datasets licensed by third parties, or other lawfully obtained sources for model development or related features. These materials may contain personal data. In such cases, we shall establish an appropriate legal basis under applicable law, provide information about the categories of sources and purposes of processing, and implement appropriate screening, data minimization and security measures.

We process your personal data in accordance with applicable law. Depending on the Services you use, the purposes of processing and applicable law, we may process your personal data in the following circumstances. Each legal basis below applies only where recognized by applicable law and where its requirements are met.

Where applicable law requires us to obtain your consent, separate consent, explicit consent, or other additional conditions, we will comply with those requirements and will not rely on the other legal bases described above as a substitute. For further details on the legal bases for processing and their corresponding purposes in specific jurisdictions, please refer to the applicable jurisdiction-specific supplemental terms or relevant notices.

Where we process your personal data based on your consent, you may withdraw your consent in accordance with this Privacy Policy. Your withdrawal of consent shall not affect the lawfulness of any processing we carried out before the withdrawal. For more information about how to withdraw your consent, object to processing or exercise your other rights, please refer to Section 6, “Your Data Protection Rights”, of this Privacy Policy.

We will not use your inputs, uploaded materials, generated outputs, or feedback to train, fine-tune, distill, or improve our or any third party's general-purpose AI models, or to develop model evaluation benchmarks.

We may still process this information to the extent necessary to provide the Services you request, maintain service security and improve the user experience. Such processing may include performing tasks, delivering results, reviewing content for safety, troubleshooting, evaluating performance, conducting internal audits and carrying out statistical research. These activities do not constitute model training.

If we intend to use this information for model training in the future, we shall seek your separate, explicit consent in advance, in accordance with applicable law, and provide you with the option to withhold consent. We shall not undertake such processing without obtaining your separate consent. The commitments set out above constitute our contractual obligations to you under this Privacy Policy.

If you believe that our processing of your information does not comply with this Section, you may raise an objection by contacting us at mosi@mosi.cn. We shall investigate and respond to your objection within fifteen (15) working days. If we confirm any non-compliance, we shall cease the relevant processing and delete the affected data.

To protect the safety of our users, the public and our Services, comply with applicable law and enforce our Terms of Service, we may use automated systems or, where necessary, human reviewers to review your inputs, uploaded materials, generated outputs, generation tasks and related publishing or exporting activities. We may also use relevant account information, usage records and logs to identify and address risks involving unlawful activities, violations of our Terms of Service, intellectual property infringement, fraud, misuse or attempts to circumvent security measures.

We may engage third-party content moderation providers to assist with automated reviews. Where human review is necessary, we shall restrict access to the relevant content and require personnel involved in the review to comply with confidentiality and security obligations. For further information about how our service providers process personal data, please refer to the “Service Providers and Other Partners” section of this Privacy Policy.

Based on the review results and applicable law, we may take measures such as refusing to generate content, adding labels or notices, restricting access to certain features, or removing or deleting content. For further details, please refer to our Terms of Service. If you disagree with a review outcome or any measures we have taken, you may request a review by contacting us at mosi@mosi.cn. Before making any decision that may significantly affect your rights or interests, such as restricting account features or suspending or terminating our Services, we will conduct a human review. You may request a further review in accordance with Section 6 of this Privacy Policy and Section 8 of our Terms of Service.

Our processing of personal data is also subject to the laws of the People's Republic of China (PRC), including the Personal Information Protection Law of the People's Republic of China, the Data Security Law of the People's Republic of China and the Cybersecurity Law of the People's Republic of China. Accordingly:

(1) Before processing sensitive personal data (including biometric data such as voice and facial features), transferring personal data overseas, conducting automated decision-making that may materially affect individuals' rights and interests, or engaging in other activities specified by law, we will conduct a personal data protection impact assessment and retain processing records as required by law. Where applicable law requires us to retain such records for three (3) years, we shall comply with that retention period.

(2) We shall process sensitive personal data only after obtaining your separate consent and shall inform you of the necessity of such processing and its impact on your rights and interests.

(3) We shall implement necessary measures to protect the security of personal data in accordance with applicable law, including encryption, de-identification, access controls, permission management and security audits, and shall establish a personal data security incident response plan.

(4) If personal data is or may be leaked, altered, or lost, we shall immediately activate our incident response plan and notify you and the competent authorities responsible for personal data protection as required by law. For further details, please refer to Section 8.4 of this Privacy Policy.

(5) We shall handle requests for access to or disclosure of personal data from judicial, law enforcement or other competent authorities outside China in accordance with this Section and Section 4.6 of this Privacy Policy.

We do not sell your personal data to third parties. We share your personal data with third-party recipients only to the extent necessary to provide our Services, support our operations, or comply with legal obligations. If we engage in activities that constitute a “sale” or “sharing” of personal data or targeted advertising under applicable law, we will provide legally required notice and opt-out mechanisms and treat legally valid opt-out preference signals, such as Global Privacy Control (GPC), as opt-out requests. Where applicable law imposes specific restrictions on the sale, sharing or use of minors’ personal data for targeted advertising, we shall comply with the relevant age-related requirements and obtain any legally required parental or legal guardian authorization before engaging in such activities. We require third-party partners to implement appropriate technical and organizational safeguards based on their actual roles and applicable law.

We may disclose your personal data to our affiliates to the extent necessary to provide our Services, offer technical support, manage operations and maintenance, maintain security or carry out administrative functions. We will put appropriate arrangements in place based on the respective roles of the parties involved and implement safeguards for cross-border processing where applicable.

We engage service providers and other partners to help us provide, support, and develop the Services and understand how they are used. We share personal data you provide, personal data collected automatically, and personal data from other sources with these providers and partners only to the extent necessary for them to perform their services. For example:

• Communications Providers: We engage communications providers to process your contact details, such as your email address and phone number, and to send you service notifications or messages.
• Content Moderation Providers: We use content moderation providers to process the text, images, audio and videos you submit, upload or generate, and conduct automated reviews to identify unlawful, non-compliant or potentially harmful content.
• Cloud Service Providers: We use cloud service providers to supply essential cloud computing infrastructure, including servers, storage and networking resources, and to store or process data necessary to provide our Services.
• Analytics Providers: We use analytics providers to process de-identified device information, IP addresses, access logs and usage data to analyze how our Products are used and assess service quality and performance. These partners may also use information about crashes, application failures, device identifiers, and overall application installations and usage to help us troubleshoot issues and improve service performance.
• Payment Service Providers: We use payment service providers to process your payment account and order information to facilitate payments and order settlement. We do not directly store your complete payment credentials. Payment service providers process such information in accordance with their respective privacy policies.
• Security Service Partners: We use security service partners to process necessary device, account, and log information to prevent fraud, abuse, and other security risks and to protect accounts, transactions, and our Services.
• Marketing Partners: We work with marketing partners to process device, network, marketing channel and conversion data for product promotion and performance analysis. We share such data with these partners only after it has been anonymized so that individuals cannot be re-identified by any means. Where the data has not been anonymized, we shall require our partners to process it solely on our behalf and in accordance with our instructions. They shall not use the data for their own purposes, combine it with data from other sources or attempt to re-identify individuals. You may reject technologies used for promotional purposes through the “Cookie Preferences” settings described in our Cookie Policy, or exercise your data protection rights under Section 6 of this Privacy Policy.

The parties described above will access, process or store personal data only in performing their duties for us and in accordance with our instructions.

Certain features of our Services may allow you to publish content, send information to specific recipients or share content through third-party platforms. When you use these features, your content, including any personal data it contains, may become accessible to the recipients or audience you select.

We will inform you of the available sharing options and settings through the relevant feature descriptions or interfaces. Please review the content, intended recipients and scope of disclosure before sharing. If you share content through a public link or third-party platform, recipients may copy or further distribute it. We encourage you to carefully review what you share and with whom before doing so.

If we undergo a merger, acquisition, restructuring, asset transfer, bankruptcy or similar transaction, we may transfer your personal data to the recipient as part of the relevant business.

We will take necessary confidentiality and protective measures under applicable law, provide any required notice about the recipient, transfer, and subsequent processing, and require the recipient to protect the information in accordance with law. If the purposes or means of subsequent processing change, we will provide notice as required by applicable law and obtain consent where legally required.

We may disclose personal data to law enforcement authorities, regulatory bodies, or legal counsel in the following circumstances:

(1) Legal Obligations: To comply with valid and enforceable judicial or administrative requests under the laws of the People's Republic of China.

(2) Vital Interests: To protect the safety of our users or the public, such as in an emergency involving a potential risk of personal injury.

Under our current service arrangements, we store data within the People's Republic of China. If we receive a request for personal data from a judicial, law enforcement or other competent authority outside the People's Republic of China, we shall first assess the legality and appropriateness of the request to the extent permitted by applicable law. Where the Data Security Law of the People's Republic of China, the Personal Information Protection Law of the People's Republic of China or other applicable laws require approval from the competent Chinese authorities, we shall obtain such approval before responding to the request in accordance with the law. We may challenge or seek legal remedies against requests that we consider overly broad, vague or lacking a lawful basis. Unless prohibited by law, we shall take reasonable steps to notify you of such requests to the extent permitted by applicable law.

You can manage your personal data and related content in the following ways:

• Accessing and Updating Account Information: You can access, obtain copies of, correct or supplement your account information through the “Account”in our Products.
• Our Model Training Commitment: We will not use your inputs, uploaded materials, or generated results for model training. See Section 3.2 of this Privacy Policy. If you identify any processing that is inconsistent with this commitment, you may report it to us at mosi@mosi.cn. We will immediately investigate the matter, cease the relevant processing and delete the affected data.
• Deleting Conversations and Other Data: You can use the deletion features available in our Products to delete certain conversation histories, uploaded materials, generated outputs or other content. You may also contact us to request the deletion of other personal data.
• Advertising and Marketing: You can opt out of receiving commercial communications by following the instructions provided in those communications.
• Managing Device Permissions: You can disable permissions for your camera, microphone, photo library, notifications and other device features through your device's system settings. You may also withdraw your consent to the processing of relevant personal data through settings in our Products or by contacting us. Disabling permissions or withdrawing consent may affect the availability of certain features that rely on those permissions or processing activities.
• Deleting Your Account: You can request account deletion through “Account – Delete Account” or by contacting us. To protect your account, we may need to verify your identity and ask you to resolve any outstanding charges or other necessary matters relating to your account. Once your account has been deleted, you will no longer be able to use it, and the associated data and content may not be recoverable. We shall delete or anonymize the personal data associated with your account, except where applicable law permits or requires us to retain it. Where we retain such information, we shall do so only for as long as necessary and to the extent necessary for the relevant purposes.

To exercise your rights, you or your legally authorized representative may contact us at mosi@mosi.cn. To protect your personal data, we may verify your identity to the extent necessary and reasonable, for example, by confirming the email address associated with your account. If an authorized representative submits a request on your behalf, we may require proof of the authorization or authority to act for you.

We will respond within the period required by applicable law. Generally, we will process or respond to a request within 15 working days after receiving it, and we will comply with any shorter deadline required by applicable law. If we need additional information, extend the response period as permitted by law, charge a fee, or cannot fulfill a request in whole or in part, we will explain the circumstances, reasons, and any applicable ways to object or appeal as required by law.

You may also appeal a request we have denied by emailing mosi@mosi.cn. The rights you may have are summarized below and depend on the laws applicable in your country of residence.

(1) Right to Information, Access and Copies: You have the right to request information about whether we process your personal data and how we process it, as well as to access or obtain copies of the relevant personal data.

(2) Right to Rectification: You may request that we correct inaccurate personal data or complete incomplete personal data.

(3) Right to Erasure (Right to Be Forgotten): You may request that we delete your personal data in circumstances prescribed by applicable law, such as where we have processed your personal data unlawfully, the purposes of processing have been fulfilled or the processing is no longer necessary, or you have withdrawn your consent and no other lawful basis for processing exists.

(4) Right to Restriction of Processing: You may request that we restrict, suspend or cease processing your personal data.

(5) Right to Data Portability: You have the right to receive your personal data in a structured, commonly used and machine-readable format, or to request that we transfer such information to an eligible recipient.

(6) Right to Withdraw Consent: Where we process your personal data based on your consent, you may request to withdraw your consent at any time. We will explain the consequences of withdrawing your consent. Important: Withdrawal of consent shall not affect the lawfulness of any processing we carried out on the basis of your consent before its withdrawal.

(7) Right to Object to Direct Marketing: We do not “sell” your personal data. You may object at any time to our processing of your personal data for direct marketing purposes, including profiling related to such direct marketing. Once we receive your objection, we shall cease processing your personal data for those purposes.

(8) Rights Relating to Significant Automated Decisions: We will not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (for example, materially affecting your financial position or credit standing). If a decision would significantly affect you, we will conduct a human review before making it. You may also appeal by emailing mosi@mosi.cn.

(9) Rights of Close Relatives of Deceased Individuals: To the extent permitted by applicable law, the close relatives of a deceased individual may request access to, copies of, rectification of, or deletion of the deceased individual's personal data to protect their own lawful and legitimate interests, unless the deceased individual made other arrangements during their lifetime or the exercise of such rights would infringe upon the lawful rights and interests of others.

• Use In-Product Features: You can exercise most of your rights directly through the “Account”.
• Contact Our Privacy Team: You or your legally authorized representative may submit a request by emailing mosi@mosi.cn.

If you have any questions or wish to make a complaint about how we process your personal data, you may first contact us under Section 11. You may also complain to an applicable data protection authority in accordance with law. If we do not fulfill your request to exercise your rights, you may object or appeal as permitted by applicable law.

We are committed to protecting the privacy of minors and set minimum age and parental or legal guardian consent requirements in accordance with applicable law and our Terms of Service.

• Minimum Age: You must be at least 13 years old to register for and use our Services. If the applicable law or jurisdiction-specific supplemental terms in your country or region require a higher minimum age, that higher age applies. If we verify that a registered user is under 13, we will immediately delete the account and prevent further access to our Services. Features involving voice cloning, voice conversion, facial processing, or image or video generation that may involve identifiable characteristics or biometric information of other individuals shall be available only to users aged 18 or above.
• Parental or Legal Guardian Permission: If you meet the minimum age but are under 18, or are otherwise considered a minor under the laws applicable in your location, you must read and understand this Privacy Policy and the Terms of Service together with your parent or legal guardian and obtain their permission before using our Services. Where required by applicable law, your parent or legal guardian must give the relevant consent or accept the relevant terms on your behalf.
• Age and Permission Verification: We may request information to the extent necessary and reasonable to confirm your age, guardianship relationship, or relevant permission. Where applicable law requires parental or legal guardian consent, we will obtain and verify such consent in accordance with law.

We do not knowingly collect personal data from children under 13. If you are a parent or legal guardian and believe your child has provided us with personal data without your consent, please contact us at mosi@mosi.cn. We will immediately take steps to delete that information and terminate the relevant account.

We encourage parents and legal guardians to monitor minors' use of our Services, guide them in exercising caution when providing personal data, and contact us promptly if they encounter inappropriate content or other safety concerns.

We take the security of your personal data seriously. Based on applicable legal requirements, the nature of the personal data, and the risks of processing, we use appropriate technical and organizational measures to prevent unauthorized access, use, disclosure, alteration, damage, or loss.

• Encryption and Secure Communications: We use appropriate measures to protect data in transit and at rest based on the category of data and the relevant risks, to prevent unauthorized access or disclosure.
• Access Control and Confidentiality: We use authentication, permission management, and access control mechanisms to restrict access to personal data to authorized personnel who need such access to perform their duties, and require those personnel to maintain confidentiality. We regularly review access permissions and use access logs and other measures to help detect and trace unusual access.

We follow the principle of data minimization and retain your personal data only for as long as necessary to achieve the purposes described in this Privacy Policy or for the period required by law.

• Account Information: We generally retain your account information for as long as your account remains active. Following account deletion, we will handle such information as described below.
• Inputs and Generated Content: We generally retain conversation histories, prompts and generated outputs saved in your account until you delete the relevant content or your account.
• User-Uploaded Materials: We retain uploaded materials until the relevant processing task is completed. If you choose to save materials for future use, we generally retain them until you delete the materials or your account.
• Activity Logs: We determine retention periods based on the needs of troubleshooting, security monitoring, incident investigations and applicable legal retention requirements. We generally retain such logs for six (6) months. Where applicable law requires a longer retention period, we shall retain them for the legally required period.
• Transaction Records: We determine retention periods based on the status of transactions and after-sales matters, as well as applicable statutory retention requirements relating to taxation, accounting and other relevant matters.
• Complaint and Report Records: We determine retention periods based on the progress of handling complaints, reports and appeals, as well as the need to resolve related disputes and comply with legal obligations.
• Other Data: We retain other data only for as long as necessary to fulfill the purposes described in this Privacy Policy or for the periods required by law.

We will handle your personal data in accordance with the following procedures when its retention period expires, the purposes of processing have been fulfilled or the information is no longer necessary, you withdraw your consent and no other lawful basis for processing exists, or your request for deletion or account deletion meets the applicable requirements:

• Initiating Deletion: We will review the retention period and whether retention remains necessary, and proactively begin the deletion process for data eligible for deletion. You may also submit a request through the deletion or account deletion features available in our Products, or by contacting us at mosi@mosi.cn.
• Deletion and Anonymization: We will promptly delete eligible data from our business systems or irreversibly anonymize it. Where applicable law requires us to retain certain transaction, security or dispute-related records, we shall retain only the information necessary for those purposes and delete or anonymize it once the applicable retention period expires.
• Clearing Backups: If the data remains temporarily in backups or caches, we will restrict access and use, will not use it for ordinary business operations, model training, or other purposes, and will clear it under our established backup update or deletion cycles and applicable legal requirements.

• If a personal data breach, alteration or loss occurs or is likely to occur, we will immediately initiate our incident response procedures, assess the impact on your rights and interests, and notify you and the competent regulatory authorities within the time limits prescribed by applicable law. The notification will include the categories of information affected, the potential impact, the measures we have taken or intend to take, and recommended steps you can take to protect yourself. Where applicable law prohibits notification for reasons such as criminal investigations, we will comply with those restrictions.

Because the Mosi Products are offered globally, your data may be stored or processed outside your country or region, or local service providers may assist with operations and maintenance.

Under our current service arrangements, Shanghai Mosi Intelligent Technology Co., Ltd. operates Mosi Products and related services, with our personal data storage facilities, technical support and operations teams located in China. If you use our Services from outside China, we will receive, store and process your personal data in China for the purposes described in this Privacy Policy.

As our business and service arrangements evolve, we may provide our Services through operating entities, servers, or service providers in other countries or regions and store and process your personal data in those locations. If the service operator, principal storage location, or processing arrangements change, we will update this Privacy Policy or provide separate notice as required by law, and obtain your consent where required by applicable law.

Data protection laws in different countries or regions may differ from those in your country or region. When personal data is transferred internationally, we will comply with applicable law and take safeguards appropriate to the specific transfer arrangements, including:

• Contractual and Other Legal Safeguards: Where required and applicable, we will use standard contractual clauses or other legally recognized transfer mechanisms and require the relevant recipients to comply with their data protection obligations.
• Risk Assessments and Security Measures: Where required by law, we will conduct relevant risk assessments and implement technical and organizational measures appropriate to the nature of the personal data and the risks associated with its processing.
• Notice and Consent: We will provide information about international data transfers in accordance with applicable law and obtain your consent where required.
• Encryption and Transfer Security: We will implement appropriate encryption in transit, access controls and other technical and organizational measures, taking into account the type of data, the method of transfer and the associated risks, to reduce the risk of unauthorized interception or access.

Mosi reserves the right to update or revise this Privacy Policy to reflect changes to the Services, technology, or legal requirements.

• Notification: For material changes affecting the processing of personal data or your rights, we will provide an explanation through a prominent announcement, in-product notice, email, or another appropriate method as required by law. Where obtain your consent again is legally required, we will obtain valid consent before the relevant processing.
• Review: We encourage you to check this page regularly for the latest information about our privacy practices.

If you have questions or complaints about this Privacy Policy or how we process personal data, or you wish to exercise your rights, you can contact us as follows.

Company Name: Shanghai Mosi Intelligent Technology Co., Ltd.

Address: No. 789 Huafa Road, Xuhui District, Shanghai, China

Email: mosi@mosi.cn

Upon receiving your request, we will verify and process it as soon as practicable and respond within the time limits prescribed by applicable law. Where applicable law does not prescribe a specific time limit, we will complete the processing of your request or provide a clear response within fifteen (15) working days.

For information about local representatives, persons responsible for personal data protection or other legally required contacts in specific countries or regions, where applicable, please refer to the relevant jurisdiction-specific supplemental terms. You may also contact our privacy team using the email address provided above.

If you believe our processing of your personal data violates data protection law, you may complain directly to a competent data protection authority or seek other remedies in accordance with law.

Unless prohibited by mandatory local law, in the event of any discrepancy or inconsistency between the English version of this Privacy Policy and any translation into another language, the English version shall prevail and be binding.

These Supplemental Privacy Terms apply when we provide Mosi Products and related Services to users in the United States. They supplement the main body of this Privacy Policy and should be read together with it. Provisions applicable to specific states are identified in the relevant sections and apply only to the extent that the laws of those states are applicable. In the event of any inconsistency between these Supplemental Privacy Terms and the main body of this Privacy Policy, these Supplemental Privacy Terms shall prevail to the extent that the relevant provisions apply to you.

You may exercise the rights available to you under applicable law in the manner described in Section 6, “Your Data Protection Rights,” of the main body of this Privacy Policy.

If you enable the “Do Not Track” (DNT) setting in your browser, we will not stop or restrict tracking of your activities across different websites solely on the basis of that signal. If you wish to opt out of cookie-based cross-context behavioral advertising, please use the opt-out control provided in this Privacy Policy or the Cookie Policy, or email mosi@mosi.cn. We respond to Global Privacy Control (GPC) signals sent by browsers.

When your browser sends a legally valid GPC or other opt-out preference signal, we will treat it as a request to opt out of the sale or sharing of personal data or targeted advertising to the extent applicable state law requires. You do not need to be logged in to send the signal, although being logged in may help us associate your choice with your account.

You may also email mosi@mosi.cn to request an opt-out related to online tracking or advertising. We will handle your request and any opt-out preference signals we are legally required to honor in accordance with applicable law.

When you use voice cloning, personalized speech synthesis, or special-effects video templates, we extract voice characteristics, voice parameters, or facial features from the audio, images, or videos you provide. To the extent any of this information constitutes a biometric identifier or biometric information, we process it as follows:

• Consent: Before collection, we will obtain your separate consent through a separate pop-up or another prominent method. You may decline, in which case only the specific features that rely on that information will be unavailable. If the materials include another person's voice or facial features, you must ensure you have the right to provide them and have given any necessary notice and obtained any necessary authorization.
• Purposes of Processing and Disclosure: We use voiceprints only to create and manage the voice profile you request and generate the corresponding speech content, and facial feature information only to create the special effects videos you request. We do not use this information for purposes unrelated to the requested feature. We disclose it only as necessary to cloud computing providers and voice processing model or API providers engaged by us under contract, or with your consent, as necessary to complete a transaction, or where required by applicable law or valid legal process. We do not sell, rent, or trade biometric information or otherwise profit from it.
• Security Measures: We will protect biometric information using a standard of care no less stringent than the reasonable standard of care in the industry and the standard we apply to other confidential and sensitive information, including through encryption, access permission management, confidentiality requirements and security incident response measures.
• We retain voiceprints and facial feature information only for as long as necessary to fulfill the stated purpose. You may request deletion at any time, after which the relevant feature will no longer be available. If a court order or law requires retention, we retain the information only to the extent and for the period permitted.

These Supplemental Privacy Terms apply where our processing of personal data relating to users in South Korea is subject to the Personal Information Protection Act (“PIPA”) of South Korea. They supplement the main body of this Privacy Policy and should be read together with it. In the event of any inconsistency between these Supplemental Privacy Terms and the main body of this Privacy Policy, these Supplemental Privacy Terms shall prevail to the extent that the relevant provisions apply to you.

We collect personal data directly from users in South Korea and process that information in the following country for the purposes described in this Privacy Policy:

Where we transfer personal data overseas, we shall comply with applicable legal requirements and rely on one of the following grounds, as appropriate:

(1) Separate Consent: Where we rely on your separate consent, we shall inform you, through a separate consent option before the transfer, of the personal data to be transferred, the destination country, the timing and method of transfer, the recipient and its contact details, the purposes of the transfer, the retention and use period, and how you may refuse consent and the consequences of doing so.

(2) Contractual Necessity: Where the relevant outsourcing of processing or storage of personal data is necessary for the performance of our contract with you, we shall disclose the statutory information described above in this Privacy Policy or provide notice as required by law.

(3) Other Legal Grounds: We may rely on other grounds provided under applicable law.

You may contact us at mosi@mosi.cn to inquire about the specific arrangements.

As described in the Privacy Policy, we will destroy your personal data when it is no longer necessary to provide the services and there is no legal or business need to retain it. This does not apply where relevant laws or regulations require longer retention. For example, under relevant Korean e-commerce rules, records of contracts and cancellation of orders, and records of payment and supply of goods or services, generally must be retained for five years, while records of consumer complaints or dispute resolution generally must be retained for three years.

When destroying personal data, we will take commercially reasonable and technically feasible measures to prevent it from being recovered or reconstructed, as further described in the Privacy Policy.

For users in South Korea, the minimum age to use the services is 14. Other requirements for minors' use and parental or legal guardian permission are governed by the Privacy Policy.

If your personal data rights have been infringed, you may seek dispute resolution or advice from the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency's Personal Information Infringement Report Center, or other relevant organizations:

• Personal Information Dispute Mediation Committee: 1833-6972 (no area code required); www.kopico.go.kr
• Personal Information Infringement Report Center: 118 (no area code required); privacy.kisa.or.kr
• Korean National Police Agency: 182 (no area code required); ecrm.police.go.kr

For matters concerning personal data protection, you may contact our privacy team at mosi@mosi.cn.

These Supplemental Privacy Terms apply to users located in the United Kingdom. They supplement the main body of this Privacy Policy and should be read together with it. In the event of any inconsistency between these Supplemental Privacy Terms and the main body of this Privacy Policy, these Supplemental Privacy Terms shall prevail to the extent that the relevant provisions apply to you.

For processing activities subject to UK data protection law, please see the table in Section 3 of the main body, which describes our principal processing purposes, the categories of personal data involved, and the legal bases.

Where processing is based on consent, you may withdraw it at any time in the manner described in “Your Data Protection Rights” in the main body.

Where we process your personal data on the basis of our legitimate interests or those of a third party, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in us, you may object to such processing at any time on grounds relating to your particular situation. We shall cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defense of legal claims.

You may object at any time to our processing of your personal data for direct marketing purposes, including profiling related to such direct marketing. Once we receive your objection, we shall cease processing your personal data for those purposes.

You may submit an objection by contacting us at mosi@mosi.cn. If we decide to continue the relevant processing, we shall explain our reasons and inform you of the available complaint or redress mechanisms.

If you believe our processing of personal data infringes your rights, you can contact us using the details in the “How to Contact Us” section of this Privacy Policy. You also have the right to complain to or seek advice from the United Kingdom's Information Commissioner's Office (“ICO”):

• Telephone: 0303 123 1113 (within the United Kingdom)
• Website: ico.org.uk
• Online Complaint: Submit a complaint to the ICO.