PRIVACY POLICY

Personal data refers to any information relating to an identified or identifiable natural person. Data that has been irreversibly anonymized or aggregated such that it can no longer identify you is not personal data. Definitions of personal information may vary by jurisdiction; where applicable, we apply the broadest definition required by law.

1.1 Information You Provide Directly to Us

1.1.1 Account and Profile Information

• Registration Credentials: If you create an account to use the Community features, we collect your email address or phone number and password.

• Third-Party Login: If you sign in via a third-party (e.g., Apple, Google, or Facebook), we collect authentication tokens and your public profile details (specifically your nickname and avatar URL) authorized by the provider. We do not collect your friend lists, timelines, or other social graph data.

• Extended Profile: You may voluntarily provide a nickname or background picture to personalize your profile.

1.1.2 Customer Services and Feedback

• Diagnosis Tickets: If you report a technical issue, we collect the diagnosis logs, error reports, and your contact information to resolve the bug.

• User Feedback: When you provide suggestions, we collect your camera model, the theme of your suggestion, and your email address.

• Warranty and Repair: If you submit a warranty claim or request repair services, we collect your Camera Serial Number (SN), proof of purchase, shipping address, and details of the reported defect to process your warranty claim and arrange repair or replacement.

1.1.3 User-Generated Content (UGC) and Community

• App Album (Local-First Storage): We request permission to access your phone’s photo album solely to enable the transfer of files from the Camera to the App. By default, your photos and videos are stored locally on your device. Leaptic does not possess a copy or back up this content to the cloud unless you voluntarily upload it.

• Leaptic Community (Cloud Upload): When you explicitly choose to post content to the public Leaptic Community, we collect and host your photos, videos, comments, and “likes” on our cloud servers.

• Metadata & Content Safety: When you upload content to the Community, the original file may contain metadata (e.g., GPS location, device model). We process this metadata to comply with local laws (e.g., ensuring content legality in your region). We employ automated tools designed to strip sensitive geolocation metadata (EXIF GPS) from your photos before they are posted to the Community. However, as no system is infallible, we cannot guarantee the removal of visual landmarks in the image itself.

1.2 Information We Collect Automatically

1.2.1 Device and Network Information

• Hardware Identifiers: To manage the secure connection between your App and Camera, we collect the Camera Serial Number (SN), Firmware Version, and Wi-Fi SSID (Network Name).

• Mobile Telemetry: To ensure App stability and manage software licensing, we collect your mobile device’s technical data, including unique device identifiers (e.g., Android ID, UUID), MAC address, IP address, operating system version, and crash logs.

1.2.2 Functional and Sensor Data

• Smart Assistant (Voice): We hereby explicitly inform you that upon enabling the "Moko" Voice Assistant, the recognition of the wake word ("Hi Moko") is processed entirely locally on your mobile device. Prior to the successful recognition of the wake word, we do not record, save, or upload any audio data to the cloud. Once the voice assistant is successfully activated, the device enters an active listening mode and continuously records for ten (10) seconds to receive your specific command. The recording automatically stops after the 10-second listening period ends. Audio data is only transmitted to our cloud servers (processed by Microsoft Azure in Germany) if you issue a command. To improve the 'Moko' assistant's ability to distinguish background noise from actual commands, we analyze short audio clips of "False Triggers" (when the device mistakenly thinks you said the wake word) to optimize recognition accuracy. We engage Microsoft Azure as our Data Processor to securely process these clips on our behalf. These clips are stored on servers in the EEA (Germany) for a maximum of 30 days solely for algorithm training and are then permanently deleted. They are not used to identify you biometrically (e.g., voiceprint), and Microsoft is contractually prohibited from using your data for its own purposes. You have the right to disable the AI Voice Assistant separately at any time via "Settings > Privacy" or by turning off the device system-level microphone permissions, thereby withdrawing your consent. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

• GPS & Location: We access your location information using the device's system-level location services (such as Android Location Services or iOS Core Location) solely to facilitate Bluetooth pairing and to geotag your media locally. We do not track your movements in the background.

1.2.3 AI-Editing Tool: When you use the AI Editing feature, the specific media files you select are temporarily uploaded to our cloud servers for processing are deleted shortly after the edited video is returned to your device. Please Note: To comply with the EU AI Act, we automatically embed a machine-readable digital watermark or metadata label into AI-generated content to identify it as artificially manipulated. Tracking Technologies & Cookies:

We use cookies and similar tracking technologies (e.g., Google Analytics) to improve our service. These are only activated if you grant consent via our Cookie Banner. For full details, please refer to our [Cookie Policy].

1.3 Device Permissions

Our App may request access to the following device permissions to provide specific functionalities. You may grant or deny each permission individually through your device's system settings; denying a permission will only affect the corresponding functionality and will not prevent you from using other features of the App:

• Bluetooth: To establish and maintain a secure connection between your App and Camera for file transfer and device control.

• Photo Library / Storage: To enable the transfer of photos and videos from the Camera to your App and to save edited content to your device.

• Microphone: To enable the "Moko" Voice Assistant and to record audio when capturing video with the Camera.

• Location: To facilitate Bluetooth pairing and to geotag your media locally on your device.

• Notifications: To send you important service updates, firmware upgrade notifications, and account security alerts.

1.4 Information from Other Sources

1.4.1 Third-Party Platforms:

When you link your Leaptic account to a third-party service (such as Instagram, TikTok, or YouTube) or use the "Share" feature, we receive a confirmation token and your public username from that platform to validate the link. Please note that for the specific transmission of data via a "Share" button (e.g., using the 'Share to Instagram' feature), we act as a Joint Controller with the respective platform. You can find more information on this division of responsibility in the privacy settings of the respective social platform.

1.5 AI-Generated Content

Certain AI features, such as comic-style generation, rely on large model algorithms to apply artistic transformations to your photos. These processes may alter facial features and introduce visual elements not present in the original image. The output of AI features is provided for creative and entertainment purposes only and does not constitute professional advice (including but not limited to legal, medical, financial, or technical advice). You are solely responsible for the content you generate, its use, and any consequences arising from its use. We do not claim ownership over your original media, and you retain all rights to content you create using our AI features, subject to our Terms of Service. We embed machine-readable watermarks or metadata in AI-generated content in accordance with applicable law. Certain AI features rely on third-party large language models (e.g., Microsoft Azure AI services); the specific model provider may be updated from time to time, and we will notify you of material changes.

We process your data only when we have a lawful basis. The table below outlines our purposes and the specific legal ground we rely on under the GDPR.

2.1 Voice Data and AI Processing

The processing of voice data (including commands and false triggers) is based on your explicit consent, which you may withdraw at any time without affecting the lawfulness of processing based on consent before its withdrawal. The processing of media files for AI editing (e.g., comic style transfer) is based on contractual necessity to provide the specific service you request. We do not use AI features to make automated decisions that produce legal or similarly significant effects. For further details on your rights, including the right to object to profiling used in recommender systems, please refer to Section 4 of this Policy.

We do not sell your personal data to third parties for monetary value. We only share your personal data with third-party recipients when necessary to deliver our Services, support our operations, or comply with legal obligations. We ensure that all third-party partners implement appropriate technical and organizational safeguards in compliance with applicable data protection laws.

3.1 Corporate Affiliates

We may disclose your information to our parent company (Shenzhen Photon Leap Technology Co., Ltd) and affiliates globally. This sharing is limited to what is necessary for unified technical support, hardware diagnostics, and centralized management. Any access by non-EEA affiliates is governed by strict Internal Data Transfer Agreements and Standard Contractual Clauses (SCCs).

3.2 Cloud Infrastructure and Data Storage (The "Local First" Policy)

To ensure the security and availability of your data, we utilize professional cloud service providers. However, we strictly distinguish between your private media and public data:

3.2.1 Local Storage (Default): Y

our raw photos and videos are stored locally on your mobile device’s internal memory. We do not automatically back up this private content to the cloud.

3.2.2 Cloud Hosting (Community & Telemetry):

If you voluntarily upload content to the Leaptic Community, or for necessary technical telemetry (e.g., crash logs), we use Alibaba Cloud (Aliyun).

3.2.3 Data Residency:

For users in the EEA, we prioritize storage in Frankfurt, Germany. However, please note that for maintenance purposes, authorized engineering personnel in China may access technical logs (excluding private user media) under strict security protocols.

3.3 Technology and Functional Service Providers

We work with specialized partners to provide specific App functionalities. These partners act as "Data Processors" or "Joint Controllers" depending on the service:

You may request a complete list of our third-party service providers, the categories of personal data shared with them, and the purposes for which they process your data by contacting us at 【gzyqgf@leaptic.tech】. We will provide this list within 30 days of your verified request.

3.3.1 Functional Features (Voice & Editing)

• Microsoft Azure (Voice Assistant): If you enable the "Moko" assistant, audio commands and short "false trigger" clips are processed by Microsoft using servers located in Germany. We have signed a Data Processing Agreement (DPA) with Microsoft to ensure this data remains within the EEA where possible.

• Meishe (Video Editing SDK): To provide advanced video editing effects, we integrate the Meishe SDK. This tool processes your Photos, Videos, and Audio locally on your device to apply effects. We have verified that this SDK does not collect unique device identifiers (such as IMEI or MAC addresses) or track your behavior across other apps.

3.3.2 Analytics and Stability Monitoring

Google (Firebase/Crashlytics): We use Google tools to monitor app stability and record crash logs. This involves the collection of Android IDs and network status.

3.3.3 Account Authentication

Meta (Facebook Login) & Google Sign-In: If you choose to log in via these platforms, we exchange authentication tokens. We limit this data strictly to authentication (Name, Email, Avatar) and do not request access to your social timeline or friend lists. Please be aware that using the Facebook Login SDK involves a data transfer to Meta Platforms, Inc. in the United States. This transfer is safeguarded by the EU-U.S. Data Privacy Framework (DPF) (to which Meta is certified) or, where applicable, Standard Contractual Clauses (SCCs).

3.4 Public Community Availability

Any information you voluntarily make public, such as photos, videos, or comments uploaded to the Leaptic Community, will be visible to any user with access to our Services. Please Note: While we attempt to strip sensitive metadata (e.g., GPS location) from public posts, we recommend you verify your content before sharing.

3.5 Legal, Safety, and Compliance

We may disclose personal data to law enforcement, regulatory authorities, or legal counsel when required by:

3.5.1 Legal Obligations:

To comply with a valid court order, subpoena, warrant, or enforceable government request.

3.5.2 Vital Interests:

To protect the safety of our users or the public (e.g., in emergencies involving potential physical harm).

3.5.3 Fraud Prevention and Security:

To investigate, prevent, or take action regarding fraud, security incidents, unauthorized access to or use of our systems, or criminal activity.

3.5.4 ·Protection of Rights:

To protect our rights, property, or safety, as well as the rights, property, or safety of our users, employees, or the public, as permitted by applicable law.

3.6 Business Transfers

In the event of a merger, acquisition, reorganization, joint venture, assignment, spin-off, transfer, or sale of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings), your personal data may be transferred as part of such transaction as a business asset. We will require the acquiring entity to agree to treat your personal data in accordance with this Privacy Policy and applicable data protection laws. We will notify you via email or a prominent in-app notice before your personal data becomes subject to a different privacy policy, where required by law.

If you are located in the European Economic Area (EEA), you have specific rights regarding your personal data under the GDPR and the EU Data Act. We are committed to ensuring you can exercise these rights easily.

4.1 Overview of Your Rights

4.1.1 Right of Access:

You have the right to request a copy of the personal data we hold about you.

4.1.2 Right to Access "Connected Product Data" (EU Data Act):

As the user of a connected product (the Camera), you have the right to access the data generated by your use of the product (including sensor logs and motor usage statistics).

• Direct Access: Since our architecture is "Local-First," you can access and download this data directly from the Camera via the App interface without contacting us.

• Third-Party Sharing: You have the right to request that we share this data (whether personal or non-personal) directly with a third party of your choice (e.g., a repair service), provided it is technically feasible and does not compromise trade secrets.

4.1.3 Right of Rectification:

You can request that we correct any inaccurate or incomplete personal data.

4.1.4 Right to Erasure (“Right to be Forgotten”):

You can request that we delete your data when it is no longer necessary for the purposes it was collected, or if you withdraw your consent.You can request that we delete your personal data when it is no longer necessary for the purposes it was collected, if you withdraw your consent, if you object to processing based on our legitimate interests, or if processing violates applicable law. Upon receiving a verified deletion request, we will delete your personal data from our active systems and will also notify any third-party recipients or service providers who have received your personal data from us to erase it, in accordance with Article 17(2) of the GDPR, unless this proves impossible or involves disproportionate effort. Where your personal data has been backed up, we will put the data "beyond use" (i.e., isolate it from active processing) until it can be permanently deleted from all backup systems. Please note that certain data may be retained as required by applicable law (e.g., tax records, transaction records for legal compliance).

4.1.5 Right to Restriction of Processing:

You can ask us to temporarily stop processing your data (e.g., while we verify the accuracy of your information).

4.1.6 Right to Data Portability:

You have the right to receive your personal data in a structured, commonly used, and machine-readable format.

4.1.7 Right to Withdraw Consent:

Where we rely on your consent to process data (for example, regarding GPS location, Voice Assistant processing, or Marketing emails), you can withdraw it at any time by toggling off the specific feature in 'Settings > Privacy'. Important: The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

4.1.8 Right to Object:

You can object to processing based on our “Legitimate Interests” (e.g., analytics). We will stop processing unless we demonstrate compelling legitimate grounds.

4.3 How to Exercise Your Rights

• Using In-App Settings: You can exercise most rights (e.g., "Delete Account" or "Download My Data") directly via Settings > Account.

• Contact our Privacy Team: For specific requests (including Data Act requests for machine data), please contact us at: 【gzyqgf@leaptic.tech】. We aim to respond to all valid requests within 30 days.

• Identity Verification: To protect your privacy and prevent unauthorized access, we may need to verify your identity before processing your rights request. This may involve confirming your email address, phone number, or other account credentials. If we cannot verify your identity with the information provided, we may request additional verification details.

• Response Time: We aim to respond to all valid, verified requests within one month (30 days) of receipt. In complex cases or where permitted by law, we may extend this period by up to two additional months, and we will notify you of such extension and the reasons for the delay within the initial one-month period.

4.4 Right to Lodge a Complaint

If you believe our processing of your data violates data protection laws, you have the right to lodge a complaint with the Supervisory Authority in the EU member state where you live or work, or the authority in【France】] where our Representative is located. (Note: As we do not have a main establishment in the EU, you may also contact our EU Representative listed in Section 9).

4.5 California Privacy Rights (CCPA/CPRA)

If you are a resident of California, you have the following rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

4.5.1 Right to Know:

You have the right to request that we disclose to you the categories of personal information we collect, the sources from which we collect it, the purposes for which we use it, the categories of third parties with whom we share it, and the specific pieces of personal information we hold about you.

4.5.2 Right to Delete:

You have the right to request that we delete personal information we have collected from you, subject to certain exceptions.

4.5.3 Right to Correct:

You have the right to request that we correct inaccurate personal information we maintain about you.

4.5.4 Right to Opt Out of Sale or Sharing:

You have the right to opt out of the "sale" or "sharing" of your personal information (as those terms are defined under the CCPA/CPRA). We do not sell your personal data for monetary value. However, to the extent any of our data practices constitute a "sale" or "sharing" under CCPA/CPRA, you may exercise your right to opt out by contacting us at 【gzyqgf@leaptic.tech】.

4.5.5 Right to Limit Use of Sensitive Personal Information:

You have the right to limit our use of sensitive personal information (if applicable) to only that which is necessary to perform the services or goods reasonably expected by an average consumer.

4.5.6 Non-Discrimination:

We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you goods or services, charge you different prices or rates, provide you a different level or quality of goods or services, or suggest that you may receive a different price or rate or different level or quality of goods or services, as a result of exercising your rights.

4.5.7 Financial Incentives:

If we offer any financial incentive (e.g., loyalty programs, discounts) in exchange for the collection, retention, or sale of your personal information, we will disclose the material terms of such incentive and obtain your opt-in consent before enrollment.

4.5.8 How to Exercise:

To exercise your California privacy rights, please contact us at 【gzyqgf@leaptic.tech】. We may need to verify your identity before processing your request, as required by law. We aim to respond within 45 days of receiving your verified request.

4.5.9 "Shine the Light" Law:

California residents may also request information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please contact us at 【gzyqgf@leaptic.tech】.

4.5.10 Do Not Track Signals:

Our Services do not currently respond to "Do Not Track" browser signals, as there is no uniform industry standard for how to respond to such signals. However, you may control cookies and tracking technologies through your browser settings, as described in our Cookie Policy.

4.6 Singapore Personal Data Protection Act (PDPA) Rights

If you are located in Singapore, you have the following rights under the Personal Data Protection Act (PDPA):

4.6.1 Right of Access:

You have the right to request access to the personal data we hold about you and to obtain a copy of such data.

4.6.2 Right to Correction:

You have the right to request that we correct any inaccurate or incomplete personal data about you.

4.6.3 Right to Withdraw Consent:

You may withdraw your consent to our processing of your personal data at any time by contacting us at 【gzyqgf@leaptic.tech】 or by adjusting your settings in the App. Please note that withdrawal of consent may affect our ability to provide certain services to you.

4.6.4 Do Not Call (DNC) Registry:

If you have registered your telephone number with the Singapore Do Not Call Registry, we will not send you marketing messages via telephone, text message, or fax to that number, unless you have given us clear and unambiguous consent to do so.

4.6.5 How to Exercise:

To exercise your PDPA rights, please contact our Data Protection Officer (DPO) at dpo@mova-tech.com. We aim to respond within 30 days of receiving your verified request.

4.6.6 Right to Lodge a Complaint:

If you believe our processing of your personal data violates the PDPA, you have the right to lodge a complaint with the Personal Data Protection Commission (PDPC) of Singapore.

4.7 Other Jurisdiction Privacy Rights

Depending on your jurisdiction, you may have additional rights under applicable data protection laws:

• Canada (PIPEDA): If you are located in Canada, you have the right to access and correct your personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA). You may also withdraw your consent to our processing of your personal information, subject to legal or contractual restrictions. To exercise these rights, please contact us at 【gzyqgf@leaptic.tech】.

• United Kingdom (UK GDPR): If you are located in the United Kingdom, you have the same rights as outlined in Section 4.1 under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe our processing violates UK data protection laws.

• Other Jurisdictions: If you are located in a jurisdiction with applicable data protection laws (including but not limited to Singapore PDPA, Brazil LGPD, Japan APPI, Australia Privacy Act), we will respect the rights afforded to you under such laws to the extent applicable to our processing of your personal data. Please contact us at 【gzyqgf@leaptic.tech】 to exercise your rights or for further information.

We are committed to protecting the privacy of young users. In accordance with our Terms of Service, we implement strict age-based restrictions to ensure that younger users can safely use our hardware functions without being exposed to social risks.

5.1 Age Eligibility and Tiered Access

• Minimum Age (13+ Only): The App and Services are not intended for children. For users in the European Economic Area (EEA), the minimum age for creating an account is 16 years old. For users in all other jurisdictions, the minimum age is 13 years old. If we verify that a registered user is below the applicable minimum age for their jurisdiction, we will immediately delete their account and block access.

• Social Community (16+ Only): Users between the ages of 13 and 16 (or between 13 and 16 in jurisdictions where the minimum age is 13) are permitted to use the App solely as a "Local Tool" (for camera control and editing). Access to the Leaptic Community (posting, commenting, liking) is technically restricted to users aged 16 and older. For users aged 13 to 16 in the EEA, access to any account-based features requires verifiable parental or guardian consent in accordance with Article 8 of the GDPR. We may use reasonable technological measures to verify parental consent, such as email verification to a parent or guardian's email address.

5.2 Parental Controls and Deletion

We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at 【gzyqgf@leaptic.tech】. We will take immediate steps to remove such information and terminate the associated account. We do not sell the personal information of children under 16 years of age. We do not use children's personal data for targeted advertising or profiling. If we become aware that we have inadvertently collected personal information from a child without appropriate parental consent, we will take immediate steps to delete such information and terminate the associated account.

6.1 Security Measures

We utilize robust technical and organizational measures to protect your data against unauthorized access, alteration, or loss.

• Encryption: We use industry-standard encryption (HTTPS/TLS) for data in transit and AES encryption for data at rest on our cloud servers (Alibaba Cloud).

• Access Control: Access to personal data is restricted to authorized personnel (e.g., engineering support) on a strict "need-to-know" basis, safeguarded by multi-factor authentication.

• Employee Training and Access: We conduct regular data protection and privacy training for our employees and contractors who have access to personal data. Access to personal data is restricted to authorized personnel on a strict "need-to-know" basis, and all access is logged and audited periodically.

• Limitations of Security: While we implement robust technical and organizational measures to protect your personal data, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security of your data, and any transmission of personal data to our Services is at your own risk.

6.2 Data Retention Policy

We follow the principle of data minimization and only retain your information for as long as necessary to fulfill the purposes outlined in this policy, or as required by law.

• Account Information: Retained for the lifetime of your account. If an account remains inactive for a continuous period of 【24 months】, we reserve the right to delete the account and associated data after providing notice.

• User-Generated Content (Cloud): Community posts are retained until you delete them or close your account.

• Device Telemetry (Logs): Crash reports and firmware logs are retained for 6 months to assist with troubleshooting. However, if you delete your account, any logs linked to your personal identity will be anonymized or deleted in 30 days in accordance with the Deletion Protocol below.

• Voice Assistant Audio: Audio clips of "False Triggers" (used for optimization) are retained for a maximum of 【90】 days and then permanently deleted.

• Anonymized Data: Data that has been irreversibly anonymized or aggregated such that it can no longer identify you may be retained indefinitely for statistical analysis, product improvement, and research purposes, without further notice to you, as such data is no longer personal data under applicable law.

6.3 Deletion Protocol

In accordance with GDPR requirements for the "Right to Erasure," we implement the following deletion logic:

• Request: When you request account deletion via the App settings, your data is immediately flagged as "Deleted" and removed from active production systems.

• Transition Period: A limited technical transition period (not exceeding 【30】days) applies to ensure the data is cleared from all backup systems and caches. During this period, the data is put "beyond use" and is not processed for any other purpose.

• Permanent Erasure: After 【30】 days, your personal data is permanently erased or irreversibly anonymized.

• Notification to Third Parties: Upon your deletion request, we will also notify any third-party recipients, service providers, or joint controllers who have received your personal data from us to erase or return your data, in accordance with Article 17(2) of the GDPR, unless this proves impossible or involves disproportionate effort. We will take reasonable steps to inform you of the third parties we have notified, where feasible.

6.4 Data Breach Notification

We maintain incident response procedures to detect, investigate, and respond to personal data breaches. In the event of a personal data breach:

• Notification to Supervisory Authorities: If a personal data breach is likely to result in a risk to the rights and freedoms of natural persons, we will notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of the breach, in accordance with Article 33 of the GDPR. If the notification is made later than 72 hours, we will provide reasons for the delay.

• Notification to Data Subjects: If a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, we will communicate the breach to the affected data subjects without undue delay, in accordance with Article 34 of the GDPR. Such communication will describe, in clear and plain language: (a) the nature of the breach; (b) the likely consequences of the breach; (c) the measures taken or proposed to be taken to address the breach; and (d) the contact details of our privacy team where you can obtain further information.

• Methods of Notification: We may notify you of a data breach via email, in-app notification, push notification, or other reasonable means. Where it is not practicable to notify each affected individual individually (e.g., due to the very large number of affected individuals), we may make a public announcement or publish a prominent notice on our website.

• Record Keeping: We will maintain a record of all personal data breaches, including the facts relating to the breach, its effects, and the remedial action taken, in accordance with Article 33(5) of the GDPR.

• Other Jurisdictions: For users in jurisdictions with applicable data breach notification laws (including but not limited to California CCPA/CPRA, Canada PIPEDA, Singapore PDPA, Brazil LGPD), we will comply with the notification requirements of such laws to the extent applicable.

As an international company, we operate globally to provide you with seamless hardware support and cloud services. This means your personal data may be processed in countries outside the European Economic Area (EEA).

7.1 Global Operations & Data Residency

We prioritize the security of your data by storing Community content and user profiles on servers located within the EEA (Frankfurt, Germany). However, to provide 24/7 technical support and hardware diagnostics, authorized personnel at our operational headquarters in Shenzhen (PRC) may require remote access to specific technical logs or account data. Additionally, we utilize trusted service providers (such as Microsoft for voice processing and Google/Meta for analytics) which may process data in the United States.

7.2 Safeguards for Cross-Border Transfers

The PRC and the United States have different data protection laws than the EEA. To ensure your data remains protected to European standards regardless of where it is processed, we implement the following strict legal safeguards:

• Standard Contractual Clauses (SCCs): We have signed the European Commission’s Standard Contractual Clauses with our non-EEA affiliates and vendors. This legally binds them to protect your data with the same high standards required in the EU.

• Transfer Impact Assessments (TIAs): We perform security assessments to verify that these transfers do not undermine the confidentiality of your data.

• Encryption: All cross-border data traffic is protected by enterprise-grade encryption to prevent unauthorized interception.

You may obtain a copy of the Standard Contractual Clauses (SCCs) we have entered into with non-EEA recipients, or further details of our cross-border data transfer mechanisms, by contacting us at 【gzyqgf@leaptic.tech】. We will provide such information within a reasonable time, subject to any applicable confidentiality obligations.

Leaptic reserves the right to update or modify this policy to reflect changes in our Services, technology, or legal requirements.

• Notification: If we make material changes that affect your rights (e.g., changing how we share data), we will notify you via an in-app prompt, email, or a prominent notice on our website.

• Review: We encourage you to review this page periodically for the latest information on our privacy practices.

If you have any questions, complaints, or wish to exercise your rights, please contact us using the details below.

9.1 Data Controller

The entity responsible for the processing of your data is: Shenzhen Photon Leap Technology Co., Ltd Address: 5th Floor, Building 2, Yongxin Times Plaza, Nanshan Subdistrict, Nanshan District, Shenzhen City, China. Email: 【gzyqgf@leaptic.tech】Data Protection Officer (DPO): We have appointed a Data Protection Officer to oversee our compliance with data protection laws, given that our core activities involve large-scale processing of special categories of personal data (including voice/audio data) and regular systematic monitoring of data subjects. You may contact our DPO regarding any questions or concerns about this Privacy Policy or our data processing practices at: 【dpo@mova-tech.com

】.

9.2 EU Representative (GDPR Article 27)

Since we are established outside the European Union, we have appointed a legal representative in the EU to act as a point of contact for supervisory authorities and data subjects:

• Representative Name:【Spacewalker Technology France Co., Limited】

• Email: 【gdpr-eu.rep@mova-tech.com】

9.3 Right to Lodge a Complaint

If you believe our processing of your personal data violates data protection laws, you have the right to lodge a complaint with the Supervisory Authority in the EU Member State where you have your habitual residence, place of work, or the place of the alleged infringement.

Regional Contact Points: In addition to our principal place of business listed above, we may maintain regional representatives or contact points in certain jurisdictions. For users in the EEA, please refer to our EU Representative details in Section 9.2. For users in other jurisdictions where we maintain a local representative or establishment, the relevant contact details will be made available upon request or as required by applicable local law.

9.4 Language Precedence

Unless prohibited by mandatory local law, in the event of any discrepancy or inconsistency between the English version of this Privacy Policy and a version translated into another language, the English version shall prevail and be binding.