ParaDoor Privacy Policy

Last updated: July 1, 2026

Effective date: July 1, 2026

This Privacy Policy describes how SHAOCHIN YU ("ParaDoor," "we," "us," or "our") collects, uses, maintains, discloses, and protects your personal information when you use the ParaDoor mobile application (the "App"), our website at https://www.paradoor.ai (the "Website", and together with the App, the "Services").

ParaDoor is an AI-powered application that lets you create AI characters and content, and chat with AI characters. You can choose which underlying AI model powers your conversations.

Please read this Privacy Policy carefully. By creating an account or using the Services, you acknowledge that you have read, understood, and agree to the practices described here. If you do not agree, please do not use the Services.

Table of Contents

  1. Information We Collect

  2. How We Use Your Information

  3. AI Features and Third-Party AI Models

  4. How We Share and Disclose Information

  5. International Data Transfers

  6. Data Retention

  7. How We Secure Your Information

  8. Children's Privacy

  9. Choices About How We Use and Disclose Your Information

  10. Your Rights and Choices

  11. Supplemental Terms - Jurisdiction Specific

  12. Changes to This Privacy Policy

  13. Contact Us

1. Information We Collect

1.1 Information You Provide

We may collect a variety of personal information from or about you or your devices from various sources, as described below.

  • Account information. When you start using the Services, we may collect your preferences and age range, and when you choose to register an account, we collect third-party login identifiers (such as Google, Facebook, or Apple), subscription status and account settings).

  • Profile information. When you set up or edit your personal profile, we may collect display name, avatar, your Google/Facebook/Apple ID, phone number, age. You may also choose to add certain creators to your Block list, in which case we may collect your blacklist information.

  • User-generated content, such as photos, videos, text, messages, and other material you submit to public or private parts of the Services, including content shared during interactions with others on the Services, other users’ generated content or metadata (such as tags or geolocation) that may be created. This includes user-submitted input, including text prompts, workflows, directions, images, voice samples, likeness data, documentation, or other material submitted by the user to generate their AI character and its corresponding behavior, which is then used to generate corresponding outputs (which may include AI characters and content generated by AI characters).

  • Rating Information. You may also choose to like or dislike conversation content, and we will collect such rating information.

  • Payment and transaction information. When you make a purchase in the Service, payment is processed by Apple's in-app purchase system (App Store) or Google Play Billing (as applicable). We do not collect or store your full payment card number — we receive a transaction record and receipt. We may also collect your credits transaction records including detailed records of your credits usage and refunds (if any).

  • Customer Support Communications. When you consult, submit complaints or communicate with us, we may collect customer support requests, inquiries, complaint records, emails, chat messages, call recordings (where permitted by applicable law), issue resolution records, supporting materials, and other communications between you and us.

1.2 Information Collected Automatically

When you use the Services, we and our service providers automatically collect:

  • Device and technical data. We receive information about the device and software you use to access our Services, such as operating system, device model, unique device identifiers (such as IDFA (Identifier for Advertisers) / AAID (Android Advertising ID)), browser type, language settings, and IP address.

  • Usage data. When you browse, operate and use various functions of the Services, we may collect information about how you interact with the Services, such as pages visited, features used; generation and editing activities; clicks, scrolls; errors, crashes, latency and diagnostic logs and other diagnostic and performance data, time spent, usage logs, interaction records, generation histories, browsing records, transaction records, content management records, page views, clickstream data, search activities, and other records relating to your use of the Services.

The technologies we use for this automatic data collection may include:

  • Cookies. Cookies are text files placed on your computer to collect standard Internet log information and visitor behavior information. We may automatically collect information from you, through cookies or similar technologies, including (e.g., web beacons, flash cookies, etc.) (“Cookies”), to automatically collect information, measure and analyze how you use the Platform. We and our partners also use Cookies to promote the Platform on other platforms and websites. Cookies enable the Platform to provide certain features and functionality. Web beacons are very small images or small pieces of data embedded in images, also known as “pixel tags” or “clear GIFs,” that can recognize Cookies, the time and date a page is viewed, a description of the page where the pixel tag is placed, and similar information from your computer or device. To learn how to disable certain Cookies, see the “Choices About How We Use and Disclose Your Information” section below.

Third-Party Use of Cookies and Other Tracking Technologies：

  • Some content or applications by third parties, including application providers. These third parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect information about you when you use our Services. The information they collect may be associated with your personal information or they may collect information, including personal information, about your online activities over time and across different websites and other online services. They may use this information to provide you with interest-based (behavioral) advertising or other targeted content.

  • We do not control these third parties’ tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly. For information about how you can opt out of certain tracking technologies receiving targeted advertising from many providers, see “Choices About How We Use and Disclose Your Information”section below.

1.3 Information From Third Parties

If you link or sign in with a third-party account (e.g., Google, Apple), we receive the basic profile information those services make available, as authorized by you.

2. How We Use Your Information

We use your personal information for the following purposes:

To provide and operate the Services

  • To provide our Services and its contents to you. For example, the personal information you provide may be used to create and manage your account.

  • To personalize your experience on the Services, including suggesting and offering you relevant products and recommendations.

  • To fulfill any other purpose for which you provide it.

  • For any other purpose with your consent.

To improve and develop the Services

  • Monitor performance, fix bugs, and analyze usage trends.

  • Develop new features.

  • To understand and analyze how you use the Services, to improve and enhance the Services, and to solicit feedback and respond to your questions. We may also analyze your activity, content, media uploads and related data to create, operate, train or improve your AI characters.

  • Train and improve AI models. We may use the messages and inputs you provide to train, fine-tune, and improve our AI models that power the Services, so the Services become more accurate and useful. You have the right to object / opt out at any time.

To communicate with you

  • Send service-related messages (e.g., account, security, policy updates).

  • Send promotional messages.

To protect the Services and comply with the law

  • Detect, prevent, and address fraud, abuse, spam, copyright infringement, security issues and policy violations.

  • Enforce our Terms of Service.

  • Respond to legal requests and protect rights, property, and safety.

3. AI Features and Third-Party AI Models

This is an important section — please read it.

  • You choose the model. ParaDoor lets you select which AI model powers your conversations and content creation. Depending on your choice, your personal information may be sent to and processed by the provider of that model.

  • Third-party model providers. Our Services integrate multiple third-party AI model providers, which may include, for example:

  • Anthropic (Claude) — based in the United States.

  • DeepSeek (DeepSeek) — based in the People's Republic of China.

  • Google (Imagen 2) — based in the United States.

  • BytePlus (Seed-Dream) — based in the People's Republic of China.

  • Theai (Inworld) — based in the United States.

  • What gets sent. When you chat, generate content, or use voice features, the prompts, inputs, and audio data you provide are transmitted to the selected provider solely to generate the AI's response or process the audio.

  • Each provider has its own policy. Once your Conversation Content is transmitted to a provider, it is also subject to that provider's privacy policy and data practices. We encourage you to review them:

  • Anthropic

  • DeepSeek

  • Google

  • BytePlus

  • Theai

  • Cross-border. Because providers are located in different countries (including US, and China), your personal information may be transferred internationally. See [Section 5]

  • Do not share sensitive information. AI models may produce inaccurate output, and your inputs are processed by third parties. Please do not enter sensitive personal data (health, financial, government IDs, etc.) into conversations.

4. How We Share and Disclose Information

We do not sell your personal information. We share information in the following limited circumstances:

4.1 Third-Party AI Model Providers

As described in [Section 3], your personal information may be shared with the AI model provider you select.

4.2 Service Providers and Vendors

We use trusted third-party companies to help operate, secure, and improve the Services. These providers are bound by contractual obligations to keep personal information confidential and use it only for the purposes for which we disclose it to them.

The categories of providers we use and the specific SDKs/services integrated into the App include:

  • Cloud Hosting and Infrastructure

    • Providers & SDKs: Google Cloud Storage / Firebase Storage.

    • Purpose & Data Processed: We use these services for object or media upload, data storage, and supporting infrastructure. They may process uploaded content, device and app information, and related metadata.

  • Analytics and Product Measurement

    • Providers & SDKs: Firebase Analytics, Firebase Remote Config.

    • Purpose & Data Processed: We use these tools for analytics, product measurement, and remote configuration updates. They may process app instance IDs, session IDs, device and app information, usage events, and related metadata.

  • Crash and Performance Monitoring

    • Providers & SDKs: Sentry SDKs, Firebase Performance Monitoring.

    • Purpose & Data Processed: We use these for crash reporting, error monitoring, logs, and app performance diagnostics. They may process crash reports, stack traces, logs, device and OS information, app instance IDs, and related diagnostic metadata.

  • Authentication and Identity Services

    • Providers & SDKs: Google Sign-In / Google Identity Services, Sign in with Apple, and Firebase Authentication.

    • Purpose & Data Processed: We use these services to let you sign in and maintain secure authentication sessions. They may process your Google or Apple account identifiers, authentication tokens, basic profile information authorized by you, relay email addresses (if chosen via Apple), device and security information, and sign-in logs.

  • Push Notifications

    • Providers & SDKs: Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM).

    • Purpose & Data Processed: We use these platform messaging services to send service-related push notifications when enabled. They may process push tokens, device identifiers, notification delivery metadata, and app information.

  • Marketing and Attribution (New)

    • Providers & SDKs: AppsFlyer SDK and OneLink.

    • Purpose & Data Processed: We use AppsFlyer for install attribution, referral and deep-link routing, marketing measurement, login attribution events, and fraud-prevention measurement. AppsFlyer may process device identifiers and advertising identifiers (where permitted by your OS settings).

  • Payment and Billing Services (New)

    • Providers & SDKs: Apple App Store / StoreKit and Google Play Billing.

    • Purpose & Data Processed: We use platform billing services to process purchases, subscriptions, refunds, and receipt validation. Apple or Google may process transaction identifiers, product identifiers, receipt or purchase tokens, subscription and refund status, device or account information, and tax or compliance data. Please note: We do not receive or store your full payment card number; all financial data is handled securely by the respective platform.

4.3 Advertising Partners

Currently, the Services do not display third-party advertising. When we introduce ads in a future update, we will update this Policy and disclose the relevant advertising and measurement partners, and the categories of data shared with them.

4.4 Legal and Safety Reasons

We may disclose information if we believe it is necessary to:

  • Comply with applicable law, regulation, legal process, or government requests.

  • Enforce or apply our Terms of Service and other agreements.

  • Protect the safety, rights, or property of ParaDoor, our users, or others.

  • Investigate, prevent, or take action regarding fraud, credit risk, security, or violations of our Terms.

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.

4.5 Business Transfers

If ParaDoor is involved in a sale of assets, or similar transaction, your information may be transferred as part of that transaction.

4.6 Other Third Parties

We may disclose information if we believe it is necessary:

  • To other users. For example, any AI character that creators create will operate autonomously, and information (including personal information) provided to their AI character may be disclosed to other users who interact with the AI character depending on the content filters, topic restrictions, or other limitations the user places on the AI character’s responses.

• To fulfill the purpose for which you provide it.

• For any other purpose disclosed by us when you provide the information.

• To Parties with your consent.

5. International Data Transfers

ParaDoor and its service providers operate globally. We are based in the United States. Your personal information sent to the AI model provider you choose — may be transferred to and processed in countries other than your own, where privacy laws may differ and may not provide the same level of protection. However, we apply the safeguards described in this policy to your personal information regardless of where it is processed.

By submitting your personal information or engaging with our Service, you hereby consent to this transfer, storing, or processing, including transferring your information across international boundaries to jurisdictions anywhere in the world as permitted by law.

If you are a Canadian resident or otherwise located in Canada, please note that we may process, store, and transfer your personal information in and to a foreign country, with different privacy laws that may or may not be as comprehensive as Canadian law. In these circumstances, the governments, courts, law enforcement, or regulatory agencies of that country may be able to obtain access to your personal information through the laws of the foreign country. Whenever we engage a service provider, we require that its privacy and security standards adhere to this policy and applicable Canadian privacy legislation.

If you are located in the United Kingdom (UK), please note that your information will be transferred outside of those areas. Where required, we rely on appropriate legal mechanisms to ensure the lawful transfer of personal information outside of the UK. These include the Standard Contractual Clauses (“SCCs”) approved by the European Commission under Article 46(2)(c) of the General Data Protection Regulation (GDPR) and the UK Data Transfer Addendum.

6. Data Retention

Except as otherwise permitted or required by applicable law or regulation, we keep your personal information only as long as necessary for the purposes described in this Policy, including to comply with legal obligations, accounting requirements, resolve disputes, and enforce our agreements. Under some circumstances we may anonymize your personal information so that it can no longer be associated with you. We may use that anonymous and de-identified data for any legitimate business purpose without further notice to you or your consent.

  • Account data is retained while your account is active.

  • Conversation content and AI creations are retained while your account is active until you delete them or your account, and may be retained in backups for a limited additional period.

  • Anonymous data may be kept indefinitely.

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Retention periods may vary depending on: account status; whether content is published or private; payment, tax or accounting requirements; security, fraud prevention and abuse investigation needs; legal claims, disputes or regulatory obligations. If a user deletes an account, we will delete or anonymize personal information within a reasonable period, except where retention is necessary for legal compliance, fraud prevention, dispute resolution, payment records, security logs or enforcement of our terms.

Users may request access, correction, deletion or export of their personal information, subject to legal, security, payment, tax and fraud-prevention exceptions.

7. How We Secure Your Information

We implement technical, administrative, and physical measures designed to protect your personal information from unauthorized access, use, alteration, or disclosure. We use industry-standard technical and organizational measures to protect your information, including encryption of data in transit (Transport Layer Security) and at rest, access controls, regular security reviews.

However, no system or method of transmission over the internet is 100% secure. We cannot guarantee absolute security, but we work to protect your information using reasonable measures. You are responsible for maintaining the confidentiality of your login credentials and should avoid sharing them with others. We urge you to exercise caution when sharing information in public or user-accessible areas of the Service.

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the relevant authorities as required by applicable law.

8. Children's Privacy

The Services are rated for users 13 and older, and we do not knowingly collect personal information from children under 13. In some jurisdictions the local minimum age may be higher (e.g., 16 in several EU member states); users must meet the higher of 13 or their local minimum age.

If you believe a child has provided us with personal information, please contact us by the details specified in the Contact Us section below, so we can delete it.

9. Choices About How We Use and Disclose Your Information

We strive to provide you with choices regarding the personal information you provide to us. We have created mechanisms to provide you with the following control over your information:

  • Cookies and Tracking Technologies / Cookies. We may use cookies, pixels and similar technologies to: keep users logged in; remember preferences; measure product performance; analyze traffic sources; support referral and creator attribution; detect fraud and abuse; improve marketing effectiveness. Users may control cookies through browser settings or, where required by law, through our cookie consent tools.

  • Promotional Offers from Us. If you do not wish to have your email address used by us to promote our own or third parties’ products or services, you can opt out by sending us an email stating your request to us by the details specified in the Contact Us section below. If we have sent you a promotional email, you may send us a return email asking to be omitted from future email distributions.

Your browser settings may allow you to transmit a “Do Not Track” signal, “opt-out preference” signal or other mechanism for exercising your choice regarding the collection of your information when you visit various websites. Like many websites, our Service is not designed to respond to such signals, and we do not use or disclose your information in any way that would legally require us to recognize opt-out preference signals. We do not control third parties’ collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way. You may be able to limit the use of your information for interest-based advertising through browser settings or privacy tools. Adjust your browser to block third-party cookies or use privacy-focused browsers and ad-blocking plug-ins.

10. Your Rights and Choices

Depending on where you live, you may have the following rights regarding your personal information:

  • Access / know. Request a copy of the personal information we hold about you.

  • Portability. Receive your information in a structured, machine-readable format (where applicable).

  • Correction. Ask us to correct inaccurate or incomplete information.

  • Deletion. Ask us to delete your personal information (you can also delete your account in [Settings → Account Settings → Delete Account]).

  • Restriction / objection. Ask us to limit or stop certain processing, including processing based on legitimate interests.

  • Withdraw consent. Withdraw consent at any time where we rely on consent, without affecting the lawfulness of prior processing.

  • Opt out of AI training. You have the right to opt out of using your user-generated content for AI training in our Services or by contacting us.

  • Opt out of marketing. Unsubscribe using the link in our emails or by contacting us.

How to exercise your rights. Email us by the details specified in the Contact Us section below. We will verify your identity before responding. We aim to respond within the time required by applicable law (typically 30 days, extendable in some cases). If you are not satisfied with our response, you can complain to your local data protection authority.

We will not discriminate against you for exercising your rights.

11. Supplemental Terms - Jurisdiction Specific

Residents of certain jurisdictions may have additional personal information rights and choices. Please see Your US State Privacy Rights, Your Canadian Privacy Rights, Your UK Privacy Rights and Disclosures, Your Australia Privacy Rights, Your New Zealand Privacy Rights for more information.

11.1 Your US State Privacy Rights

For individuals residing in certain US states, this section is designed to help you better understand how we collect, use, and disclose your personal information and, depending on where you reside, how to exercise your rights under state privacy laws in the US. You can read more about the personal information we collect and where we collect it from in “[Section 1] Information We Collect” above, how we use personal information in “[Section 2] How We Use Your Information” above, and how long we retain personal information in “[Section 6] Data Retention” above.

Certain US state privacy laws may provide residents with some or all of the rights listed below. However, these rights are not absolute and may be subject to certain exceptions. Therefore, we may decline your request in certain cases as permitted by law. These rights may include the right to:

  • Confirm whether we process their personal information.

  • Request that we disclose to you the categories and specific pieces of personal information we have collected, sold and/or shared about you.

  • Request that we disclose the following to you:

    • The sources from which your personal information is collected

    • The business or commercial purpose for collecting, selling, or sharing your personal information

    • The categories of third parties with whom we shares or sells personal information

    • A list of third parties to which we have disclosed your personal data.

  • Request that we delete certain personal information we have collected about you.

  • Request that we correct inaccuracies in their personal information, taking into account the information’s nature and purpose of the processing .

  • Data portability.

  • Request to opt-out of personal data processing for profiling in furtherance of decisions that produce legal or similarly significant effects.

  • Request to either limit (opt-out of) or require consent to process sensitive personal data.

Exercising Your Rights To exercise any of these rights, please email us by the details specified in the Contact Us section below. We will not discriminate against you for exercising your privacy rights.

Verification To protect your personal information from unauthorized access, change, or deletion, we may require you to verify your credentials before you can submit a request to know, correct, or delete personal information. If you do not have an account with us, or if we suspect fraudulent or malicious activity, we may ask you to provide additional personal information for verification. If we cannot verify your identity, we will not be able to honor your request.

Authorized Agents You may also submit a rights request through an authorized agent. If you do so, the agent must present signed written permission to act on your behalf and you may also be required to independently verify your identity with us. Authorized agent requests can be submitted to us by the details specified in the Contact Us section below.

Appeals To appeal a decision regarding a consumer rights request, please send us an email within 30 days after the decision was rendered with a detailed explanation of why you believe the decision was incorrect or unsatisfactory and any additional information or evidence that supports your appeal. On receipt of your appeal, we will acknowledge its receipt within ten business days. The appeal will be reviewed by ParaDoor or a designated reviewer who was not involved in the initial decision. We may contact you for further information or clarification if necessary. We will provide a written response to your appeal within 30 days of receipt. If additional time is required to review your appeal, we will notify you of the extension and the reasons for it. If your appeal is upheld, we will take the necessary steps to rectify the issue and inform you of the actions taken. If your appeal is denied, we will provide a detailed explanation of the reasons for the denial and inform you of any further options available, such as contacting the relevant state authorities or data protection agencies.

Sale or sharing We do not sell your personal information. We do not currently "share" it for cross-context behavioral advertising, because we do not currently serve third-party targeted ads. When we introduce advertising, this may constitute "sharing" under California law, in which case we will update this section and provide an opt-out (including honoring Global Privacy Control signals).

Use for model training As described in [Section 2], we use your Conversation Content to train and improve AI models. This is not a "sale" or "sharing" under California law. The contents of your conversations may constitute "sensitive personal information" under California Privacy Rights Act; we use it to provide and improve the Services based on our legitimate interests, and you may limit this use by opting out).

California “Eraser” Law If you are a California resident under the age of 18 and have registered and posted content to the Service, you may request its removal by emailing us by the details specified in the Contact Us section below. You must identify the content and confirm that you posted it. We will make reasonable efforts to anonymize or remove it from public view, although we cannot guarantee complete or comprehensive removal from all locations (e.g., if third parties have copied or shared the content elsewhere).

Your rights. California residents have the rights to know, delete, correct, opt out of sale/sharing, limit use of sensitive personal information, and not be discriminated against.

Shine the Light To opt out of any disclosure of personal information for third-party direct marketing, contact us with "California Shine the Light Request" in the subject line.

Nevada Nevada provides its residents with a limited right to opt-out of certain personal information sales. Residents who wish to exercise this sale opt-out rights may submit a request to us by the details specified in the Contact Us section below.

11.2 Your Canadian Privacy Rights

If you live in Canada, by law you have the right to request access to and to correct the personal information that we hold about you.

If you want to review, verify, correct, or withdraw consent to the use of your personal information you may send us an email to request access to, correct, or delete any personal information that you have provided to us. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect. We may charge you a fee to access your personal information, however, we will notify you of any fee in advance. Please note that if you withdraw your consent, we may not be able to provide you with a particular product or service. We will explain the impact to you at the time to help you with your decision.

We may request specific information from you to help us confirm your identity and your right to access, and to provide you with the personal information that we hold about you or make your requested changes. Canadian law may allow or require us to refuse to provide you with access to some or all of the personal information that we hold about you, or we may have destroyed, erased, or made your personal information anonymous in accordance with our record retention obligations and practices. If we cannot provide you with access to your personal information, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

If you are concerned about our response or would like to correct the information provided, you may contact us by the details specified in the Contact Us section below.

11.3 Your UK Privacy Rights and Disclosures

If you reside in the UK, the following additional terms apply to our processing of your personal data.

Legal Basis for Processing. We only process your personal data where applicable law permits or requires it, including:

  • Where the processing is necessary for the performance of our contract with you.

  • Where the processing is necessary for our legitimate interests or the legitimate interests of third parties.

  • Where the processing is necessary to comply with a legal obligation, such as responding to a legal request or retaining transaction information to comply with record-keeping obligations.

  • With your consent. For example, certain personal data processed by the Service may be considered “special category data” under article 9 of the GDPR. We process this data only with your explicit consent or where necessary for reasons of substantial public interest, in accordance with applicable law.

Legal Rights. Under certain circumstances, you have rights under data protection laws concerning your personal data. Your rights may include the following:

Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us to continue to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully, or where we are required to erase your personal data to comply with local law. Note, however, that we might not always be able to comply with your erasure request for specific legal reasons that will be notified to you, if applicable, at the time of your request.

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation that makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information that override your rights and freedoms.

Request restriction of processing your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (1) if you want us to establish the data’s accuracy; (2) where our use of the data is unlawful, but you do not want us to erase it; (3) where you need us to hold the data even if we no longer require it as you need it to establish, exercise, or defend legal claims; or (4) you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.

Request the transfer of your personal data to you or a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information that you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we might not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

Exercising Your Rights. If you wish to exercise any of the rights set out above, please contact us by the details specified in the Contact Us section below.

Fees. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to honor your request in these circumstances.

Verification. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information regarding your request to speed up our response.

Responding to Your Request. We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made several requests. In this case, we will let you know and keep you updated.

Right to Lodge Complaint. If you believe our data processing practices violate your rights under the EU or UK GDPR, you may lodge a complaint with the supervisory authority in your country of residence or work. If you are in the EU, you can find your local supervisory authority here. For any unresolved complaints relating to the UK, you can reach out to the Information Commissioner’s Office, and for Switzerland, to the Federal Data Protection and Information Commissioner⁠. While you have the right to lodge a complaint directly with the supervisory authority, we welcome the opportunity to address your concerns and resolve any issues first.

11.4 Your Australia Privacy Rights

Under the Australian Privacy Act 1988 (Cth), as amended, including the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (collectively “Aus PA”)), you (if you are an Australian resident) may have certain privacy rights in connection with your personal information (as such term is described in the Aus PA).

If you are an Australian resident, you have the following rights as set forth in the Aus PA:

Access to and Correction of Personal Information.

You can access your own personal information by contacting us. Requests for access to your personal information will be responded to within a reasonable period after the request is made. Access to your personal information will be given in the manner requested by you, if it is reasonable and practical to do so. A fee for providing the requested access may apply.

There are some circumstances in which we are entitled to deny you access to your personal information. These include circumstances where such personal information is used in confidential decisions or in a commercially sensitive decision-making process, where the privacy of others may be breached if the personal information was accessed or where the law requires or authorises such access to be denied.

If access to requested information is refused or not provided in the manner requested, or there is a refusal to correct the information, then written notice will be provided setting out reasons for the refusal and mechanisms available to complain about the refusal.

If we are holding personal information in relation to you that is inaccurate, out of date, incomplete, irrelevant or misleading or you request to correct the information, we will take reasonable action to correct the information to ensure that, having regard to the purpose for which it is held, the information is accurate, up to date, complete, relevant and not misleading.

Transfer of Personal Information Overseas.

In certain situations, personal information that we collect may be disclosed to third-party service providers that operate overseas. This may include US and China that may lead to personal information disclosed to overseas recipients.

Before disclosing personal information overseas, reasonable steps will be taken to ensure the recipient does not breach the Aus PA or the effect is that the information will be protected in at least a substantially similar way in which the Aus PA protects the personal information.

Notifiable Privacy Data Breaches.

A data breach happens when personal information is accessed or disclosed without authorization or is lost. Where we assess that we have reasonable grounds to believe that an eligible data breach has occurred, we will notify you and the Australian Information Commissioner about the breach when a data breach involving personal information is likely to result in serious harm.

11.5 Your New Zealand Privacy Rights

If you are a New Zealand resident you are in control of any personal information you provide to us. If at any time, you would like to access, correct, review, restrict, delete or stop further use of the personal information we have about you or if you would like to change your preferences for contacts from us, you can let us know by contacting us as specified in the Contact Us section below.

We are not responsible for removing your personal information from the lists of any third party who has previously been provided with your personal information in accordance with this Policy.

You have the right to lodge a complaint to us by the details specified in the Contact Us section below or to the Privacy Commissioner if you believe your privacy has been breached.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Policy on this page and, where appropriate, through the App or by email. The "Last updated" date at the top indicates when the Policy was last revised.

Your continued use of the Services after a change takes effect means you accept the updated Policy.

13. Contact Us

If you have questions, requests, or concerns about this Privacy Policy or your personal information, please contact our Data Protection / Privacy contact: contact@paradoor.ai