This English version is the legally binding one. A Traditional Chinese translation is provided for convenience only.

1. Who is responsible

Avatar Lab, a sole proprietorship established and operating in Taiwan, is the controller of the personal data described here.

Privacy contact: [email protected] · General contact: [email protected]

2. Summary — the four things that matter most

3. What we collect

3.1 Account data

We request only the minimum OAuth scopes: openid email profile from Google, user:email from GitHub. We do not receive your password, contacts, files, calendar or any other data from those providers.

3.2 Content you create or upload

• Character specifications (text you write or answer in the Lab).
• Images you upload (for example when importing an existing character).
• Reference images and training sets generated for you.
• Adapter packs and platform anchor text derived from the above.

3.3 Usage and technical data

• Generation events: timestamp, model used, parameters, token counts, image counts, consistency scores, error and failure modes. This is the metadata referred to in Section 2.
• Funnel milestones: internal user ID plus which step of the product you reached (signed up, created a pack, generated, and so on). Deliberately milestones only — not every click — and it records the internal user ID, not your email.
• Credit balance and consumption, and, once paid plans launch, billing records (plan, status, amount, currency, payment provider event ID).
• Cookies. Two, both first-party and strictly necessary: a signed session cookie that keeps you logged in, and a short-lived cookie (10 minutes) that remembers where to send you after login. We use no advertising or tracking cookies.
• Server logs. Our hosting and CDN providers process request logs which may include IP address, user agent and timestamps, for security and reliability. Aggregate page-view analytics may be collected at the network layer without cookies.

4. Why we process it, and on what legal basis

Where we rely on legitimate interests, you may object — see Section 8.

5. Who we share it with

We do not sell personal data and do not share it for advertising. We use the following processors and providers:

We may also disclose data where required by law, court order, or to establish or defend legal claims.

6. International transfers

Your data is stored in Japan and transmitted to providers in the United States and elsewhere. Where a transfer is from the EEA or UK, it is made on the basis of the European Commission's Standard Contractual Clauses or an adequacy decision, as applicable to the provider concerned.

7. How long we keep it

8. Your rights

Subject to your location, you may have the right to: access your data; correct it; delete it; export it in a portable format; restrict or object to processing based on legitimate interests; and withdraw consent where processing rests on consent.

Export is partly built into the product: character specifications, reference images and adapter packs can be downloaded from the interface at any time, in open formats (JSON, standard image files, plain text).

All other requests, including deletion of your account and its contents, are handled on request — write to [email protected]. We acknowledge within 5 working days and complete within 30 days. There is no charge unless a request is manifestly unfounded or excessive.

• Taiwan (Personal Data Protection Act): you may request review, duplication, supplementation or correction, cessation of collection, processing or use, and deletion.
• EEA / UK (GDPR): the rights above, plus the right to lodge a complaint with your supervisory authority.
• California (CCPA/CPRA): the right to know, delete, correct, and to opt out of sale or sharing — noting that we do not sell or share personal information as those terms are defined.

9. The limit on deletion — blockchain anchoring

If a character of yours was issued a Character ID and anchored, a hash of its specification forms part of a Merkle tree whose root was written to a public blockchain.

• The chain stores a 32-byte root only. It contains no name, no email, no image, and no readable text.
• The hash is one-way: the specification cannot be reconstructed from it.
• It cannot be deleted, by us or by anyone. Public blockchains are append-only. It will remain after you delete your account.

We can, and on request will, delete the local batch record that connects your character to a position in that tree — after which the on-chain root can no longer be used to demonstrate anything about your character. Please note that doing so also destroys your ability to use the anchor as evidence.

10. Security

Sessions use signed cookies with expiry; login tokens are stored hashed, never in plain text; unverified email addresses are rejected outright; webhook payloads from the payment provider are signature-verified and processed idempotently. Access to production data is limited to the operator.

No system is perfectly secure. Where a breach is likely to result in a risk to your rights, we will notify you and the relevant authority as the law requires.

11. Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us with personal data, contact [email protected] and it will be deleted.

12. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you by automated means. Consistency scores are measurements presented to you, not decisions taken about you.

13. Changes

We will post any change here with a new version date, and give notice by email or in-product at least 14 days before a material change takes effect.

Contact: [email protected]