Privacy Policy

1. Scope and Age Notice

This Privacy Policy applies to the "CUDDLES" mobile app for parents/guardians.

This app uses the microphone only while a guardian is on a call with the doll, and its screens are not designed for children to directly enter or provide personal information.

However, service data such as a child's voice and conversations may be generated, transmitted, and stored on our servers through a plush toy (device) linked to the guardian's account. In such cases, the processing, storage, and deletion of that data are subject to the choice and control of the guardian (legal representative), for example via in-app deletion features.

This app does not target children under the age of 14 (in the Republic of Korea) or under the age of 13 (in the United States) as direct service users, and where required by local laws, we comply with guardian consent and notice procedures.

2. Personal Information We Collect

(1) Account Registration / Account Management
Email address, password (hashed), nickname

(1-1) When Using Social Sign-In
If you sign in with a Google, Apple, or Naver account, we receive the following from that provider:
- Required: email address, the provider's unique identifier for you
- Optional: name or nickname, profile picture
We never receive your password and cannot see it. The email address is used to identify your account and to link your orders.
If you choose “Hide My Email” with Apple, we receive a relay address (@privaterelay.appleid.com) instead. Because that differs from the email you used at checkout, past orders will not link automatically — you can link them yourself from My Account.

(1-2) Official-Store Orders (Website Checkout)
- Items: orderer and recipient name, mobile number, email, shipping address (postal code, address, delivery note), order and payment details (product, amount, payment method type, approval time, receipt), recurring-billing cycles, cancellations and early-termination charges, and the consents given on the order form
- Card details are handled by the payment processor (Toss Payments in Korea, Stripe in the US); the Company does not store them.
- If you sign up with the same email, orders are linked to your account automatically (verified emails only).

(1-3) Naver Smart Store Orders (Korea)
For purchases on Naver Smart Store, we use the order information Naver provides to sellers (order number, product, recipient name, phone and address) for shipping and order confirmation.

(2) Automatically Collected Information (Service Operation)
Device information (OS / model / app version), access IP, access date and time, app usage event logs, push tokens, advertising identifiers (AAID / IDFA)

(3) Children's Conversation Data (via Device Linking)
- Source: Plush toy (device) → linked to guardian's account
- Content: Voice recordings (audio data) and transcripts (text) of a child's conversations
- Processing: Collected voice (audio) data is stored encrypted in transit and at rest, and the original is automatically deleted after 90 days. Where you have agreed, a separate research copy is kept to improve speech recognition quality; in that copy account identifiers are replaced with an irreversible speaker code and transcripts mask your child's nickname and the doll's name. The audio itself, however, is kept as recorded — see Section 3A for details and how to turn it off.
- Management: The guardian can optionally delete this data immediately from within the app
- Other voices: while the child talks to the doll, voices of other people nearby (siblings, guardians, guests) may be recorded too. Please let guests know.

(4) Call data (doll ↔ guardian app calls)
- Source: the doll's microphone (child side) and the guardian's app microphone (guardian side). A call connects only after the guardian has agreed in the app, before the first call, to this storage.
- Content: the child's voice and the guardian's voice during the call, a transcript (text) and one-line summary of the call, and its time, length and direction
- Processing: original audio is stored encrypted in transit and at rest and is automatically deleted after 90 days. The child side follows the same rules as (3): a research copy is made only where you have agreed under Section 3A; a research copy of the guardian's voice is made only if you separately opt in, in the app, before your first call (Section 3A). Call transcripts are not merged into the doll's conversation history, and no safety alert is sent on the basis of a call alone. Only the child's side of a call may be used, with low weight, to count whether a wellbeing signal recurs (repeat observation); the guardian's speech is never used for this. The doll does not listen to or remember the call; after it ends, the doll may only ask how the call went (it does not know what was said). The transcript and summary are shown in the guardian app’s Call history and in the weekly report.
- Management: you can delete calls one at a time in Call history (transcript, summary and audio together); deleting conversation history by period or in full also deletes calls in that period. Calls are also deleted with the doll or the account.

(5) Purchase information from partner retailers (group buys, Korea)
- Source: if you buy from a partner retailer, that retailer provides it to the Company with the consent obtained at purchase.
- Items: buyer email, order number, order time, product bundle, and return or cancellation status (for a 1+1 bundle shared between two households, the recipient's email)
- Use: only to apply group-buy benefits (free passes) to the account registered with the same email, and to withdraw them on return or cancellation.

We do not currently collect any additional items beyond the above. Any future changes will be announced in advance and will be subject to required consents.

3. Purposes of Use

• Member identification and account management, service provision, maintenance, and improvement
• Order processing: payments and recurring billing, shipping, exchanges, returns and refunds, order notices (email and text), and linking orders to accounts (Section 2 (1-2), (1-3))
• Customer support and error analysis (including ensuring stability and preventing misuse)
• To diagnose errors and improve quality, a small number of authorized staff may review conversation transcripts and audio; every such access is logged (who, when, which account). This is for service improvement only — research use requires the consent in Section 3A.
• Providing personalization and history based on children's conversation data (e.g., maintaining previous conversation context)
• (With optional consent) Notices, events, and marketing communications
• In-app advertising (AdMob) delivery and performance measurement (depending on personalized / non-personalized ad settings)
• Child safety: automatic detection of self-harm, abuse, and emergency signals, guardian notifications, aggregation of recurring signals, internal review by Company staff, and reporting where required by law (Terms, Article 7)
• Managing talk-time limits: recording talk time and session counts, calculating daily and weekly limits, calculating and deducting extra-minute balances, and notifying guardians when a limit is reached (Terms, Articles 4 and 10)
• Looking things up: searching to answer a child's factual questions (only the question text is sent to an external search provider; see Section 6)
• Applying group-buy benefits: applying free passes to accounts using purchase information from partner retailers, and withdrawing them on return or cancellation (Section 2 (5))
• Call records: providing the transcript and summary of calls between the doll and the guardian app in the guardian app’s Call history and weekly report (Section 2 (4)). Call content is not used for the doll’s memory or schedule reminders

3A. Use for Research (Voice and Conversation Data)

To build a service that understands children better and responds more naturally, we pseudonymize or anonymize collected voice and conversation data and use it to improve our speech recognition and conversational models. This may include academic research.

We apply the following safeguards:

• Identifiers separated: Research copies replace account identifiers with an irreversible speaker code, and transcripts mask your child's nickname and the doll's name.
  The audio itself, however, is kept as recorded. A voice can identify a person on its own, and a recording may contain your child saying their name. Altering the voice would make it useless for recognition research, so we describe this as severing the link, not anonymization.
• No re-identification: We do not attempt to re-identify any individual from processed data, and we do not combine it with other information for that purpose.
• Source data stays private: Original audio recordings and raw transcripts are never provided or published externally. Access is limited to research and engineering personnel, and access is logged.
• Results may be published: Outputs of that research — statistics, performance metrics, analyses, papers, and technical reports — may be published in a form from which no individual can be identified or inferred. The underlying data itself is not published.
• Deletion stops research use: When a guardian deletes conversations, the research copies are deleted too, and research use of that data stops. We keep the link between a research copy and its original precisely so that a deletion request reaches the copy. On deletion, access is blocked immediately and temporary copies kept for recovery are fully deleted within 7 days. Only results already published (statistics, papers) cannot be recalled.

Guardian voice (calls, optional opt-in): For calls between the doll and the guardian app, a research copy of the guardian's side is made only if you separately agree to “Also use my voice for research” in the app before your first call. The purpose is research on caregiver–child interaction and improvement of the conversation model (the doll's tone and responses), under the same safeguards as above (speaker code, no re-identification, source data private, deletion stops use). You can turn it off anytime in the doll's settings (“Caregiver voice research”); later calls are then not kept for research.

Research use is optional. We make research copies only for accounts that ticked “Voice research use” at sign-up or when consents were refreshed; if you did not tick it, no copy is made. You can withdraw at any time in the app (Settings → “Voice research use (account)”, or the doll’s settings); after that no new copies are made, and copies already made are deleted when you delete those conversations. You may also email support@cuddles-anc.com. Your use of the service is not limited either way.

4. Retention and Destruction

• Account information: Destroyed without delay upon membership withdrawal
• Access logs / event logs: Retained for the minimum period required by applicable laws, and destroyed within a maximum of 3 years in accordance with our internal policy Server operating logs (kept 30 days) do not contain conversation content such as what the child or the doll said.
• Call audio (child side and guardian side, original): Automatically deleted 90 days after storage. Encrypted in transit and at rest; a research copy of the guardian's voice is made only where you have opted in. Call transcripts (text) are deleted together with the doll or the account.
• Children's voice (original): Automatically deleted 90 days after storage. If a guardian deletes it sooner, access is blocked immediately and it is fully deleted within 7 days. Encrypted in transit and at rest.
• Children's voice (research copy): Created only where you have agreed under Section 3A, and stored with account identifiers replaced by a speaker code. No fixed retention limit, but deleted when you turn research use off or delete those conversations.
• Children's conversation transcripts: Retained until the guardian requests deletion. In the app you can delete a single conversation, a date range, or everything.
• Transaction / payment records (official store, Naver Smart Store, in-app purchases): under Korean e-commerce law, records of contracts, cancellations, payments and delivery are kept for 5 years, and records of consumer complaints and disputes for 3 years
• Partner retailer purchase information (Section 2 (5)): Kept for 1 year after the benefit period ends (for returns and disputes), then destroyed; information never applied to an account is destroyed 1 year after the sale
• Destruction method: Electronic files are destroyed using technical methods that prevent recovery or reproduction; paper documents are destroyed by shredding, incineration, or similar physical methods
• Safety signal records: Detected speech, surrounding turns, and classification results are stored separately from personalization memory and are deleted together with the conversation. Cases that require internal review are sent to Company staff as an internal notification (email) with the account email, child's name, toy information, and conversation context, and, where needed for a report, the name, contact details, and shipping address entered at purchase; review records are kept for up to 1 year and then destroyed.

5. Provision to Third Parties (AdMob / Google Ads)

In principle, the Company does not provide users' personal information to third parties. However, the following third-party disclosures may occur for the purpose of serving in-app advertisements.

• Third party: Google LLC (AdMob / Google Ads)
• Purpose: In-app ad delivery and performance measurement (personalized / non-personalized advertising)
• Items provided: Advertising identifier (AAID / IDFA), device and app information, approximate IP / region, ad impression and click events, etc.
• Retention / Use period: In accordance with the third party's policies

※ You can change your consent to receive personalized ads at any time under App Settings > Privacy / Advertising.

6. Entrusted Processing (Processors)

To provide the Service, we entrust personal information processing tasks as follows. AI providers receive only voice and conversation content without account identifiers, and each processor acts only on our instructions.

7. Overseas Storage (Cross-Border Transfer)

To operate the service, we use Google Cloud Platform (including Firebase) infrastructure, and user information may be stored and processed on servers located in the United States.

• Recipient: Google LLC (GCP / Firebase)
• Country of transfer: United States
• Items transferred: Account information, service logs, children's conversation data (when linked), etc.
• Timing / Method of transfer: Real-time network transfer during service use

8. Payment Notice

Official-store purchases (cuddles-anc.com) are processed by Toss Payments (Korea) or Stripe (US), and in-app subscriptions by the Apple App Store / Google Play payment systems. The Company does not store sensitive payment information such as card numbers. Orders, receipts and purchase history are kept for the periods in Section 4.

9. User Rights and How to Exercise Them

Users may request access to, correction of, deletion of, or suspension of processing of their personal information.

• Children's conversation data can be deleted immediately by the guardian from within the app, choosing a single conversation, a date range, or everything. Deleting also clears the audio, transcript, research copy, and the doll's memory summary, which is then rebuilt from the conversations that remain.
• When deletion may be refused: Material under a legal preservation obligation — such as a law enforcement request or preservation order — cannot be deleted. If you attempt deletion in that case, we tell you on screen that it was refused and why. We do not quietly retain it.
• Deletion records: We erase the content but keep the fact of it — when, what scope, and how many items were deleted. No content is included.
• Account deletion can be performed directly from within the app.
• Legal guardian consent and verification: For children under 14, the guardian gives separate consent (“collection and use of my child’s personal data, as legal guardian”) at sign-up or when consents are refreshed, and we send a confirmation email to the account address; tapping the confirmation button verifies that the consent came from the legal guardian (Enforcement Decree of the Personal Information Protection Act, Article 17-2). If not confirmed, we may remind you. Where the user is 14 or older, their own consent applies.
• For any other requests, please contact support@cuddles-anc.com.

10. Security Measures

Transport encryption (TLS), one-way hashing of passwords, minimization of access privileges, access logging (conversation access records kept for at least 1 year and reviewed monthly), and compliance with GCP / Firebase security policies.

11. Data Protection Officer and Contact

• Data Protection Officer: Hyunbae Jeon (CEO, Cuddles ANC Inc.)
• Email: support@cuddles-anc.com
• Phone: +82 32-721-4434

12. Notice and Amendments

If there are any additions, deletions, or modifications to this Policy, we will notify users via an in-app announcement starting at least 7 days before the effective date. For material changes to user rights, we will provide notice at least 30 days in advance.