1. What Information Do We Collect

1.1 Device Information

1. To provide you with a better experience when using our application, we collect limited information about your device and network connection.
2. This information depends on the context of your interactions with us, your choices, including your privacy settings, and the products and features you use. It may include:
   • SDK/API versions, IP address, platform, timestamps, application identifiers, application version, device model, operating system version, language settings, time zone, network status, screen resolution, memory usage, storage usage, and crash or diagnostic information reasonably necessary to operate, maintain, secure, and improve the services.
   • We may store certain information collected in this manner using app-related or device-related identifiers associated with the devices you use. We will treat this information as personal information where required by applicable law.

1.2 Data Related to Your Use of Services

1. Click counts, landing pages, browsed pages and their order, time spent on specific pages, request date and time, and number of times the application is opened.
2. Permission status relevant to app functions.
3. Whether features are functioning properly.
4. Timestamps such as first open time or feature use time.
5. Application version, application model, and application network status.
6. Firebase installation ID, app instance ID, or similar analytics identifiers generated by integrated analytics tools, where applicable.
7. System language, country or region derived from system settings or IP, and other usage diagnostics reasonably necessary to improve product experience.
8. This data may be passed only to our authorized third-party analytics and infrastructure service providers solely for analytics, service operation, diagnostics, fraud prevention, security, and product improvement purposes.
9. The above information is only used to improve product experience, service reliability, feature quality, analytics, and operational security. We do not sell your personal information to third parties.

1.3 Analytical and Support Information from Other Sources

We may receive limited analytical, diagnostic, or support-related information from service providers that help us operate, secure, measure, and improve the services, provided that such collection and use are consistent with this policy and applicable law.

1.4 Integrated Third-Party SDKs in Our Applications May Access Your Information, Including:

1. Demographic or regional information derived from technical data, such as approximate country or region determined from IP address.
2. Anti-fraud, abuse prevention, or service security data.
3. Data related to your device and app environment, such as device type, technical information, app version, crash data, and country or region.
4. Data used for service analytics, diagnostics, performance measurement, and product improvement.

The information collected by third-party SDKs and service providers is used only for the purposes described in this policy and is subject to applicable contractual, confidentiality, and data protection obligations. These third parties may include analytics and infrastructure partners such as Google Analytics and Google Firebase.

1.5 Other Information

We may collect information you voluntarily provide to us. This includes, but is not limited to, your email address, feedback, support requests, and answers to questionnaires.

1.6 AI Generation Data

When you choose to use optional AI generation or AI editing features, we collect and process only the data reasonably necessary to provide the specific function you request.

1. User-submitted media. This includes photos or videos that you select, upload, capture, import, submit, or otherwise provide for AI processing. Depending on the requested feature and the provider API, this media may be processed or transmitted as a temporary media URL, image or video bytes, or Base64-encoded media content.
2. User generation inputs. This includes text prompts entered by you, optional negative prompts, and related generation parameters such as style, resolution, aspect ratio, duration, effect settings, template selections, or other settings needed to generate or edit the requested result.
3. Technical task metadata. This includes limited task-level technical parameters required to process the request, return the generated result, maintain service security, perform safety moderation, and support error handling. We do not intentionally transmit raw account credentials such as your password to third-party AI providers for AI generation requests.

We collect and process the above information only when you actively choose to use a supported feature, including AI generation, AI editing, face-related effects, image-to-video generation, portrait enhancement, stylization, cartoon effects, fantasy transformations, or media analysis features available in the app.

How we collect AI-related data: we collect this information directly from you when you choose media from your device, capture media in the app, enter a text prompt, select generation settings, tap a feature entry point, or submit an AI generation or editing request. We may also automatically collect limited technical request metadata necessary to securely process the request and return the result.

Temporary storage before processing: when you upload media for a supported feature, your photo or video may first be uploaded to the object storage service configured for the app so that the requested workflow can run. In the current Mixoo deployment, this storage currently uses Alibaba Cloud OSS by default, although the specific bucket, endpoint, or region may vary by app configuration. This storage step is only for temporary data storage and does not by itself constitute sharing your data with any third-party AI service provider.

Ephemeral Processing: uploaded photos, videos, and generated AI results are processed on a temporary basis. Unless a longer retention period is required by applicable law, original media and generated results stored on our servers are automatically deleted within 24 hours after the generation or editing process is completed.

No Model Training: we do not use your uploaded photos, videos, prompts, or generated content to train, retrain, or improve our own AI models or the general-purpose models of our third-party AI providers. Your data is used solely to complete the specific generation or editing task you requested.

Where applicable, you may also request deletion of your data, after which it will be removed from our systems in accordance with applicable law and operational requirements.

1.7 Face Data Disclosure

Some optional Mixoo features process photos or videos that contain a person's face. For purposes of this policy, "Face Data" means: (i) face images contained in user-uploaded media; and (ii) derived attribute results returned by a processing service, such as face count, estimated age range, estimated gender, or image quality scores, but only where such results are necessary to provide the requested feature.

1. Purpose. We use Face Data only to apply the specific visual transformation, face-related effect, portrait processing, animation, editing result, or media analysis result that you request.
2. No Identification. We do not use Face Data to identify, authenticate, verify, or recognize any individual user.
3. No Marketing Sharing. Face Data is not sold and is never shared with third-party advertisers, data brokers, or unrelated marketing partners. Face Data is shared only with the AI infrastructure or AI processing providers identified in Section 3 when technically necessary to provide the requested feature.
4. No General-Purpose Faceprint Sharing. In the current implementation, we do not extract and generally share a standalone face embedding or general-purpose faceprint with third parties for unrelated identification purposes.
5. Retention. Face Data is processed on a temporary basis and, unless a longer retention period is required by law, is deleted from our servers within 24 hours after processing is completed.

2. How We Use Information

2.1 To Improve and Optimize Services

We use collected information to improve app performance, optimize user experience, analyze product usage, troubleshoot issues, maintain service stability, and enhance existing features.

2.2 To Provide You with Better Services

We have a legitimate interest in collecting and processing necessary data in order to:

1. Update and develop services.
2. Enhance and improve your experience.
3. Manage our relationship with you.
4. Customize your service experience.
5. Respond to your comments and inquiries and provide support.
6. Send you relevant information, such as updates, security alerts, support messages, and service notices.

2.3 To Provide Services

We process the necessary data to:

1. Allow you to use the services.
2. Operate the services.
3. Provide and deliver products and services you request.
4. Process AI generation or AI editing requests, including processing user-submitted photos or videos, text prompts, related generation parameters, and limited technical task metadata as necessary to fulfill the function you request.
5. Store uploaded media in configured object storage when needed to run the requested workflow.
6. Route certain requests through our own internal review service for content compliance detection before any generation step is performed.
7. Run optional face-related analysis workflows, such as face counting, age estimation, gender estimation, or quality scoring, when required by a feature you selected.

2.3.1 Consent for Optional Features and Third-Party AI Processing

Before transmitting your personal data to a third-party AI service provider for an optional AI feature, we provide a clear in-app disclosure and obtain your permission through an appropriate consent mechanism.

Before such transmission, we explain what categories of data will be sent, identify the specific third-party AI recipient used for that feature, describe the purpose of the transfer, and request your permission before proceeding.

If you do not provide consent, your personal data will not be sent to the third-party AI provider for that optional AI feature, and the requested optional AI feature will not run.

2.4 Ensuring Service Security

Ensuring security during the provision of services is our top priority. We take appropriate security and technical measures to protect your information from unauthorized access, loss, and misuse. To achieve this goal, we also require our vendors to take appropriate security measures when processing personal information on our behalf.

To maintain the security of services, combat fraud, prevent abuse, and ensure proper use in other respects, we have a legitimate interest in processing necessary data to:

1. Analyze and monitor the use of services.
2. Prevent abuse, crime, fraud, unauthorized access, or misuse.
3. Take action against users involved in fraud, abuse, or misconduct.

Despite our efforts, we cannot guarantee the absolute security of your personal data, nor can we ensure the security of any communications facilities that we provide. We recommend that you exercise caution when disclosing any information through the services. In particular, please note that any personally identifiable information or sensitive personal data that you share or disclose in public areas of the services may be collected and used by others. Therefore, you should be mindful of the information shared online.

3. Information We Share

As mentioned above, your personal information may be shared with our service providers and third-party partners only to the extent reasonably necessary to operate the services, provide features requested by you, perform analytics, maintain security, comply with law, or otherwise as described in this policy. The use of the information we disclose to them will be governed by their privacy policies, contractual obligations, and applicable law.

We may share limited technical, device, usage, and diagnostic data with third-party analytics and infrastructure providers, such as Google Analytics and Google Firebase, to help us measure app performance, diagnose issues, maintain security, and improve the services.

When you choose to use optional moderation, media analysis, AI generation, or AI editing features, we may share the data necessary to fulfill your request with the specific service provider used by that feature. Mixoo follows a feature-by-feature, model-by-model, and need-to-know approach. Mixoo does not send every uploaded photo or video to every listed provider, and does not simultaneously share your media with all vendors.

Depending on the feature you use, data may be handled as follows:

• Configured object storage (currently Alibaba Cloud OSS by default): user-uploaded photos or videos may first be stored in the app's configured object storage bucket, endpoint, or region so that the requested workflow can be processed. This storage step does not by itself mean the media has already been shared with an external AI generation provider.
• Our internal review service: images, videos, or prompts may first be sent to our internal review service for content compliance detection. This step is part of the review flow and does not itself perform AI generation. In these cases, the direct recipient from the app's perspective is our internal review service.
• Alibaba Cloud: if a feature requires face detection, age or gender estimation, image quality scoring, face swap, cartoonization, image colorization, sketch conversion, or super-resolution processing, Alibaba Cloud may receive the user-submitted image or video content in the form of media bytes, Base64-encoded data, or an accessible media URL, depending on the feature. In media analysis workflows, Alibaba Cloud may return results such as face count, age, gender, or quality score.
• Tencent Cloud: for certain text-to-image features, Tencent Cloud may receive the prompt, negative prompt, style, and resolution. For certain age-change features, Tencent Cloud may receive an image URL.
• Zhipu AI: for certain image-to-video generation features, Zhipu AI may receive image Base64 data together with prompt, quality, size, duration, fps, and similar task parameters necessary to generate the requested result.
• ByteDance / Volcengine: for certain image-to-video generation features, ByteDance / Volcengine may receive an image URL together with prompt, ratio, resolution, duration, and similar task parameters necessary to generate the requested result.
• Google Gemini: for certain AI image generation features, including Nano Banana Pro, Nano Banana, and Nano Banana 2, Google Gemini may receive a prompt, input image URL, multiple input images, resolution, and aspect ratio. For certain AI video generation features, including Veo 3.1, Google Gemini may receive a prompt, input image URL, first-frame and last-frame image URLs, reference video URL, resolution, aspect ratio, and duration.

Such AI-related data is transmitted in encrypted form and only when reasonably necessary to provide the feature requested by you.

We do not intentionally transmit raw account credentials such as your password to third-party AI providers for AI generation requests. We also do not authorize third-party AI providers to use your uploaded photos or videos, prompts, generation parameters, or related AI request data for unrelated purposes beyond providing the specific AI functionality requested by you, except where required by applicable law.

In addition, some requests may first be routed through our own internal review service for content compliance detection before any model call is made. This internal review service is operated by us and is not an independent third-party AI generation provider.

Before any personal data is sent to a third-party AI provider for an optional AI generation, AI editing, or face-related analysis feature, we provide an in-app disclosure that explains what data will be sent, identifies the specific direct recipient used for that feature, explains the purpose of the transfer, and asks for your permission before proceeding. Where a feature first routes the request to our internal review service, the disclosure may identify our internal review service as the direct recipient.

We require third-party recipients to process personal data only for the specific functionality requested by you, in accordance with our instructions, confidentiality obligations, and applicable data protection laws, and to provide the same or equal protection for the shared data.

We further require that all third-party AI providers and AI infrastructure providers, including Alibaba Cloud, Tencent Cloud, ByteDance / Volcengine, Zhipu AI, and Google Gemini, are contractually restricted from using your uploaded personal media, Face Data, prompts, or generated outputs for any purpose other than fulfilling your specific request. They are strictly prohibited by us from using such data for their own AI model training, retraining, or unrelated product improvement purposes.

Alibaba Cloud:
Privacy Policy: https://terms.aliyun.com/legal-agreement/terms/suit_bu1_ali_cloud/suit_bu1_ali_cloud201902141711_54837.html

Tencent Cloud:
Privacy Policy: https://cloud.tencent.com/document/api/301/11470

ByteDance / Volcengine:
Privacy Policy: https://www.volcengine.com/docs/6256/64902?lang=zh

Zhipu AI:
Privacy Policy: https://docs.bigmodel.cn/cn/terms/privacy-policy

Gemini API / AI Studio:
Terms: https://ai.google.dev/gemini-api/terms

4. Important Permissions We Request

1. Depending on the features you choose to use, we may request certain permissions so that Mixoo can function properly. You can choose not to grant a permission, but please note that some features may not operate correctly without it. The permissions we may request include:
   • Photos: to let you select, import, save, or export photos and videos for editing, generation, and sharing.
   • Camera: to let you capture photos or videos directly in the app for optional creation or editing features.
   • Microphone: to enable audio capture in features that support video creation or editing, if such features are available in the app.
   • Notifications: to notify you about important service-related updates, processing status, or other app notices, where applicable.
   • Network Access: to allow the app to communicate with our servers and integrated service providers in order to provide requested features, including optional AI processing and analytics.

5. Legal Basis for Processing Your Personal Data

We process personal data for the purposes described in this privacy policy. The legal bases for processing personal data include: processing necessary for the performance of a contract with you, such as to provide the services you request and to identify and verify your identity where necessary; processing necessary for compliance with legal obligations; processing necessary for our legitimate interests, such as managing our relationship with you, ensuring the security of our services, improving product quality, and informing you about service-related matters; and processing based on your consent, such as transmitting your uploaded photos or videos, prompts, generation parameters, and related personal data to third-party AI providers for optional AI generation or editing features after obtaining your permission.

In certain cases, to enable us to provide you with all of our services and to allow you to use all of the features of our app, you may need to provide personal data for the above processing.

6. Your Rights

1. When you use our services, we provide you with the rights described below. If you wish to exercise your rights under applicable law, please contact us using the contact information in Section 9. When we receive your personal rights request, please ensure you are prepared to verify your identity. Please note that your personal rights have limitations. We may limit your personal rights in the following ways:
   • When access is legally required or authorized to be denied;
   • When granting access would negatively affect the privacy of others;
   • To protect our rights and property;
   • If the request is frivolous or burdensome.

6.1 Right to Withdraw Consent

If we rely on consent to process your personal information, you have the right to withdraw your consent at any time. Withdrawing consent does not affect the legality of our processing or any processing carried out by any third party based on your consent prior to withdrawal.

6.2 Right to Access and Rectification

If you request a copy of the personal information we hold about you, we will provide you with a copy free of charge and without undue delay, unless the law allows us to charge a fee. If such access would adversely affect the rights and freedoms of other individuals, we may limit your access. You can also request the correction or updating of any personal information we hold about you unless you can do so directly through the service.

6.3 Right to Deletion ("Right to be Forgotten")

You may request that we delete personal information we hold about you if: it is no longer relevant to the purposes for which it was collected or processed; it was collected based on your prior consent but that consent has since been withdrawn; or it was collected in connection with processing activities you oppose, and there is no other legitimate basis for processing.

You may request account or data deletion by following the instructions provided through the privacy links associated with the Services, by visiting our dedicated data deletion request page at https://mixooai.com/data-deletion.html, or by contacting us using the email address listed in Section 9. Once a valid deletion request is received, your data will be purged from our active systems within 30 days, unless a shorter period applies under Section 1.6 or 1.7 or a longer period is required by law.

6.4 Right to Restriction

You have the right to restrict our processing of your personal information when one of the following applies:

• You contest the accuracy of your personal information we process. We will restrict our processing of your personal information during the time necessary for us to verify the accuracy of that information, which may lead to partial or complete service interruptions;
• The processing is unlawful, and you oppose the deletion of your personal information and request restriction of its use;
• We no longer need your personal information for processing purposes, but you need it to establish, exercise or defend legal claims; or
• You have objected to processing, pending verification of whether our legitimate grounds override your rights.

We will only process your restricted personal information in the following cases: with your consent; to establish, exercise, or defend legal claims; or where otherwise permitted by applicable law.

6.5 Right to Object to Processing

If we are processing your personal information based on your consent, contract, or legitimate interests, you can object to our processing at any time under applicable law. We may continue to process your personal information where necessary for the defense of legal claims, or any other exception under applicable law.

6.6 Right to Data Portability

If we process your personal information based on a contract with you or your consent, or if such processing is carried out through automated means, you may request to receive your personal information in a structured, commonly used and machine-readable format and, where technically feasible, request us to transmit your personal information directly to another controller, unless exercising this right adversely affects the rights and freedoms of others.

6.7 Notification to Third Parties

If we share your personal information with third parties, we will notify those third parties of any requests to correct, delete, or restrict your personal information unless this proves impossible or involves disproportionate effort. We will identify those third parties per your request, where required by applicable law.

6.8 Automated Individual Decision-Making, Including Profiling

You have the right not to be subject to decisions based solely on automated processing of your personal information, including profiling, that produce legal effects concerning you or similarly significantly affect you, unless exceptions apply under applicable law.

6.9 Right to Lodge a Complaint

If you believe we have violated your privacy rights, please contact us using the contact information in Section 9 so that we can address your concerns. You also have the right to lodge a complaint with the relevant regulatory authority in your area, particularly where you are resident, work, or where the infringement occurred.

7. Children's Privacy Protection

This service is not directed at anyone under the age of 13. We do not intentionally collect personally identifiable information from children under 13. If we discover that a child under 13 has provided us with personal information, we will immediately delete that information from our servers. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us so that we can take necessary measures.

8. Changes to the Policy

Any information collected is subject to the policy in effect at the time of collection. However, we may occasionally revise this policy. If such changes occur, we will provide additional notifications in appropriate ways. Your continued use of our app or services means you accept these changes.

9. Contact Us

This Privacy Policy applies to the iOS version distributed through the App Store. If you have any questions, concerns, privacy rights requests, or deletion requests regarding this policy, you may contact us by email or use our dedicated data deletion request page at https://mixooai.com/data-deletion.html.