Privacy Policy

1. Introduction

Callarex Studios is the commercial brand for the digital applications, games, and AI tools provided to you (collectively, the "Services"). This Privacy Policy outlines our practices regarding the collection, use, and disclosure of your personal information when you access our platforms.

2. How AI Works & Transparency

Transparency is fundamental to the Services. When utilizing Callarex AI, your chat inputs are processed in real-time to generate responses via machine learning models.

• No Training Without Consent: I do not use your private chat inputs to train models without your explicit, opt-in consent.
• Anonymization: I may use anonymized, aggregated usage statistics to monitor system performance and routing efficiency.

3. Information Collection & Data Processors

I collect personal data necessary to operate, secure, and improve the Services. The following third-party service providers act as Data Processors and process personal data on my behalf pursuant to contractual data processing agreements:

• Identifiers: Email addresses, hashed passwords, and IP addresses via Google Firebase.
• Commercial Information: Purchase history and digital credits via Fourthwall.
• Device & Network Activity: Device identifiers (e.g., Android Advertising ID) and usage data via Google Analytics, AdMob, and Unity Ads.

Sensitive Personal Information (SPI): I do not knowingly collect or process sensitive personal information (such as government IDs, precise geolocation, or financial account credentials) as defined by the CPRA.

4. Legal Basis for Processing

For the purposes of the GDPR and other global data protection regulations, Rex Zhuang acts as the Data Controller responsible for the personal data processed under this policy. I process personal data under the following legal bases:

• Performance of a Contract: To provide AI tools, digital credits, and fulfill purchases.
• Legitimate Interests: To maintain system security, conduct analytics, and prevent fraud or abuse.
• Legal Obligation: To comply with tax, financial, and regulatory requirements.
• Consent: Where you provide explicit permission for marketing or non-essential cookies.

5. Cookies & Targeted Advertising

I use Google Analytics and third-party ad networks to analyze performance. Where legally required, I obtain your explicit consent via a cookie banner before tracking begins. You may opt-out through browser settings or device-level ad IDs.

6. Data Security & Retention

I secure the Services using industry-standard practices, including HTTPS/TLS encryption in transit and the use of securely hashed passwords.

• Account data is retained as long as your account is active; inactive accounts may be purged after 14 months.
• Analytics data is typically deleted or anonymized after 14 months of inactivity.

7. International Data Transfers

The Services are powered by infrastructure located in the United States. Your personal data may be transferred to and stored on US-based servers. Where required by international laws, I rely on Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms to ensure your data remains protected to an equivalent standard required in your jurisdiction.

8. Your Privacy Rights & Procedures

Depending on your location, you may have rights to access, correct, or delete your data. You may exercise these rights via the Support Portal. I will respond to all verified requests within 30 days. For security purposes, I may require you to verify your identity before processing your request. These requests are typically processed free of charge.

9. US State Privacy Rights (CCPA/VCDPA/CPRA)

In the preceding 12 months, I have collected Identifiers, Commercial Information, and Internet/Network Activity. I do not sell your personal information for monetary compensation. However, the use of advertising cookies may be considered "sharing" for targeted advertising under laws in California, Virginia, Colorado, Utah, Connecticut, and other applicable states. Residents have the right to:

• Request disclosure of what data is collected and how it is shared.
• Request the deletion of their personal information.
• Opt-out of the "sale" or "sharing" of personal information. You may exercise this right and submit an opt-out request by emailing me directly at callarexstudios@gmail.com.
• Non-Discrimination: I will not discriminate against you for exercising your privacy rights.

10. Brazil Privacy Rights (LGPD)

Brazilian residents have specific rights under the LGPD to confirm processing, access data, and revoke consent. Please contact me via the email below to exercise these rights.

11. Children’s Privacy

The Services are not directed at children under the age of 13 (US) or 16 (EEA/UK). I do not knowingly collect personal data from minors without verified parental consent.

12. Changes to This Policy & Contact Information

I may update this Privacy Policy from time to time. Material changes will be notified via a notice on the Callarex website or within the application interface.

For inquiries, or to exercise your privacy rights, contact the Data Protection Officer (DPO) at: callarexstudios@gmail.com.

EEA and UK users have the right to lodge a complaint with their local data protection supervisory authority.