PRIVACY POLICY

Cloud Robot LLC ("Cloud Robot," "Company," "we," "our," or "us") is committed to protecting your privacy and processing personal information in a transparent, lawful, and secure manner.

This Privacy Policy explains how we collect, use, disclose, transfer, retain, protect, and otherwise process personal information when you access or use:

• our mobile applications;
• our websites and landing pages;
• our artificial intelligence assistant;
• APIs and developer services;
• customer support services;
• Telegram-based functionality;
• and all related software, products, tools, features, and services (collectively, the "Services").

This Privacy Policy also explains:

• how we use Cookies and similar technologies;
• how artificial intelligence processes your content;
• how to exercise your privacy rights;
• how to delete your account;
• how we process information received through Telegram;
• how we transfer personal information internationally; and
• how we comply with applicable privacy legislation.

This Privacy Policy applies whenever you interact with the Services unless a separate privacy notice expressly applies.

1. Acknowledgement and Consent

By creating an account, accessing, or using the Services, you acknowledge that you have read, understood, and accepted this Privacy Policy.

Where consent constitutes the applicable legal basis for processing under applicable law, including the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados – Law No. 13,709/2018 ("LGPD")), you freely, specifically, informedly, and unequivocally consent to the collection, use, storage, disclosure, transfer, sharing, and other processing of your Personal Information by the Company as described in this Privacy Policy.

This Privacy Policy constitutes the primary notice describing how the Company processes Personal Information. The purposes of processing, categories of Personal Information collected, legal bases for processing, categories of recipients, international data transfers, retention periods, data subject rights, account deletion procedures, and security measures are described in the relevant Sections of this Privacy Policy and form an integral part of your consent where consent is required by applicable law.

Where you choose to use Telegram-related functionality, certain information is processed independently by Telegram under Telegram's own Privacy Policy, Terms of Service, and other applicable policies. The Company is responsible only for Personal Information processed under its own control. Nothing in this Privacy Policy modifies or replaces Telegram's own privacy documentation.

Where consent is the applicable legal basis, you may withdraw your consent at any time using the methods described in this Privacy Policy. Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal and does not affect processing based on any other legal basis available under applicable law.

Nothing in this Section limits or replaces any rights available to you under applicable privacy legislation, including the GDPR, UK GDPR, LGPD, CCPA/CPRA, or other applicable laws. Information regarding your privacy rights and the procedures for exercising them is set out in Section 11 (Your Privacy Rights) and Section 16 (Region-Specific Privacy Rights).

2. Scope of this Privacy Policy

This Privacy Policy applies to all personal information processed by the Company through the Services.

It does not apply to:

• third-party websites;
• third-party applications;
• independent payment providers;
• Telegram's own services;
• Apple;
• Google;
• or any other third party that independently determines the purposes and means of processing personal information.

Where you use Telegram-related functionality, Telegram independently processes certain information under its own Privacy Policy and Telegram API Terms of Service. The Company is responsible only for personal information processed under its own control.

3. Information We Collect

The categories of information we collect depend on how you use the Services. We may collect information:

• directly from you;
• automatically through your use of the Services;
• from third-party providers;
• through Telegram where you choose to use Telegram functionality; and
• through Cookies and similar technologies.

3.1 Information You Provide

You may voluntarily provide information including:

Account Information: full name; username; email address; telephone number; password or authentication credentials; profile photograph; language preferences; account settings.

Subscription Information: subscription plan; billing information; payment confirmations; purchase history. The Company does not store complete payment card details where payments are processed by independent payment processors.

User Content: prompts; conversations; text; uploaded files; PDF documents; Word documents; spreadsheets; images; photographs; audio recordings; videos; AI instructions; feedback; support requests; survey responses.

You remain responsible for ensuring that you possess all necessary rights and permissions to provide any information relating to third parties.

3.2 Information Collected Automatically

When you access or use the Services, we automatically collect certain technical information. This may include:

Device Information: device identifiers; operating system; browser type; application version; device model; language settings; mobile carrier.

Usage Information: features used; interactions with AI; timestamps; pages viewed; session duration; clickstream information; navigation events; search history within the Services; feature preferences.

Log Information: IP address; authentication logs; diagnostics; crash reports; performance metrics; security logs; fraud detection signals.

Approximate Location: We may infer approximate geographic location from your IP address for purposes including fraud prevention, localization, legal compliance, and analytics. We do not collect precise GPS location unless separately requested and authorized.

3.3 Information Received from Third Parties

We may receive personal information from authentication providers, identity verification providers, payment processors, cloud hosting providers, analytics providers, customer support providers, marketing providers, fraud prevention services, business partners, and publicly available sources.

Such information may include authentication tokens, subscription status, payment confirmations, publicly available profile information, device identifiers, and fraud indicators. We process such information only where necessary for purposes described in this Privacy Policy.

3.4 Information Received Through Telegram

Certain functionality is made available through the Telegram API. Where you choose to interact with the Services using Telegram, we may receive: Telegram User ID, Telegram username, profile information made available through Telegram, messages intentionally sent to the Service, prompts, uploaded files, images, voice messages, documents, and technical authentication information necessary to process requests.

We collect only the information reasonably necessary to provide Telegram-related functionality. We do not attempt to obtain information beyond permissions expressly granted by Telegram and your interactions with the Services. Telegram independently processes personal information under its own Privacy Policy. Deletion of your Cloud Robot account does not delete your Telegram account.

3.5 Cookies and Similar Technologies

We use Cookies and similar technologies to operate the Services, authenticate users, remember preferences, improve functionality, analyze Website usage, maintain security, and personalize user experience where permitted by law. Where required by applicable law, non-essential Cookies remain disabled until you provide affirmative consent. Further information is provided in Section 7.

4. How We Use Personal Information

The purposes described in this Section constitute the purposes for which the Company processes Personal Information under this Privacy Policy. Where consent constitutes the applicable legal basis for processing, your consent applies to the processing activities described in this Section.

We use personal information only where there is an appropriate legal basis and only for legitimate business purposes. Depending upon how you use the Services, personal information may be processed to:

Provide the Services: create user accounts; authenticate users; provide AI functionality; provide Telegram functionality; synchronize user settings; manage subscriptions; provide customer support; maintain account security.

Improve the Services: fix software defects; improve usability; optimize performance; improve accessibility; develop new functionality; evaluate reliability; monitor system performance.

Security: prevent fraud; detect abuse; identify unauthorized access; investigate security incidents; enforce our Terms of Service; protect users; protect infrastructure.

Communications: account activity; technical support; service announcements; legal notices; security incidents; privacy requests; account deletion requests. Where permitted by law, we may also send newsletters, surveys, and promotional communications. You may opt out of marketing communications at any time.

Legal Compliance: comply with applicable laws; respond to judicial proceedings; comply with governmental requests; establish, exercise, or defend legal claims; protect rights, safety, and property.

Research and Product Improvement: Subject to applicable law, anonymized or otherwise lawfully processed information may be used to improve AI systems, improve Service performance, conduct testing, perform statistical analysis, improve security, and evaluate new functionality. Information obtained through Telegram is never used to train or improve AI models unless expressly permitted under Telegram's applicable Terms of Service and policies.

5. AI Processing and User Content

Artificial intelligence functionality is a core component of the Services. To provide AI-powered features, the Company processes prompts, conversations, uploaded files, images, documents, audio recordings, generated outputs, and other content that you voluntarily submit through the Services ("User Content").

5.1 How AI Processes User Content

Depending on the functionality you use, User Content may be processed to generate responses, answer questions, summarize information, draft documents, translate content, analyze uploaded materials, generate recommendations, classify or organize information, improve readability and formatting, detect malicious or abusive content, identify technical errors, maintain service reliability, monitor system performance, prevent fraud and misuse, and comply with applicable legal obligations.

Processing may be carried out using artificial intelligence models operated by the Company and, where applicable, carefully selected third-party AI infrastructure providers acting solely on the Company's instructions.

5.2 User Responsibilities

You are solely responsible for User Content that you submit through the Services. By submitting User Content, you represent and warrant that you have all necessary rights and permissions to submit such content, submission does not violate applicable law or infringe third-party rights, and where personal information of another individual is included, you have an appropriate legal basis to provide such information.

5.3 AI Model Improvement

Where permitted by applicable law, the Company may use lawfully processed information to evaluate model performance, improve response quality, identify software defects, improve security, develop new AI functionality, test new features, conduct quality assurance, and perform statistical analysis. Where required by applicable law, such processing will occur only with an appropriate legal basis and using anonymized or de-identified information where technically feasible.

5.4 Telegram Data Restrictions

The Company strictly complies with the Telegram API Terms of Service. Accordingly:

• information obtained through Telegram is processed solely for providing the requested Telegram-related functionality;
• Telegram-derived information is not used to train, fine-tune, develop, improve, benchmark, or evaluate artificial intelligence or machine learning models except where expressly permitted under Telegram's applicable policies;
• the Company does not attempt to circumvent Telegram's technical or privacy controls;
• Telegram-derived information is not sold or licensed to third parties.

5.5 Human Review

To maintain quality, safety, and security, authorized personnel may review limited portions of User Content where reasonably necessary to investigate abuse, respond to support requests, diagnose technical problems, detect fraud, maintain security, or comply with legal obligations. Access is limited to personnel with an appropriate business need and subject to confidentiality controls.

6. Legal Bases for Processing Personal Information

Where the GDPR, UK GDPR, LGPD, or similar legislation applies, the Company processes personal information only where an appropriate legal basis exists.

6.1 Performance of a Contract: Processing is necessary to create and maintain user accounts, authenticate users, provide the requested Services, AI functionality, and Telegram functionality, process subscriptions, and provide support.

6.2 Consent: Where required by applicable law, including the LGPD, the Company processes certain categories of Personal Information based on your freely given, specific, informed, and unambiguous consent (e.g. optional analytics, marketing, optional AI features). Consent may be withdrawn at any time.

6.3 Legitimate Interests: Where permitted by applicable law, processing may occur for legitimate interests such as improving the Services, maintaining security, preventing fraud, protecting infrastructure, and enforcing rights.

6.4 Compliance with Legal Obligations: Processing necessary to comply with applicable legislation, judicial orders, tax, accounting, anti-money laundering, or data protection laws.

6.5 Vital Interests: Where necessary to protect the vital interests of an individual.

7. Cookies and Similar Technologies

The Company uses Cookies and similar technologies (HTTP Cookies, Session Cookies, Persistent Cookies, Local Storage, Session Storage, SDKs, Pixels, Web Beacons, Device Identifiers) to improve functionality, security, performance, and usability.

Categories of Cookies used:

• Strictly Necessary Cookies: Required for operation (authentication, security, fraud prevention, load balancing). Cannot be disabled.
• Functional Cookies: Remember preferences (language, accessibility, interface configuration).
• Analytics Cookies: Help understand website traffic, feature usage, and performance metrics (Google Analytics, Firebase, Microsoft Clarity, Matomo).
• Performance Cookies: Evaluate application stability and server response times.
• Advertising Cookies: Personalize advertising and measure campaign effectiveness where permitted by law and consent.

8. How We Share Personal Information

The Company does not sell personal information except where expressly disclosed or permitted by law. We may disclose personal information in the following circumstances:

• Service Providers: Shared with trusted providers assisting us in operating the Services (cloud, AI infrastructure, payment processors, analytics, customer support, cybersecurity). All providers are contractually bound to process data solely on our instructions.
• Corporate Transactions: In connection with mergers, acquisitions, investments, reorganizations, asset sales, or due diligence.
• Legal Compliance: To comply with applicable laws, judicial proceedings, governmental requests, or to protect rights, safety, and property.
• With Your Consent: When expressly authorized or instructed by you.
• Telegram: Data transmitted through Telegram solely to provide requested functionality under Telegram's independent platform terms.

9. International Data Transfers

Because the Services operate globally, personal information may be transferred to, stored in, or processed in countries other than your residence. Where required by law, we implement appropriate safeguards including Standard Contractual Clauses (EU/UK), adequacy decisions, and supplementary technical and organizational controls.

10. Data Retention

The Company retains personal information only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy or as required by law.

10.2 AI Content: Prompts, conversations, uploaded documents, and outputs are retained only as long as reasonably necessary to provide functionality, maintain quality, diagnose issues, or comply with legal claims.

10.3 Telegram Information: Retained only as long as necessary to provide Telegram functionality. Never retained for AI model training.

10.4 Backup Systems: Encrypted backup copies in disaster recovery systems remain for up to 90 days following deletion, after which they are automatically overwritten or permanently deleted.

11. Your Privacy Rights

Depending on your jurisdiction, you may have rights including access, rectification, erasure, restriction, objection, consent withdrawal, data portability, and lodging complaints with a supervisory authority.

12. Account Deletion

The Company provides users with the ability to permanently delete their account and associated personal information.

12.1 Requesting Account Deletion

Through the Application: Open App → Settings → Account → Delete Account → Confirm.

Through Customer Support: Send an email to privacy@larchie.com.

12.3 Processing & Impact

Following identity verification, most personal information associated with the account will be permanently deleted or irreversibly anonymized within 30 days. Active subscriptions on third-party stores (Apple App Store, Google Play) must be canceled directly with the respective platform.

12.7 Information That May Continue to Be Retained

Certain records may be retained post-deletion where required by law (payment records, invoices, tax records, cybersecurity logs, litigation materials).

12.8 AI Content & Telegram Deletion

Deletion permanently removes or anonymizes AI conversations and uploaded files. Deletion of a Cloud Robot account does not delete your Telegram account or Telegram-hosted data.

13. Security

We implement administrative, technical, physical, and organizational safeguards including SSL/TLS transit encryption, rest encryption for sensitive data, role-based access control, multi-factor authentication, network segmentation, vulnerability testing, and disaster recovery procedures.

14. Children's Privacy

The Services are intended for individuals who have reached the minimum age required under applicable law. We do not knowingly collect personal information from children without appropriate parental authorization.

15. Third-Party Services

The Services may integrate with third parties (Telegram, payment gateways, analytics providers, AI infrastructure). Third parties operate under their own privacy policies and terms of service.

16. Region-Specific Privacy Rights

16.1 EEA, UK and Switzerland (GDPR/UK GDPR): Rights to access, rectifying, erasure, restriction, objection, portability, and complaining to supervisory authorities.

16.2 California Residents (CCPA/CPRA): Right to know, access, correct, delete, limit use of sensitive data, and non-discrimination. We do not sell personal data.

16.3 Brazil (LGPD): Right to confirm processing, access, correction, anonymization, portability, consent revocation, and review of automated decisions. The Company designates a DPO/Encarregado where required.

17. Telegram API Compliance

We process Telegram data strictly for service operation and support. We collect the minimum required data, never train AI models on Telegram-derived data, never sell Telegram data, and do not bypass Telegram controls.

18. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time. Material changes will be communicated via website publication, in-app notices, or email updates. The "Last Updated / Effective Date" at the top indicates the date of the latest revision.

19. Contact Information

If you have any questions regarding this Privacy Policy, wish to exercise your privacy rights, or submit an account deletion request, please contact us:

20. Supervisory Authorities

Nothing in this Privacy Policy limits your statutory rights under data protection laws. You maintain the right to submit a complaint directly to the competent data protection supervisory authority in your jurisdiction.