AshLess AI Privacy Agreement

I. Introduction

AshLess AI (hereinafter also referred to as “we”) deeply understands the importance of user privacy, particularly regarding the protection of personal health information in smoking cessation scenarios. This Privacy Policy clearly outlines how we collect, use, disclose, and protect your personal information when you use the “AshLess AI” mobile application and its related services (the “Services”).

We are committed to complying with stringent global data protection laws and regulations, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), to provide you with a secure and reliable smoking cessation support service experience.

(1) Scope of Application

This Agreement applies to all services you use through this APP, including but not limited to:

• Registration and login
• Smoke-free duration tracking
• Achievement badge unlocking
• AI voice call reminders
• Quit-smoking calendar planning
• AI companion group chats

Please note that if you access third-party platforms (such as official websites of professional smoking cessation organizations or health information platforms) via this APP to use related services, those services will be governed by the third party's privacy policy. We recommend you carefully review the third party's privacy policy.

(II) Agreement Acceptance

By using this service, you acknowledge that you have fully read, understood, and agreed to the information processing methods described in this agreement. If you disagree with any part of this agreement, please discontinue using our services.

Upon agreement updates, your continued use of the service after the updated agreement takes effect constitutes your acceptance of the revised terms.

(III) Contact Us

II. Information We Collect

We collect only information necessary to provide our services and do not gather redundant data unrelated to smoking cessation assistance. This includes the following categories:

(1) Personal Identifying Information

Registration Information: When you register an account, you may voluntarily provide us with your name, email address, and profile picture (optional). This information is used to create your dedicated account, ensure smooth login, synchronize smoking cessation data, and send service notifications when necessary.

Third-Party Account Login Information: If you choose to log in using a third-party account (e.g., Google, Apple ID), we will obtain basic information authorized for sharing by that third-party account, such as your nickname and email address. This method aims to provide a convenient login experience and reduce the registration process.

(II) Smoking Cessation Information

User-provided content: Information you actively input while using the service related to quitting smoking, including but not limited to:

• Time of last cigarette (used to calculate smoke-free duration);
• Daily smoking volume and smoking history (used to generate personalized cessation recommendations);
• Cessation goals (e.g., “30 smoke-free days,” “reduce smoking by 50%”) for matching cessation plans;
• Daily status recorded in the quit calendar (e.g., “experienced mild withdrawal symptoms”);
• Text content sent in AI companion group chats (used for group interactions and AI assistant feedback).

Automatically generated data: Service-generated smoking cessation metrics include:

• Cumulative smoke-free duration, reduced cigarette consumption, and savings on tobacco costs;
• Unlocked achievement badge records (e.g., “7 Consecutive Smoke-Free Days”);
• AI voice reminder settings (e.g., reminder times, content types).

(3) Device and Usage Information

Device Information: To ensure service functionality and compatibility, we automatically collect basic device information including:

• IP address
• Device model
• Operating system version (e.g., iOS 17, Android 14)
• Unique device identifiers (e.g., iOS IDFV, Android AAID)
• Network status (e.g., Wi-Fi/mobile network)

Usage Data: We collect behavioral data during your app usage, including:

• App open/close times, access frequency of functional modules;
• Manual update frequency for smoke-free duration records, achievement badge unlock times;
• Function operation logs (e.g., number of times “Modify Quit Goal” was performed).

III. Purpose of Information Use

The information we collect is used exclusively for the following legitimate purposes and not for scenarios unrelated to smoking cessation support:

(1) Providing Core Smoking Cessation Services

Functionality: Based on your smoking cessation information, we provide tailored services including:

• Calculating and displaying cumulative smoke-free duration, reduced smoking volume, and savings on tobacco expenses;
• Triggering achievement badge unlocking (e.g., automatically awarding badges upon reaching set smoke-free days);
• Sending AI voice reminders at scheduled times with customized content;
• Synchronizing quit calendar data for cross-device viewing and editing.

Personalized Support: Tailored to your smoking history and quit goals, we offer customized assistance including:

• AI assistant providing targeted quit advice in group chats;
• Optimized quit calendar planning templates.

(2) Enhancing Service Quality

Functional Optimization: By analyzing device information and usage data, we improve service stability and convenience, including:

• Optimizing feature compatibility across different operating system versions;
• Adjusting feature design based on user habits (e.g., placing frequently used buttons prominently).

Service Iteration: Based on statistical analysis of smoking cessation-related data, iterate service content, including:

• Adding AI voice reminders tailored to user needs;
• Optimizing the achievement badge system to enhance smoking cessation motivation.

(3) Essential Service Notifications

Account & Security Alerts: Send necessary service notifications via your provided email address, including:

• Account login anomaly alerts (e.g., verification emails upon detecting logins from non-usual devices);
• Major service update notifications;
• Critical cessation milestone reminders (e.g., “5 days remaining until your 30-day smoke-free goal”).

(IV) Compliance Obligations

Record Retention: Retain necessary information as required by laws and regulations, including transaction records for paid services and account registration information.

Risk Prevention: Based on device information and usage data, identify and prevent abnormal usage behaviors (e.g., bulk account registration, malicious tampering with smoke-free duration records) to ensure service fairness and security.

IV. Information Sharing and Disclosure

We strictly control the scope of information sharing and only collaborate with third parties in the following necessary scenarios, ensuring your information security:

(1) Third-Party Service Providers

We only partner with third parties essential to delivering service functionality and clearly define their information protection obligations through agreements:

• Cloud Service Providers: We partner with compliant cloud providers like AWS and Google Cloud to store your account information and smoking cessation data on their encrypted servers. These providers are authorized solely for data storage.
• Payment Processors: If you use paid services, we share necessary transaction information (e.g., order amount, account email) with payment processors like Stripe and PayPal. We do not transmit your sensitive smoking cessation information.
• Data Analytics Providers: We may share anonymized usage data (e.g., “average daily app engagement time by region”) with analytics providers like Firebase. This data is de-identified and cannot be linked to specific users.

(2) Legal and Security Requirements

Legal Disclosure Requirements: Upon receiving lawful requests from government agencies or judicial authorities (e.g., subpoenas, court orders), we will disclose necessary information in compliance with the law. We rigorously review the legitimacy of such requests.

Interest Protection Disclosure: To protect your or other users' legitimate rights and interests (e.g., preventing fraud using accounts), we may disclose relevant information within a reasonable and necessary scope.

(3) Prohibition on Data Sales

We solemnly pledge never to sell any of your personal information, including personal identity details, smoking cessation-related data, device information, etc. This commitment strictly adheres to the “no sale of data” requirements under regulations such as the CCPA and GDPR. You retain full control over your information at all times.

V. Data Security and Storage

We implement multi-layered security measures to protect your information while strictly controlling data retention periods to ensure information is retained only for as long as necessary:

(1) Security Protection Measures

Data Encryption:

• Transmission Process: Utilizes SSL/TLS encryption technology to ensure your information cannot be intercepted or tampered with during transmission.
• Storage Process: Sensitive smoking cessation information is stored using AES-256 encryption. Access to decrypted data is restricted to authorized technical personnel who must pass multi-factor authentication.

Access Control:

• An internal access permission system is established, permitting data access only to personnel performing essential tasks. All access activities are logged and subject to regular audits.
• Third-party service providers require strict approval for access, granted only at the minimum privilege level necessary.

Security Monitoring:

• Regular security vulnerability scans and penetration tests are conducted to promptly address potential risks.
• An anomaly detection mechanism monitors bulk data access and unusual IP logins, triggering real-time alerts.

Please note: Despite our stringent security measures, internet transmission and electronic storage cannot guarantee 100% security. We cannot rule out the risk of data breaches caused by force majeure events. Should such an incident occur, we will notify you promptly as stipulated in this agreement.

(II) Data Retention Period

Personal Identifiable Information and Smoking Cessation-Related Information:

• We will retain this information for the duration of your account to ensure normal service operation.
• If you request account cancellation, we will delete all personal identifiable information and smoking cessation-related information within 15 business days after completing the cancellation process (except where required by laws and regulations).

Device Information and Usage Data:

• Device information is retained during your service usage period. If you remain inactive for 12 consecutive months, we will delete associated device identifier information.
• Usage data may be retained long-term for service optimization after anonymization (removal of all personal identifiers).

(3) Cross-Border Data Transfer

When cross-border data transfer is necessary for business purposes, we strictly comply with relevant laws and regulations by implementing the following compliance measures:

• Enter into cross-border data transfer agreements with overseas recipients that meet GDPR, China's Personal Information Protection Law, and other applicable requirements;
• Encrypt cross-border transmitted data to ensure secure transmission;
• Transmit data only to overseas recipients that have passed data protection capability assessments.

VI. Your Rights

In accordance with rights granted by regulations such as GDPR and CCPA, you may exercise the following rights when using this service, and we will provide convenient means for you to exercise them:

(1) Information Correction and Deletion

Information Correction: If you discover errors in your account information or smoking cessation-related details, you may modify them via the following methods:

• Account Information: Directly edit and modify in the app under “Settings - Account Information”;
• Smoking Cessation Information: Modify smoking history, cessation goals, etc., in the “Quit Calendar” or “Personal Center - Cessation Settings”.

Record Deletion: To delete specific quit-smoking records, manually remove them within the corresponding feature module. To delete all quit-smoking-related information, contact customer service for assistance. We will complete the deletion within 7 business days after verifying your identity.

(II) Account Cancellation

You may submit a cancellation request via the app under “Settings > Account Security > Account Cancellation.” The cancellation process is as follows:

1. The system will send a verification email to your registered email address to confirm your cancellation intent;
2. After you complete verification, the system will inform you of the data handling procedures post-cancellation;
3. Account closure will be completed within 3 business days after submission. Closed accounts cannot be reactivated.

(III) Obtaining Information Copies

If you require copies of your personal information (e.g., account details, smoking cessation records), contact customer service to submit a request. After verifying your identity, we will provide you with a readable copy of the information (e.g., a PDF summary of smoking cessation records) via encrypted email within 7 business days.

(IV) Withdrawing Consent

You have the right to withdraw your consent for information collection and use at any time. The specific methods are as follows:

• Withdraw consent for device information collection: Disable the app's “Device Information Access Permissions” in your mobile system settings;
• Withdraw consent for email notifications: Disable email notifications in the app's “Settings - Notification Management”;
• Withdraw consent for smoking cessation-related information collection: Cease using features requiring such data collection.

Please note: After consent withdrawal, we will cease collecting the corresponding information. However, previously collected data will be processed according to the storage period stipulated in this agreement and will not be immediately deleted.

(5) Security Notification Rights

If a personal information leak occurs that may impact your rights and the risk level reaches “High Risk,” we will notify you within 72 hours of discovery via:

• In-app pop-up notification;
• Email notification to your registered email address;

Concurrently, we will report to relevant regulatory authorities as required by law and implement remedial measures (e.g., freezing abnormal accounts, patching security vulnerabilities).

VII. Child Protection

This service is explicitly not intended for minors under the age of 13 and strictly complies with COPPA (Children's Online Privacy Protection Act) and GDPR regulations regarding the protection of children's information:

• We clearly label “Suitable for ages 13+” on the app registration page and app store detail page. Users must confirm they meet the age requirement during registration;
• If we discover during operation that a user is under 13, we will immediately cease collecting their personal information and delete stored data within 7 business days (except where required by law to retain it);
• If a guardian discovers unauthorized use of this service by a minor, they may contact customer service with proof of guardianship and the minor's account information. We will assist in account cancellation and data deletion.

VIII. Policy Updates

(1) Update Notification

Should this policy undergo changes, we will promptly notify you via app pop-ups, email (if provided), or other means. For significant changes (e.g., expanding data collection scope or altering information sharing methods that may substantially impact your rights), we will obtain your explicit consent before implementation.

(2) Effective Date of Changes

Revised policy provisions shall take effect after a reasonable period following notification. Your continued use of our services after changes take effect constitutes your acceptance of the updated privacy policy. Should you disagree with the revised policy, you may choose to discontinue our services and exercise your rights under this policy.