KattyC Privacy Policy

1. Information We Collect

We collect only the minimum information necessary to provide and improve our services.

(a) Voice & Audio Data

• Voice Input: Your spoken questions or responses recorded via the device microphone.
• Speech Recognition (ASR): Your voice is transcribed into text for understanding and generating a response.
• Speech Output (TTS): AI-generated voice replies are created for natural dialogue.

Purpose: To enable two-way voice communication, understand user intent, and deliver accurate responses.

(b) Learning Interaction Data

• Questions asked, answers provided, and study session history.
• Contextual metadata (timestamp, feature usage, progress data).
• Feedback or ratings provided by you.

Purpose: To personalize your learning experience and continuously improve AI tutoring quality.

(c) Account & Profile Information (if applicable)

• - If you log in with your Apple account: basic personal profile information, such as your name and Apple ID.
• - If you are using a test account: no personally identifiable data will be collected.

Purpose: For authentication, account linking, and personalized learning analytics.

(d) Device & Technical Data

• Device type, operating system, app version, IP address, and crash logs.
• Cookies or local storage for maintaining session states.

Purpose: To maintain security, optimize performance, and improve reliability.

2. How We Use Your Information

We use the collected data only for legitimate educational and technical purposes:

1. To provide AI-driven voice tutoring using LLM, ASR, and TTS technologies.
2. To retrieve relevant course materials using Retrieval-Augmented Generation (RAG).
3. To personalize feedback and improve academic support.
4. To conduct anonymous research and analytics for academic improvement.
5. To comply with legal obligations and institutional requirements.

3. Data Storage & Retention

• All data is stored on secure, access-controlled servers located in compliant regions (e.g., Hong Kong or equivalent jurisdictions).
• Audio data may be processed into text and anonymized; original recordings are periodically deleted.
• We retain data only as long as necessary to fulfill the purposes stated in this policy.

4. Data Security

We implement strong security measures to protect your information, including:

• Encryption in transit (HTTPS/TLS)
• Access control and authentication
• Anonymization and pseudonymization
• Regular security reviews

Despite these measures, no system is 100% secure. We will promptly notify affected users and authorities in case of a data breach as required by law.

5. Sharing and Disclosure

We do not share your personal data with third parties except:

1. Educational Institutions (e.g.,South China Agricultural University) – for authorized academic use, progress tracking, and quality assurance.
2. Service Providers – to operate AI models (LLM, ASR, TTS) under strict data protection agreements.
3. Legal Compliance – when required by applicable law, regulation, or court order.

All third-party processors are contractually bound to protect your data and may not use it for independent purposes.

6. AI Services

We use the Doubao AI model (Doubao-seed-1-6-vision) provided by Volcano Engine to enable pet image recognition and auxiliary veterinary consultation features.

When you use the relevant AI features, we will transmit the pet images you actively upload and the consultation text you enter (collectively referred to as "Analysis Content") to Volcano Engine for processing. This data consists of non-sensitive, non-personal information and is used solely to generate analysis results. We do not use this data for AI model training or any other purposes.

Data Recipient: Volcano Engine (a service provided by ByteDance). We have entered into a Data Processing Agreement with Volcano Engine, requiring them to process the data in accordance with the same privacy standards as us and to strictly comply with their Doubao Model Service Agreement.

You will see a clear information disclosure and consent prompt before using any AI feature, and you may choose whether to proceed.

7. Your Rights

Depending on your jurisdiction (e.g., the Hong Kong PDPO, the Turkish KVKK, the EU GDPR), you have the following rights:

• Right of Access: Obtain a copy of your personal data.
• Right to Rectification: Correct inaccuracies.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your data.
• Right to Withdraw Consent: Stop further processing at any time.
• Right to Data Portability: Request your data in a structured, machine-readable format.

To exercise these rights, contact us using the details below.

8. Children and Students

Our App is intended for students and educational use only.

• If you are under 18, you must use the App under supervision or with consent from a parent, guardian, or institution.
• We do not knowingly collect personal data from minors without proper authorization.

9. International Data Transfers

If data is transferred outside of Hong Kong, we ensure that adequate protection (e.g., standard contractual clauses, encryption) is in place in compliance with the PDPO, the KVKK, and, where applicable, the GDPR.

10. Updates to This Policy

We may update this Privacy Policy periodically to reflect technical, legal, or operational changes. The latest version will always be available within the App and on our website.

• Material changes will be notified clearly in-app before becoming effective.

11. Compliance with Hong Kong and Turkish Law

We are committed to complying with the applicable laws and regulations of the jurisdictions in which we operate, in particular the laws of Hong Kong and the laws of Turkey. Where any provision of this Privacy Policy conflicts with a mandatory requirement of Hong Kong or Turkish law, that mandatory requirement prevails.

(a) Hong Kong

• We process personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) and the six Data Protection Principles set out in it.
• We collect personal data only for lawful purposes directly related to our functions and activities, and we take all reasonably practicable steps to protect it against unauthorised or accidental access, processing, erasure, loss, or use.
• You may request access to and correction of your personal data by contacting us, and you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD).

(b) Turkey

• We process personal data in accordance with the Personal Data Protection Law No. 6698 (KVKK), including the general principles in Article 4 and the legal grounds for processing in Articles 5 and 6.
• Where we rely on your explicit consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Data subjects in Turkey may exercise the rights set out in Article 11 of the KVKK (including the rights to learn whether their personal data is processed, to request information, correction, or erasure, and to object to results arising from automated analysis) by contacting us.
• Where personal data is transferred outside Turkey, we ensure an adequate level of protection as required by the KVKK, including the safeguards published by the Personal Data Protection Authority.

(c) Consumer Rights

Nothing in this Privacy Policy limits any consumer rights you may have under the laws of Hong Kong or Turkey, including rights under the Trade Descriptions Ordinance (Cap. 362) of Hong Kong and the Law on the Protection of Consumers No. 6502 of Turkey.

(d) Complaints

If you believe your data protection rights have been infringed, you may contact us first using the details in Section 12, or lodge a complaint with the competent supervisory authority, including the PCPD in Hong Kong or the Personal Data Protection Authority in Turkey.

12. Contact Us