Privacy Policy

1. Who We Are

We have designated a Data Protection Officer in accordance with Singapore’s Personal Data Protection Act 2012 (“PDPA”). You may contact our Data Protection Officer using the Data Protection Contact above.

• Organisation: KOTOBAAI PTE. LTD.
• Registered Address: 160 Robinson Road #14-04 Singapore Business Federation Center Singapore 068914
• Data Protection Contact: privacy@kotobaai.ltd
• Support Contact: support@kotobaai.ltd

2. Scope

This Privacy Policy applies when you:

1. create or use an account;
2. use the Service;
3. submit topics, answers, notes, profile information, brand information, images, or other content materials;
4. receive Generated Content;
5. subscribe, pay, cancel, or manage billing;
6. use Promotional Credits or Paid Plan Credits;
7. use a trial, beta version, research version, experimental feature, referral credit, coupon, discount, or promotional access;
8. contact us for support;
9. visit our website, landing pages, app, or marketing pages;
10. interact with our AI-assisted, workflow, automated processing, administrative, or content-generation systems.

3. Key Definitions

For the purposes of this Privacy Policy:

A user account may contain both Promotional Credit Content and Paid Plan Content. We classify each content-generation request based on the credit or access type used for that request at the time the request begins. Subscribing to a paid plan later does not automatically change the classification of content previously submitted using Promotional Credits.

The classification of each content-generation request is determined by our internal account, billing, credit, request, and system records. The applicable data-use category is based on the credit or access type used when the request begins.

This Privacy Policy and the Terms of Service are the primary notices for the privacy and data-use rules that apply to Promotional Credit Use and Paid Plan Use. Except where required by applicable law, we are not required to display a separate request-level privacy notice each time a user starts or submits a content-generation request.

1. “Promotional Credits” means credits or access granted without direct monetary payment for the relevant content-generation request, including free credits, trial credits, beta credits, research credits, experimental credits, promotional credits, referral credits, or any credits that we designate as promotional.
2. “Paid Plan Credits” means credits provided as part of an active paid subscription or credits purchased for monetary payment, unless we designate those credits as promotional.
3. “Promotional Credit Use” means a content-generation request, workflow, submission, processing activity, or output created using Promotional Credits.
4. “Paid Plan Use” means a content-generation request, workflow, submission, processing activity, or output created using Paid Plan Credits.
5. “Promotional Credit Content” means User Content, answers, notes, reflections, examples, personal stories, drafts, generated outputs, image-related inputs and outputs, feedback, usage data, and related data submitted, created, generated, stored, or processed in connection with Promotional Credit Use.
6. “Paid Plan Content” means User Content, answers, notes, reflections, examples, personal stories, drafts, generated outputs, image-related inputs and outputs, feedback, usage data, and related data submitted, created, generated, stored, or processed in connection with Paid Plan Use.

4. Personal Data We Collect

We may collect the following categories of personal data.

Account and Billing Data

This may include your name, email address, login identifiers, account settings, authentication information, payment provider customer ID, subscription status, plan, credits, payment status, invoices, billing address, or tax information.

We do not store full payment card numbers, CVC codes, or full payment credentials. Those are processed by Stripe or another payment provider.

Service Content

We may collect and process content and materials you submit or generate through the Service, including:

Service Content may contain personal data if you include it. You must not submit confidential information, trade secrets, sensitive personal data, credentials, or third-party personal data unless you are authorised to do so and accept the applicable data-use terms.

1. topics, themes, answers, notes, instructions, examples, reflections, personal stories, and edits;
2. profile, brand, style, preference, and feedback information you provide;
3. generated drafts, generated text, image-related inputs and outputs, and related outputs;
4. service records such as request records, status records, operational identifiers, timestamps, and related service records.

Technical, Usage, and Communications Data

This may include IP address, device and browser information, log data, pages or features used, button clicks, workflow events, error reports, approximate location derived from IP address, cookies, pixels, tags, API records, integration records, automated processing records, prompt metadata, workflow metadata, output metadata, quality-related metadata, emails, support requests, feedback, survey responses, and marketing communication preferences.

5. How We Provide the Service

We may operate the Service through our own systems and third-party service providers, including hosting providers, database providers, workflow providers, AI providers, content-generation providers, payment processors, analytics providers, communication providers, support providers, administrative tools, automated processing tools, and other service providers.

The Service may be manual, semi-automated, or automated. We may change the technical architecture, tools, service providers, workflows, automation level, storage location, data flow, or delivery method of the Service from time to time, subject to this Privacy Policy, the Terms of Service, and applicable law.

Any description of a current workflow is descriptive only and is not a commitment to maintain that architecture.

6. Purposes of Processing

We use personal data to:

1. create and manage accounts;
2. authenticate users and secure the Service;
3. provide, operate, maintain, automate, and improve the Service;
4. generate questions, drafts, image suggestions, recommendations, and related outputs;
5. review, edit, and deliver Generated Content;
6. manage subscriptions, credits, billing, invoices, and payment status;
7. provide customer support;
8. detect, prevent, and investigate fraud, abuse, security incidents, and technical issues;
9. analyse usage, performance, product quality, and output quality;
10. send service-related notices and permitted marketing communications;
11. advertise and market the Service, especially in connection with Promotional Credit Use, public websites, landing pages, and marketing pages;
12. support financing, due diligence, investment, merger, acquisition, sale, business transfer, asset transfer, product transfer, restructuring, or similar transactions;
13. comply with legal, regulatory, accounting, tax, dispute, and enforcement obligations.

7. Paid Plan Use

Paid Plan Use is subject to stronger privacy protections than Promotional Credit Use. This Privacy Policy and the Terms of Service are the primary notices for how Paid Plan Content is handled.

For Paid Plan Use, we use Paid Plan Content primarily to provide the Service, generate and deliver outputs, operate automated processing, provide support, maintain security, comply with law, improve service quality, and support business transfers.

We do not use Paid Plan Content to create advertisements, advertising copy, landing page copy, marketing examples, retargeting audiences, cross-context behavioural advertising, or public case studies without your explicit permission.

We do not use identifiable Paid Plan Content to train or fine-tune our own AI models, create model-training datasets, or train third-party public AI models, unless we obtain your separate explicit consent or we provide another lawful basis and notice where required by applicable law.

We may use de-identified, aggregated, or abstracted learnings from Paid Plan Content to improve prompts, workflows, product design, quality control, automated processing, and service operations, provided that we do not identify, publicly disclose, or market using a specific paid user without permission.

Paid Plan Use is designed for stronger privacy protection than Promotional Credit Use. However, the Service is not designed to receive highly confidential, privileged, regulated, or sensitive information.

8. Promotional Credit Use

Promotional Credit Use is subject to broader data-use rules than Paid Plan Use. These broader rules are part of the value exchange for promotional, free, trial, beta, research, experimental, referral, discounted, or unpaid access.

Promotional Credit Content may include inputs, answers, notes, reflections, examples, personal stories, drafts, generated outputs, image-related inputs and outputs, feedback, usage data, and related data.

We may use, analyse, review, adapt, excerpt, transform, summarise, incorporate, and create derivative works from Promotional Credit Content for:

We will not intentionally publish your legal name, company name, contact details, profile URL, photograph, likeness, voice, or the fact that you use the Service in marketing, case studies, sales materials, social media, or public examples without your explicit permission, and we will take reasonable steps designed to prevent such publication.

We also will not intentionally publish Promotional Credit Content in a form that reasonably identifies you or your company as a specific user or case study without your explicit permission. However, Promotional Credit Content may be used, reviewed, adapted, excerpted, transformed, paraphrased, summarised, or incorporated into marketing or advertising materials in a non-identifying or modified form.

Promotional Credit Content may be accessed by KOTOBAAI personnel, approved contractors, editors, engineers, advertising providers, analytics providers, support providers, AI providers, content-generation providers, and other service providers where reasonably necessary for product, AI, marketing, advertising, analytics, quality control, support, security, legal, operational, or business purposes.

Information about the data-use rules that apply to Promotional Credit Use and Paid Plan Use is set out in the Terms of Service and this Privacy Policy, and may also be made available on our website, pricing page, help pages, or other materials. We may, but are not required to, provide additional notices in the Service, by email, or at the time of use.

You must not submit confidential information, trade secrets, sensitive personal data, credentials, or third-party personal data when using Promotional Credits.

1. product development, testing, evaluation, and improvement;
2. prompt, workflow, user experience, automation, and quality improvement;
3. improving AI-related features, prompts, quality evaluation, and internal product development;
4. using AI providers, content-generation providers, APIs, tools, or service plans whose data-use terms may allow provider review, retention, training, or model improvement;
5. creating marketing messages, landing page copy, advertising copy, examples, positioning, market research, audience insights, and campaign materials;
6. using answers, notes, reflections, examples, personal stories, drafts, generated outputs, and feedback as source material for advertising, marketing, landing page copy, product messaging, and campaign development;
7. building, testing, or measuring advertising, retargeting, analytics, pixels, tags, cookies, or similar technologies;
8. creating de-identified, aggregated, paraphrased, transformed, or derived data for commercial, product, marketing, research, AI, or operational purposes.

9. AI, Service Providers, and Human Review

We may use AI providers, content-generation providers, workflow tools, automated processing tools, and human reviewers to process Service Content and generate or edit outputs.

For Paid Plan Use, where commercially and technically reasonable, we use AI providers, APIs, settings, or service plans designed not to use Paid Plan Content to train public or third-party AI models.

For Promotional Credit Use, we may use AI providers, content-generation providers, APIs, tools, or service plans that may process, retain, review, or use inputs, outputs, images, prompts, feedback, or usage data for model improvement, training, evaluation, safety, abuse monitoring, or other provider purposes, subject to the provider’s applicable terms.

Service Content and Generated Content may be reviewed by KOTOBAAI personnel, approved contractors, editors, engineers, support providers, and other service providers only on a need-to-know basis for service delivery, automated processing, content review, quality control, support, troubleshooting, security, legal compliance, maintenance, or business transfer purposes.

10. Advertising, Analytics, and Marketing

We may use analytics, cookies, pixels, tags, retargeting tools, advertising platforms, and similar technologies on public websites, landing pages, Promotional Credit Use flows, trials, beta versions, research versions, experimental features, and marketing pages.

For Promotional Credit Use, we may use Service Content, answers, notes, reflections, examples, personal stories, generated outputs, feedback, and usage data to create, test, measure, and improve advertising, marketing messages, landing pages, audience insights, and campaigns.

We do not currently use Paid Plan Content to create advertising, retargeting audiences, cross-context behavioural advertising, or marketing examples without your explicit permission. We do not currently place advertising pixels or cross-context behavioural advertising technologies inside Paid Plan Use content-submission screens or Paid Plan Use generated-content display pages.

If we use advertising or retargeting technologies that constitute “sale” or “sharing” of personal information under applicable privacy laws, and such laws apply to us, we will provide notices and choices where required by law.

You may opt out of marketing emails by using the unsubscribe link or contacting us. We may still send non-marketing service, billing, security, or legal notices.

11. Disclosure of Personal Data

We may disclose personal data, Service Content, and Generated Content to:

Service providers, contractors, and other parties that process personal data on our behalf are bound by contractual confidentiality and data protection obligations and may process personal data only as necessary to perform services for us or as required by law, consistent with the PDPA’s requirements for data intermediaries. Disclosures to regulators, courts, law enforcement, public authorities, and transaction parties are made subject to applicable legal protections and, where appropriate, confidentiality undertakings.

1. hosting, cloud, database, and infrastructure providers;
2. workflow tool providers;
3. AI service providers and content-generation providers;
4. API, automation, and integration providers;
5. payment processors such as Stripe;
6. email, support, analytics, advertising, and communication providers;
7. contractors, editors, engineers, support providers, and operations providers;
8. professional advisers, including lawyers, accountants, auditors, consultants, investors, and due diligence advisers;
9. regulators, courts, law enforcement, or public authorities where required or permitted by law;
10. parties involved in financing, investment, merger, acquisition, reorganisation, sale of shares, sale of assets, sale of business, product transfer, business transfer, insolvency-related process, or similar transaction.

12. Business Transfers

We may disclose or transfer personal data, Promotional Credit Content, Paid Plan Content, Generated Content, account data, subscription records, billing-related records, operational records, and related data in connection with any merger, acquisition, financing, due diligence, reorganisation, sale of shares, sale of assets, sale of business, product transfer, business transfer, insolvency-related process, or similar transaction.

This may include disclosure to potential or actual investors, acquirers, purchasers, successors, affiliates, advisers, and their representatives.

Any successor or acquirer may continue to process personal data, Promotional Credit Content, Paid Plan Content, and Generated Content in accordance with this Privacy Policy, applicable law, and any updated privacy policy or notice made available by that successor or acquirer, subject to Section 18 (Changes and Contact), including the notice, consent, and choice commitments that apply to material changes affecting Paid Plan Content.

13. International Transfers

We are based in Singapore. Your personal data may be processed in Singapore and in other countries where we or our service providers operate, which may include Japan, the United States, the European Economic Area, the United Kingdom, and other jurisdictions.

Where required by applicable law, including Singapore’s Personal Data Protection Act 2012, we will take reasonable steps designed to ensure that personal data transferred outside Singapore receives a standard of protection comparable to the protection under Singapore data protection law. These steps may include contractual safeguards, due diligence, access controls, vendor review, or other lawful transfer mechanisms.

14. Retention

We retain personal data, Service Content, and Generated Content only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted for legal, tax, accounting, security, fraud prevention, dispute, backup, business transfer, or operational reasons.

As a general guide:

We aim to avoid storing user-submitted content materials, answers, reflections, personal examples, or full Generated Content in technical logs where reasonably practicable.

1. account data is retained while your account remains active and for a reasonable period after closure;
2. billing and transaction records are retained for the period required for tax, accounting, audit, and legal purposes;
3. generated content and formal content history are retained while your account remains active, unless deleted earlier where legally and technically feasible;
4. working materials related to Paid Plan Use, including content materials, answers, notes, instructions, drafts, prompts, and related working data, are generally retained for a limited period after delivery or closure of the relevant request, unless longer retention is needed for support, dispute, security, legal, product, quality control, automation, or operational reasons;
5. Promotional Credit Content may be retained for as long as reasonably necessary for product improvement, AI improvement, marketing, advertising, research, operational, legal, or business purposes, unless deletion is required by applicable law;
6. technical, operational, access, authentication, audit, error, fraud-prevention, API, automation, and security logs may be retained for up to three years, unless a longer period is required or permitted for security, fraud prevention, legal, accounting, tax, dispute, backup, business transfer, or operational reasons;
7. backups are retained for a limited backup cycle and then overwritten or deleted in the ordinary course.

15. Security

We use reasonable technical, organisational, and administrative measures to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, loss, or similar risks.

These measures may include access controls, administrative restrictions, password protection, managed payment providers, separation of identifiers, limiting data shared with service providers, and using test or dummy data for development where reasonably practicable.

No system is completely secure, and we cannot guarantee absolute security.

16. Your Rights and Requests

Subject to applicable law, you may request access to personal data that we hold about you and request correction of inaccurate personal data.

You may also contact us to ask about deletion, de-identification, withdrawal of consent, restriction of processing, marketing opt-out, or other privacy-related requests. In particular, you may withdraw any consent you have given for the collection, use, or disclosure of your personal data at any time by giving us reasonable notice. If you withdraw consent, we will inform you of the likely consequences, which may include our inability to continue providing some or all of the Service, and we will cease (and cause our data intermediaries to cease) the relevant collection, use, or disclosure, except where retention or processing remains required or authorised under applicable law. For other requests, we will respond where required by applicable law and, where not legally required, we may respond where reasonably practicable and appropriate for our Service.

Some requests may be refused, limited, or delayed where permitted by law, including where necessary for security, fraud prevention, legal compliance, accounting, tax, dispute handling, business transfer, backup, product operation, service delivery, quality control, automation, or operational reasons.

For Promotional Credit Content, deletion or withdrawal requests may not remove materials, insights, models, datasets, advertising materials, marketing materials, de-identified data, aggregated data, or derivative works that were created, used, published, or incorporated before we processed the request, unless deletion is required by applicable law.

Depending on your location, additional privacy rights may apply. For example, certain laws may provide rights to request information about how personal data is collected, used, disclosed, sold, or shared; to request deletion or correction; to opt out of certain marketing or advertising uses; or to limit certain uses of sensitive personal information. These rights apply only to the extent the relevant law applies to us and to your personal data.

Additional Notice for Users in Japan (APPI)

If Japan’s Act on the Protection of Personal Information (“APPI”) applies to our handling of your personal information, the following applies in addition to the rest of this Privacy Policy. The business operator handling your personal information is KOTOBAAI PTE. LTD., 160 Robinson Road, #14-04, Singapore Business Federation Center, Singapore 068914, ISHIDE YUMI. The purposes for which we use personal information are set out in Section 6 (Purposes of Processing), and a summary of our security control measures is set out in Section 15 (Security); you may request further information about these measures using the Data Protection Contact below.

Provision to third parties in foreign countries: We are located in Singapore, and we use service providers located in Singapore, the United States, and other countries, as described in Sections 11 and 13. Where the APPI requires consent for the provision of personal information to a third party in a foreign country, we will obtain that consent after providing the information required by the APPI about the personal-information protection systems of the relevant country and the protective measures taken by the recipient, or we will instead ensure that the recipient continuously implements measures equivalent to the standards required under the APPI, in each case as required by the APPI. Where we entrust the handling of personal information to service providers, we will exercise necessary and appropriate supervision over them.

Retained personal data: Subject to the APPI, you may request notification of the purposes of use of, disclosure of, correction, addition, or deletion of, cessation of use of, and cessation of third-party provision of your retained personal data, and disclosure of records of provision to third parties. We will create and retain records of third-party provision where required by the APPI, and we will respond to requests and complaints within the timeframes and in the manner required by the APPI. Requests and complaints may be submitted to the Data Protection Contact below.

To submit a request, contact us at privacy@kotobaai.ltd. We may need to verify your identity before responding.

17. Children and Data Breach Assessment

The Service is not intended for children under 18. We do not knowingly collect personal data from children under 18. If you believe a child has provided personal data to us, contact us so we can take appropriate steps.

If we become aware of a data breach or suspected data breach involving personal data, we will assess the incident and take steps that we consider appropriate in the circumstances.

Where required by applicable law, we will notify the relevant authority and/or affected individuals.

18. Changes and Contact

We may update this Privacy Policy from time to time by posting the updated version or making it available through the Service.

We are not required to provide individual notice for ordinary operational, technical, vendor, service-provider, feature, architecture, workflow, automation, or product changes.

Where required by applicable law, or where we make a material change that significantly reduces the privacy protections applicable to Paid Plan Content, we will provide appropriate notice, obtain consent, or provide choices as required.

• KOTOBAAI PTE. LTD.
• Registered Address: 160 Robinson Road #14-04 Singapore Business Federation Center Singapore 068914
• Data Protection Contact: privacy@kotobaai.ltd
• Support Contact: support@kotobaai.ltd