Boya OS - Data Security and Privacy Policy

Version: v4.0
Effective Date: September 30, 2026

Introduction

Shenzhen Comica Audio Technology Co., Ltd. ("we", "us" or "our") attaches great importance to user privacy and the protection of personal information. When you use our products and/or services, we may collect and use information relating to you. This Policy explains how we collect, use, store, share and transfer such information, and how you may access, update, delete and protect your information.

Please read this Policy carefully before using our products or services and confirm that you understand it. If you have any questions, please contact our customer support team.

This Policy explains the following:

1. How We Collect and Use Your Personal Information

We are committed to protecting the personal information you provide when using Boya OS. We collect, use, store and transfer personal information in accordance with applicable laws and regulations, and protect your information under privacy protection principles. Personal information means all kinds of information recorded electronically or otherwise that relates to an identified or identifiable natural person, excluding anonymized information.

Personal information includes basic information, such as nickname, region, email address and device number, and online identifiers, such as system account information.

Purposes for Collecting and Using Personal Information

We collect and use your personal information only for the following purposes:

1.1 Situations Where Your Authorization Is Required

These functions include:

1.2 Personalized Services and Service Quality Improvement

We may collect your order information, browsing information and interest data to recommend relevant services and provide a consistent experience across devices. The information collected may include:

1.3 Transaction Security

To improve system security, we may collect browsing information, order information and device information to assess account risks and record potential risk points.

1.4 Personal Information That May Be Collected Without Your Authorization

1.5 Rules for Using Personal Information

1.6 Clipboard

To ensure the normal operation of basic editing functions such as copy and paste, this product needs to access your clipboard. This is used to process text or links that you actively copy, so that you can edit content or quickly open web pages.

2. How We Share, Transfer and Publicly Disclose Your Personal Information

2.1 Sharing

We do not share your personal information with any company, organization or individual outside Shenzhen Comica Audio Technology Co., Ltd., except in the following circumstances:

We may share your information with affiliates or partners, but only for lawful, necessary and specific purposes, and we will enter into confidentiality agreements with them.

When you actively connect to and authorize a third-party AI application or other third-party service that supports the Model Context Protocol (“MCP”), we may provide the relevant third party with data from your Boya OS account, such as transcription text, meeting minutes, summaries, and to-do items, within the scope of the permissions you have granted, to enable the features you have requested. The specific types of data that can be accessed and the scope of permissions are subject to the authorization page displayed when you connect to and authorize the relevant third-party service and the actual features provided.

Data obtained through MCP may be processed by the relevant third party in accordance with its own terms of service and privacy policy. You may revoke previously granted access permissions through the relevant authorization management settings. After authorization is revoked, we will stop providing additional data to the relevant third-party service under that authorization. However, the subsequent storage, use, deletion, and other processing of data obtained by the third party before the revocation will remain the responsibility of that third party and will be governed by its own terms of service and privacy policy.

2.2 Transfer

We do not transfer your personal information to any company, organization or individual, except in the following circumstances:

2.3 Public Disclosure

3. How We Protect and Store Your User Data

3.1 Technical and Organizational Measures

3.2 How We Process Your User Data

3.3 How We Retain and Delete User Data

4. How You Manage Your Personal Information

You have the right to access, correct, delete and supplement your information, withdraw authorization, or cancel your account.

You may apply at any time to cancel the account registered in this product. The operation path is: go to My, tap the profile picture at the top, select Account and Profile, select Account Security, and follow the page prompts to complete account cancellation. Before account cancellation, your identity must be verified. After cancellation, we will stop providing services and delete your personal information, unless otherwise required by law.

4.1 Responding to Your Requests

If you cannot access, correct or delete your personal information through the methods above, or if you find that Boya OS has violated rules in collecting or using personal information, you may contact us through the contact details at the end of this Policy. We may require you to provide a written request or other identity verification, and will respond within 30 days after receiving your request. Reasonable requests are generally free of charge, but repeated or excessive requests may be charged. Exceptions apply where required by law or regulation, such as public interest, research, legal compliance or national security.

4.2 Obtaining a Copy of Personal Information

You have the right to obtain a copy of your personal information. You may apply through the contact details in Section 9, How to Contact Us. After verifying your identity, we will provide a copy to the extent permitted by law and technically feasible.

5. How We Process Children's Personal Information

Our products and services are mainly intended for adults. Children may not create accounts without the consent of a parent or guardian. If information of children under the age of 14 is collected without verifiable parental consent, we will delete the relevant data as soon as possible.

6. How Your Personal Information Is Transferred Globally

Because we maintain servers in the United States, your personal data may be processed on servers outside your country of residence. For example, personal data of users in Japan may be stored in the United States, and personal data of users in Canada may also be stored in the United States.

Because our business is international, your personal data may also be accessed by our affiliates, or transferred to third-party customer service providers and third-party SDK providers for the purposes described in this Notice. Accordingly, we may transfer personal data to other jurisdictions whose laws and data protection compliance requirements may differ from those applicable in your location.

Data protection laws vary by country, and some countries provide more protection than others. Regardless of where your personal data is processed, we apply the same safeguards described in this Notice.

When cross-border transfer of personal data occurs, where required by applicable law, we will provide adequate protection for your personal data through various means, including, where appropriate, reliance on an adequacy decision for a country, implementation of the European Commission's Standard Contractual Clauses and the UK International Data Transfer Agreement between our affiliates and third parties, or any other lawful mechanism that permits personal data to be transferred from those countries.

7. Notices and Updates

Boya OS may update this Policy to reflect changes in legal requirements or business practices, but will not reduce your rights. Material changes will be notified through prominent notices, including changes to service models, purposes of information processing, sharing recipients, methods for exercising rights, and contact details.

8. Transparency Statement on AI Features and Data Processing

This statement explains how Boya OS processes data related to AI features, including what data is processed, how data is stored and protected, who may access it, and what rights you have. This statement should be read together with the other sections of this Privacy Policy.

8.1 Types of Data Processed

When you use AI features, the data processed may include recordings, text generated by speech-to-text transcription, summaries and other AI-generated outputs, and queries you submit when using AI features.

8.2 AI Training Commitment

Unless Boya OS has obtained your express consent, Boya OS will not by default use your content, including recordings, transcribed text or summaries, to train, optimize or develop AI or machine learning models. When your data is processed by Boya OS's AI service providers, the contractual agreements signed between Boya OS and those providers prohibit them from using your data for model training or any secondary purpose.

8.3 AI Trigger Mechanism

AI features such as transcription and summarization are activated only when you actively initiate a request. Boya OS does not process your data in the background without action by you.

8.4 AI Service Providers

To provide AI features such as transcription and meeting minutes generation, Boya OS works with the following AI service providers:

8.5 Data Processing Agreements with AI Service Providers

All AI service providers provide services under data processing agreements. These agreements impose strict purpose limitations, prohibit retention of data beyond the period necessary to complete the requested task, and prohibit use of data for model training or any secondary purpose. Boya OS regularly reviews its service providers to ensure their continued compliance with these obligations.

8.6 Data Minimization

When you use AI features, only the data necessary to complete the requested task is transmitted to AI service providers. Processing results are returned to your device. If you have enabled cloud sync, the results are synchronized and stored in the cloud.

8.7 Your Rights Regarding AI Data

You have the right to access, correct, delete or restrict processing of your AI data. You may exercise many of these rights directly in the app. If you need further assistance, please contact us through the contact details in Section 9, How to Contact Us.

9. How to Contact Us

If you have any questions or suggestions about this Privacy Policy or personal information, please contact us through the following methods. We will respond within 15 business days:

Appendix: Privacy Policy Links of Third-Party Service Providers