Privacy Policy

Last Modified: April 2025

I. INTRODUCTION

Llama AI Ltd ("we," "us," or "our") takes your privacy seriously. This Privacy Policy ("Privacy Policy") explains our data protection practices and describes the types of information we may process when you access and/or use our mobile applications ChatChat and Nutri AI (collectively, the "Apps") and the website at https://chatchat.ai (the "Website").

When we refer to personal data (or personal information), we mean any information relating to an identified or identifiable individual. This includes, but is not limited to, identifiers such as your name, email address, device identifiers, or other characteristics unique to you.

The scope of the data we process may vary depending on your interactions with our Website and Apps. This Privacy Policy applies globally to all users, regardless of location. However, specific regional rights (such as those granted under the GDPR or CCPA) are addressed within relevant sections of this document.

PLEASE READ THIS PRIVACY POLICY CAREFULLY. BY USING THE WEBSITE OR APPS, YOU AGREE TO THIS POLICY.

Under the California Consumer Privacy Act of 2018 (CCPA), California residents shall have the right to request:

• The categories of personal information that is processed;
• The categories of sources from which personal information is obtained;
• The purpose for processing user personal data;
• The list and categories of third parties with whom we may share your personal information;
• The specific pieces of personal information that we might have obtained about a particular user provided that the data in the request is reliable enough and allows us to identify the user.

Please use the navigation links through this Privacy Policy:

PERSONAL INFORMATION

All about the categories of information, its sources, and purposes of processing >>

Please note that according to CCPA, personal information does not include de-identified or aggregated consumer information.

SHARING

How your information can be shared >>

Please note that all third parties that are engaged in processing user data are service providers that use such information based on an agreement and pursuant to a business purpose.

OPT-OUT OPTIONS

If you do not want us to process your personal information anymore, please contact us via email at support@chatchat.ai or our “Contact Us” form available on the Website.

If you do not want us to share device identifiers and geolocation data with service providers, please check your device settings to opt out as described below >>

REQUESTS

To submit a verifiable consumer request for access, portability, or deletion of personal data, please contact us via email at support@chatchat.ai or our “Contact Us” form available on the Website. Please include in the text of your request the wording "Your rights to maintain confidentiality in the state of California.”

When submitting a verifiable request, you should be ready to:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative, which may include: name, address, city, state, and zip code, and email address. We may use this information to surface a series of security questions to verify your identity. If you are making a request through an authorized agent acting on your behalf, such authorized agent must provide written authorization or a power of attorney, signed by you.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We will not be able to respond to your request or provide you with personal information if we cannot: (i) verify your identity or authority to make the request; or (ii) confirm that the personal information relates to you. We may ask you for additional information or documents to verify your identity. We may also carry out checks, including with third-party identity verification services, to verify your identity before taking any action with your personal information. This is regarded as a safeguard measure to prevent disclosure of your personal information under a fake or scam request.

We ensure that personal information provided in a verifiable consumer request will be used only to verify the requestor’s identity or authority to make the request and not for any other purpose. We will keep it for the adequate term reasonably needed for the purpose described above and delete it after the purpose is fulfilled.

We try to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time, we will inform you of the reason and extension period in writing. Please note that we are only required to respond to two requests per customer each year.

EQUAL RIGHTS

Nothing in the way we deal with your request shall be interpreted as discrimination, which means that we will not set up different pricing or products, or different levels or quality of services for you, if you choose to exercise your rights. However, in some circumstances, we may not be able to provide services if you choose to delete your personal information from our records.

SALE OF DATA

We do not sell any of your personal data to third parties.

II. INFORMATION WE PROCESS

There are several categories of information that may be processed when you access and/or use the Website.

Functional Information

We ask for and process the following information when you access and/or use the Website. This information is necessary for the adequate performance of the contract between you and us. Without such information, it is impossible to provide complete functionality of the Website and perform the requested services.

• Your email address: You may enter this into the “Enter your email” section available on the Website if you would like to get a free guide from us. We use your email address to send you the guide requested. Your email address may also be used for a different purpose, please check the subsection “Email Communications” of this Privacy Policy.

• Contact Information: (name, email address, as well as any other content included in the email) which you may fill in by yourself when you contact us via email: support@chatchat.ai or our “Contact Us” form available on the Website. We collect, store, and process it by our cloud storage provider (Amazon.com, Inc.). We use such information in order to respond effectively to your inquiry, fulfill your requests, send you communications that you request, and perform the requested services.

• Payment Information: If you choose to purchase a subscription on the Website (tap on the relevant button which will open the Subscription Plans modal dialog), the following methods of payment may be available to you:

  • Payment by card: If you pay with a card, you will be required to enter your email address, as well as your debit or credit card information, name on card, country or region. In this case, the payment transaction will be processed via Stripe payment system. Hence, some categories of your personal data (including transaction data) are collected, retained, and processed by Stripe payment service provider in accordance with its privacy policy.
  • PayPal: If you pay with your PayPal account, you share your information with the PayPal payment system. Please see PayPal’s privacy policy for more details. This information circulates between you and PayPal and remains inaccessible to us.

Additionally, if you have purchased the subscription on the Website and you want to cancel it by contacting us via email: support@chatchat.ai or our “Contact Us” form available on the Website, we may request that you indicate one of the following:

• Your email address registered when you purchased the subscription;
• Receipt number identifying the payment;
• Unique number identifying the invoice.

Information That Is Processed Automatically

When you access and/or use the Website, some information about your device and your user behavior may be processed automatically. This information is generally non-personal, i.e., it does not, on its own, permit direct association

with any specific individual, and we may access it only in aggregated form. We process this information on the grounds of our legitimate interest in improving the Website and giving our users the best experience.

We may use third-party automatic data processing technologies to analyze certain information sent by your device via the Website (advertising or analytics tools). Some of them may launch automated processing of your personal data, including profiling, which means any form of automated processing of personal data used to evaluate certain personal aspects relating to you, in particular to analyze or predict aspects concerning your personal preferences, interests, behavior, location, or movements (see the list of data described below). Processing information through automatic data processing technologies starts automatically when you first access the Website.

• Device Details: When you use a device (computer, mobile phone, or tablet) to access the Website, some details about your device are reported, including “device identifiers.” Device identifiers are small data files or similar data structures stored on or associated with your device, which uniquely identify your device (but not your personality). Device identifiers enable generalized reporting or personalized content and ads by third parties.

  What data may be processed:

  • Information about the device itself: type of your device, type of operating system and its version, model and manufacturer, screen size, screen density, orientation, audio volume, battery, battery life, loading time, latency, framerate, device memory usage.
  • Information about the Internet connection: mobile carrier, network provider, network type, IP address, timestamp and duration of sessions, speed, browser.
  • Location-related information: IP address, the country code/region/state/city associated with your SIM card or your device, language setting, time zone, neighboring commercial points of interest (e.g., “coffee shop”).
  • Device identifiers: Identity For Advertisers for iOS devices/Advertising ID or Android ID for Android devices, user identifiers.

• Cookies and similar technologies: When you access and/or use the Website, cookies and similar technologies may be used (pixels, web beacons, scripts). A cookie is a text file containing small amounts of information which is downloaded to your device when you access the Website. The text file is then sent back to the server each time you use the Website. This enables us to operate the Website more effectively. For example, we will know how many users access specific areas or features within our Website and which links they clicked on. We use this aggregated information to understand and optimize how our Website is used, improve our marketing efforts, and provide content and features that are of interest to you. Third-party analytics tools may use cookies or similar technologies for the purpose of analyzing Website traffic.

• Log file information: Log file information is automatically reported each time you make a request to access the Website. When you use the Website, analytics tools automatically record certain log file information, including the time and date when you start and stop using the Website, and how you interact with the Website.

Information provided automatically to advertising or analytics tools does not generally come to our control; therefore, we cannot be responsible for processing such information. Please note that some services are engaged in personal data profiling and may obtain information related to your personality and/or your device by using technologies that do not belong to our scope of responsibility.

Email Communications

When you register on the Website, we may use your email address to send you invoices for your subscription purchases. Once you enter your email address into the “Enter your email” section available on the Website to get a free guide from us, you may also receive communications (newsletters) regarding special subscription offers, new features and functionalities, and other news related to the Website on the grounds of our legitimate interest. Sending you newsletters will allow you to stay up to date and receive the latest news about the Website, including about the best price offers. You also hereby acknowledge and accept the treatment of some categories of your personal data (i.e., the information about your name that you provide us, subscription purchase date, geolocation data, activity information, etc.) for market analysis activities, particularly for the purpose of delivering you targeted communications (newsletters) that most align with your needs and interests. You may also unsubscribe, opt-out of receiving communications to your email address at any time by using the resignation link provided in each email you receive from us. Your unsubscribe request shall be honored within a reasonable period of time.

III. THE PURPOSES OF PROCESSING YOUR PERSONAL DATA

Our mission is to constantly improve the Website and provide you with new experiences. As part of this mission, we use your information for the following purposes:

(a) To make our service available and ensure the efficient operation of the Website. We use functional information to provide you with all requested services and to ensure the efficient operation of the Website according to its intended purpose.

(b) To improve, test, and monitor the effectiveness of our Website. We use information that is processed automatically to better understand user behavior and trends, detect potential outages and technical issues, to operate, protect, improve, and optimize our Website.

(c) To communicate with you. We use the information we have to communicate with you through newsletters, i.e., to send you marketing notifications, receive your feedback about your Website experience, and let you know about our policies and terms. We also use your information to respond to you when you contact us.

(d) To prevent fraud and spam, to enforce the law. We really want the Website to be free of spam and fraudulent content so that you feel safe and free. We may use your information to prevent, detect, and investigate fraud, security breaches, potentially prohibited or illegal activities, protect our trademarks, and enforce our Terms of Use as well as applicable law.

If any new purpose for processing your personal data arises, we will let you know when we start to process information for that other purpose by introducing the corresponding changes to this Privacy Policy.

IV. SHARING OF YOUR INFORMATION

We will share your information with third parties only in the ways that are described in this Privacy Policy.

Please note that while integrating external services we choose third parties that can assure they apply all necessary technical and organizational measures to protect user personal data. However, we cannot guarantee the security of any information transmitted from us to any such third party. We are not responsible for any accidental loss or unauthorized access to your personal data through a fault of third parties.

We will not rent or sell your personal data to any third parties, but we may share your information from tools like cookies, log files, device identifiers, and location data with third-party organizations that provide automatic data processing technologies for the Website. We do not control or influence these third parties’ tracking technologies or how they may be used.

We may also share certain information such as cookie data with third-party advertising partners. This information allows third-party ad networks, inter alia, to deliver targeted advertisements that they believe will be of most interest to you.

We may engage the following third-party service providers in order to provide us with the necessary infrastructure for delivery and improvement of our services:

Entity Name	Services Performed	Entity Location	Link to Privacy Policy
Amazon.com, Inc.	Cloud storage provider	U.S.A.	Privacy Policy
Amplitude Inc.	Analytics service provider	U.S.A.	Privacy Policy
Apple, Inc.	Authorization tool	U.S.A.	Privacy Policy
Facebook (Meta Platforms, Inc.)	Analytics and marketing service provider	U.S.A.	Privacy Policy
Google LLC	Google Analytics (tool for Website traffic analysis)	U.S.A.	Privacy Policy and How Google uses information from sites or apps that use its services and here (see section ‘Information for Visitors of Sites and Apps Using Google Analytics’) and Google Tag Manager (tool for Website traffic analysis) and Authorization tool*
OpenAI, L.L.C.	AI-generated content provider	U.S.A.	Privacy Policy. To learn more information about applicable license terms with respect to User Content, visit https://openai.com/terms/
PayPal, Inc. / PayPal (Europe) S.à r.l. et Cie, S.C.A.	Payment processing service provider	U.S.A. / Luxembourg	Privacy Policy
Stripe Inc. / Stripe Payments Europe Limited	Payment processing service provider	U.S.A. / Ireland	Privacy Policy and Privacy Policy Legal

In case you want to learn more about the services and privacy options (including opt-out), please consult the corresponding websites and privacy policies.

We may engage the following third-party service providers in order to provide us with the necessary infrastructure for delivery and improvement of the Website: as indicated

above we use Google Analytics and Google Tag Manager services that track and report the Website traffic. Google Analytics and Google Tag Manager use different types of cookies to analyze user activity on the Website. If you want to learn more about the types of cookies and other data collected and processed by Google Analytics and Google Tag Manager service providers (Google LLC), please visit here, here, and here. Note that we are not responsible for any usage of your data by the above-mentioned third-party service provider (Google LLC) in violation of our instructions.

If you do not want Google Analytics and/or Google Tag Manager to use cookies, you can block data collection by following the instructions provided in Section VIII of the present Privacy Policy.

The Website may contain links to third-party websites/services or you may access the Website from a third-party site. We are not responsible for the privacy practices of these third-party sites or services linked to or from the Website, including the information or content contained within them.

We may disclose your personal information if it is needed for objective reasons, due to the public interest, or in other unforeseen circumstances:

• As required by law;
• When we believe, in good faith, that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
• In some cases, we may share your information with our affiliates, subsidiaries, contractors, business partners, or other third parties who perform services on our behalf.

If we are involved in a merger, acquisition, or sale of all or a portion of our assets, you will be notified via email and/or prominent notice on our Website of any change in ownership or your personal information usage, as well as any choices you may have regarding your personal information.

V. INTERNATIONAL DATA TRANSFERS

We work in the cross-border area and provide the Website to users around the world.

We and third-party organizations that provide automatic data processing technologies for the Website or our third-party partners may transfer processed information across borders and from your country or jurisdiction to other countries or jurisdictions around the world.

If you are located in the European Union or other regions with laws governing data processing that may differ from U.S. law, please note that we may transfer information, including personal information, to a country and jurisdiction that does not have the same data protection laws as your jurisdiction.

By using the Website, you agree that we may transfer your personal information to a third country, a territory, or one or more specified sectors within that third country, or to an international organization where data protection and confidentiality regulations may not provide the same level of protection of personal data as your country does.

We try to make sure that the recipient of any personal data provides proper protection of the personal data received, in accordance with the current legislation on the protection of such information.

For data storage purposes, we recourse to the services of hosting organizations. We take your privacy seriously and, therefore, encrypt your personal data - if possible - before sending it to the hosting organizations for storage purposes. Please note that we cooperate only with those hosting organizations that have passed our security and reliability check.

VI. HOW LONG WE USE YOUR PERSONAL DATA

We generally retain your personal information for as long as is necessary for performing the functional service of the Website and to comply with our legal obligations. If you no longer want us to use your information that we physically access and store, you can request that we erase your personal information.

However, some data may still be stored for a certain period (but no longer than the storage purpose requires) if information is necessary to comply with legal obligations (taxation, accounting, audit) or to maintain safety and data backup settings, prevent fraud, or other malicious acts.

VII. EXERCISING YOUR RIGHTS

Applicable data protection laws give you certain rights regarding your personal information. You have the following rights in relation to your personal information that was collected:

• Data Access and Portability: You can request copies of your personal information.
• Change or Correct Data: Where you cannot update data by yourself, you have the right to ask to correct, change, update, or rectify your data.
• Data Retention and Deletion: The user data is generally retained for as long as your user profile is in existence or as it is needed to provide the relevant services. However, specific retention times can vary based on the context of the processing performed. You have the right to ask to delete all or some of the personal data that is held about you.
• Restriction of Processing: Under certain circumstances, you may have the right to limit the ways in which your personal information is used.
• Exercising the right to know about data sharing: You have the right to know whether your data is shared with third parties. Detailed information on this issue is contained in section IV of the present Privacy Policy; however, if you have further questions in this regard, you can contact us at any time.

To exercise any of the rights described above, you can contact us via email: support@chatchat.ai or our “Contact Us” form available on the Website. Please bear in mind that we ensure the above-mentioned rights only with respect to the information that we physically access and store.

You also have the right to lodge a complaint with your local data protection or supervisory authority if you reasonably believe that your rights under applicable data protection laws have been breached. Please note that when you exercise your right to lodge a complaint with your local data protection or supervisory authority, you may be required to provide additional information and support your complaint with sufficient objective evidence. By lodging a complaint, you agree to provide sufficient explanation as to what you believe impaired your rights. Additionally, in some cases prior to lodging a complaint with your local data protection or supervisory authority, you may be required to send your initial claim directly to us and ask for clarifications if necessary.

VIII. HOW TO OPT OUT

Google Analytics: If you want to opt-out of being tracked by Google Analytics you can install and enable Google Analytics Opt-out Browser Add-on. Additionally, you can manage cookies and/or delete cookies that might have already been set by Google Analytics through your browser settings. Further information on Google Analytics’ data practices and relevant instructions can be found at here (see section ‘Information for Visitors of Sites and Apps Using Google Analytics’).

Google Tag Manager: If you want to opt-out of being tracked by Google Tag Manager, you can manage cookies and/or delete cookies that might have already been set by Google Tag Manager through your browser settings. Further information on Google Tag Manager’s data practices and relevant instructions can be found at here.

Bear in mind that if you choose to disable all cookies, this can affect the Website functions; some of the features that make the Website more efficient may not function.

IX. SECURITY

The security of your personal information is highly important to us. We follow generally accepted industry standards to protect the personal information submitted to us, both during transmission and once we receive it.

We take reasonable and appropriate measures to protect personal information from loss, misuse, and unauthorized access, disclosure, alteration, and destruction, taking into account the risks involved in the processing and the nature of the personal information.

We implement appropriate technical and organizational measures, which are designed to implement data-protection principles, such as data minimization, in an effective manner and to integrate the necessary safeguards into the processing. We seek your personal data to be encrypted with proper and strong encryption algorithms, including hashing where possible.

Unfortunately, no method of transmission over the Internet or method of electronic storage is 100% secure. We do our best to protect your personal data; nevertheless, we cannot guarantee its absolute security. In the event that your personal information is compromised as a breach of security, we will promptly notify you in compliance with applicable law.

If you have any questions about the security of the Website, you can contact us via email: support@chatchat.ai or our “Contact Us” form available on the Website.

X. CHILDREN’S PRIVACY

Our Website is not intended for children. Therefore, we do not knowingly or intentionally collect or solicit any personal information from children. For the purposes of this Section X, the terms “child” and/or “children” in the context of data processing activities may be interpreted on a case-by-case basis as prescribed by applicable data protection laws. No one who is considered a “child” under applicable data protection laws is allowed to directly provide any personal information to the Website. As a general rule, we consider a person under the age of 16 to be regarded as “a child” until we have legal grounds to conclude that a person under 16 should be

treated as an adult as per provisions of local data protection rules or based on the parent authorization provided to us directly. Solely the holders of parental responsibility are liable for preventing their children from providing personal information via the Website without relevant verifiable parental consent. If we learn that we have collected personal information from a child without verification of the holder of parental responsibility, we will erase that information as quickly as possible. If you reasonably believe that we might have any information from or about a child, or a child has directly provided us with personal information via the Website without verifiable parental consent, please contact us.

XI. CHANGES TO THE PRIVACY POLICY

This Privacy Policy is updated regularly.

Whenever we change this Privacy Policy, we will post those changes to this Privacy Policy and other places that we consider appropriate. Additional forms of notice of modifications or updates as appropriate under the circumstances may be provided to you.

XII. HOW TO CONTACT US

If you have any questions about this Privacy Policy, please feel free to contact us via email: support@chatchat.ai or our “Contact Us” form available on the Website.

---

Llama AI Ltd

Shelton Street 71-75, Covent Garden, London, WC2H 9JQ