Privacy Policy

This Privacy Policy explains how STARTORK PTE. LTD. ("STARTORK", "we", "us") collects, uses, stores, discloses, transfers, and otherwise processes personal information when you access or use Hushmi, the Rick app, and related STARTORK websites, applications, subscriptions, features, and services (collectively, the “Service”).

Consumer health data

Depending on what you choose to discuss or use through Rick, certain information may constitute Consumer Health Data under applicable U.S. state laws, including the Washington My Health My Data Act. For more information about how STARTORK handles Consumer Health Data, including applicable rights and controls, please see our Consumer Health Data Privacy Notice.

Hushmi is an adult-only artificial intelligence companion service featuring Rick, an AI character.

This Privacy Policy should be read together with our Terms of Service, AI Model Improvement Notice & Consent, Billing & Refund Policy, Cookie Policy, and any additional privacy notices presented when particular information is collected.

1. Who controls your information

For purposes of applicable data-protection law, the controller or operator responsible for the personal information described in this Privacy Policy is:

STARTORK PTE. LTD. 60 Paya Lebar Road, #05-09, Paya Lebar Square, Singapore 409051

Privacy inquiries and requests may be sent to:

contact@startork.ai

Data Protection Officer inquiries may be sent to the privacy contact above.

Where applicable law uses different terminology, references to “controller,” “business,” or “operator” should be understood according to the relevant law.

2. Information we collect

The information we collect depends on how you use the Service.

A. Account and profile information

We may collect information such as:

• email address;
• display name;
• optional gender identity, including if you choose “prefer not to say”;
• password hash or authentication credentials generated by our authentication systems;
• date of birth;
• age or eligibility status;
• language;
• locale;
• country or region;
• time zone;
• account role;
• subscription status;
• verification status;
• account creation and modification timestamps; and
• identifiers associated with your STARTORK account.

We do not store your plaintext password.

Providing gender identity is optional. We use it only for profile personalization, you may change or clear it in Settings, and we do not send it to AI, voice, payment, analytics, or other third-party providers by default.

If you sign in through a third-party authentication provider, we may receive information that provider makes available to us, such as your email address, name, or provider-specific identifier.

B. Conversations and User Content

We process the content you submit to Rick, including:

• text messages;
• prompts;
• conversation history;
• files or other supported content you choose to provide;
• corrections;
• reactions;
• feedback associated with conversations; and
• Rick's generated responses.

Conversation content may contain information about your life, relationships, interests, preferences, experiences, or other matters you choose to discuss.

Because Rick is an AI companion, conversations may be personal or sensitive. You control what you choose to disclose.

C. Voice and call information

When you use voice features, we may process:

• microphone audio;
• speech input;
• text generated from speech;
• text sent for speech generation;
• generated audio;
• call timestamps;
• call duration;
• provider or session identifiers;
• technical call metadata;
• call transcripts where the applicable feature creates or stores them; and
• diagnostic information relating to voice functionality.

On iPhone, your speech is processed by the iPhone system speech recognition service. Whether recognition happens on the device or uses Apple servers depends on your device and settings; we do not promise that every recognition request stays on your device. Transcripts are sent to OpenAI to provide the conversation. Text Rick speaks is sent to ElevenLabs to generate his voice. These providers process the information needed for the requested feature.

The fact that voice information is processed to provide a call does not make that information eligible for broader AI model improvement.

D. Memories, preferences, and personalization

To provide continuity and personalization, we may process or generate information such as:

• memories you ask Rick to maintain;
• learned preferences;
• communication-style preferences;
• nicknames;
• relationship preferences;
• conversation patterns;
• interaction history;
• relationship-state or continuity information;
• familiarity or interaction signals; and
• other personalization information derived from your interactions with Rick.

Some of this information is derived or inferred from interactions rather than directly entered into a settings field.

These records are used to provide the personalized Rick experience and are treated separately from the AI model-improvement pipeline unless we clearly state otherwise and obtain any permission required by law.

E. Safety, age, fraud, and integrity information

We may process information needed to protect users and operate the Service safely, including:

• safety or crisis signals;
• abuse or misuse indicators;
• age-related signals;
• moderation classifications;
• account restrictions;
• safety decisions;
• reports;
• fraud indicators;
• suspicious login or payment activity;
• security events;
• enforcement history;
• limited message excerpts where reasonably necessary to investigate or document an event;
• identifiers of messages associated with an event;
• structured reasons or classifications; and
• timestamps and audit records.

We seek to avoid unnecessarily duplicating entire conversations into safety, age-review, or administrative records where a more limited record is sufficient.

F. Usage, device, and technical information

When you use the Service, we may automatically collect:

• IP address;
• browser type;
• operating system;
• device type;
• language settings;
• session identifiers;
• request timestamps;
• pages or features used;
• interaction events;
• application version;
• response times;
• error information;
• network information;
• approximate geographic location inferred from IP address;
• security logs;
• diagnostic information;
• request identifiers; and
• service-performance data.

We may use cookies, local storage, and similar technologies as described in our Cookie Policy. Approximate login location, such as city or country inferred from the connection IP address, is used for account security. This is not precise GPS location and is separate from Sentry crash reporting, where IP addresses and geographic location are removed.

G. Subscription and transaction information

If you purchase a subscription, we may process:

• plan;
• subscription status;
• billing period;
• renewal date;
• transaction status;
• payment-provider customer identifiers;
• subscription identifiers;
• invoice or receipt identifiers;
• billing country;
• refund or dispute information; and
• limited payment-method metadata made available by Stripe, including card brand, last four digits and expiry date.

We use this limited information to show your saved payment method and help you manage billing. We do not receive your full card number or security code in our application database.

When an account with a subscription is deleted, we retain a subscription-cancellation job containing the Stripe subscription identifier, test/live mode, processing status, attempt counts and relevant timestamps. This job survives account deletion so cancellation at the end of the billing period can be completed and failures investigated; it does not retain chats or memories. It is not a promise that cancellation has already succeeded when you request account deletion.

Payment-card information is processed by our payment providers.

STARTORK does not intend to store full payment-card numbers or card-security codes on its own application database.

H. Support and communications

If you contact us, submit a support ticket, appeal a decision, or otherwise communicate with STARTORK, we may collect:

• your contact information;
• ticket or request identifiers;
• category and subject;
• messages you send to support;
• attachments you provide;
• support responses;
• internal notes;
• status;
• responsible personnel;
• associated account or transaction information; and
• records necessary to investigate and resolve the request.

I. Consent, legal, and audit information

We may retain records showing:

• acceptance of Terms;
• acknowledgment of privacy notices;
• AI model-improvement choices;
• consent version;
• opt-in and opt-out timestamps;
• consent boundaries;
• withdrawal records;
• privacy requests;
• account-deletion requests;
• policy versions;
• administrative actions; and
• other records reasonably necessary to demonstrate compliance, investigate disputes, or enforce legal rights.

3. Where information comes from

We collect personal information from several sources.

Directly from you

For example, when you:

• create an account;
• provide information in Settings;
• talk to Rick;
• use voice features;
• purchase a subscription;
• contact support;
• submit feedback; or
• exercise a privacy choice.

Automatically from your device or use of the Service

For example through:

• application logs;
• cookies;
• network information;
• security systems;
• diagnostics; and
• usage events.

From service providers

For example:

• authentication providers;
• payment processors;
• app stores;
• infrastructure providers; or
• security providers.

Generated or inferred by STARTORK

For example:

• personalization signals;
• memories;
• relationship-continuity information;
• safety classifications;
• fraud indicators;
• usage metrics; and
• account-risk signals.

4. How we use information

We process personal information only for purposes reasonably connected with operating, protecting, improving, supporting, and complying with legal obligations relating to the Service.

These purposes include:

Providing Rick

We use information to:

• generate AI responses;
• maintain conversation history;
• provide voice features;
• provide requested memories;
• maintain relationship continuity;
• personalize interactions;
• synchronize the Service across supported sessions or devices; and
• provide other requested functionality.

Operating accounts

We use information to:

• create and maintain accounts;
• authenticate users;
• manage sessions;
• enforce age requirements;
• administer settings;
• process subscriptions; and
• communicate important account information.

Safety and integrity

We use information to:

• detect and respond to prohibited use;
• enforce age restrictions;
• identify security threats;
• detect fraud;
• investigate abuse;
• operate safety controls;
• protect users;
• protect STARTORK systems; and
• enforce our Terms.

Safety systems may use automated classifications or risk signals.

These systems are intended to support operation and protection of the Service and do not guarantee that every harmful, unsafe, fraudulent, or inappropriate situation will be detected.

Customer support

We use information to:

• answer questions;
• investigate technical problems;
• handle account requests;
• respond to complaints;
• process appeals;
• investigate billing issues; and
• resolve disputes.

Service reliability and development

We may use technical, operational, aggregated, or appropriately de-identified information to:

• understand service performance;
• diagnose errors;
• measure reliability;
• manage capacity;
• evaluate feature performance;
• prevent failures;
• improve user experience; and
• develop new functionality.

Using conversation content to train or fine-tune AI models is governed separately by Section 6 and our AI Model Improvement Notice & Consent.

Hushmi app features and service providers

These uses provide the service, safety, security and reliability; they are not permission to train AI models with your conversations. Optional model improvement remains separately controlled.

Legal and compliance purposes

We may process information where reasonably necessary to:

• comply with applicable law;
• respond to valid legal process;
• enforce agreements;
• investigate violations;
• establish, exercise, or defend legal claims;
• maintain legally required records;
• respond to regulators; or
• protect the rights, safety, security, and property of STARTORK, our users, or others.

5. Core AI processing is different from model training

Rick cannot generate a response without processing the information you send.

When you communicate with Rick, STARTORK and authorized AI or infrastructure providers may process relevant conversation content to:

• understand your request;
• generate a response;
• apply safety systems;
• maintain context;
• provide personalization; and
• operate requested features.

This is core Service processing.

It is separate from using conversations to train or improve broader AI models.

You do not need to opt in to AI model improvement for STARTORK to process information as necessary to provide Rick.

Where third-party AI providers process information on our behalf to provide Rick, we seek to use commercial arrangements, configurations, and contractual protections appropriate to that processing.

Where a provider acts as our processor or service provider, its processing is limited by the applicable agreement, service configuration, and data-protection obligations.

6. Optional AI model improvement

STARTORK's broader use of eligible conversations for AI model evaluation, approved improvement datasets, training, or fine-tuning is governed by our separate AI Model Improvement Notice & Consent.

AI model improvement is off by default.

If you do not opt in, conversation content is not made eligible for the broader model-improvement uses governed by that consent.

Turning model improvement off does not prevent the processing required to provide Rick, personalization, requested memories, safety, fraud prevention, support, billing, security, or other core Service functionality.

Consent boundary

Only eligible records created after the applicable opt-in boundary may be considered for the model-improvement pipeline.

Turning the option off ends eligibility for future selection under that consent.

If you later enable it again, a new consent boundary is created. Re-enabling the setting does not retroactively make earlier messages eligible.

A materially new consent version does not automatically extend an earlier consent to a new period or materially expanded use where renewed consent is required.

Data excluded from model improvement

The model-improvement pipeline is designed to exclude categories including:

• content created before the applicable consent boundary;
• accounts known or reasonably believed to belong to minors;
• accounts under age review;
• safety or crisis conversations and associated risk records;
• age disclosures and appeals;
• support tickets and support records;
• billing and payment records;
• test-account and internal QA data;
• voice recordings;
• call audio;
• call transcripts and related voice-call records;
• derived memories;
• relationship-profile data;
• communication-style profiles;
• deleted or invalidated content where applicable;
• unsupported content types;
• passwords and authentication secrets;
• payment credentials;
• government identifiers;
• records detected as containing high-risk direct identifiers; and
• records detected as containing categories of sensitive personal information that STARTORK has designated as ineligible for model improvement.

Automated filtering reduces risk but cannot guarantee that every personal or sensitive fact contained in free-form text will always be detected.

Additional information about selection, withdrawal, safeguards, approved datasets, and completed model updates is provided in our AI Model Improvement Notice & Consent.

7. Sensitive personal information

Conversations with an AI companion can naturally involve sensitive subjects.

Depending on applicable law, sensitive personal information may include information concerning:

• health;
• mental health;
• sex life;
• sexual orientation;
• racial or ethnic origin;
• religious or philosophical beliefs;
• political opinions;
• trade-union membership;
• genetic information;
• biometric identifiers;
• precise geolocation;
• government identifiers;
• financial-account credentials; or
• other information given heightened protection by law.

STARTORK does not require you to disclose sensitive personal information simply to maintain a basic account.

If you voluntarily include sensitive information in a conversation, it may be processed as necessary to provide the conversation, requested personalization, relevant safety functions, or another feature you have chosen to use.

Where applicable law requires explicit or separate consent for a particular processing activity involving sensitive personal information, STARTORK will rely on consent only where a legally sufficient consent has been obtained or will otherwise limit the processing as required by law.

Sensitive conversation information is not used to create advertising profiles.

STARTORK does not use sensitive personal information to determine your eligibility for unrelated high-impact decisions such as:

• employment;
• housing;
• lending or credit;
• insurance eligibility; or
• similar third-party decisions.

Opting in to general AI model improvement does not automatically authorize sensitive personal information for training.

Records detected as containing sensitive categories designated as ineligible under the AI Model Improvement Notice are excluded from that pipeline.

8. Information about other people

You should not provide personal information about another person unless you are legally authorized to do so.

Because users control what they write in free-form conversations, STARTORK cannot guarantee that conversations will never contain information about third parties.

If you provide another person's information, you are responsible for having an appropriate basis to provide that information.

A person who believes personal information about them has been provided to STARTORK without authorization may contact us.

We may investigate and take appropriate action, subject to identity verification, the rights of other users, confidentiality, technical limitations, and applicable law.

9. Age restrictions and age-review information

Rick is intended only for users who are at least 18 years old.

We request date-of-birth information and use age-related controls designed to prevent users who indicate that they are under 18 from registering or continuing to use the Service.

If information during use reasonably indicates that a user may be under 18, STARTORK may temporarily restrict the account and create an age-review record.

Where reasonably sufficient, that record may contain:

• account identifier;
• triggering message identifier;
• structured reason;
• review status; and
• timestamps,

rather than another full copy of the triggering conversation.

An appeal may include information that the user chooses to provide in support of the appeal.

Do not send identity documents through ordinary chat or ordinary support channels unless STARTORK specifically provides an approved verification process that requests them.

Information collected for age review is not eligible for AI model improvement.

If STARTORK determines that an account belongs to a person who is not eligible to use the Service, we may restrict or close the account and handle associated personal information according to applicable law, safety needs, dispute requirements, and our retention rules.

10. Automated systems and human access

STARTORK uses automated systems to operate features such as:

• AI response generation;
• personalization;
• memories;
• safety classification;
• age-related detection;
• fraud prevention;
• abuse detection;
• rate limiting;
• security monitoring; and
• service diagnostics.

Authorized personnel may access limited personal information where reasonably necessary to:

• investigate a support request;
• review an appeal;
• investigate suspected abuse or security incidents;
• respond to a safety event;
• troubleshoot a technical problem;
• comply with law;
• conduct an authorized privacy or security investigation; or
• perform an approved model-improvement task where the user has provided the required permission.

Access should be limited according to role and purpose.

Administrative or security access may be logged or audited.

STARTORK does not routinely require employees to read private conversations simply because those conversations exist.

11. Service providers

STARTORK uses service providers to help operate the Service.

Categories of providers may include:

• cloud hosting and infrastructure;
• managed databases;
• AI inference;
• speech recognition and speech generation;
• email delivery;
• authentication;
• security and fraud prevention;
• observability and diagnostics;
• analytics;
• customer support;
• subscription management; and
• payment processing.

The current material providers and purposes include:

App Attest records are cryptographic integrity records, challenge/receipt metadata and necessary registration associations, not documents verifying a person's identity or age. Age-range observations record only the minimized result described above.

A provider's involvement does not automatically authorize it to use STARTORK conversation content for its own independent purposes.

Where providers act on our behalf as processors or service providers, we use contractual, configuration, organizational, or technical controls appropriate to the service relationship.

Some providers, such as payment processors or app stores, may independently determine certain processing required for their own legal or operational responsibilities. Their own privacy notices may apply to that independent processing.

STARTORK may maintain a separate Subprocessor or Service Provider List identifying current material providers.

Changing a provider within an already disclosed category and purpose does not necessarily require a new Privacy Policy, unless the change materially changes how personal information is processed or applicable law requires additional notice or consent.

12. Advertising, marketing, cookies, and analytics

STARTORK may use account contact information to send:

• transactional communications;
• security notices;
• billing notices;
• product announcements; and
• marketing communications where permitted by law.

You may unsubscribe from marketing communications using the unsubscribe mechanism provided in those communications.

You may still receive non-marketing communications necessary to operate your account or Service.

STARTORK does not use the content of your private Rick conversations, voice calls, memories, safety records, or sensitive personal information to build advertising profiles.

As of the Effective Date, STARTORK does not sell personal information for money and does not share personal information for cross-context behavioral advertising as those terms are defined under applicable U.S. privacy laws.

If STARTORK later introduces practices that constitute sale, sharing, or targeted advertising under applicable law, we will update applicable notices and provide legally required opt-out controls before or when those practices begin.

Our websites may use cookies, analytics tools, and similar technologies for functions such as:

• authentication;
• security;
• preferences;
• performance measurement; and
• product analytics.

Additional information is provided in our Cookie Policy and, where applicable, cookie controls.

13. Other circumstances in which we may disclose information

In addition to service providers, STARTORK may disclose personal information in the following circumstances.

Legal process and public authorities

We may preserve, access, or disclose information where we reasonably believe doing so is necessary or appropriate to:

• comply with applicable law;
• respond to valid court orders, subpoenas, warrants, or other legal process;
• respond to lawful requests from competent authorities;
• protect legal rights;
• investigate fraud or abuse;
• protect the security of the Service; or
• prevent serious harm where disclosure is legally permitted.

Where legally permitted and appropriate, STARTORK may challenge requests that we believe are invalid, overbroad, or otherwise improper.

We may be prohibited by law from notifying you about certain requests.

Professional advisers

We may disclose information to advisers such as:

• lawyers;
• auditors;
• accountants;
• insurers;
• cybersecurity specialists; or
• other professional advisers

where reasonably necessary for the services they provide and subject to appropriate confidentiality obligations.

Corporate transactions

Personal information may be disclosed or transferred in connection with:

• financing;
• due diligence;
• merger;
• acquisition;
• restructuring;
• reorganization;
• sale of assets;
• sale of equity;
• bankruptcy; or
• transfer of all or part of STARTORK's business.

Any recipient that becomes responsible for personal information will remain subject to applicable privacy law and any commitments that continue to apply to the transferred information.

At your direction

We may disclose information when you direct or authorize us to do so.

14. De-identified and aggregated information

STARTORK may create aggregated, statistical, or de-identified information from personal information where permitted by law.

Where information has been de-identified so that it is no longer reasonably capable of being linked to you under applicable legal standards, we may use it for purposes such as:

• analytics;
• service measurement;
• capacity planning;
• security research;
• reliability analysis;
• business planning; and
• product development.

Where required by applicable law, STARTORK will maintain de-identified information in de-identified form and will not attempt to re-identify it except where legally permitted for purposes such as testing whether de-identification remains effective.

Information that is merely pseudonymized remains personal information where applicable law treats it as such.

15. Retention

The following schedule applies to identifiable Hushmi app records and backup copies that STARTORK configures and controls, including its application database and private object storage, subject to a documented legal hold or another specific legal obligation. A deletion request also covers related derived memories within its verified scope; a memory independently supported by other content you have not deleted may remain. Deleting a memory alone does not delete the original chat.

The 35-day app-backup limit is not a guarantee that every copy in an AI provider's separate request-processing, security or archival systems is physically erased within 35 days. Provider processing and applicable deletion rights are described in Section 16. This distinction does not reduce your legal rights or release STARTORK or its processors from applicable deletion duties. It does not retroactively remove any shorter commitment that applies to information collected under an earlier notice.

Generated voice caches are linked to the relevant message or call and can be regenerated when needed. The maintenance process selects caches that have not been played for 90 days (or since generation if never played), in bounded batches, avoiding active playback. This is an inactivity threshold, not a guarantee that the final byte is erased exactly on day 90. Deleting the source conversation or account invalidates the associated cache and queues deletion of privately stored OSS objects; unsuccessful deletes remain queued for retry. The deletion process removes retained object versions and checks that none remain; storage lifecycle expiry is an additional safeguard. The user-data deletion and backup limits in the table above also apply to voice caches, including retained object versions.

App Attest and age-range records associated with the account are removed on account deletion; temporary challenges cease to be usable at their expiry. Expiry of a challenge is not a claim that every audit record is deleted at that instant. Subscription-cancellation records are kept separately as minimum billing and operational evidence under the payment-record retention schedule, so deleting an account does not silently abandon cancellation.

To prevent repeat free trials after account deletion, we retain a purpose-limited, keyed email digest and trial-redemption time permanently. This record does not contain your raw email, chats or memories, is not used for advertising, and does not stop you creating a new account or buying a plan. A keyed digest is pseudonymous personal information, not anonymous information. Requests concerning this fraud-prevention record remain subject to applicable privacy law.

Optional model-improvement records remain governed by the separate AI Model Improvement Notice & Consent and its retention controls. They are not automatically eligible merely because records are retained for another purpose.

16. Deletion, service providers and backups

You may delete information using available product controls and request deletion of your account. A queued or accepted deletion request, including an HTTP 202 response, is not a statement that all related copies have already been erased.

Records and backups controlled by STARTORK

The applicable limits in Section 15 govern our app records and the backup copies we configure and control. We remove or suppress deleted records from ordinary use, follow up on pending object and version deletion, and track required external deletion tasks. Missing source relationships, pending cleanup or a missing provider artifact identifier are not proof that all required deletion has completed.

If a backup containing previously deleted information is restored, applicable deletion or suppression instructions must be reapplied before that information returns to ordinary active use. A backup is not a reason to restart ordinary use of deleted content.

Information processed by service providers

OpenAI and ElevenLabs receive the information described in Section 11. These providers may retain request information, generated outputs or limited security records under their applicable service and data-processing terms. Optional response storage is disabled in our supported OpenAI generation requests. Our ElevenLabs workspace has model-training use switched off. These controls do not establish zero data retention or delete earlier records by themselves.

For ElevenLabs self-service processing, we do not represent an unverified provider-wide maximum deletion time as a contractual guarantee. We distinguish our app's 35-day backup limit from the provider's separate systems. Account inactivity cleanup is not a substitute for handling an individual deletion request.

When a valid request covers information held by a processor on our behalf, we notify the relevant recipients, use available deletion mechanisms or documented instructions, and track the required action and evidence. We do not treat a required processor task as complete solely because we did not save a provider-side identifier. Contact contact@startork.ai to exercise applicable rights or ask about the status of a request.

Applicable rights and limited retention

Applicable law controls our obligations and those of recipients; a provider's standard retention practice does not override those duties. For a qualifying Washington Consumer Health Data request, we act without undue delay and within 45 days of receiving the request, with a further 45 days only where legally permitted and notified with reasons within the initial period. Authentication does not restart this deadline. Relevant recipients must honor the deletion request. Where Washington law permits deletion from archived or backup systems to be delayed for restoration, that delay cannot exceed six months from authentication. This limited legal allowance does not extend a shorter commitment that applies to STARTORK-controlled copies in Section 15.

We may retain limited records for a specific legal obligation, a lawful security or fraud-prevention purpose, or other applicable legal exception. We assess the particular records and legal basis and explain a refusal or restriction where required. Such records must not be reused for unrelated purposes. Payment, minimal compliance and fraud-prevention records have the specific treatment described in Section 15.

17. Security

STARTORK uses administrative, organizational, and technical safeguards designed to reduce the risk of:

• unauthorized access;
• unauthorized disclosure;
• loss;
• misuse;
• alteration; or
• destruction

of personal information.

Depending on the system and risk involved, safeguards may include:

• authentication controls;
• access controls;
• role-based permissions;
• encrypted communications;
• encryption or protected storage;
• logging and monitoring;
• security testing;
• rate limiting;
• secrets management;
• vendor controls;
• backup protections;
• incident response; and
• secure-development practices.

Access to sensitive operational systems is restricted according to business need.

No service, network, database, transmission method, or storage system can be guaranteed to be completely secure.

You are responsible for protecting your account credentials and devices.

If STARTORK becomes aware of a personal-data breach, we will investigate and provide notices to regulators or affected individuals where and when required by applicable law.

18. International transfers

STARTORK is based in Singapore, while our infrastructure and service providers may process personal information in Singapore, the United States, and other countries.

As a result, your personal information may be transferred to or accessed from a jurisdiction different from the one in which you live.

Privacy laws may differ between jurisdictions.

Where applicable law requires safeguards for international transfers, STARTORK uses measures reasonably designed to ensure an appropriate or legally required level of protection.

Depending on the transfer and applicable law, these measures may include:

• contractual data-protection obligations;
• data-processing agreements;
• restrictions on provider use;
• security requirements;
• Standard Contractual Clauses where applicable;
• recognized transfer mechanisms; or
• other lawful safeguards.

Transfers of personal information outside Singapore are subject to applicable Singapore transfer requirements.

You may contact us for additional information about material transfer safeguards applicable to your information.

19. Your privacy rights and choices

Your rights depend on where you live and which privacy laws apply.

Rights are subject to applicable exceptions and verification requirements.

Depending on applicable law, you may have the right to:

• know whether we process personal information about you;
• request information about our collection and use of your information;
• access personal information;
• obtain a copy of certain personal information;
• correct inaccurate information;
• delete personal information;
• request portability in a usable format;
• withdraw consent where processing is based on consent;
• object to certain processing;
• restrict certain processing;
• opt out of certain sales or sharing;
• opt out of targeted advertising;
• limit certain uses of sensitive personal information;
• opt out of certain qualifying profiling or automated-decision uses;
• use an authorized agent;
• appeal certain denied privacy requests; and
• complain to an applicable privacy or data-protection regulator.

We may need to verify your identity before fulfilling a request.

Verification information will be used for the purpose of processing and protecting the request.

A request may be denied or limited where permitted by law, including where fulfilling it would:

• violate another person's rights;
• expose confidential or security-sensitive information;
• interfere with fraud or security investigations;
• conflict with legal obligations;
• require us to retain information for a lawful purpose; or
• fall within another applicable legal exception.

We will not unlawfully discriminate against you for exercising applicable privacy rights.

You may submit privacy requests to:

contact@startork.ai

Where legally permitted, STARTORK may voluntarily honor certain privacy requests even if a particular privacy law does not technically apply to STARTORK or to the request. Doing so does not constitute an admission that the law applies.

20. Singapore privacy rights

Where Singapore's Personal Data Protection Act applies, individuals may have rights and choices including:

• requesting access to certain personal data in STARTORK's possession or control;
• requesting correction of inaccurate or incomplete personal data;
• withdrawing consent where processing depends on consent; and
• contacting our Data Protection Officer regarding our data-protection practices.

Certain exceptions, procedural requirements, and lawful retention rights may apply.

STARTORK may need a reasonable period to process a withdrawal request and explain the likely consequences of withdrawal where required.

Withdrawal of consent does not require STARTORK to delete information that STARTORK is legally entitled or required to retain for another purpose.

21. United States privacy disclosures

Depending on your state and whether the relevant law applies to STARTORK, you may have additional privacy rights.

These may include rights relating to:

• access;
• knowledge;
• correction;
• deletion;
• portability;
• sale;
• sharing;
• targeted advertising;
• certain profiling activities;
• sensitive personal information;
• authorized agents;
• appeals; and
• non-discrimination.

Categories of personal information

During the preceding twelve months, STARTORK may have collected categories described in this Privacy Policy, including:

• identifiers and account information;
• customer and subscription information;
• commercial or transaction information;
• internet and electronic-network activity;
• device information;
• approximate location;
• audio information;
• conversation and communication content;
• preferences and characteristics you choose to disclose;
• sensitive personal information contained in content you voluntarily provide;
• safety and integrity information; and
• inferences or derived personalization information.

The specific information collected depends on your use of the Service.

Sources

Information may come from:

• you;
• your device;
• your use of the Service;
• payment and authentication providers;
• other service providers; and
• information generated or inferred through operation of the Service.

Business purposes

We use these categories for the purposes described in this Privacy Policy, including:

• providing the Service;
• personalization;
• security;
• safety;
• fraud prevention;
• subscriptions;
• support;
• diagnostics;
• compliance; and
• optional model improvement where separately authorized.

Categories of recipients

Information may be disclosed to categories including:

• cloud and database providers;
• AI providers;
• speech providers;
• authentication providers;
• security and infrastructure providers;
• customer-support providers;
• payment providers;
• professional advisers;
• authorities where legally required; and
• parties involved in an applicable corporate transaction.

Sale and sharing

As of the Effective Date, STARTORK does not sell personal information for monetary consideration and does not share personal information for cross-context behavioral advertising.

STARTORK does not sell or share the content of private Rick conversations, private voice interactions, derived memories, safety records, or sensitive personal information for behavioral advertising.

If these practices materially change, we will update our disclosures and implement rights or controls required by applicable law.

Sensitive personal information

STARTORK uses sensitive personal information only for purposes described in this Policy and does not use it to make unrelated eligibility decisions concerning employment, credit, housing, or insurance.

Where state law provides a right to limit additional uses of sensitive personal information, we will provide that right where applicable.

Retention

Retention periods or criteria for the categories above are described in Section 15 and may be further specified in notices presented at or before collection where required.

Authorized agents and appeals

Where applicable law permits, an authorized agent may submit a privacy request on your behalf.

We may request evidence of the agent's authority and may separately verify your identity.

Where state law provides a right to appeal our decision regarding a privacy request, instructions for appeal will be included in our response.

22. EEA, United Kingdom, and similar jurisdictions

If European Economic Area, United Kingdom, or another comparable data-protection law applies to our processing of your information, additional rules may apply.

Depending on the activity, STARTORK may process personal information because:

• processing is necessary to provide the Service or perform our contract with you;
• processing is necessary to comply with a legal obligation;
• processing is necessary for legitimate interests such as security, fraud prevention, service reliability, or defending legal rights, where those interests are not overridden by your rights;
• you have provided consent; or
• another lawful basis applies.

Where special-category or sensitive personal data requires a separate legal condition, STARTORK will rely on an applicable condition, including explicit consent where required, or limit the processing accordingly.

Where these laws apply, you may have rights including:

• access;
• correction;
• erasure;
• restriction;
• portability;
• objection;
• withdrawal of consent; and
• the right to complain to an applicable supervisory authority.

Withdrawal of consent does not affect the lawfulness of processing conducted before withdrawal or processing based on another lawful basis.

Where STARTORK is required to appoint an EEA or UK representative, the applicable representative's details will be published in this Policy or another readily accessible privacy notice.

23. Children

Rick is an adult-only service.

The Service is not directed to children or persons under 18.

STARTORK does not knowingly permit persons under 18 to maintain ordinary Rick accounts.

If we learn that an ineligible minor has provided personal information through the Service, we may suspend or close the account and take reasonable steps to delete or otherwise appropriately handle the information, subject to:

• safety requirements;
• legal obligations;
• fraud prevention;
• evidence preservation;
• dispute requirements; and
• applicable law.

If you believe that a person under 18 is using Rick, please contact us.

24. Changes to this Privacy Policy

STARTORK may update this Privacy Policy as:

• the Service changes;
• our data practices change;
• providers change;
• features change;
• applicable law changes; or
• new privacy or security requirements arise.

We will display the effective date of the current version.

Where required by applicable law, we will provide additional or advance notice of material changes.

We will not use a Privacy Policy update by itself to retroactively expand optional AI model-improvement consent where a new opt-in or other consent is required.

If a new activity materially changes the purpose for which personal information was originally collected, STARTORK will provide additional notice or obtain additional permission where required by law.

Previous policy versions may be retained for compliance, auditing, and dispute-resolution purposes.

25. Contact and Data Protection Officer

Questions, complaints, or privacy requests may be sent to:

Privacy: contact@startork.ai

Data Protection Officer inquiries: contact@startork.ai

Support: contact@startork.ai

Controller/operator:

STARTORK PTE. LTD. 60 Paya Lebar Road, #05-09, Paya Lebar Square, Singapore 409051

If you contact us about a privacy request, please provide enough information for us to understand and appropriately verify the request, but do not send passwords, payment-card information, or government identity documents unless STARTORK specifically provides an approved process requesting them.