INNVOX App Privacy Policy

1. Scope

This policy explains how the INNVOX mobile app for iPhone and Android (the "App") handles information. The App works with the INNVOX Pro voice training device and can also be tried in demo mode without the device.

In this policy, "we", "us" and "our" mean Spiral Ladder Technology (Shenzhen) Co., Ltd., the company that publishes the App under the INNVOX brand.

Our website innvox.ai and online store are covered by a separate privacy policy at https://innvox.ai/privacy. This policy covers only the App.

2. Summary

• The App has no accounts, no ads, and no advertising ID. It contains no third-party analytics, advertising, or push notification SDKs, and it has no AI chat or AI coaching features.
• Nothing is sent from the App to us before you accept this policy when you first open the App.
• Your voice is captured by the INNVOX device and analyzed on your phone. The App does not use the phone's microphone. Recordings and training records are stored on your phone, and you can export them at any time.
• Uploading training data to us is optional and off by default. If you turn it on, uploaded data is deleted automatically after 12 months, and you can delete it yourself at any time in the App.
• On Android, crash reports are sent to us after you accept this policy. They are deleted automatically after 90 days.
• In the United Kingdom, the App sends nothing to us automatically: training data upload is not offered, and crash reports stay on your phone (see section 17).
• We do not sell your personal information and do not share it for cross-context behavioral advertising.

3. Information That Stays on Your Phone

• Microphone: the App does not use your phone's microphone and does not ask for microphone permission. Your voice is captured by the microphone in the INNVOX device.
• Bluetooth: the App uses Bluetooth to connect to your INNVOX device, receive the audio and air pressure sensor data it captures during training, and analyze it on your phone, for example pitch, loudness, and stability. This analysis does not need an internet connection.
• Recordings and training records (such as recordings, measurements, and training history) are stored in the App's storage on your phone. They are sent to us only if you turn on the optional upload described in section 4.
• Location (Android 11 and earlier only): on these Android versions, the system requires location permission before an app can scan for Bluetooth devices. The App asks for it only to find your INNVOX device. The App does not read, collect, or store your location.
• Wi-Fi: during a firmware update, the App uses Wi-Fi only to join the INNVOX device's own hotspot and transfer the firmware. It does not collect information about other Wi-Fi networks.

4. Optional: Upload Training Data to Help Improve INNVOX

The setting "Upload training data to help improve INNVOX" is off by default. You can turn it on by ticking the box (unticked by default) on the consent screen when you first open the App, or later in Settings > Privacy & security. You can turn it off at any time; after that, nothing more is uploaded. This upload is not offered in the United Kingdom; see section 17.

When it is on, the App uploads the following for each training session:

• a measurement table (CSV file) with the session's voice and airflow measurements and information about the INNVOX device used (such as its device ID, name, firmware version, and battery level);
• the session's audio recordings (WAV files), which contain your voice;
• a random installation ID generated by the App (not an advertising ID, IMEI, phone number, or any hardware identifier);
• your phone's operating system type (iOS or Android) and the App version;
• timestamps of the session and the upload.

4.1 How Uploaded Training Data Is Used and Kept

The data is sent over HTTPS to our server at innvox.ai and stored on servers we control. We use it to improve our measurement algorithms and product quality. Our staff who work on product and algorithm development and user support can access it.

Uploaded training data is kept for 12 months after we receive it and is then deleted automatically. You can delete it sooner at any time as described in section 12.

5. Crash Reports (Android Only)

After you accept this policy, if the Android App crashed or exited abnormally, the App sends a crash report to innvox.ai the next time you open it (except in the United Kingdom; see section 17). A crash report contains:

• the reason the App exited and the technical record Android keeps about it (such as error messages and stack traces, and for native crashes the crash dump file Android creates for the App);
• your phone's manufacturer, model, and processor information;
• the Android version and the App version;
• the installation ID and the time the App exited.

5.1 How Crash Reports Are Used and Kept

We use crash reports only to find and fix problems. They do not contain recordings or training measurements. Crash reports are sent whether or not training data upload is turned on. They are kept for 90 days after we receive them and are then deleted automatically.

The iPhone App does not send crash reports to us. If you have chosen in your iPhone settings to share analytics with app developers, Apple may provide us with crash information under Apple's own terms.

6. Firmware Updates

When you check for or install a firmware update for your INNVOX device, the App downloads firmware information and files from our servers (innvox.ai). These requests do not include your installation ID or any other personal information from the App. As with any internet request, our servers receive your IP address and basic request details (such as the time and the file requested), which are kept in standard server logs for a limited period for security and troubleshooting.

7. Diagnostic Logs and Data You Choose to Export

The App keeps a technical log on your phone to help troubleshoot problems. It is not sent to anyone automatically. Only when you tap "Export diagnostic logs" does the App create a log file, and you choose where to share it (for example, by email to us). If you send it to us, we use it only to help with your issue and delete it when it is no longer needed for that purpose.

Settings > Privacy & security > "Export data on this phone" packs the data the App keeps on your phone into one file: training measurement records and recordings, technical logs and crash reports kept on the phone, the App's settings (without Wi-Fi passwords), and the App version, installation ID, and export time. You choose where to save or share the file; it is not sent to us automatically. If you agree to send it to us (for example, after we contact you and we agree on it), we use it only for the agreed purpose and delete it when it is no longer needed.

8. How We Use Information

We use information only to:

• to improve our measurement algorithms and product quality (training data you choose to upload);
• to find and fix crashes and other problems (crash reports and diagnostic logs you send us);
• to provide firmware updates;
• to respond to your questions and privacy requests;
• to comply with the law and keep our services and systems secure.

8.1 What We Do Not Do

We do not use your data for advertising or profiling, and we do not make automated decisions based on it that have legal or similarly significant effects on you. We do not create voiceprints or use recordings to identify anyone.

9. Who Can Access Your Information and Sharing

Uploaded data is stored on servers we control, and only our authorized staff can access it.

We do not sell personal information, do not share it for cross-context behavioral advertising, and do not give it to third parties for their own purposes. Companies that provide our server hosting and network services store and transmit data on our behalf and may process it only to provide those services to us.

We may disclose information if required by law, or to protect the rights, safety, and security of our users, the public, or us. If our business is reorganized or sold, information may be transferred as part of that transaction and will remain subject to this policy.

10. International Transfers

We are based in China. Uploaded data is sent over HTTPS to innvox.ai and stored on servers we control, which may be located outside your country. Our staff who access the data are located in China. This means your information may be processed in China and in other countries whose data protection laws may differ from those where you live. Wherever it is processed, we protect it as described in this policy.

11. How Long We Keep Information

• Uploaded training data: 12 months after we receive it, then deleted automatically. You can delete it sooner.
• Crash reports (Android only): 90 days after we receive them, then deleted automatically.
• Server logs: a limited period, for security and troubleshooting.
• Data on your phone: until you delete it in the App or uninstall the App.
• Emails, diagnostic logs, and export files you send us: until your request has been handled or the agreed purpose is complete.

12. Your Choices and Deleting Your Data

• Turn upload on or off: Settings > Privacy & security > "Upload training data to help improve INNVOX".
• Delete uploaded data: Settings > Privacy & security > "Delete uploaded data". This immediately deletes from our servers all training data and crash reports uploaded from this installation of the App.
• Your installation ID is shown on the same screen and can be copied. Reinstalling the App or switching to a new phone creates a new installation ID, and the App can then no longer delete data uploaded under the old one. In that case, email yaodong@innvox.cn with the old installation ID if you have it, or with the approximate dates and the type of phone you used, and we will delete the data we can identify as yours.
• Data on your phone: delete training records in the App, or uninstall the App to remove all of the App's data from your phone. You can also export a copy with Settings > Privacy & security > "Export data on this phone".
• Permissions: you can turn off Bluetooth or location access at any time in your phone's settings. Features that need them will stop working.

13. Security

Data is sent over encrypted HTTPS connections. Upload requests must carry an app key. Uploaded data is stored outside the public website, and only authorized staff can access it. No method of transmission or storage is completely secure, but we work to protect your information and will notify you and regulators of a breach where the law requires.

14. Children

The App is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has uploaded data through the App, contact us at yaodong@innvox.cn and we will delete it.

15. Your Privacy Rights in the United States (Including California CCPA/CPRA)

If you live in California or another US state with a consumer privacy law (such as Colorado, Connecticut, Virginia, Utah, Texas, or Oregon), you have the rights below, subject to exceptions under the law.

In the past 12 months, we collected the following categories of personal information through the App, from you and your phone, for the purposes in section 8: audio information, namely voice recordings (only if you turn on training data upload); identifiers (the App's random installation ID, and IP address in server logs); device information (phone operating system, Android device model and version, App version, and INNVOX device information in measurement tables); and diagnostic information (crash details and timestamps).

We disclose these categories only to our server hosting and network service providers, for the business purposes above. We have not sold or shared (for cross-context behavioral advertising) personal information, including that of consumers under 16, and we do not use or disclose sensitive personal information in ways that would give rise to a right to limit its use.

• Right to know and access: ask what categories of personal information we collect and get a copy of the specific information we hold about you.
• Right to delete: ask us to delete personal information we hold about you.
• Right to correct: ask us to correct inaccurate personal information.
• Right to opt out of sale or sharing: we do not sell or share personal information, so there is nothing you need to opt out of.
• Right to non-discrimination: we will not deny you service or treat you differently for exercising these rights.
• Appeals: if we decline your request, you can appeal by replying to our decision email. If you disagree with the outcome of the appeal, you can contact your state Attorney General.
• How to make a request: use "Delete uploaded data" in the App for immediate deletion, or email yaodong@innvox.cn with the subject "Privacy request". Because the App has no accounts, we verify requests using the installation ID shown in Settings > Privacy & security (and, if needed, the approximate upload dates). We respond within 45 days, and may extend this by up to 45 more days where the law allows, after telling you.
• Authorized agents: you may use an authorized agent to make a request. We may ask the agent for your written permission and ask you to confirm the request with us directly.

16. Your Privacy Rights in Canada (PIPEDA and Quebec Law 25)

If you live in Canada, we handle your information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, the Act respecting the protection of personal information in the private sector as amended by Law 25. You have the right to:

• access your personal information and learn how it has been used and disclosed;
• correct personal information that is inaccurate or incomplete;
• withdraw your consent: turn off training data upload at any time or delete uploaded data. Withdrawing consent does not affect processing that took place before;
• where the law provides, receive your personal information in a structured, commonly used technological format;
• make a complaint. Please contact us first. You can also complain to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) and, in Quebec, to the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca).

16.1 Privacy Officer

Our Privacy Officer (the person in charge of the protection of personal information under Quebec law) handles access, correction, consent withdrawal, and complaint requests from Canadian users: Privacy Officer, Spiral Ladder Technology (Shenzhen) Co., Ltd., yaodong@innvox.cn. We respond to requests within 30 days.

17. Your Privacy Rights in the United Kingdom (UK GDPR)

If you are in the United Kingdom, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 apply to how we handle your personal information. The controller is Spiral Ladder Technology (Shenzhen) Co., Ltd., Shenzhen, Guangdong, China (contact: yaodong@innvox.cn, +86 173 8486 0919).

In the United Kingdom, the App sends nothing to us automatically. Training data upload is not offered (there is no upload box on the consent screen and no upload switch in Settings), and Android crash reports stay on your phone and are not sent. Your training records, recordings, and technical logs stay on your phone, and you can export them yourself with Settings > Privacy & security > "Export data on this phone".

The App decides on your phone whether you are in the United Kingdom, without going online or asking for extra permissions. It treats you as being in the UK if any of these is true: your phone's region is the United Kingdom, its time zone is London, your Android SIM or mobile network country is the United Kingdom, or your iPhone's App Store country is the United Kingdom. Once it has done so, the App keeps treating you as being in the UK on that phone.

In the United Kingdom, we receive information about you only when you check for or install a firmware update (section 6; the requests contain no personal information, but our servers receive your IP address), when you use "Delete uploaded data" (which sends the installation ID), or when you choose to send us an export file, diagnostic logs, or an email. If you turned on upload before the App recognised you as being in the UK, data uploaded before then is handled as described in sections 4.1 and 11, and you can delete it with "Delete uploaded data".

The legal bases we rely on are:

• Export files, diagnostic logs, and emails you choose to send us: our legitimate interests in responding to you and solving your problem; for data you send after we contact you and you agree, your consent.
• Training data uploaded before the App recognised you as being in the UK: the consent you gave by turning the upload on. You can delete it at any time with "Delete uploaded data".
• Firmware updates: necessary to provide the features you ask for under our Terms of Use with you.
• Deletion and other privacy requests: compliance with our legal obligations.
• Server logs: our legitimate interests in keeping our services and systems secure.
• Withdrawing consent does not affect processing based on consent before you withdrew it.

17.1 Your Rights in the United Kingdom

Subject to the conditions in the UK GDPR, you have the rights below. You can get the data kept on your phone at any time with "Export data on this phone". You can use "Delete uploaded data" in the App (see section 12), or email yaodong@innvox.cn with the subject "Privacy request". We verify requests using the installation ID and normally respond within one month; for complex or numerous requests we may extend this by two further months, after telling you. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

• Access: get a copy of the personal information we hold about you;
• Rectification: have inaccurate or incomplete personal information corrected;
• Erasure: have your personal information deleted;
• Restriction: ask us to restrict processing in certain circumstances;
• Objection: object to processing based on our legitimate interests, such as server logs;
• Portability: receive personal information you gave us on the basis of consent in a structured, commonly used, machine-readable format;
• Withdraw consent: withdraw any consent you have given, at any time;
• Complaint: complain to the Information Commissioner's Office (ICO), ico.org.uk, phone 0303 123 1113. We would appreciate the chance to deal with your concern first, so please contact us before you do.

17.2 Transfers Outside the United Kingdom

In the United Kingdom, the App does not send data outside the UK automatically. Only firmware update and deletion requests, and data you choose to send us, leave the UK: our servers are currently provided by a hosting provider in the United States, and our staff who handle the data are in China. These countries may not protect personal information to the same standard as the UK. We protect the data with the measures described in this policy: encryption in transit (HTTPS); storage outside the public website, with access limited to authorized staff; a hosting provider that may process the data only to provide its services to us; and automatic deletion after the periods in section 11. To learn more about how your data is protected when it is transferred, email yaodong@innvox.cn.

18. Not a Medical Device

The App and the INNVOX device are voice training tools, not medical devices. They do not diagnose, treat, or prevent any disease or condition. Measurements and results are for voice training reference only. We do not use your data to make health assessments about you.

19. Changes to This Policy

We may update this policy. We will post the new version on this page with a new effective date. If we make a material change, such as collecting a new type of data or using data in a new way, we will tell you in the App and, where required by law, ask for your consent again before the change applies to you.

20. Contact Us

Spiral Ladder Technology (Shenzhen) Co., Ltd. (INNVOX), Shenzhen, Guangdong, China

Email: yaodong@innvox.cn

Phone / WhatsApp: +86 173 8486 0919

Website: https://innvox.ai/