I. Personal Information We Collect

We generally collect and obtain information through the following three methods:

• 1. Information You Provide Directly to Us

  • （1）Contact Information: If you decide to contact us directly via email, we will collect the email address you provide and any other information you voluntarily provide in order to respond to your inquiry. After responding to any inquiry from a child, we will immediately delete all relevant personal information contained therein.
  • （2）Payment Information: We do not collect or store any of your financial data, as all payments are managed by the platform you use to download the app (such as Google Play or the Apple App Store).

• 2. Information We May Collect Automatically

  When you use our services, we may automatically collect certain information, primarily including the following:

  Information Type	Specific Information	Data Processing Activities and Explanations
  Account Information	Account ID (generated when users register)	Manage your information and account.
  Location Data	The approximate geographic location of the device, inferred from the IP address, such as at the country or city level. Note: We do not collect precise GPS location information.	1) Provide services (such as offering age-appropriate content or language versions based on your region); 2) Operate, provide, maintain, protect, manage, and customize our apps and how they are provided; 3) Improve the app experience and identify fraud, security, or technical issues related to the apps (such as detecting logins from unusual locations).
  Technical Data	1) IP address; 2) Device operating system version, device model, device brand, device resolution, device language, device identifier (OpenUDID, collected on iOS only); 3) App ID (Application ID/Bundle ID): Used to identify the app's runtime environment and version updates; 4) App Set ID/App Group ID: Used for basic cross-app statistical analysis and fraud prevention; 5) Advertising ID (IDFA): Collected only on iOS devices and used solely for behaviorally targeted advertising with user consent, ad frequency control and basic attribution analysis; not collected from children; 6) Cookies: Used only for web-based services (for adults) to maintain login status and perform basic statistical analysis; we do not use cookies for cross-site tracking or behavioral marketing.	1) Ensure the proper operation and compatibility of our apps; 2) Analyze app performance and troubleshoot technical issues; 3) Prevent fraud and maintain security; 4) Not used for behavioral advertising targeted at children, profiling, or automated decision-making. Regarding cookie management, you can control cookies through your device's system settings or the cookie banners displayed in our apps, where you can choose to accept or reject non-essential cookies.
  Log and Usage Data	1) Frequency and duration of app usage; 2) Features used and actions performed within the apps, including browsing and tapping behavior; 3) In-app progress, in-app purchases (excluding financial data such as bank account and credit card information), aggregated usage statistics, and performance data; 4) Error and crash reports.	1) Improve and optimize app features and the user experience; 2) Troubleshoot issues and ensure stable service operation; 3) Conduct aggregated statistical analysis to understand user trends (without identifying individuals); 4) Crash logs will also be used for security incident investigations and verification of fixes.

• 3. Information We Collect from Third Parties

  We may receive technical data about you from third-party sources (i.e., some companies listed in the "Third-Party Data Controllers and Processors" section below). These third parties collect data solely in accordance with their privacy policies and our agreements with them, and we monitor their compliance.

  Under no circumstances do we collect your precise location information (such as a specific street address). We do not intend to and do not actively collect "Special Categories of Personal Data" (such as health information, race, religion, political opinions, philosophical beliefs, sexual orientation, etc.), and we have made every effort through technical and administrative measures to prevent the accidental collection of such data. If such data is collected due to an unforeseen system vulnerability, we will immediately delete it and notify the relevant regulatory authorities.

II. How We Use Personal Information and the Legal Bases

We will only use your personal data to the extent permitted by law. The specific legal basis for each processing activity is as follows:

Please note that in exceptional cases where we are legally required to process personal data and cannot provide advance notice (such as in emergencies involving the protection of children's safety), we may process such data without prior notice, but will subsequently provide notice in accordance with the laws.

III. Children's Privacy

• 1. Age Confirmation and Parental Consent Mechanism

  We take children's privacy seriously. When users access our services, if they indicate during registration or at key points of operation that they are below the applicable legal age threshold for "children", we will:

  • (1) Restrict data collection: By default, disable behavioral tracking and personalized advertising features;
  • (2) Obtain parental consent: Require the provision of a parent's or legal guardian's email address and send a parental consent form (Verifiable Parental Consent) to explain the types of data we will collect and the purposes for which such data will be used;
  • (3) Confirm consent: The parent or legal guardian must confirm consent by replying to the email. Before obtaining such consent, we will not collect any children's personal data beyond what is permitted by applicable laws (except for technical data necessary for internal operations, such as crash logs).

• 2. Information We Collect from Children

  We may automatically collect the following persistent identifier information generated when children use our apps through the operation of our services (solely to support necessary internal operations and never for behavioral advertising, profiling, or contacting children):

  • IP address
  • Account ID
  • Device ID: OpenUDID (collected on iOS only
  • App Set ID/App Group ID

  Internal operations specifically refer to: crash troubleshooting, service stability monitoring, basic data statistics, contextual advertising, security protection, and compliance with legal requirements. We will not use the above data for any other purposes.

• 3. Retention, Access, and Deletion of Children's Data

  We retain children's data only for the period reasonably necessary to fulfill the purposes for which it was collected (i.e., providing app services and supporting internal operations).

  Parents or children have the right to refuse further use or collection of children's information at any time. If you (the parent) wish to access, view, or delete your children's information, you may contact us via email at [privacy@babybus.com].

  To protect children's privacy, we may require parental identity verification information (such as records confirming parental consent via email). Upon receipt of a deletion request, we will permanently delete children's data from our active databases within the timeframe required by applicable laws. However, we may retain de-identified records in backups where necessary for legal compliance or security auditing purposes.

IV. How We Disclose the Information We Collect

We may share or disclose your personal information with a limited number of carefully selected third parties, including:

• 1. Our Affiliates

  We may share information with our affiliates (such as BABYBUS (FUJIAN) NETWORK TECHNOLOGY CO., LTD. and JAPAN BABYBUS CO., LTD.). These companies will use your personal information in the same manner as described in this Privacy Policy. For users subject to the GDPR, the legal basis for data processing by our affiliates is our legitimate interests or your consent, as applicable.

• 2. Advertising Partners

  If you are a parent or an adult (i.e., not a child), we may disclose your personal information to third-party advertising partners based on an appropriate legal basis (if applicable), to assist with measuring the effectiveness of our marketing campaigns.

  Please note that we will never disclose information collected from children to advertising partners, nor will we transfer children's data to advertising partners in connection with child-directed services.

• 3. Disclosure to Protect Us or Others

  If we believe in good faith that accessing, retaining, or disclosing any information related to you to external parties is necessary or appropriate, we may do so in order to: comply with law enforcement or national security requests and legal proceedings (such as court orders or subpoenas); protect the rights, property, or safety of you, us, or others; enforce our policies or contracts; collect outstanding debts; or assist in the investigation or prosecution of suspected or actual illegal activities to the extent permitted by law.

• 4. Disclosure in Connection with Business Transfers

  If we are involved in an actual or proposed merger, acquisition, financing due diligence process, reorganization, bankruptcy, receivership, asset purchase or sale, or transfer of services to another provider, your information may be transferred as part of such transaction, to the extent permitted by applicable law and/or contractual obligations.

  Third-Party Data Controllers and Processors
  Google AdMob (Google LLC) AdMob is a mobile advertising platform that enables developers to monetize their apps by displaying advertisements from other advertisers within their apps. It uses personal data and non-personal data solely for its internal purposes. Legal Basis for Processing: Legitimate interests, namely supporting internal operations. Location of Processing: United States Privacy Policy: https://policies.google.com/privacy Address: 1600 Amphitheatre Pkwy, Mountain View, California 94043, US
  InMobi (InMobi Technology Services Pte. Ltd.) InMobi is an advertising service provided by InMobi Technology Services Pte. Ltd. It uses personal data and non-personal data solely for its internal purposes. Legal Basis for Processing: Legitimate interests, namely supporting internal operations. Privacy Policy: https://advertising.inmobi.com/privacy-policy Contact: privacy@inmobi.com
  UnityAds&ironSource (Unity Technologies) UnityAds&ironSource is an advertising service provided by Unity Technologies. It uses personal data and non-personal data solely for its internal purposes. Legal Basis for Processing: Legitimate interests, namely supporting internal operations. Privacy Policy: https://unity.com/cn/legal/game-player-and-app-user-privacy-policy Contact: DPO@unity3d.com
  Petal Ads (Aspiegel SE) Petal Ads is an advertising service provided by Aspiegel SE. It uses personal data and non-personal data solely for its internal purposes. Legal Basis for Processing: Legitimate interests, namely supporting internal operations. Privacy Policy: https://privacy.consumer.huawei.com/legal/ads/privacy-statement.htm?&code=EU&language=en-EU&branchid=0&contenttag=default Address: Aspiegel SE, 3rd floor, Mespil Court, Mespil Road, Ballsbridge, Dublin 4, D04 E516, Ireland. Registration number 561134.
  Mintegral Mintegral is an advertising service provided by Mintegral entities. It uses personal data and non-personal data solely for its internal purposes. Legal Basis for Processing: Legitimate interests, namely supporting internal operations. Privacy Policy: https://www.mintegral.com/en/privacy Contact: privacy@mintegral.com
  Topon (Ascent Pro Technology Limited/TOPON PTE. LTD.) Topon is an advertising service provided by Ascent Pro Technology Limited/TOPON PTE. LTD. It uses personal data and non-personal data solely for its internal purposes. Legal Basis for Processing: Legitimate interests, namely supporting internal operations. Privacy Policy: https://help.toponad.net/cn/docs/1Mn1B7 Contact: privacy@toponad.net
  Sign in with Google (Google LLC) Sign in with Google is an account login management service provided by Google LLC It uses personal data and non-personal data solely for its internal purposes. Legal Basis for Processing: Legitimate interests, namely supporting internal operations. Privacy Policy: https://developers.google.com/terms/api-services-user-data-policy Location of Processing: United States Address: 1600 Amphitheatre Pkwy, Mountain View, California 94043, US
  Firebase (Google LLC) Firebase is a mobile analytics platform that helps developers analyze crash reports and user retention. It uses personal data and non-personal data solely for its internal purposes. Legal Basis for Processing: Legitimate interests, namely supporting internal operations. Location of Processing: United States Privacy Policy: https://policies.google.com/privacy?hl=en Address: 1600 Amphitheatre Parkway, Mountain View, CA 94043, US Contact: https://firebase.google.com/support/troubleshooter/contact/
  Google Analytics (Google LLC) Google Analytics is a web analytics service provided by Google LLC It uses personal data and non-personal data solely for its internal purposes. Legal Basis for Processing: Legitimate interests, namely supporting internal operations. Location of Processing: United States Privacy Policy: https://policies.google.com/privacy Address: 1600 Amphitheatre Pkwy, Mountain View, California 94043, US

  You may refer to the table above for information regarding the third-party service providers and SDKs integrated into our services. Any information received by third-party service providers is controlled by the respective companies and is subject to their respective privacy policies. You may view such privacy policies through the links provided in the table above.

  We have enabled COPPA/GDPR compliance modes for all third parties that process children's data (such as Google's TFCD/TFUA and TFAT flags) to ensure that they do not engage in personalized advertising or collect additional data.

V. How We Protect Your Personal Information

We take appropriate physical, technical, and administrative measures based on currently available technologies to ensure that your personal data is not lost, accessed or used without authorization, altered, or disclosed.

Although we have implemented measures designed to protect data security, no website or internet transmission is completely secure. We cannot guarantee that unauthorized access, hacking, data loss, or other security incidents will never occur. In the event of a security incident, we will notify affected users and regulatory authorities in a timely manner as required by law. To the maximum extent permitted by applicable law, we shall not be liable for any unauthorized access, use, disclosure, or loss of personal information.

By using our services or providing us with personal information, and to the extent permitted by law, you consent to our communicating with you electronically regarding security, privacy, and administrative matters related to your use of our services. If we discover that our security systems have been compromised, we may attempt to notify you by posting a notice within the services, sending a notice by mail, or emailing you.

VI. Data Storage and Retention

• 1. We will store information on servers located closest to the end user in order to provide secure and fast services. The server locations include:

  • （1）The United States;
  • （2）Hong Kong;
  • （3）Germany.

  You acknowledge and agree that your data may be processed on our servers or the servers of our processors, which may be located outside your country of residence. Nevertheless, we will ensure that appropriate measures are implemented to protect your personal data in accordance with this Privacy Policy. This means that all of our service providers and partners are required to process personal data in compliance with the European Union's General Data Protection Regulation ("GDPR") and other applicable laws.

• 2. We will retain your information for as long as necessary to provide you with our services. Thereafter, we will continue to retain such information only to the extent necessary to comply with legal obligations, resolve disputes, enforce agreements, and comply with applicable statutes of limitations.

VII Your Rights

This section varies depending on your jurisdiction. Please refer to the applicable provisions based on your actual circumstances.

• A. General Rights Applicable to All Users Worldwide

  You may contact us at [privacy@babybus.com] to exercise the following basic rights:

  Right of Access: To obtain a copy of your personal data held by us.

  Right to Rectification: To correct incomplete or inaccurate data.

  Right to Erasure ("Right to Be Forgotten"): To request the deletion of your data (subject to legal retention obligations).

  Right to Restriction of Processing: To restrict how we use your data under certain circumstances.

  Right to Object to Processing: You have the right to object when we process data based on our legitimate interests.

• B. Section for EU/UK Users (GDPR Rights)

  In addition to the rights listed above, if you are located in the European Union or the United Kingdom, you also have the following rights:

  Right to Withdraw Consent: When we process data based on your consent, you have the right to withdraw your consent at any time (withdrawal does not affect the lawfulness of processing prior to withdrawal).

  Right to Data Portability: You have the right to receive an electronic copy of the personal data you have provided (in a structured, commonly used format).

  Right to File a Complaint with a Supervisory Authority: You have the right to file a complaint with your local data protection authority (DPA). For example:

  Information Commissioner's Office (ICO) in the UK: https://ico.org.uk

  Irish Data Protection Commission: https://www.dataprotection.ie

  For contact information for DPAs in other EU member states: https://edpb.europa.eu/about-edpb/about-edpb/members_en

  Right to object to automated decision-making: We are committed to not engaging in automated decision-making. If any exceptions apply, we will provide separate notice.

• C. Section for U.S. Users (COPPA Rights - For Parents)

  If you are a resident of the United States and your child is under 13 years of age:

  Right to Review: You have the right to request to review the personal information we have collected about your child.

  Right to Deletion ("Erase Button"): You have the right to request the deletion of all personal information we have collected about your child at any time. We will immediately process such requests through the channels described in Section III(3).

  Right to Object to Further Collection: You have the right to request that we cease further collection or use of your child's personal information.

  Please note that exercising all these rights may require verification of your identity, and the exercise of certain rights may be subject to exemptions provided by local law (such as where necessary to protect the public interest or to exercise legal claims).

VIII. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us via email at [privacy@babybus.com].

We have appointed representatives in the United Kingdom and the European Union in accordance with Article 27 of the GDPR. You may contact them as follows:

• Representative in the United Kingdom:
  Rickert Services Ltd UK
  -BabyBus Co., Ltd. -
  PO Box 1487
  Peterborough
  PE1 9XX
  United Kingdom
  art-27-rep-babybus@rickert-services.uk
• Representative in the European Union:
  Rickert Rechtsanwaltsgesellschaft mbH
  - [BabyBus Co., Ltd.] -
  Colmantstraße 15
  53115 Bonn
  Germany
  art-27-rep-babybus@rickert.law