PolyMate
Official site
POLYMATE / PRIVACY

PolyMate Privacy Policy

Effective Date: September 19, 2026 · Last Updated: September 19, 2026 customer@polymate.com

We do not use user content for model training. Primary servers are in Singapore; providers may process data elsewhere. Delete your account in the App or contact support to exercise privacy rights.

01About this policy

HONG KONG TOONSHORT TECHNOLOGY LIMITED ("we", "us" or "our") operates PolyMate. This Policy explains how we collect, use, share, retain and protect personal information through the PolyMate application and related services referring to this Policy, and the choices available to you.

PolyMate is intended for adults aged 18 and over worldwide. Availability of particular services, models and features is subject to local law, app store requirements and provider territorial restrictions. For processing for which we are responsible, we act as a controller or data user under applicable law.

We may provide additional notices or request permissions at the point of collection. Reading this Policy or continuing to use the Services does not automatically provide consent where consent is required. Send privacy questions and rights requests to customer@polymate.com.

02Personal information we collect

We obtain this information from your submissions, authorized sign-in and payment platforms, and records generated during service operation. Required information enables the service you request; withholding it may make the relevant feature unavailable. You may choose whether to provide optional information and permissions.

  • Account details: account identifiers, email address, name and profile image, where supplied by Google, Facebook or Apple with your authorization, together with your PolyMate nickname, profile image and preferences. Third-party sign-in does not give us your password for that platform.
  • Conversations and generated content: messages, prompts, character details, images and other materials you submit, and generated text, images, videos and associated histories. Your submissions may contain personal information.
  • Device and operational data: IP address, device and operating system type, application version, language, access times, feature interactions, error and crash records, installation identifiers and push tokens; advertising identifiers and advertising interactions where permitted by applicable permissions and choices.
  • Location: approximate region inferred from IP address; if you separately grant location permission, device location within the precision you authorize for the feature explained in the permission notice. IP-based region inference and device location access are distinct activities.
  • Transactions: order identifiers, products, amounts, currencies, purchase times, receipts and transaction status provided through Apple or Google payment channels. We do not access or retain your bank payment card details; relevant payment providers handle those details.
  • Support and review records: questions, contact details, attachments and feedback you submit, and records needed to handle complaints, security incidents or business reviews.

03Device permissions

We request relevant permissions according to the feature used and operating system rules. You can deny or withdraw them in system settings. Permission does not authorize uses beyond those explained to you.

Denying an optional permission may affect the corresponding feature, but not unrelated features. Revocation does not automatically erase information previously processed lawfully; you may request deletion under this Policy.

  • Photos: selecting and uploading images such as profile pictures. When the system photo picker is used, access may be limited to selected photos.
  • Saving photos and storage: writing images, videos or files you choose to save to your device. Required permissions depend on the operating system and saving method.
  • Notifications: delivering service alerts and related notifications. You can disable them and manage lock-screen previews in system settings.
  • Location: requested when you initiate a feature requiring location, with the specific purpose and required precision explained before the request. You may refuse, choose an approximate-location option offered by your system, or withdraw permission. Permission for one feature is not treated as consent for other purposes.
  • iOS App Tracking Transparency (ATT): where applicable, requesting tracking authorization for cross-app or website advertising measurement and personalized advertising. If refused, we will not perform ATT-restricted tracking or access restricted advertising identifiers. Non-personalized advertisements may still appear.

04Purposes and legal bases

We process relevant information to create and authenticate accounts; provide AI conversations, image and video generation; retain histories and preferences; process payments and entitlements; deliver notifications; respond to support requests; diagnose crashes and faults; perform necessary security, fraud prevention and content reviews; measure advertising and provide personalized advertising where permitted; and meet legal obligations and handle disputes.

Where EEA or UK law applies: account, generation and purchase processing is limited to what is necessary to perform our contract; necessary security, fraud prevention, diagnostics and review may rely on legitimate interests after balancing your rights; mandatory records and legally required disclosures rely on legal obligations; and non-essential tracking, advertising requiring consent and certain permission-related processing rely on applicable consent. We will not substitute legitimate interests to bypass a consent requirement.

If you voluntarily enter sensitive content concerning health, sex life, religion or similar matters, it may form part of a generation request. Avoid unnecessary sensitive information or other people's private information. Where applicable law requires additional conditions or explicit consent, those requirements must be satisfied before processing.

We do not use user content to train models. Response generation, content safety review and troubleshooting are distinct from model training. Provider rules are described next.

05AI providers and human review

PolyMate uses BytePlus text and video models and Qwen image model services. To fulfil your selected task, relevant providers may receive prompts, necessary conversation context, reference images or other generation materials you submit, generation parameters and technical information such as request identifiers, and process resulting outputs. An image used only as a profile picture does not automatically become model input under this clause.

We do not use conversations, uploads or generated content for training or fine-tuning. Provider processing must comply with applicable service contracts, account settings, published rules and data protection law. Published terms neither grant unlimited authorization from you nor remove our responsibilities. A provider's separate training authorization cannot be inferred from this Policy.

BytePlus: current ModelArk rules exclude training without a separate opt-in; third-party models have their own terms. Processing may occur in Malaysia, Indonesia and/or the EU/EEA. Filter-triggered inputs and outputs are retained in Malaysia for 180 days, not a universal retention period.

Qwen: when accessed through Alibaba Cloud Model Studio, its privacy notice excludes training on customer data. Storage and inference locations depend on the region and deployment scope. The reviewed notices establish no single log-retention period for our image interface; applicable contracts and settings determine it.

Authorized personnel may review relevant conversations and materials for support, reports, safety risks, legal compliance and necessary business quality reviews. Access is limited to a specific business need and subject to confidentiality, access restrictions and appropriate oversight; this is not permission for unrestricted browsing of conversations.

06SDKs, payment and sign-in services

Providers do not thereby receive unrestricted rights to all account details or conversations. We limit disclosures according to the feature and applicable law. A provider's optional data fields do not mean PolyMate necessarily supplies them.

  • Firebase Crashlytics (Google): crash measurement and diagnostics; may process crash traces, installation identifiers, application versions and device state. Google describes a 90-day retention period for relevant crash data and identifiers before removal from live and backup systems begins.
  • Firebase Cloud Messaging (Google): notification delivery using installation identifiers, registration tokens and necessary delivery data. Its documentation states that installation IDs remain until the customer invokes deletion, followed by removal from live and backup systems within 180 days. Disabling notifications is not an API deletion request.
  • Adjust: attribution, advertising measurement and fraud prevention; depending on configuration and permissions, processes installation and app events, ad interactions, IP address, device details and advertising or other identifiers.
  • AppLovin MAX: ad mediation, delivery and measurement using device/app information, IP addresses, available advertising identifiers and ad events, subject to consent and configuration. Enabled networks may process data under their own policies; participating networks should be identified through advertising consent or partner disclosures.
  • Google, Facebook and Apple: authenticate your chosen sign-in method. Apple and Google also provide relevant payment services. Each platform is responsible for processing within its own services.

07Advertising, cookies and privacy choices

We use attribution and ad mediation services. Subject to applicable consent and opt-out requirements, advertising partners may use identifiers and interaction records to measure effectiveness, control frequency or personalize ads. Cross-service advertising disclosures may constitute a sale, sharing or targeted advertising under some laws even without direct payment for data.

If related web or embedded pages use cookies or similar storage, necessary technologies support sign-in, security and essential preferences. Non-essential technologies requiring consent must remain disabled until consent is obtained. You may manage choices through consent controls presented to you or clear/restrict browser cookies, which may affect features.

Use system settings to adjust ATT, advertising identifiers and location permissions, or email customer@polymate.com to opt out of personalized advertising, sale or sharing. Device settings do not necessarily cover every statutory opt-out right, and email requests do not replace legally required immediate technical opt-out mechanisms.

Where legally required, we will treat valid Global Privacy Control (GPC) or other universal opt-out signals from a browser or device as requests to opt out of sale, sharing or targeted advertising, applying choices to an identifiable browser, device or account. ATT, GPC and browser Do Not Track are distinct mechanisms.

Opting out does not necessarily remove all ads or necessary security processing. Some choices are browser- or device-specific and may need to be renewed after clearing storage or changing devices. We will not unlawfully discriminate against you for exercising your rights.

08Other disclosures

Beyond the providers above, we may disclose information needed for hosting, security, support or professional advice to relevant recipients, subject to appropriate data protection requirements for their roles. Similar company names or group relationships do not imply sharing with unspecified affiliates.

We may disclose information to authorities or other necessary recipients where required by law, valid legal process, fraud investigations or protection of legal rights. Information may transfer with a merger, acquisition, restructuring or asset transfer, while remaining subject to applicable data protection requirements.

When you choose to share content through system tools or other platforms, recipients may independently retain or redistribute it. Third-party websites, sign-in and payment platforms govern processing within their own services through their policies; this does not remove our responsibility for our processing.

For processing or disclosure outside previously explained purposes, we will satisfy applicable notice, legal basis and consent requirements.

09Storage locations and international transfers

PolyMate's primary servers are in Singapore. We follow Singapore data protection and security requirements applicable to that storage and processing, together with other legal duties arising from users' locations or processing activities.

AI, messaging, advertising, attribution and sign-in services may process information elsewhere. Section 5 describes certain published AI provider arrangements; PolyMate's Singapore deployment does not mean all providers process data only in Singapore.

Transfers must meet applicable legal conditions and safeguards. For EEA or UK regulated transfers, mechanisms may include adequacy decisions, EU standard contractual clauses with an applicable UK addendum, or another lawful mechanism, with assessment and supplementary safeguards where needed. This description does not assert that a specific document has already been executed with every provider.

Contact our support email for information about principal processing locations and applicable safeguards relevant to your data. Use of the Services alone does not replace separately required transfer consent.

10Retention, account deletion and unlinking

We retain information for periods necessary to provide services, meet legal obligations, resolve disputes and maintain security, considering sensitivity, purpose and continuing need. Account information, conversation history and generated materials support the services you use. Transactions, security and complaint records may require different retention periods.

You can delete your PolyMate account using the in-app account deletion feature. This also removes links in our systems between that account and third-party accounts such as Google, Facebook or Apple. It does not delete your third-party accounts; you can also manage PolyMate authorization on those platforms.

We handle deletion or anonymization of account-related personal information under applicable law. Transaction, compliance, dispute and fraud prevention records that must be retained are not necessarily erased immediately and should have restricted uses. Backups and independent provider logs are not guaranteed to disappear simultaneously; applicable deletion procedures and necessary retention rules apply. We will communicate deletion requests to relevant processors where required by law and applicable.

To request deletion of specific conversations, check progress or ask about retention, contact customer@polymate.com. A deadline for responding to a rights request is not the same as physical removal of all backups and provider copies. This Policy does not promise an unverified universal erasure period.

Do not treat account deletion as automatic cancellation of Apple- or Google-managed subscriptions. If you have recurring payments, verify cancellation with the relevant platform.

11Information security

We will apply technical and organizational safeguards proportionate to risk, including appropriate transmission protection, authentication, role-based access, confidentiality requirements and incident handling. Access to user content should be limited to authorized personnel with a business need, and safeguards should extend to outsourced processing.

Internet transmission and electronic storage cannot be guaranteed absolutely secure. Following an incident, we will investigate, contain its effects and take remedial action, notifying affected people and regulators within the scope and time required by applicable law.

Protect your third-party sign-in accounts and promptly report suspected unauthorized access. This Policy does not claim end-to-end encryption or a particular security certification for PolyMate.

12Privacy rights and regional provisions

Contact customer@polymate.com to request access, correction, deletion or information about your personal data, or delete your account in the App. Provide only what is needed to locate your account and handle the request, not passwords. We may proportionately verify access or deletion requests. We will not impose identity verification not required by law for sale, sharing or targeted-advertising opt-outs.

Depending on applicable law, you may also have rights to a copy, portability, restriction, objection, withdrawal of consent and appeal. Withdrawal does not affect earlier lawful processing. If a request is refused, we will explain applicable reasons and appeal options. Appeals can be sent to the same email; you may also complain to a competent authority as provided by law.

EEA and UK: where applicable, GDPR or UK GDPR rights include objection to direct marketing and complaints to a supervisory authority. Rights requests are generally answered within one month. Where complexity or volume permits an extension, we will explain the reasons and extension within the original period. See Sections 4 and 9 for bases and transfers.

US states, including California: where the relevant state law applies to us, you may exercise access, correction, deletion, portability, sale/sharing/targeted-advertising opt-out, sensitive-information and appeal rights, and use an authorized agent as permitted by law. Applicable California requests are generally answered within 45 days, with notice of a lawful extension. Opt-outs follow their separate statutory deadlines, not access or deletion response periods.

California category disclosure: Section 2 covers identifiers, commercial transactions, internet/device activity, location, user content and sensitive information it may contain. Sources, purposes, recipients and retention criteria appear in Sections 2 and 4–10. Advertising device/advertising identifiers, network and interaction events, and IP-derived region may constitute sale or sharing under state law. Conversations are not classified as sold/shared for advertising merely because AI generation is provided. Any additional use of precise location must meet applicable sensitive-information requirements.

Hong Kong: you may request access and correction under applicable law and complain to the Office of the Privacy Commissioner for Personal Data. Singapore: applicable rights include access, correction and withdrawal of consent, and raising concerns with the Personal Data Protection Commission. Mandatory rights in other jurisdictions are not limited by this Policy.

13Adults only

PolyMate is exclusively for people aged 18 or over and is not directed at, or open to, anyone under 18. Users must meet the account-age and download restrictions of the app store they use.

App store ratings, account information and download restrictions form part of age management; they do not mean we independently verify every actual user's age. Anyone under 18 remains ineligible even if able to download and install the App.

If we discover that an ineligible user has provided personal information, we will restrict access, delete relevant information or take other legally necessary measures. Report such cases to customer@polymate.com.

14Updates and contact

Effective date: September 19, 2026. Last updated: September 19, 2026.

We may revise this Policy as our product or processing arrangements change and update the dates on this page. Material changes will be communicated appropriately. Where fresh consent is required, valid consent will be obtained before the relevant processing begins.

Operating company: HONG KONG TOONSHORT TECHNOLOGY LIMITED. Customer support and privacy email: customer@polymate.com.

The Chinese and English versions express the same policy. No language arrangement limits your mandatory legal rights.

15Published provider information

These links provide context; they do not authorize processing beyond applicable law and contracts. Sources reviewed September 19, 2026.

16Contact

If you have any questions about this document, contact us at:

HONG KONG TOONSHORT TECHNOLOGY LIMITED
customer@polymate.com