Privacy Policy

Release Date: December 10, 2025

Effective Date: December 10, 2025

Welcome to Caro AI (hereinafter referred to as "Caro AI", "us" or "we"). At Caro AI, the guardianship of your privacy rights is of utmost importance to us and we are deeply committed to ensuring the protection of your Personal Data. You'll find the ways we gather, manage and safeguard your Personal Data highlighted in this Caro AI Privacy Policy ("Privacy Policy") as well as your rights to Personal Data protection. Any information that significantly impacts your rights and interests is emphasised using bold font to alert you. If you do not agree with any part of this Policy, please do not use or access our Services.

"Personal Data" in this Privacy Policy alludes to any data relating to an identified or identifiable natural person (data subject) such as date of birth, communication details, social account information, nickname, email address and so forth.

Minor Safety Minors below the age of 16 are not the target audience for Caro AI. If notified that any Personal Data has been unknowingly collected from a user below 16 by Caro AI, we will duly erase such Personal Data and terminate the user’s account. In the case that we have mistakenly gathered Personal Data from a minor aged under seventeen, kindly alert us using the details in “How to contact us” section below.

As a parent or lawful guardian of a minor, we implore that you peruse this Privacy Policy prior to permitting your minor to create a Caro AI account and use the application. We also urge that you vigilantly supervise your child’s use of Caro AI, ensuring the minor utilises only suitable functions.

For enquiries about this Privacy Policy, kindly reach out to us using the contact information provided at the end of this Privacy Policy.

Outlined below are key information discussed in this Privacy Policy:

Personal Data types we gather and their uses
Use of cookies and analogous technologies
Processing of minor’s Personal Data
Entrusting the processing and sharing of your Personal Data
Ensuring the protection of your Personal Data
Storing your Personal Data
Your rights
Specific directive for residents of California
Policy Update
Reaching us
Applicable law and dispute settlement

Collection and use of Personal Data

The kind of Personal Data we amass is contingent on your utilisation of Caro AI and its features. The table below summarises the types of Personal Data we compile and the purposes for which they are used.

A. Directly provided Personal Data

Account Creation and Login.

To use Caro AI applications, registration and login via a third-party platform (for instance, Facebook, Google) are required. In these circumstances, we collect your Open ID, device information and location, amongst other details, through these third-party accounts to which you are granting us access to the Personal Data concerned. We will obtain your consent before sending you promotional messages as required by relevant laws and regulations. However, you can reject or opt-out if you are uninterested in the material. Refusal to provide such Personal Data means you will not complete the registration process and will thus be unable to utilise our Services. Login entails collecting your age and nickname for chat function usage.

Creating UGC and Digital Avatar.

Creation of your digital avatar necessitates collection of your profile details including persona tags, language style, personality, etc. Generating user-generated content (UGC) such as chats, images and other content of various forms within Caro AI will mean we collect the UGC you generate, the timing, location, contents and so forth depending on the specific feature you use. We will generate and process data connected to your UGC, for example, views and followers count.

Contact and Marketing.

The contact information you provide (e.g., email address) may be used to conduct user surveys or marketing. Consent will be sought in compliance with relevant laws and regulations before marketing messages are sent. Non-interest in these materials can be communicated anytime.

B. Personal Data supplied or created on Caro AI

Viewing Content. Publicly available UGC can be viewed within Caro AI without a Caro AI account or login.

Social Network and Interaction. We may request contacts access at login to find your friends within the Caro AI community thereby enhancing your social network experience and boosting your UGC views; this access can be declined without affecting your use of other Caro AI features. We may make friend recommendations based on data analysis but you can opt out.

Chat and Message. Depending on the mode you utilise, we may collect your text chat or voice chat data during the IM Chat function.

Payment and Transaction. Completion of the payment and transaction process on the top-up and payment functions necessitates collection of your user ID, payment currency, payment amount, amongst other information.

Feedback and Report. The need to address your concern or respond to your feedback requires collection of feedback and screenshot.

Improving User Experience. Information like your language, gender, clicks and actions, program progress, operating system, network information will be automatically collected to improve your user experience within Caro AI.

Maintaining Stability and Security. Keeping Caro AI stable and secure entails collecting operation data as you use Caro AI.

If you give us the Personal Data of someone else, please draw their attention to this Privacy Policy. By supplying their Personal Data, you certify to us that you have undertaken all necessary legal requirements for any Personal Data collection and processing on their behalf.

Generally, we will use your Personal Data for the purposes elucidated in this Privacy Policy or to the extent communicated to you when we gather the Personal Data. We may also process your Personal Data for other purposes which are not incompatible with the utilisation communicated to you if it is permitted by laws and regulations. If we do so, we will adequately inform you separately.

Using cookies and similar technologies

Like many online services, we employ cookies and similar technologies for operation and provision of our Services and enhancing user experience. Cookies are typically small text files stored on your device's browser directory or program data subfolders when you use Caro AI. They enable Caro AI to store or access information about you, your devices or settings. They are principally used to ensure the normal functionality of Caro AI.

In principle, cookies do not contain identifiable information about you. They, however, facilitate a more personalized user experience. Non-acceptance of these cookies may restrict some Caro AI functions for you. Cookies enable features like saving your login details for future use. Such cookies are essential for Caro AI normal functioning. More information on cookies can be found on www.allaboutcookies.org.

Processing of minors' Personal Data

Caro AI is not directed towards minors below 16. Any Personal Data from a user below 16 unknowingly collected will be deleted from Caro AI; the user’s account will also be cancelled. If you suspect we have collected Personal Data from a minor under 16, kindly notify us using the details in the “How to contact us” section below.

As a parent or legal guardian of a minor, we urge that you scrutinize this Privacy Policy before permitting your minor to create a Caro AI account and use the application. We strongly advise that parents and guardians instruct their children to avoid revealing or sharing any Personal Data about themselves without prior permission from you when using our services. Direct any questions you have concerning how we process minors’ Personal Data using the contact information provided in “How to contact us”.

Sharing and entrustment of your Personal Data processing

To deliver enhanced services, we may engage third parties (e.g. those assisting us with Caro AI-associated services like cloud service providers) to process your Personal Data on our behalf. We will form strict confidentiality contractual arrangements with such third parties requiring them to process Personal Data in line with our stipulations, this Privacy Policy, and the secrecy and security measures stipulated in by-laws and regulations.

We may share your Personal Data in the following situations:

For an improved user experience, we may share your behavioural and profiling data with our partners; for instance, online advertising service providers.
During transactions and payments, your registration details (i.e. email, mobile number or social media token used for login) could be made known to relevant third-party payment service providers to forestall security or fraud issues.
To promote Caro AI via advertisement and marketing campaigns, your personal data contained in user-generated content may be revealed to those receiving the ads or marketing information.
Any changes to existing processes may necessitate transfer of Personal Data to other entities; such entities will be required to process your Personal Data per this Privacy Policy.
We may reveal your Personal Data to law enforcement authorities, regulatory agencies, courts and third parties where necessary to (1) comply with an applicable law or regulation; (2) defend our legal rights; or (3) protect your vital interests or those of any other persons.

Our app uses the AppLovin advertising service, which is a third-party advertising platform that places ads on your device and may collect certain data about you. Information about AppLovin how to collect and use data, please refer to [AppLovin privacy policy].

Third parties that operate as data controllers may process your Personal Data; to know their data processing practices, you will need to check their individual privacy policies provided on their official platforms.

Protection of Personal Data

AI Chat Data Processing: When you use the AI chat function of this App your chat content data (used solely to process your immediate requests) will be transmitted to our servers and processed by the locally deployed conversational AI model, with the core purpose of generating real-time AI chat responses for you. Regarding this data processing activity, we will comply with clear disclosure and consent requirements: when you use the chat function for the first time, or through the relevant settings interface within the Application, we will fully and clearly disclose specific information about data processing to you, and only after obtaining your explicit consent will we perform the aforementioned data transmission and processing operations.

We adopt appropriate technical and administrative measures to safeguard the security of your Personal Data that we collect and process. The security measures we implement are commensurate with the level of risks associated with Personal Data processing: all user data is encrypted at rest, code mechanisms are continuously reviewed to ensure the effective implementation of security measures, and regular vulnerability scans and potential threat detection are conducted on applications and other systems.

It should be noted that absolute security cannot be guaranteed in the internet environment. If a breach of your Personal Data occurs, please contact us immediately via the contact information provided in the "How to Contact Us" section.

In the event of accidental incidents, force majeure, or other circumstances leading to a Personal Data breach, we will fully mobilize all available resources to handle the situation and synchronize the progress of the incident with you in a timely manner.

Storing Personal Data

A. International Transfer

To support our global operations and security management, your Personal Data may be transferred to our affiliated entities abroad in jurisdictions different from where you reside. In such instances, we will employ stringent safeguards to ensure the security of your Personal Data during transit, complying with relevant laws and regulations.

B. Retention Period

Your Personal Data will be stored only for the duration necessary to fulfill the legitimate business needs of our company (e.g., to provide you service and comply with legal, tax, and financial requirements.) When such need no longer exists or the retention period based on appropriate laws and regulations has elapsed, we will either delete or anonymize your Personal Data.

Your rights

We prioritize the protection of your Personal Data. To access, correct, or erase your Personal Data, to refuse marketing messages, file a complaint, withdraw consent, or exercise other statutory rights, kindly proceed as described below or contact us using the contact details provided in “How to contact us”.

A. Accessing your Personal Data: You have the right to access the Personal Data that we collect about you. You can access them through the Caro AI account settings or contact us directly.
B. Correcting your Personal Data: We strive to ensure that your Personal Data is precise and current. You have the right to rectify such Personal Data.
C. Erasing your Personal Data: You have the right to request that we erase your Personal Data, including your Caro AI account and the related Personal Data. You can delete your account or request us to delete your Personal Data by contacting us here.
D. Withdrawing your Consent: You have the right to withdraw consent for the further processing of your Personal Data.
E. Complaints: You can lodge a complaint if you believe we've failed to protect your Personal Data. Please reach out to us so we can rectify any issues.
F. Rights in relation to automated decision making and profiling: You can ask for a review of any decisions generated by automated means.

Please note that these rights are not absolute and may be subject to conditions.

Specific directives for residents of California

This section holds particular relevance if you reside in California and pertains to special notifications which adhere to your profile. For those living in California, the term Personal Data, as used in this clause, signifies any detail that can identify, connect, describe, or could plausibly link directly or indirectly to either a specific consumer or a household.

Under the California Shine the Light Law, residents from California can inquire about all third-party establishments that have been privy to certain Personal Data shared by us, all for marketing-oriented purposes. You are entitled to such a request once a year. The request should confirm your identity as a California resident and should provide a current address within California for response purposes. You can forward such a request through our contact details offered in the 'How to contact us' section below. Please allow a waiting period of up to 30 days for a response.

If you're under 18 years of age, reside in California, and haven’t been able to get rid of certain public information that you have furnished to Caro AI then you can propose a request for the removal of the same via the contact information supplied in the 'How to contact us' section. The requested removal should be specific to the information you wish eliminated and should offer detailed data like the URL of every page that hosts such data, for us to locate and handle it.

The terms of the California Consumer Privacy Act (CCPA) give you the privilege of opting out of the ‘sale’ of your Personal Data. As is the case with many social and recreational mobile applications, we utilize services that assist in delivering ads that conform to your interests and may share Personal Data with our business associates for their utility. Enabling access to your Personal Data to these organizations can be construed as a ‘sale’ under the CCPA context.

At this time, we don’t have a definitive global industry standard solution to processing or responding to requests for Do Not Track. As such, our services may be unable to respond to “Do Not Track” requests. Various tools and methods are available to avoid having your online activity and device data collected by third parties.

Under the CCPA, you are entitled to exercise any of these rights without the fear of receiving bias from us. Subject to the laws and regulations that apply, we may charge a minimal fee to abide by your requests.

Policy Update

We reserve the right to modify or amend this Privacy Policy from time to time. We will notify you of significant modifications by prominently posting a notice on our webpages or by sending you a direct notification.

Reaching Us

For any queries regarding this Privacy Policy, please contact us at contact@caro.chat

Applicable law and dispute settlement

This Privacy Policy is governed by the laws of the Hong Kong Special Administrative Region of China, without regard to its conflict of law provisions. Any disputes arising out of or related to the Privacy Policy, including any questions regarding its existence, validity, or termination, shall be submitted to the Hong Kong International Arbitration Centre ("HKIAC") for arbitration in accordance with the HKIAC Arbitration Rules in effect at the time. These rules are incorporated into this clause by reference. The seat of arbitration shall be in Hong Kong, and the tribunal shall be composed of three (3) arbitrators. The language of the arbitration shall be English.