HAZYMOON PRIVACY POLICY

Last Updated: 2026/9/24

Effective Date: 2026/9/24

Welcome to Hazymoon (the "Platform"). The Platform is provided and controlled by QUYUE TECHNOLOGY PTE. LTD, a company incorporated in Singapore with its registered office at 3 Fraser Street, #04-23A Duo Tower, Singapore 189352 ("Hazymoon", "we" or "us"). We are committed to protecting and respecting your privacy.

For the purposes of applicable data protection laws, the data controller is QUYUE TECHNOLOGY PTE. LTD. Please read this Privacy Policy carefully, as it describes in detail how we collect, use, disclose, share, store and protect your personal information, as well as what privacy rights you have and how you can exercise them. Due to legal or operational considerations, we may restrict access to the Services, or certain features, for users in specific regions or jurisdictions; where we apply such territorial restrictions (for example, by blocking IP addresses), you must not circumvent them by any means (for example, by masking your IP address or using proxy IPs, virtual private networks or similar tools).

By accessing or using our website, services, applications, products and content (including, without limitation, the Hazymoon iOS application, the Hazymoon Android application distributed via APK, and the Hazymoon web application) (collectively, the "Services"), you acknowledge that you have read this Privacy Policy ("Policy") and that you understand how we will collect, use and process your personal information. If you do not agree with this Policy in general or any part of it, we recommend that you do not use our Services.

Your use of our Services is at all times governed by our Terms of Service (the "Terms"), into which this Privacy Policy is incorporated. Any terms used but not defined in this Privacy Policy shall have the meanings given to them in the Terms.

This Privacy Policy explains, among other things:

1. The Types of Information We Collect

2. How We Use Your Personal Information

3. How We Use Cookies and Similar Technologies

4. How We Disclose Your Information

5. How We Store and Protect Your Information

6. How Long We Keep Your Information

7. Your Privacy Rights and How to Exercise Them

8. Additional Rights for California Residents

9. Personal Information of Minors

10. Changes to This Privacy Policy

11. Contact Us

If you have any questions about how we use your information, please contact Hazymoon.official@outlook.com.

1. The Types of Information We Collect

"Personal Information" means any information that identifies or can reasonably be linked to a particular individual, and also includes information referred to as "personally identifiable information", "personal data" or "sensitive personal information" under applicable data privacy laws, regulations or rules.

The following table sets out in detail the categories of Personal Information we collect and have collected in the preceding twelve (12) months, the categories of sources from which we collect such information, the purposes for which we use it, and the categories of third parties to whom we disclose such Personal Information.

Information you should not provide. When you fill in profile fields or self-descriptions, or upload images, audio or other content to the Services, you should not include sensitive personal information that is not necessary for your use of the Services, including: government-issued identification numbers; health information or health-insurance information; biometric information; passwords or credentials for accounts unrelated to the Services; financial account credentials, or card numbers combined with security codes or passwords; precise geolocation; genetic data; data relating to criminal convictions and offenses; and personal information of any person under the age of 16. Private communications through the Services may inherently reveal aspects of your personal life.

2. How We Use Your Personal Information

How we use your information. To provide the Services to you, we collect and process your Personal Information for one or more of the purposes set out below and/or in Section 8 of this Policy, including:

A. Business Purposes for Which We Collect Personal Information

(1) To Provide, Customize and Improve the Services

• To verify your eligibility (including that you are at least 18 years old) and to enable, or where appropriate restrict, your access to and use of our Services, including region-specific availability and age-restricted features;

• To create and manage your account, persona and profile;

• To operate AI-driven interactive storytelling and companion features, including novel-style chat, memory (settings, summaries and pinned memories), and the generation of text, images, video and voice content within your stories;

• To process purchases of virtual currency (Gems) and subscriptions, and to administer subscriptions, including automatic renewals, purchase confirmations and renewal reminders, cancellations and refunds, and notices of fee changes (see Section 2.E);

• To personalize the content you receive, including the Character recommendation feed and content in your region, and to provide you with customized content that may be of interest to you;

• To respond to your requests and provide customer support;

• To correct errors or bugs and improve our Services, including through testing, research, internal analytics and product development;

• To moderate content, investigate reports, and enforce the Terms (Terms Section 12), including automated screening and human review;

• To analyze and manage our Services, including for system administration, security, fraud detection, verification of account ownership, archiving and backup purposes;

• To prevent fraudulent registrations and abuse of promotional rewards, including by enforcing the re-registration restrictions described in Section 6;

• To send service communications, including Character "Texts" pushes, check-in reminders, task and settlement notices — by default, no push notifications are sent between 23:00 and 08:00 in your local time (Terms Section 5.6);

• To achieve other purposes described to you at the time your Personal Information is collected and/or that are compatible with the original purpose of collection and permitted under applicable data privacy laws; and

• To track activity on our Services to verify that you are not a bot and to optimize the Services.

Model training . We do not use your private chat content to train AI models by default. Chat content may be used for product improvement only (a) where you give separate, explicit opt-in consent through a clearly distinct prompt, or (b) where processing is necessary for safety, security and abuse-prevention purposes. This position is reflected in Terms Section 6.4.

(2) Service Marketing. To show you advertisements, including rewarded advertising through which you may earn Gems, and — where enabled — interest-based advertising or targeted advertising. We do not currently sell or share your Personal Information for cross-context behavioral advertising; if we were to do so in the future, we would provide an appropriate opt-out mechanism and update this Policy (see Sections 4 and 8).

(3) To Communicate With You. To respond to correspondence we receive from you, contact you where necessary or upon your request, and send you information about our Services; to send you emails and other communications in accordance with your preferences, with marketing communications sent only with your consent and always offering an unsubscribe option.

B. Other Lawful Purposes for Processing Personal Information. In addition, the categories of Personal Information described above may be collected, used and disclosed to governmental authorities (including law enforcement) or other relevant parties as necessary to satisfy legal requirements and to enforce legal terms, including: to comply with our legal obligations under applicable laws and regulations, court orders or other legal processes (for example, to prevent, detect and investigate security incidents and potential illegal or prohibited activities, including content involving minors, which we report to competent authorities where required); to protect the rights, property or safety of you, us or others; to enforce any agreements entered into with you; to respond to claims that any content infringes the rights of third parties; and to resolve disputes.

We will not collect additional categories of Personal Information or use the Personal Information we have collected for materially different, unrelated or incompatible purposes without first providing you with notice or obtaining your consent, unless otherwise required or permitted by applicable law.

C. Legal Bases for Processing. Where required or recognized by applicable law, our legal bases for processing are: performance of contract (providing the Services, payments); your consent, including explicit consent for sensitive personal information and for marketing where required; compliance with legal obligations (tax, anti-money-laundering, age-verification and content-regulation duties); and our legitimate interests (security, anti-fraud, moderation, aggregated analytics), balanced against your rights. You may request further details of this mapping from our privacy contact (Section 11).

D. AI and Automated Processing. Characters, conversations and generated media are produced by artificial intelligence, as disclosed in the product and in Terms Section 5.2, in accordance with AI-content disclosure requirements in California, New York and other applicable jurisdictions; AI-generated content carries machine-readable markings independent of any visible watermark (Terms Section 5.3). Automated processing is used for the recommendation feed, relationship-level evaluation, memory summarization, and content-moderation classification; none of these constitutes a decision based solely on automated processing producing legal effects or similarly significant effects for you under applicable law, and we maintain channels for explanation and human intervention. Where you express thoughts of suicide or self-harm, crisis-support information is surfaced per Terms Section 5.5; such content is processed solely to deliver crisis support and maintain safety, and is not used for advertising or profiling.

E. Payments, Subscriptions and Refunds.

• Payment processing. You authorize the Payment Processor to store your designated payment method and to continue charging it, including after its stated expiration date, in order to avoid interruptions to your subscriptions, and to apply anti-fraud protocols and industry-standard verification to your transactions.

• Subscriptions and auto-renewal. Paid subscriptions are charged on a pre-paid basis for the period you select, and automatically renew at the then-current price at the end of each billing cycle unless you cancel before the end of the current billing period. You may cancel your subscription at any time through your in-app account settings, or by notifying us by email at least seven (7) days before the start of the next billing period; the cancellation takes effect at the end of the then-current billing period, and you retain access to the Services until that time. We will notify you by email fifteen (15) days before the start of each new billing period. If you are offered a free trial or promotional period, your subscription automatically converts to a paid subscription at the end of that period, and your payment method is charged the then-current subscription fees, unless you cancel beforehand. We send a confirmation email after purchase setting out the automatic-renewal terms and how to cancel, and — where your subscription term exceeds twelve (12) months — an annual renewal reminder in accordance with California law.

• California Automatic Renewal Law. In accordance with the California Automatic Renewal Law (Cal. Bus. & Prof. Code §§ 17600–17606), we clearly and conspicuously disclose the automatic-renewal terms, obtain your affirmative consent before charging your payment method, send you a confirmation email after purchase, and provide you with a simple and immediate online method to cancel your subscription.

• Fee changes. Any change to subscription fees takes effect only after the end of your then-current subscription term; we will notify you of the change at least fifteen (15) days before it takes effect, through the in-Service user interface, pop-up notifications, email or other reasonable means, so that you may cancel your subscription in advance.

3. How We Use Cookies and Similar Technologies

We use cookies and similar technologies, such as pixels, web beacons and software development kits (collectively, "Cookies"), so that our servers can recognize your web browser, understand how and when you access and use our Services, analyze trends, understand our user base, and operate and improve our Services. Cookies are small data files placed on your device when you access the Services. We may also supplement information we collect from you with information we receive from third parties.

(1) We Use the Following Types of Cookies:

• a. Necessary Cookies. Essential to provide the features or Services you have requested (for example, logging in to secure areas). If you disable these Cookies, some features may not function properly or may become unavailable.

• b. Functional Cookies. Used to remember your choices and settings (for example, the language you have selected) and to recognize you when you return.

• c. Performance/Analytics Cookies. Help us understand how visitors use our Services, such as the number of visitors, which pages they view, and how long they stay.

• d. Targeting Cookies. Set by our advertising partners through our Services to track and measure the effectiveness of advertising campaigns, including rewarded-ad delivery.

(2) Disabling Cookies and Similar Technologies. By using the web application and allowing us to place non-necessary Cookies, you consent to their use; non-necessary Cookies are enabled only after your consent where required by applicable law, and you may withdraw or modify your consent at any time through the cookie settings panel or your browser settings. If you disable Cookies, your experience may be affected and some features may not function properly. Our Services do not currently respond to web-browser "Do Not Track" signals; however, as described below, we honor universal opt-out preference signals where required by applicable law.

(3) Cookies and Targeted Advertising; In-App SDKs. Cookies and similar technologies may collect information about browsing activities so that we or third-party advertising networks can deliver advertising (including rewarded advertising) and measure its effectiveness. We do not control third-party Cookies; their use is governed by their own privacy policies. In our applications, analytics, advertising and attribution SDKs may collect advertising identifiers (IDFA/AAID); we respect system-level ad-tracking limitation settings (such as iOS "Ask App Not to Track" and Android opt-out settings). The Services will recognize and honor universal opt-out mechanisms (including the Global Privacy Control signal) as required under California and other US state laws, and will treat such signals as valid requests to opt out of the sale or sharing of Personal Information.

4. How We Disclose Your Information

(1) Service providers. We disclose your Personal Information to the categories of service providers and other parties listed in this Section, under contractual arrangements that restrict them to using the information solely on our behalf and in accordance with our instructions. We do not sell Personal Information, nor do we share it with third parties for their own marketing purposes. However, under the laws applicable in the region where you are located, some of the disclosures described in this Policy may be deemed a "sale" or "sharing" of your Personal Information; see Sections 3(3) and 8 for the applicable opt-out mechanisms. By using our AI-powered features, you consent and authorize us to share the content you submit with one or more third-party AI model and generation service providers for the sole purpose of fulfilling your requests; these providers act on our behalf under data-processing agreements.

(2) Legal and safety disclosures. We will disclose your information to law enforcement agencies, public authorities or other organizations if legally required to do so, or if such disclosure is reasonably necessary to: comply with legal obligations, processes or requests; enforce our Terms and other agreements, policies and standards, including investigation of any potential violation thereof; detect, prevent or otherwise address security, fraud or technical issues; or protect the rights, property or safety of us, our users, a third party or the public as required or permitted by law.

(3) Business transfers. All Personal Information we collect may be transferred to a third party in the event of a merger, acquisition, bankruptcy, corporate reorganization or other transaction in which a third party assumes control of all or part of our business.

(4) Specific third-party disclosures.

(5) Corporate group. We may also disclose your information to any member, subsidiary, parent or affiliate of our corporate group, only for the purposes set out in this Policy and bound by it.

(6) Third-party websites, applications and advertisements. The Services may contain links to third-party websites, applications and advertisements. When you follow such a link, you will be subject to that third party's own terms and privacy policies, which we do not control; we encourage you to read them before providing any personal information.

5. How We Store and Protect Your Information

(1) Where your information is stored. Your information is collected and stored on servers located in the United State, routed according to the region from which you use the Services. These locations may be outside the country or region where you reside, and the servers may be accessed by our support and engineering teams and/or our affiliates around the world. Regardless of where our servers are located, we take steps to ensure that your information is treated securely and in accordance with this Policy.

(2) International transfers. Cross-border transfers of Personal Information are protected by contractual and technical safeguards (including encrypted storage of chat content and access controls); where applicable law imposes specific requirements on cross-border data transfers, we will adopt the corresponding transfer mechanisms recognized under that law. You may request a copy of the applicable transfer safeguards from our privacy contact (Section 11).

(3) Security measures. Chat content is encrypted at rest by default; employee access is authorized and audit-logged; and we implement appropriate technical and organizational measures to protect personal information from loss, misuse and unauthorized access, disclosure, alteration and destruction, including encryption in transit, least-privilege access controls and periodic penetration testing. We maintain and update these measures from time to time to improve the overall security of our systems. The transmission of information via the internet is not completely secure; although we do our best to protect your information, we cannot guarantee the security of information transmitted through the Services.

(4) Third-party credentials and links. Apart from what is disclosed in this Policy, the Platform does not know your credentials for your Google, Apple or other email accounts; these third parties communicate with us only via specific encrypted tokens. Websites and services that link to or from our Services may collect your personal information; this Policy does not apply to them, and we encourage you to read their privacy policies.

6. How Long We Keep Your Information

We use the following criteria to determine the period for which we keep your information: our contractual obligations and rights in relation to the information involved; legal obligations under applicable laws and regulations to retain data for a certain period; statutes of limitations under applicable law; our legitimate business purposes; and disputes or potential disputes.

• User-initiated deletion. You can delete any conversation and all associated memory with one tap at any time; the corresponding summary-layer data is erased together with it.

• Account deletion. You may delete your account at any time through your account settings (Profile → Settings → Delete account) . Account deletion is permanent and irreversible, and all content and information associated with the account will be permanently erased. Following account deletion (Terms Section 4.4), we physically erase your personal data within thirty (30) days, except for: (i) moderation logs, transaction records and similar records retained for the minimum period required by law; and (ii) the limited anti-fraud data described below.

• Anti-fraud retention after deletion. To prevent fraudulent registrations and abuse of promotional rewards: you may not re-register within twenty-four (24) hours after account deletion; we retain your third-party sign-in identifiers and email address solely for anti-fraud purposes; and if you re-register within ninety (90) days using the same third-party account or email address, you will be classified as an existing user and will not be eligible for new-registration rewards.

• Age-verification data. Verification materials are deleted promptly after the verification decision, retaining only a limited audit record of the result.

After you have terminated your use of our Services, we may store information in an aggregated and de-identified format. Notwithstanding the foregoing, we may retain personal information as reasonably necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

7. Your Privacy Rights and How to Exercise Them

(1) Through your account. If you have registered for an account, you may access and update certain personal information you have provided to us by logging in and using the features available in account settings, including notification preferences, memory settings, conversation deletion, and account deletion (see Section 6).

(2) Restriction and objection. In certain circumstances (for example, where you believe the data is inaccurate, our processing is unlawful, or we no longer need to process the data for a specific purpose), you have the right to request that we stop or restrict processing of the Personal Information we hold about you, except to the extent we continue to process it for storage purposes only.

(3) Withdrawal of consent. Where we rely on your consent to process your Personal Information (including the explicit consent for sensitive personal information described in Section 1), you may withdraw your consent at any time by notifying us or by using the consent-management features in the Services. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. If we stop processing on the basis of consent, we may still use the information where another valid legal ground applies (for example, performance of a contract or compliance with a legal obligation).

(4) Users in other jurisdictions. Where applicable law grants corresponding rights, you may also have the right of access, rectification, erasure, restriction of processing, data portability, and objection to processing, and the right to lodge a complaint with the relevant supervisory authority, in each case as provided by that law. We respond to requests within the timeframe required by applicable law.

(5) How to submit requests. You may request access, correction or deletion of personal information, or deletion of your account, via Hazymoon.official@outlook.com (email) . We verify requesters using reasonable measures and process authorized-agent requests as permitted by applicable law. California-specific rights and timelines are set out in Section 8.

8. Additional Rights for California Residents

(1) Special notice to California residents. If you are a resident of California, the CCPA/CPRA requires us to provide you with the following additional notice. For the purposes of this Section, "Personal Information" has the meaning given in the California Consumer Privacy Act of 2018 (California Civil Code Sections 1798.100 through 1798.199) and its implementing regulations, as amended from time to time (the "CCPA"). The categories of Personal Information we collect, use and disclose in the preceding twelve (12) months are described in Section 1 above.

Under California's "Shine the Light" law, California residents may request once per calendar year a list of third parties to whom we have disclosed certain personal data for their direct marketing purposes. Please include sufficient information to verify that you are a California resident and your current California mailing address. We will respond within thirty (30) days via Hazymoon.official@outlook.com.

We will respond to verifiable consumer requests free of charge within forty-five (45) days; where reasonably necessary, we may extend once by an additional forty-five (45) days with written notice.

(2) Your CCPA/CPRA rights:

• a. Right to receive Notice at Collection. At or before collection, you have the right to receive notice of our practices, including the categories of personal information and sensitive personal information collected, the purposes, whether information is "sold" or "shared", and retention periods. These details are provided in Sections 1, 2 and 6 of this Policy.

• b. Right to know / access. You may request a copy of the personal information we have collected about you during the preceding twelve (12) months, and further information about how we collect, use, disclose or sell it.

• c. Right to correct. You may request correction of inaccurate personal information we maintain about you, subject to statutory exceptions.

• d. Right to delete. You may request deletion of personal information we have collected from or about you, subject to statutory exceptions (for example, retention required for legal obligations, completing a transaction, or security purposes).

• e. Right to opt out / "Do Not Sell or Share My Personal Information". You have the right to opt out of any future "sale" or "sharing" of your personal information as defined under the CCPA/CPRA. We do not currently "sell" or "share" personal information as those terms are defined under the CCPA/CPRA; we share information only with service providers contractually restricted to acting on our behalf. We honor Global Privacy Control (GPC) signals from supporting browsers as valid opt-out requests. If we were to engage in "sale" or "sharing" in the future, we would update this Policy and provide an opt-out mechanism.

• f. Authorized agents. You may designate an authorized agent, in writing or through a valid power of attorney, to submit requests on your behalf; we may require proof of authorization and direct identity verification with you.

• g. Verification. We verify requests by asking you to submit them using the email address associated with your account or to provide matching account information.

• h. Right to non-discrimination. We will not discriminate against you for exercising your CCPA rights — including by denying services, charging different prices, or providing a different level or quality of services — except where differential treatment is permitted by law. Note that our Gems reward programs (check-ins, tasks and referral rewards) are voluntary programs offered to all users and constitute financial incentive programs under California law; their material terms, a good-faith explanation of the value of the data involved, and a non-discrimination statement are provided at the program entry points.

• i. Direct marketing disclosures. We do not disclose your personal information to third parties for their own direct marketing purposes.

(3) Residents of other US states. Residents of Virginia, Colorado, Connecticut, Texas, Oregon and other states with comprehensive privacy laws have comparable rights (including, where required, opt-in consent before processing sensitive data), subject to each state's rules.

9. Adults Only — Personal Information of Minors

Our Services are not directed to individuals under 18 years old, and we do not knowingly collect personal information from anyone under 18. If we become aware that a person under 18 has provided personal information to us, we will delete such information and terminate the account. If you believe we have collected information from a minor under 18, please contact us at Hazymoon.official@outlook.com. This Section operates together with the age requirements and age-verification measures in Terms Sections 3.1–3.2.

10. Changes to This Privacy Policy

We may revise this Policy from time to time, and the latest version will be available on the Platform. When we make changes, we will provide a new version of this Policy and update the "Last Updated" date at the top. For material changes (including changes to the categories of personal information we collect, the purposes for which we use it, or how we disclose it), we will notify you before the changes take effect by a prominent in-app notice, a pop-up message, or an email sent to your registered email address. For non-material changes, we will announce the update on the relevant page and display a notice within the Services after the Policy has been updated. Unless we state otherwise, changes take effect immediately for users who do not have an account, and thirty (30) days after publication for users who do have an account. Your continued access to or use of the Services after the effective date of the updated Policy constitutes your acceptance of it; if you do not agree to the changes, you may stop using the Services and request deletion of your account before the changes take effect, and we will handle your personal information in accordance with this Policy. Where a change requires fresh consent (for example, introducing a new model-training purpose or a new category of sensitive data), we will obtain consent separately — continued use alone does not constitute consent. We may also require you to expressly accept the updated Policy before you can continue using the Services.

11. Contact Us

If you have any questions or concerns, please contact us via Hazymoon.official@outlook.com (email).

QUYUE TECHNOLOGY PTE. LTD. (operating entity)

3 Fraser Street, #04-23A Duo Tower, Singapore 189352 (registered address)

(End of draft v0.3 — architecture and operational mechanics aligned with the group Terms of Service)