PRIVACY POLICY
Effective date: November 1, 2026

## 1. Scope and operator

Mindverse is operated by 清湾智能, an independent team based in Hong Kong, with its contact address at 7F, Lee Shau Kee Business Building, Clear Water Bay, New Territories, Hong Kong ("Mindverse", "we", "us" or "our"). 清湾智能 is the team name supplied for this project, not a representation that an incorporated company has been registered. This Privacy Policy applies to https://mindverse.art and our creative workspaces, AI tools, storage, sharing and related services (the "Services").

For privacy questions or requests, contact privacy@mindverse.art. General support is available at support@mindverse.art.

This Policy covers information we handle for our own service operations. Where we process content solely on an organization's documented instructions under a separate agreement, that organization may be responsible for responding to requests about its content. You may contact us for help identifying the appropriate contact.

## 2. Information we collect

- Account information: your name, email address, account identifier, password hash, account status, workspace membership and permissions. We store password hashes rather than readable passwords.
- Creative content: prompts, instructions, reference materials, uploaded images, audio and video, generated results, project and workflow data, and associated metadata that you submit or save.
- Usage and transaction records: generation requests, selected models, task status, usage amounts, credit adjustments and, where paid features are offered, orders, subscription status and payment references.
- Technical information: IP addresses, browser and device information, timestamps, error reports, authentication records and security-related logs generated when you access the Services.
- Communications: information you provide in support requests, privacy requests, infringement reports, feedback or other correspondence.
- Connected-account information: if a third-party sign-in or integration is made available and you choose to use it, the account identifier, profile information, email address or other information covered by the permissions shown to you. We do not receive your third-party account password.

You choose what to upload. Content can contain personal information about you or others. Do not submit another person's information without the necessary authority, notices and permissions. Do not upload identity documents, payment-card details, health records or similarly sensitive information unless the particular feature expressly supports that use and appropriate arrangements are in place.

Required account and request fields are needed to provide the corresponding feature; optional information is voluntary. If you do not provide required information, we may be unable to create your account, complete a request or provide support.

## 3. Why we use information

We use relevant information to:

- Create and authenticate accounts, maintain login sessions, administer workspaces and enforce access permissions.
- Process your instructions, route requests to selected AI services, store projects and return, edit or export results.
- Maintain usage and credit records and, where applicable, administer purchases, subscriptions, refunds and accounting.
- Respond to requests and send necessary account, security, transaction and service notices.
- Diagnose faults, maintain reliability, investigate misuse and protect accounts, infrastructure and other users.
- Meet legal obligations, handle complaints and disputes, and enforce our agreements.

Any additional use of content for evaluation, product improvement or model training is described in Section 4. Marketing communications, if offered, are handled according to applicable notice and consent requirements, with a way to unsubscribe.

Where applicable law requires a legal basis, we rely on performance of a contract for requested services, legal obligations for required records and disclosures, legitimate interests where available and appropriately balanced for security and service administration, and consent where required. You may contact us for information about the basis for a particular use. Acceptance of our Terms is not blanket consent to every processing activity.

## 4. AI processing and service providers

When you request a generation, edit, analysis or similar operation, the prompts, reference files and parameters needed for that operation may be transmitted to model providers, API intermediaries and infrastructure providers. Generated results, task identifiers and technical metadata may be returned to us and associated with your account or project.

Service providers: Huawei Cloud for cloud infrastructure and storage; TalkingData for usage analytics; 302.AI for API aggregation and routing of generation requests. Depending on the selected model and route, underlying model providers may include ByteDance, OpenAI, Anthropic, Google and Alibaba. Not every provider receives every request. This list does not mean that Mindverse has a direct contract with each underlying model provider.

Mindverse's own use of non-public content for training, evaluation and improvement, and the applicable controls: Without separate affirmative permission, Mindverse will not use non-public Customer Content to train or improve a general-purpose model offered to unrelated third parties. We may use aggregated or de-identified information and limited, access-controlled evaluation data to improve functionality, reliability and safety, consistently with this Policy and applicable law.

Upstream providers' content retention, training or improvement practices, applicable settings and restrictions: Necessary prompts and files may be processed by 302.AI and the selected underlying providers. Their retention, safety review, training or improvement practices depend on the service, model, routing, contractual terms and settings actually used. We do not make a blanket promise of zero retention or no training across all providers. Contact privacy@mindverse.art for information about a particular model before submitting confidential or sensitive material. We will disclose a material incompatible use and obtain any authorization required before enabling it.

Access to content for support, security or troubleshooting is limited to the relevant operational purpose and applicable permissions. Third-party providers may apply content-safety checks and their own lawful retention requirements. We remain responsible for the obligations applicable to our handling of information and our use of service providers; referring to a provider's policy does not remove those obligations.

## 5. When information is disclosed

Information may be disclosed to:

- Technical and professional providers that help operate the Services, including the categories described in Section 4, to the extent needed for their role.
- Workspace owners, administrators and authorized collaborators, according to the workspace's permissions and the content or features you use.
- People with whom you choose to share or publish content. Sharing links and downloaded copies can be forwarded by recipients.
- Authorities, advisers or affected parties where disclosure is required by law or reasonably necessary to investigate fraud, respond to a valid legal request or protect legal rights and safety.
- A prospective or actual successor in a merger, acquisition, reorganization or asset transfer, subject to applicable confidentiality and data-protection requirements.
- Other recipients when you direct us to disclose information or provide the consent required by law.

Visibility defaults, public-gallery use and any promotional use of customer content: Projects are private by default and normally visible only to their owner. If you create a sharing link, anyone who obtains that link can access the shared content and may forward it. There is currently no public gallery. We may display your work on the official website for promotion only after obtaining your separate affirmative permission covering the selected work and intended use; accepting these Terms or creating a sharing link alone does not grant that permission. You can request that future promotional use stop by contacting support@mindverse.art, subject to lawful retention and copies already distributed with your authorization. Necessary provider processing and authorized support or security access are not public publication.

Our practices concerning sale of personal information, advertising disclosures and cross-site tracking: Mindverse does not sell personal information for money or use it for cross-context behavioral advertising or targeted advertising. TalkingData is used for usage analytics, not as authorization for unrelated advertising use. Analytics disclosures and any legally required choices still apply. Before introducing a sale, advertising disclosure, remarketing or cross-site tracking, we will update this Policy, give required notice and provide the necessary consent or opt-out controls. Where applicable law requires an opt-out or other choice, the relevant mechanism must be provided before the activity begins.

## 6. Cookies and local storage

The Services use browser storage for authentication and preferences. The following describes the storage identified in the current application:

- mindverse_session: a first-party login cookie used to maintain an authenticated session. The application default is 30 days; it can expire earlier through logout or revocation. Production lifetime: up to 30 days under the current application default, unless you log out, the session is revoked or a shorter expiration applies. The cookie is configured as HttpOnly, with Secure enabled in production and SameSite=Lax.
- lang: local storage used to remember your selected interface language. It generally remains until it is changed or browser storage is cleared.
- theme: local storage used to remember your display theme. It generally remains until it is changed or browser storage is cleared.

Additional cookies, storage, SDKs, analytics, payment or advertising technologies enabled in production, their providers, purposes, durations and available choices: TalkingData may process usage events and browser or device information through the analytics integration actually enabled. Its exact identifiers, storage lifetimes and collection settings depend on the deployed SDK or API configuration; no unverified cookie names or fixed lifetimes are asserted here. Other provider components may introduce functional storage when enabled. Contact privacy@mindverse.art for the current inventory. Non-exempt tracking must not run before any legally required consent, and a functioning withdrawal mechanism must be available; this policy text alone does not implement those controls.

You can clear or block browser storage in your browser settings. Blocking the login cookie may prevent sign-in or authenticated features. Clearing language or theme preferences may reset those choices. Where consent is legally required for non-exempt storage or tracking, those technologies must remain inactive until consent is given, and you must be able to withdraw it through the available consent controls. This Policy is an explanation of storage practices, not a consent-management interface.

## 7. Retention and deletion

We retain information for the purposes described in this Policy, taking account of service needs and applicable legal requirements. Our production retention schedule is:

- Account and workspace records: for the active account or workspace relationship and thereafter only as reasonably necessary to complete closure, respond to a verified deletion request, prevent abuse, resolve disputes or meet legal obligations; unnecessary records will be deleted, de-identified or securely isolated pending deletion.
- Uploaded content, generated results, project data and temporary provider files: as needed to provide saved projects and requested operations, taking account of user settings, deletion requests and legal or security needs. Temporary files and upstream copies follow the applicable operation and provider arrangements. We do not promise a uniform deletion deadline for every model or storage system.
- Technical, security and diagnostic logs: only as reasonably necessary for security, fraud prevention, troubleshooting and service reliability, or for an applicable legal hold or dispute; outdated or unnecessary records will be deleted or de-identified.
- Transaction, credit, accounting and dispute records: for applicable accounting, tax, payment and dispute requirements. Where Hong Kong business-record rules apply, required records are retained for at least seven years after completion of the relevant transaction; unrelated creative content is not retained for seven years merely because a purchase occurred.
- Backup retention and the time for deleted information to age out of backups: according to the backup and disaster-recovery lifecycle actually in use. Deletions may take time to cycle out of protected backups; there is no promise of immediate erasure from every copy. Backups awaiting deletion are isolated from ordinary use and, if restored, relevant deletion requests must be reapplied.

You may request deletion through privacy@mindverse.art. After appropriate verification, we assess and carry out requests under applicable law. Some records may need to be retained for legal obligations, security, fraud prevention or disputes; we will explain applicable limitations. Removal from active systems does not necessarily remove every backup copy immediately. Backup copies awaiting scheduled deletion must be protected and not reused for unrelated purposes.

Copies that you or others have downloaded, published or shared outside our control may remain available. Deleting a Mindverse account does not by itself delete an account you hold with a third-party provider.

## 8. Security

We use safeguards appropriate to the information and risks, including account authentication and access restrictions. No online service or storage system is completely secure. You should protect your credentials, review sharing permissions and keep copies of important work. Report suspected unauthorized access to support@mindverse.art. Where a security incident triggers notification obligations, we will provide the notices required by applicable law.

## 9. International processing

Countries or regions in which we and our providers store or process information: Hong Kong for team operations, and other countries or regions where the selected cloud, analytics, API intermediary and underlying model services actually process information. The operator's Hong Kong location is not a promise of Hong Kong-only data residency. Exact infrastructure regions and per-model routing should be confirmed with privacy@mindverse.art; we do not infer them from a provider's headquarters. Laws in these locations may differ from those in your location.

Applicable transfer arrangements and how to obtain information about relevant safeguards: We assess the requirements applicable to the relevant transfer and use contractual, organizational or other lawful measures where required. This statement does not assert that a particular DPA, SCC, adequacy mechanism or certification is already in place for every provider. Any mandatory mechanism must be put in place before the relevant transfer. Contact privacy@mindverse.art to ask about the safeguards applicable to a particular processing route. Where a specific transfer mechanism, assessment or consent is required, it must be in place before the relevant transfer. A reference to international processing in this Policy is not itself a substitute for that mechanism.

## 10. Your rights and choices

Depending on your location, the applicable law and our role, you may have rights to access or obtain a copy of your information, correct inaccuracies, request deletion, restrict or object to certain processing, request portability, withdraw consent, or opt out of qualifying sales, advertising or profiling. These rights are subject to the conditions and exceptions in applicable law; not every right applies everywhere.

Send requests to privacy@mindverse.art, describing the request and the account concerned. We may request proportionate information to verify identity or an agent's authority. We use verification information for that purpose and related security needs. We respond within the applicable legal period and explain any lawful refusal and available review or appeal route. You may also complain to the relevant data-protection authority. If Hong Kong law applies, this includes the Office of the Privacy Commissioner for Personal Data.

Where consent is used, withdrawal does not affect the lawfulness of processing before withdrawal. Unsubscribing from optional marketing does not stop necessary account or security messages.

## 11. Age eligibility

The Services are intended for people aged 18 or older. If you believe a person under 18 has provided personal information, contact privacy@mindverse.art so that we can investigate and take appropriate action.

## 12. External services

External websites and services you access independently have their own terms and privacy practices. Review the information shown before connecting an account or sending content to another service. We remain responsible for our own processing and for service-provider responsibilities imposed on us by law.

## 13. Updates and contact

We may revise this Policy as the Services and our practices change. We will update the date above and give additional notice or seek consent where required for material changes. We will not treat an updated policy as retroactive authorization for an incompatible new use of previously collected information.

Operator: 清湾智能
Business address: 香港新界清水灣 Lee Shau Kee Business Building 7F
Privacy requests: privacy@mindverse.art
Support: support@mindverse.art
Website: https://mindverse.art