Data controller / Seller: DEEPLUM TECHNOLOGY Limited

Controller address: OFFICE 5, 8/F, MEGA CUBE, 8 WANG KWONG ROAD, Kowloon Bay, Kowloon, Hong Kong SAR

Privacy contact: privacy@deeplum.ai  |  General support: support@deeplum.ai

Website: https://deeplum.ai

1. Who we are and scope

DEEPLUM TECHNOLOGY Limited ("DEEPLUM", "we", "us" or "our") sells DEEPLUM products and operates the DEEPLUM website, online store, mobile application, smart glasses, charging cases, magnetic earphones, magnetic lenses, related software, AI-enabled features, customer support, and related services (collectively, the "Services").

For the purposes of applicable data-protection laws, DEEPLUM TECHNOLOGY Limited is the controller of the personal information described in this Privacy Policy. This means that DEEPLUM TECHNOLOGY Limited determines why and how personal information is processed for the Services.

Shenzhen DEEPLUM technology Co., Ltd. provides server management, technical operations, and authorized technical-support services to DEEPLUM TECHNOLOGY Limited. It processes personal information only on DEEPLUM TECHNOLOGY Limited's documented instructions and under applicable contractual, confidentiality, security, and data-protection obligations, except where it is independently required by law to process information.

Our primary DEEPLUM application-server infrastructure is deployed in Germany. As explained in Section 6, a server location does not necessarily mean that all processing or support access occurs only in Germany: authorized technical-support personnel, including personnel of Shenzhen DEEPLUM technology Co., Ltd., may access personal information remotely when necessary to manage, secure, troubleshoot, or support the Services, subject to access controls and transfer safeguards.

1.2 Privacy contact & Data Protection Officer

• Privacy email (preferred for all GDPR / privacy-rights requests): privacy@deeplum.ai
• General support email: support@deeplum.ai
• Postal address: OFFICE 5, 8/F, MEGA CUBE, 8 WANG KWONG ROAD, Kowloon Bay, Kowloon, Hong Kong SAR

We will respond to verifiable privacy requests within the time limits set by applicable law (typically 30 days; extendable to 60 days for complex requests under GDPR, with notice).

1.3 EU and UK Authorized Representatives (GDPR Article 27 / UK GDPR)

This policy applies when you visit our website, create an account, make a purchase, use a DEEPLUM device or application, use AI-enabled features, contact us, or otherwise interact with the Services. It does not apply to independent third-party services that you choose to use, which are governed by their own notices.

2. Personal information we collect

The information we collect depends on how you interact with us and the features you enable.

2.1 Store, order, and support information

We may collect:

• Identity and contact information: name, email address, telephone number, billing address, shipping address, country/region, and language preference.
• Order and transaction information: products viewed, cart and wishlist activity, order number, products purchased, order amount, shipping method, delivery status, returns, exchanges, cancellations, and customer-service history.
• Payment information: payment method, payment token, transaction confirmation, payment status, and limited payment-related information supplied by our payment providers. We do not intentionally store full payment-card numbers or card security codes on our own systems.
• Account information: account identifier, username, encrypted or hashed authentication credentials where applicable, preferences, saved addresses, and account settings.
• Communications: the content and metadata of emails, chat, support tickets, reviews, survey responses, and other communications you send to us.

2.2 Website and online-service information

We may collect:

• Device and network information: IP address, browser type, device type, operating system, language, time zone, device identifiers, and network or connection information.
• Usage information: pages viewed, clickstream, referral source, search terms, cart activity, timestamps, interactions with website features, and cookie or consent preferences.
• Approximate location: location derived from your IP address, such as country or region, to support localization, security, tax, shipping, and fraud prevention.

2.3 Device, app, and accessory information

When you connect or use a DEEPLUM smart-glasses product or mobile application, we may collect:

• Device and app identifiers: device model, serial number or device identifier, firmware version, app version, operating-system version, Bluetooth pairing status, and device configuration.
• Technical, diagnostic, and support information: battery or charging status, connectivity status, error reports, crash logs, performance metrics, feature-usage events, and support diagnostics that you choose to share with us.
• Connected-device information: information necessary to connect smart glasses, charging cases, magnetic earphones, or compatible accessories through Bluetooth.
• Microphone, or other sensor data, if you enable a feature that requires it: the application or device may access the relevant permission only to provide the feature you initiate.

Location information: DEEPLUM does not collect or store precise device location on its own servers. When you use a navigation or location-dependent feature, location is processed locally on your device and by the third-party map provider you select (e.g., the mapping application opened from our product). You may revoke location permission at any time in your device settings.

2.4 AI, translation, and meeting features

If you choose to use real-time translation, transcription, meeting-summary, action-item, or similar AI-enabled functions, we process the content you provide to operate that feature. This may include audio, speech-derived text, text you enter, language settings, and feature instructions.

Based on our current product design:

• voice and text content used for real-time translation or transcription is processed to provide the requested feature and is not retained by DEEPLUM by default;
• DEEPLUM does not use that voice or text content to train public or general-purpose AI models;
• meeting minutes and summaries are saved locally in the application on your device only when you choose to save them; and
• we do not intentionally use AI-feature content for advertising or to build marketing profiles.

Do not submit personal information about other people unless you have a lawful basis and, where required, their permission. AI-feature content may incidentally contain sensitive information. We do not ask you to provide sensitive information for marketing purposes and do not use AI-feature content to infer health, biometric, racial or ethnic, religious, political, sexual-orientation, or similar sensitive characteristics.

AI output accuracy: AI-enabled features (including real-time translation, transcription, navigation, meeting summaries, and assistant responses) rely on probabilistic models and may produce inaccurate, incomplete, or out-of-date output. DEEPLUM does not warrant the accuracy, completeness, or fitness for any particular purpose of AI-generated content. You should not rely on AI features for medical, legal, financial, safety-critical, or other high-stakes decisions; for important decisions, please consult a qualified professional.

2.5 Information from other sources

We may receive personal information from Shopify, payment processors, fulfillment and shipping providers, fraud-prevention providers, customer-support providers, app stores, social-media or advertising partners, and other persons who place an order, make a gift purchase, submit a referral, or communicate with us about you.

3. How we use personal information and legal bases

We use personal information only for the purposes below and, where required, on the stated legal basis.

Purpose	Examples	EU/EEA and UK legal basis
Provide the Services and perform our contract	Process orders and payments, deliver products, manage accounts, pair and support devices, provide requested translation/AI features, process returns, and provide customer support	Performance of a contract; steps taken at your request before entering a contract
Operate, secure, and improve the Services	Maintain systems, manage servers, troubleshoot, prevent fraud and abuse, secure accounts, assess compatibility, fix defects, and improve product reliability using aggregated or de-identified information where possible	Legitimate interests in operating secure and reliable Services; legal obligation where applicable
Communicate with you	Order, payment, delivery, safety, account, support, product-update, and policy messages	Performance of a contract; legitimate interests; legal obligation where applicable
Marketing and advertising	Send promotional emails or messages where permitted; measure campaigns; show personalized or targeted advertising where you permit it or where legally permitted	Consent where required; otherwise legitimate interests, subject to your rights and local law
Cookies and similar technologies	Operate essential website functions; remember preferences; analyze site performance; measure or personalize advertising	Consent for non-essential technologies where required; legitimate interests or contract for strictly necessary technologies
Comply with law and enforce our rights	Tax/accounting records, valid legal requests, disputes, product safety, recalls, and enforcement of our agreements	Legal obligation; legitimate interests in legal claims and protection of our business

Where we rely on legitimate interests, we balance those interests against your rights and expectations. You may object to this processing in certain circumstances. Where we rely on consent, you may withdraw it at any time; withdrawal does not affect processing before withdrawal.

4. Cookies, analytics, and advertising choices

We use cookies, software development kits (SDKs), pixels, local storage, and similar technologies. Some are strictly necessary for website security, checkout, shopping-cart functionality, fraud prevention, and a service you request. Others support preferences, analytics, advertising, or measurement.

Where legally required, we ask for your consent before placing or reading non-essential cookies or similar technologies. Rejecting non-essential technologies will not prevent you from making a purchase, although some optional functionality may be affected. You can withdraw your consent at any time, as easily as you gave it, through our Cookies Policy and Cookie Settings.

We may use Shopify and approved service providers for analytics, advertising measurement, and marketing. If we disclose personal information for cross-context behavioral advertising or targeted advertising, you may opt out through [Decline]. We honor applicable universal opt-out preference signals, including Global Privacy Control (GPC), for the browser and device from which the signal is received where required by applicable law. We do not respond to browser "Do Not Track" (DNT) signals, as no uniform industry standard exists.

We do not knowingly sell or share personal information of individuals under 16 for cross-context behavioral advertising.

For details of current cookies and similar technologies, including provider, purpose, duration, and choices, see our Cookies Policy. International transfers from the EU/EEA, the UK, or Switzerland are governed by appropriate transfer mechanisms (such as the EU Standard Contractual Clauses or the UK International Data Transfer Addendum); see our Cookies Policy for details.

5. How we disclose personal information

We may disclose personal information only as needed for the purposes described in this policy, including to:

• Shenzhen DEEPLUM technology Co., Ltd.: for server management, technical operations, technical support, security monitoring, troubleshooting, and related services performed on DEEPLUM TECHNOLOGY Limited's behalf.
• Shopify: to host and operate our online store and related commerce services. Shopify may process personal information under its own terms and privacy disclosures for certain services.
• Service providers/processors: cloud hosting, AI and speech-processing providers, payment processors, shipping and fulfillment providers, logistics partners, fraud-prevention providers, app-infrastructure providers, customer-support providers, email/SMS providers, analytics providers, and professional advisers. They are authorized to process information only for services they provide to us, subject to applicable contractual and legal requirements.
• Advertising and marketing partners: only as described in Section 4 and subject to your choices and applicable law.
• Affiliates and corporate group members: where necessary to operate the Services, provide support, or manage our business under appropriate safeguards.
• Authorities and other parties: where required by law, to respond to valid legal process, protect safety and security, prevent fraud or abuse, establish or defend legal claims, enforce our agreements, or complete a corporate transaction.
• Other parties at your direction: when you ask us to share information, such as a shipping recipient, social-login provider, or third-party integration you choose to use.

We do not sell personal information for money. However, some disclosures involving advertising or analytics technologies may be treated as a "sale," "sharing," or "targeted advertising" under certain US state privacy laws. Where that applies, we provide the opt-out choices described in Section 4.

6. International transfers and processing locations

DEEPLUM TECHNOLOGY Limited is established in Hong Kong SAR. Our primary DEEPLUM application-server infrastructure is deployed in Germany.

Personal information may nevertheless be accessed or processed outside Germany where necessary to operate or support the Services. In particular, Shenzhen DEEPLUM technology Co., Ltd., located in China, may remotely access personal information on our German server infrastructure when necessary for authorized server management, system maintenance, security, incident response, troubleshooting, or technical support. Access is limited to personnel with a business need to know and is subject to role-based access controls, confidentiality obligations, logging, and applicable transfer safeguards.

Personal information may also be processed in the countries where Shopify, payment, logistics, AI, speech, mapping, analytics, support, or other service providers operate.

When we transfer personal information from the EU/EEA, the UK, or Switzerland to a country not recognized as providing an adequate level of protection, we use an appropriate transfer mechanism, such as the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum or International Data Transfer Agreement, or another lawful mechanism. We implement supplementary measures where appropriate. You may request information about the relevant transfer safeguards by contacting us.

For Canadian residents, personal information may be processed outside your province or Canada, including in Germany, Hong Kong SAR, China, the United States, and other countries where our providers operate. It may be subject to the laws of those jurisdictions. We remain accountable for personal information transferred to service providers for processing and require contractual safeguards appropriate to the sensitivity of the information.

7. Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, tax, or reporting requirements, and to establish, exercise, or defend legal claims.

Retention periods by data category:

Data category	Retention period	Legal / business basis
Order and transaction data	7 years after order completion	Applicable tax and accounting law (e.g., German Abgabenordnung §147, Hong Kong Inland Revenue Ordinance)
Account data	Active period + 3 years after closure	Returns, warranty, and dispute handling
Customer support records	3 years after resolution	Complaint handling and service improvement
Marketing subscription preferences	Immediate deletion of opt-in record; suppression list retained indefinitely	Anti-spam laws (CAN-SPAM, GDPR, etc.)
Device diagnostics and crash logs	90 days	Performance and troubleshooting
AI voice / translation content	Not retained by default	Privacy-by-design; user can delete on-device history
AI cloud backup (if enabled by user)	Active period + 30 days after disabling	Recovery buffer
App analytics events (anonymized)	12 months aggregated	Product improvement
Non-essential Cookies	Maximum 12 months; renewed consent	GDPR Art. 5(1)(e) and ePrivacy
Prescription data (where applicable)	5–10 years	National laws (e.g., Germany, Italy)
Financial documents (invoices, refunds)	10 years	Applicable tax law

Your prescription data may be retained and archived pursuant to applicable statutory and regulatory requirements.

8. Security

We use reasonable technical, organizational, and administrative measures designed to protect personal information. These may include access controls, encryption in transit, role-based access restrictions, administrator-access logging, supplier assessments, security monitoring, and incident-response procedures.

Incident response: In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of the breach, and will inform affected users without undue delay, in line with GDPR Articles 33–34.

No transmission or storage system is completely secure. Please protect your account credentials and devices, do not share passwords, and contact us promptly if you suspect unauthorized access. Do not send payment-card details, passwords, or other highly sensitive information through unencrypted email.

9. Your privacy rights and choices

Depending on where you live and subject to applicable exceptions, you may have the right to:

• request access to the personal information we hold about you;
• request correction of inaccurate personal information;
• request deletion of personal information;
• request a portable copy of certain personal information;
• request restriction of processing in certain circumstances;
• object to processing based on our legitimate interests, including profiling;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except where permitted by law; and
• withdraw your consent at any time, where processing is based on consent (withdrawal does not affect the lawfulness of processing before withdrawal).

To exercise these rights, contact us at privacy@deeplum.ai (preferred) or support@deeplum.ai. EU users may also contact our EU Authorized Representative (Section 1.3); UK users may also contact our UK Authorized Representative (Section 1.3). We will respond to verifiable requests within the time limits set by applicable law.

We honor the Global Privacy Control (GPC) browser signal as a valid opt-out of "sale" or "sharing" of personal information and cross-context behavioral advertising, where required by applicable law. We do not respond to browser "Do Not Track" (DNT) signals, as no uniform industry standard exists.

10. Children

DEEPLUM does not knowingly collect personal information from children under 16 for targeted advertising. If you are under 16, a parent or legal guardian must place any order and accept this Privacy Policy on your behalf, in line with GDPR Article 8 and applicable national laws.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects when this policy was last revised. For material changes, we will provide reasonable notice through the website or app, and, where required by law, give you the right to object.

12. Contact

For privacy-related questions, contact: