Part 1 Privacy Policy

YouMiku ("we", "us", or "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website (youmiku.com and related subdomains) and services.

We comply with applicable data protection laws worldwide, including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA), the UK Data Protection Act 2018, and other applicable privacy laws in the jurisdictions where our users reside.

Legal basis: GDPR Article 5; CCPA Cal. Civ. Code §1798.100; UK DPA 2018; applicable local data protection laws

1. Data Controller Information

Legal basis: GDPR Articles 13(1)(a), 27, 37-39; CCPA Cal. Civ. Code §1798.130

2. Information We Collect

We collect only the information necessary to provide our services, following the principles of data minimization and purpose limitation.

2.1 Information You Provide

2.2 Information We Automatically Collect

2.3 Information We Do NOT Collect

• Your full bank card or credit card details (payments are processed by PayPal; we never access your financial information)
• Your government ID number (unless explicitly required by law in your jurisdiction)
• Your contacts list, precise GPS location, SMS messages, or other data unrelated to our core service
• Biometric data for identification purposes

Legal basis: GDPR Article 5(1)(c); CCPA Cal. Civ. Code §1798.100(a)

3. Purposes of Processing

We process your personal data for the following purposes and legal bases:

Legal basis: GDPR Article 6; CCPA Cal. Civ. Code §1798.140(e)

4. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

Legal basis: GDPR Article 5(1)(e); CCPA Cal. Civ. Code §1798.100(c)

5. Special Category Data

In providing our services, the following special categories of personal data (as defined by GDPR Article 9) may be involved:

• Payment Information: When you purchase membership or character packs via PayPal, payment processing is handled entirely by PayPal. We do not collect or store your bank card or credit card details. We only record the order number, package type, and payment status.
• IP Address: Used for account security verification and fraud prevention. Under GDPR, IP addresses are considered personal data.
• Facial Information (Photos/Video): When you voluntarily upload an avatar or use video calls. Video call data does not pass through our servers — we cannot access or store your video feed.
• Gender & Age: Collected when you voluntarily provide this information in your profile. Used solely for profile display and match recommendations.

Legal basis: GDPR Article 9; CCPA Cal. Civ. Code §1798.121

6. Children's Privacy

Our service is not directed to children under 13 years of age (or the minimum age required for digital consent in your jurisdiction, e.g., 16 in most EU member states under GDPR Article 8).

We do not knowingly collect personal data from children under the applicable minimum age. If we become aware that we have collected personal data from a child without verifiable parental consent, we will take steps to delete such information promptly.

For users who are minors (between the applicable minimum age and 18), we apply the following additional protections:

• Parental or guardian consent is required before account registration
• Stricter access controls are applied to minors' personal data
• Parents or guardians may exercise data rights on behalf of minors at any time
• No targeted advertising or profiling based on minors' data

Legal basis: GDPR Article 8; COPPA 15 U.S.C. §6501; CCPA Cal. Civ. Code §1798.120(c)

7. Data Sharing & Third Parties

We do not sell your personal data to any third party. We may share your information with the following categories of recipients when necessary:

All third-party service providers are contractually bound to comply with applicable data protection laws. We require them to sign Data Processing Agreements (DPAs) that meet GDPR Article 28 requirements.

Legal basis: GDPR Articles 26, 28; CCPA Cal. Civ. Code §1798.140(ag)

8. International Data Transfers

As an international platform, your data may be processed in countries other than your country of residence. We ensure appropriate safeguards for all international transfers:

• PayPal Payment: Payment data is processed by PayPal internationally. Using PayPal means you also agree to PayPal's Privacy Policy.
• Translation Service: Text data may be processed via servers in different countries to provide accurate translation results.
• STUN/TURN Servers: Your network connection information (IP address) is sent to public STUN servers (provided by Google) for NAT traversal during video calls.
• Cloud Hosting: Your data may be stored on cloud servers located in different regions worldwide.

Legal basis: GDPR Articles 44-50; UK GDPR Article 44; CCPA Cal. Civ. Code §1798.130(a)(5)(B)

9. Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data:

We will respond to your request within 30 days (GDPR Article 12(3)). For CCPA requests, we respond within 45 days. If we deny your request, we will explain the reason and inform you of your right to appeal.

Legal basis: GDPR Articles 15-22; CCPA Cal. Civ. Code §1798.105-1798.135; UK GDPR Articles 15-22

10. Security Measures

We implement appropriate technical and organizational measures to protect your personal data:

• Data Encryption: User passwords encrypted using PBKDF2-SHA512 with salt — cannot be reverse-engineered
• Access Control: Strict role-based access management; all access is logged
• Encrypted Transmission: All data transmission uses HTTPS/TLS encryption
• Log Retention: System and security logs retained for a minimum of 180 days
• Data Backup: Regular automated backups to prevent data loss
• Security Management: Internal information security policies and incident response plans
• Staff Training: Regular privacy and data protection training for all personnel
• Vulnerability Management: Regular security assessments and prompt patching

Legal basis: GDPR Articles 32-34; CCPA Cal. Civ. Code §1798.150

11. Automated Decision-Making

We use an automated algorithm in our "Match" recommendation feature to suggest other users. The recommendation algorithm is based on:

• User online status (online users are prioritized)
• Whether the user has uploaded photos (users with photos are prioritized)
• Random shuffling (results differ on each refresh)

This algorithm does not create user profiles, does not evaluate personal characteristics, and does not involve differential pricing. It does not produce legal or similarly significant effects on you. You have the right to request an explanation and to object to it.

Legal basis: GDPR Article 22; CCPA Cal. Civ. Code §1798.185(a)(16)

12. Policy Updates

When this Privacy Policy is updated, we will notify you through the following methods:

• Posting the changes prominently on our website with at least 7 days advance notice
• For material changes, we will send a separate notification via in-app message or email
• If you do not agree with the updated policy, you have the right to cancel your account
• Continued use of the service after the effective date constitutes acceptance of the updated policy

Legal basis: GDPR Article 13(1)(d); CCPA Cal. Civ. Code §1798.135(a)