Privacy Policy

1. General information and scope
1. We value your and your child’s personal privacy highly and hereby want to explain how we collect, process and use your personal information when you use our App “CuboAi” and when you visit our website. We hereby promise you that when we are collecting, processing, and using your data, we shall comply with the EU General Data Protection Regulation (GDPR).
2. The privacy policy applies to the processing of personal data by Yun Yun AI Baby camera Co., Ltd. with registered offices at Rm. 4, 19F., No. 2, Ln. 150, Sec. 5, Xinyi Rd., Xinyi Dist., Taipei City 110014, Taiwan (R.O.C.) (“we”, “Yun Yun”). Yun Yun is a controller in the meaning of the GDPR. Our representative in the European Union is VeraSafe United Kingdom Ltd., address at 37 Albert Embankment, London SE1 7TL, United Kingdom.
3. You can contact our Data Protection Officer via https://verasafe.com/public-resources/contact-data-protection-representative.
2. Data processing while using the CuboAi App
1. To use the CuboAi App, it will be necessary for you to register. Therefore you have to provide your email address and choose a password. All other information you provide is offered on a voluntary basis. We use this data to create and maintain your CuboAi Account. The legal basis for this is Article 6 (1) b) of the GDPR. We will not be transferring your registration information to third parties for commercial purposes. When you create an account, the data you provide will be saved on a revocable basis. To delete your customer account, please send an e-mail to support@getcubo.com.
2. When you install the CuboAi App and the CuboAi product, we shall invite you to provide some basic personal information, such as, the name(s), age(s), gender(s) of your child (children). The information you provide is used to create your own user environment. The legal basis for this data processing is Article 6 (1) f) of the GDPR. If you do not agree to provide this data, you can choose to give pseudonyms. Please note that if you provide incorrect information (e.g. wrong age), certain features and analyses by the app may not work properly. 
3. In order to provide the monitoring features of CuboAi it is necessary to process personal data of babies, toddlers and minors. In particular, video and audio recordings are processed. CuboAi products will also upload the recorded audio and video data to Google Cloud Place (GCP) for storage (see https://cloud.google.com/terms/cloud-privacy- for GCP's privacy policy), as well as clips judged by the AI to be memorable (for instance if baby is acting cute). Furthermore, the data in Memory Wall in CuboAi Application  will also be organized according to baby’s age for you to download and save.   
   CuboAi products also collect information on environment temperature, humidity, and decibel levels. We store this data in themonitor and upload it to our servers simultaneously. Our smart technology will analyze the data and detect dangerous situations. When our smart technology warns of any impending dangers around your child, the video and audio information will be stored in the monitor and listed by date in the “Notification” tab. You can download the information from the CuboAi mobile application. If you refuse to provide information on the environment temperature, humidity, and decibel levels, please refrain from using CuboAi’s products. CuboAi’s Sleep Sensor Pad uses its own micro motion detection algorithm to convert the movement detected from the surface of your little one’s mattress into unique data, and by transforming these movement data (i.e. the rise and fall of baby's chest) into Motion statistics, it allows parents to track baby’s real-time well-being status in the CuboAi App for better peace of mind. For instance, if the camera AI confirms the baby is in the crib, but the Sleep Sensor Pad detects no micro motion, it will send parents an alert. If you refuse to provide information on movement data, please refrain from using CuboAi’s products.
   The main purpose of our services and products is to help parents pay immediate attention to their baby’s condition. CuboAi products combine AI artificial intelligence technology to actively detect potentially dangerous events (i.e. if baby has their face covered, roll over, or if their micro motion or other conditions signal potential danger) and send alerts to parents’ mobile devices. Therefore, to enhance the performance of our services and the statistical and analytical performance of our products, we collect, process, and utilize the voice recordings, photos, images, and other personal data of children (under the age of 12) using our products. By using our services and products, you consent to the collection, processing or use of your voice recordings, photographs, images and other personal information and that of the child (for whom you are the legal representative). If you do not consent to such collection, processing or use of personal information, please contact us and we will take steps to remove your child's personal information from our service and product servers and stop collecting the voice recordings, photographs, images or other personal information, but this may prevent you from continuing to use our service and products. See section titled "Your Rights" regarding removal of data.
   The use of the monitoring features is only allowed for the legal representative of the child or for persons that have been authorized by the legal representative of the child. If this is not the case for you, you may not use the CuboAi App for monitoring a child. The legal basis for this data processing is Article 6 (1) b) of the GDPR, because without processing this data, Yun Yun would not be able to perform the services according to the Terms of Service. The recordings will also be used to train CuboAi's algorithm to become increasingly better at recognizing dangerous situations for infants, such as their mouth or nose being covered. The legal basis for this is Article 6 (1) f) of the GDPR. We will not use the recordings for other purposes.
4. In order to use the CuboAi App with the CuboAi products it is necessary to provide the ID of the Wi-Fi router at your home to establish a secure internet connection. The legal basis for this data processing is Article 6 (1) b) of the GDPR.
5. It is noted that in the course of providing the monitoring features to you, we may collect information that could reveal your and/or the child’s (children’) racial or ethnic origin. We do not analyze or exploit this information and process it only indirectly.
6. If you want to use sleep tracking, sleep analysis or breathing rate tracking features of the app, the data collected for these features constitute health data in the meaning of the GDPR. Therefore, this requires the consent of the legal representative of the child that is monitored by the CuboAi products. Before your first use of these features, we will ask you to provide consent. With your consent, you represent that you are the legal representative or that you have been authorized by the legal representative of the child to give said consent. The legal basis for this data processing is Article 9 (2) a) of the GDPR. If the consent is not given, these features can unfortunately not be used.
7. To improve the function of the CuboAi products and to provide a better user experience for you, as well as to ascertain the technical problems you encounter when using the CuboAi products, we shall collect technical information of your CuboAi product, such as the model type, serial number, software version, the strength of your Wi-Fi signal, and the log of your Product. The legal basis for this data processing is Article 6 (1) f) of the GDPR.
8. CuboAi products allows you to freely adjust the settings regarding whether to store and share any specific information and content of you and/or the child (children). You can change settings in the App.
9. When you sign up for marketing and promotional communications and submit the questionnaire based on your consent, we shall thereby collect your email address, phone number, age(s) of your child (children) and questionnaire responses. We conduct a market analysis based on this data and send you promotional communications – according to your preferences and behavior – about Yun Yun products, services, events and promotions. The legal basis for this data processing is Article 6 (1) a) of the GDPR. Registration is voluntary and not necessary to use the app. Yun Yun will give you the chance to withdraw your consent for receiving promotional communications at any time via the unsubscribe link at the bottom of each promotional communications email you may receive from us.
10. When you contact our online customer service by email, we shall thereby collect your email address, purchase history, and the content (communication records) of your questions or requests that you addressed to provide you with consumer support. The legal basis for this data processing is Article 6 (1) b) of the GDPR. We also use this data to improve our products and services and to educate our customer service employees during training. The legal basis for this data processing is Article 6 (1) f) of the GDPR.
3. Data processing when visiting our website
1. As with every other website, our server collects information automatically and stores it temporarily in server log files transmitted by the browser unless you deactivate such collection. If you view content in our website, we collect the following data which for technical reasons we need if we are to display the contents of the website to you and to ensure the stability and security thereof (legal basis: Article 6 (1) f) of the GDPR):
1. the IP address of the computer from which the inquiry is sent;
2. the file inquired about by the client;
3. the http response code;
4. the Internet page from which you are visiting (referrer URL);
5. the time the server inquiry is sent;
6. the type and version of the browser used; and
7. the operating system on the computer sending the inquiry.

No server log files are evaluated in association with an individual person. The provider is not able to associate the data with any specific person or persons at any time. The data is not merged with data from any other sources. 

1. Transmission to third parties
   1. Except as otherwise provided by law or other than the situations identified below, we shall not provide, exchange, rent or sell any personal information of you or the child you monitored to any individual, group, private company or government organization other than those described in the preceding articles, “Data Processing” except in the case where it is required by the laws or regulations, demanded by a competent authority; the circumstances of such exceptions include, but are not limited to:
      1. With your written consent or by your setting on our app, such as when you choose to share your personal information with other users;
      2. With express provision in the laws and regulations;
      3. To avoid danger to your life, body, liberty or property;
      4. When it is necessary for statistical or academic purposes and the specific persons cannot be identified in view of the disclosure;
      5. When your use of the app violates our Terms of Service, or may damage or obstruct our service and the rights and interests of other users or cause damage to anyone, it is necessary for us to disclose your personal information through our reasonable judgment to facilitate identification, contact or legal action;
      6. Other similar circumstances favorable to your interests.
   2. We may employ or commission third-party companies and individuals to assist our services, provide and execute services related to the services on our behalf, or assist us in analyzing how the app or website is used.  These third parties may only obtain the personal information of you or the child you monitored on our behalf and are obliged not to disclose or use the personal information for any other purpose. When we entrust a third party to collect, process or use the personal information of you or your child, our company will sign a confidentiality agreement and data processing agreement with the outsourced company or individual to maintain and ensure the confidentiality level of your personal information in accordance with our personal information protection level. Third parties engaged are:
      1. TUTK (https://www.throughtek.com/privacy_policy.html); 
      2. Amazon (https://aws.amazon.com/tw/compliance/data-privacy-faq/); 
      3. Google (https://support.google.com/analytics/answer/7318509?hl=zh-Hant); 
      4. Segment (https://segment.com/docs/legal/privacy/); 
      5. Zendesk (https://www.zendesk.tw/company/customers-partners/privacy-policy/); 
      6. Shopify (https://www.shopify.com/legal/privacy). 

   We may use the non-identifiable part of your information for statistical and analytical purposes and share the results with our partners.  For example, we may share with them the environmental information such as the temperature and humidity of the space used by the child (children) and shall make sure that the above-mentioned information we shared will not be linked to you and that our partners shall comply with it.

2. Storage period
   1. We will retain your personal data for the period necessary to fulfill the purposes outlined in this Privacy Policy and our Terms of Service:
      1. Before you delete your account, we will continue to store your account information.
      2. For providing you with consumer and customer support, we will continue to store your purchase information before you request us to delete it.
      3. Before you delete your account, we will continue to store the information you provide when you install the app and the CuboAi product.
   2. The information processed during the use of the app:
      1. We store your environmental information in the CuboAi product for 10 days; after 10 days this data will be automatically deleted. We also upload your environmental information to our servers; we will continue to store this data before you request us to delete it.
      2. We store the video and audio information in the CuboAi product for 18 hours; after 18 hours this data will be automatically deleted.
      3. Videos in the “Notification” tab will be kept for 30 days and will be automatically deleted after 30 days.
      4. Memorable photos uploaded to our servers will be kept for 10 days and will be automatically deleted after 10 days.
      5. Photos taken by CuboAi’s Auto Photo Capture regularly, the environmental information, and the analysis results from CuboAi will be uploaded to our servers; we will continue to store the data above before you request us to delete it.
   3. All data uploaded to our servers that we do process on the legal basis of Article 6 (1) b) or Article 6 (1) f) of the GDPR is automatically deleted when you have not logged into the app for 3 years. This does not apply when we have legitimate interests in further processing your personal data. In this case, the personal data is deleted when our legitimate interest has ceased to exist or when you object to our legitimate interests. Statutory storage obligations remain unaffected by this.
   4. We will continue to store the information you provide along with your consent (Article 6 (1) a) of the GDPR) when you sign up for marketing and promotional communications before you request us to delete it.
   5. You can ask us to delete the information at any time. Please contact us at support@getcubo.com.
3. International transfer
   1. Because we use third-party service providers (such as Amazon and Google) to support us in providing our service, your personal information may be transferred to — and processed on — computers or servers located outside of your state, province, country or other governmental jurisdiction where the personal data protection laws may differ than those in your jurisdiction. As required by the GDPR, we shall only transfer personal data to recipients offering an adequate level of data protection. Therefore, we have signed contracts based on the EU's standard contractual clauses with providers that process data outside the European Union.
   2. Since Yun Yun is located in Taiwan, it might be necessary in individual cases to transfer personal data to Taiwan and process it there. The legal basis for this data transfer is Article 49 (1) b) of the GDPR. Yun Yun is committed to protecting your privacy in the process.
4. Your rights
   1. You have the following rights vis-à-vis us regarding your personal data. You have the right to:
   1. access,
   2. rectify or erase,
   3. restrict processing,
   4. object to processing, and
   5. portability.

Vulnerability Disclosure Policy

Yun Yun Technology places great importance on the security of our products and is fully committed to promptly assessing and addressing any issues. Upon receiving a report of a security issue, we will allocate the necessary resources for analysis and verification and will provide an appropriate resolution.

Note: Yun Yun Technology does not offer rewards for vulnerability disclosure. By submitting a vulnerability report, you acknowledge and agree that you do not expect any reward and waive any future claims for compensation from Yun Yun Technology based on the report.

Authorization

If you conduct security research in good faith and in compliance with this policy, we will consider your research to be authorized. We will cooperate with you to promptly understand and resolve the issue, and we will not take legal action against you for your research. If a third party initiates legal proceedings against you for activities conducted under this policy, we will publicly confirm that your actions were authorized.

Guidelines

Under this policy, “research” includes the following activities:

• Immediately notifying us upon discovering an actual or potential security issue.
• Striving to avoid violating privacy rights, degrading the user experience, disrupting production systems, or damaging or manipulating data.
• Exploiting system vulnerabilities only when necessary to confirm the existence of a vulnerability. Do not use system vulnerabilities to obtain or disclose data, execute persistent command line access, or pivot to other systems.
• Providing us with reasonable time to address the issue before publicly disclosing it.
• Refraining from submitting large volumes of low-quality reports.
• If you verify the existence of a vulnerability or encounter any sensitive data (including personally identifiable information, financial information, or trade secrets), you must cease testing immediately, notify us without delay, and refrain from disclosing the data to any third party.

Testing Methods

The following testing methods are not authorized:

• Testing that involves denial-of-service (DoS or DDoS) attacks or any other tests that could impact access, damage systems, or corrupt data.
• Physical testing (e.g., office entry, open doors, tailgating), social engineering (e.g., phishing, vishing), or any other non-technical vulnerability testing.

Scope

This policy applies only to products and services that are fully owned and managed by Yun Yun Technology.

Vulnerability Reporting

If you identify a security vulnerability while using our products or applications, please submit the relevant details to support@cuboai.com.

• Upon receiving your report and your contact information, we will acknowledge receipt of the report within five business days.
• We will make every effort to confirm the existence of the vulnerability and, where possible, transparently communicate the measures we are taking to remediate the issue, including any potential delays or challenges.
• We will also maintain open communication to discuss the issue as needed.

Please send us an email (support@getcubo.com) or contact our data protection officer [●].

 

• In addition, you have the right to lodge a complaint with a data protection supervisory authority if you are not satisfied with our processing of your personal data.