Privacy Policy

Effective date: 2026-10-09

TaoApex services are provided by TAOAPEX LTD (Company No. 16862192), registered at 128 City Road, London, EC1V 2NX, United Kingdom. Privacy contact: privacy@taoapex.com.

## What we collect
We may collect account details, content you submit, payment or subscription records, technical logs, and cookie data needed to operate and improve the Services.

For TaoTalk AI, this includes your account email, name and user identifier; messages, relevant conversation history, summaries, saved memories and character settings; optional voice recordings for transcription; optional photos you upload as character avatars; device identifiers and push tokens; product interaction and error events; and purchase or subscription records. You control what you type or upload. A message or saved memory may contain personal details such as your name, preferences, relationships or life events.

## Why we use data
We use personal data to provide the Services, secure accounts, process payments, answer support requests, comply with legal obligations, and run optional analytics or marketing only where consent is required.

## AI, sharing, and transfers
## TaoTalk AI

### Explicit permission and your choice
Before AI chat or voice messaging, TaoTalk AI presents a separate disclosure and asks you to select Allow AI Data Sharing or Don't Allow. Accepting general terms, signing in or granting microphone permission is not AI data-sharing consent. The current disclosure requires a new decision even if you accepted an earlier version. If you decline, you can continue browsing, but AI text and voice messaging remain disabled. No message or voice audio is sent for AI processing by that app until you allow it.

You can read the disclosure or select Turn Off AI Data Sharing at Profile > AI Data Sharing, or from the chat menu. We store your disclosure version, decision and the time it was saved. A saved withdrawal blocks new AI chat, voice transcription, memory processing and AI-personalized conversation reminders for your account, including on older clients. It does not erase data already processed or automatically delete stored conversations; use account deletion or contact privacy@taoapex.com for deletion requests. An in-flight request cannot be recalled from a provider after it has been sent.

### Data, specific recipients and purposes
- Google (Gemini API): receives your message, relevant conversation history, conversation summaries, saved memories and character settings to generate replies, extract relevant memories and summarize long conversations. Optional conversation reminders may use recent chat context. When you send a voice message, Google receives that audio to transcribe it; the resulting text follows the same chat processing. Merely opening the chat, browsing characters or starting a recording does not send audio to an AI provider.
- OpenRouter and Nebius: receive message or memory text needed to produce embeddings for related-memory search. OpenRouter routes these requests only to Nebius, with other-provider fallbacks disabled and no-data-collection and zero-data-retention routing restrictions enabled. They do not receive your voice recording for transcription.

We do not add account passwords, authentication tokens, account email, payment details, device IDs or push tokens to AI request content. However, personal information you include in messages, relevant history or memories is part of the text processed by the named AI recipients. Uploaded avatar photos are stored for your selected avatar and are not sent to these AI recipients.

### Provider protection and limits
We require AI service providers to provide the same or equivalent protection as this policy: processing only for the disclosed service, confidentiality and access controls, secure transport, no public-model training on customer content, and appropriate retention and deletion safeguards. We use the paid Gemini API under Google's applicable data-processing terms; Google does not use paid-service prompts or responses to improve its products, but may retain limited data for abuse prevention and legal obligations. For OpenRouter embeddings, our requests enforce the privacy restrictions described above and fail rather than route to an undisclosed provider. These controls do not promise that all operational or legally required records disappear immediately.

Provider information: Google Gemini API terms, Google data-processing terms, OpenRouter privacy policy, and OpenRouter provider privacy controls.

Other inputs may be processed by trusted hosting, payment, support, analytics, or AI providers only as needed to deliver the requested feature. We require service providers to protect personal data under contractual and technical safeguards that provide the same or equivalent level of protection described in this policy. We do not sell personal data and do not use customer content to train public AI models. Some service data may be processed in the UK, EU, or US with appropriate safeguards.

## Retention and security
Active account data is kept while the account remains open. Deleted-account data is generally removed from active systems within 30 days; some logs may be kept for 90 days and some generated images for 7 days. We use access controls plus TLS 1.3 in transit and AES-256 at rest where described in our product materials.

## Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. If you are in the UK, you can complain to the Information Commissioner's Office (ICO).

## Cookies, children, and updates
We use essential cookies to run the site and ask for consent where non-essential analytics cookies are used. Our Services are not intended for children under 16. We may update this policy from time to time and post the latest version here.