Lilura Privacy Policy

1. Who is responsible and how to contact us

Chengdu Xinqi Technology Co., Ltd., operating Lilura under the Xinio Tech brand, is responsible for the processing described in this policy. You can contact us at support@xiniotech.com for privacy questions or requests.

This policy covers the Lilura app, related AI and account features, and the Lilura product pages on this website. The general company website and other products have their own notices where linked. The features you use determine which of the information below is processed.

2. Information we process

We do not receive the password for your external sign-in account. App marketplaces process payment credentials under their own notices; our purchase records are not a record of your complete payment-card number.

Browsing a product page does not by itself submit a chat, upload a photo library, or create a character. Images are supplied through the features you choose to use. A reference to a possible future feature in product materials does not mean we are already collecting the data for that feature.

3. Purposes and applicable legal grounds

We use information to provide the functions you request, maintain accounts and conversation continuity, process purchases and refunds, respond to requests, review safety concerns, secure the Service, and comply with applicable obligations.

Where a law requires a legal ground for processing, the relevant ground depends on the purpose and circumstances: performing our agreement with you, complying with a legal obligation, necessary and proportionate legitimate interests such as security and troubleshooting where permitted, or your consent where required. A general agreement to use Lilura is not a substitute for a separate permission required by law.

Where special-category or sensitive information requires an additional legal condition or explicit permission, that condition must be met before the relevant processing. We do not treat an optional disclosure in chat as a blanket waiver of privacy rights.

4. AI processing, memory, and sensitive conversations

AI features use external processing. To respond to a message or generate an image, relevant information may be sent to AI service providers. This can include your current input, earlier messages or memory needed for context, character settings, and selected images. Generated responses and memory information may be stored so that the feature can continue across sessions.

Private chats are not exposed to other users or a character's creator simply because you interact with that character. They are nevertheless processed by us and the providers needed to operate the feature. They are not an end-to-end encrypted communication that only you can access.

AI-provider retention and improvement practices can differ. Some providers' applicable terms permit retention of submitted content for operating, securing, and improving their services, which may include model training. Other processing routes may have more restrictive controls. We therefore do not make a service-wide promise that every AI provider has zero retention or never uses content for training. Contact us before submitting information if you need a particular restriction or clarification.

This policy does not give Lilura a general license to use your private conversations or images for unrelated advertising or an independent model-training program. A new use requiring additional notice, a legal ground, or your consent must satisfy those requirements before it begins.

Conversations may reveal sensitive information even in a fictional scenario. Please avoid unnecessary information about identity documents, financial accounts, passwords, health, religion, sexual orientation, or other people's private lives. If you want us to review or remove particular personal information, use the data request instructions.

5. Who can receive information

Information may be disclosed as needed for the following purposes:

• Service providers: AI processing and memory services; hosting, storage, and delivery; sign-in and account services; app-marketplace and purchase verification; and security, communication, and support services. The information disclosed depends on the task being performed.
• Other users: character and creator materials you choose to make public, within the applicable publication controls. Your private chats and personal memories are not included merely because a character is public.
• Legal and safety needs: information necessary to comply with a valid legal requirement, handle a rights claim, investigate abuse or fraud, or protect people and the Service, subject to applicable law.
• A business transaction: information may transfer as part of a merger, acquisition, restructuring, or asset transaction, with applicable protections and notices.
• Your direction: information you ask us to share or disclose with the relevant permission.

Access by personnel handling a support, safety, or operational issue is limited to what is appropriate for that purpose. Do not assume that every employee or a character creator can browse your conversations.

This category-based description does not replace an identity-specific disclosure required by applicable law. Where a feature or market requires additional recipient, transfer, or consent information, the required information must be provided through the relevant notice before that processing. Additional notices may apply to particular regions or features and will be provided before the relevant processing where required.

6. Website technology, analytics, and permissions

The Lilura product and policy pages do not set advertising cookies or load behavioral-analytics scripts. Hosting and security infrastructure may process standard request information, including an IP address, browser information, and access times, to serve and protect these pages. Email links open your chosen email application; no message is sent until you send it.

If we introduce non-essential app analytics, advertising attribution, marketing, or other optional processing, we will provide appropriate information and any choices required by applicable law before enabling it. This policy is not a blanket consent to future tracking or screen recording.

Device permissions are requested for the relevant function where required. Granting a device permission does not authorize unrelated uses. You can manage permissions through your device settings; denying a permission may affect the feature that needs it.

7. International processing

Lilura uses infrastructure and service providers in more than one country. Your information may be processed outside your country of residence, including in the United States and other locations where we or our providers operate. Privacy laws and rights of access by public authorities can differ between locations.

Where required by applicable law, a transfer must have an appropriate legal basis and safeguards, and the required notice or consent must be provided or obtained. Stating that services operate internationally does not replace these requirements or override your rights. Contact support@xiniotech.com for information relevant to your request or location.

8. Retention, account deactivation, and deletion

Information is retained for the purpose for which it is processed, taking account of the information type, whether your account and content remain in use, your choices, legal obligations, security needs, and unresolved requests or disputes. Account history and stored content are not automatically erased simply because you stop opening the app.

• Account, conversations, memories, and media: used to maintain your account and the content available through it, subject to your requests and the applicable controls.
• Purchases and account integrity: records may need to remain for accounting, refunds, fraud prevention, or to prevent duplicate redemption of one-time offers, for the period justified by that purpose and applicable law.
• Support, safety, and legal matters: relevant records may be retained while a request, claim, investigation, or legal obligation remains open and for an applicable retention period.
• Backups and service-provider copies: deletion can require separate processing and may follow the applicable backup or provider lifecycle. We do not promise that every copy disappears immediately when a request is submitted.

The current in-app account process first deactivates the account and provides a 30-day recovery window using the original sign-in method. After that window, recovery through that process is no longer available. That process is not a confirmation that all associated personal information has been erased.

For deletion of an account and associated data, or deletion of particular personal information, contact us using Account and data requests. We may need to verify the account and clarify the scope. We will explain any relevant retention exception and what action can be taken on the request in accordance with applicable law. A request concerning data is separate from a purchase-refund request.

9. Your choices and privacy rights

Depending on where you live and the laws that apply, you may have rights to know about processing, access or receive a copy of your information, correct it, delete it, restrict processing, object to particular uses, obtain portability, withdraw consent, or opt out of specified advertising, sale, or sharing practices. The fact that data is disclosed without a cash payment does not by itself decide whether a local law calls it a sale or sharing.

To exercise a right, email support@xiniotech.com with the subject Lilura Privacy Request and describe your request. Provide an account ID or enough information to locate the account. Do not send passwords, sign-in tokens, payment-card details, or identity documents unless a necessary, proportionate verification method has been agreed.

We may verify that you or an authorized representative are entitled to make the request. We will handle it within the time required by the law that applies and explain any lawful exception, extension, or refusal. Where a right to appeal applies, you can ask us to review a decision by replying with Lilura Privacy Appeal. You may also contact your competent privacy authority.

Withdrawing consent affects future processing based on that consent and does not by itself invalidate earlier lawful processing. Some requests can affect a feature that depends on the relevant information; we will explain that consequence. Exercising a privacy right does not remove mandatory consumer protections or justify unlawful discrimination.

10. Adults-only service

Lilura is intended for adults aged 18 and over and is not offered to people under 18. An age declaration is not independent age verification. If you believe a person under 18 has supplied personal information through Lilura, contact us so that we can investigate and take the action required by applicable law.

11. Security

We use measures appropriate to the information and the risks, including access restrictions and protected connections, to reduce unauthorized access, loss, or misuse. No online service or transmission can be guaranteed completely secure. Protect your sign-in account, use a trusted device, and report suspected unauthorized access.

12. Policy updates

The effective and last-updated dates appear at the top of this page. We may update this policy when information practices, the Service, or legal requirements change. Material changes will receive an appropriate notice, and a new consent will be requested where required. Publishing a revised notice does not automatically authorize processing for which separate permission is needed.

Questions about this policy, the information relevant to your location, or a privacy request can be sent to support@xiniotech.com.