Important Notice
Please read this Policy carefully before using Biyoo. Pay particular attention to how personal information is collected and used, third-party services, cross-border data transfers, retention periods, account cancellation, and data deletion.
You may request account cancellation in the App through Settings > Account > Delete Account, or contact us at support@hibiyoo.com to submit a relevant request.
This Policy may be provided in Simplified Chinese, Traditional Chinese, and English. Any inconsistency among versions will be handled in accordance with Section 18 of this Policy.
1. Scope
1.1 This Biyoo Privacy Policy (the “Policy”) explains how the Biyoo service provider collects, uses, shares, retains, and protects personal information when you use the Biyoo mobile application, website, and related services, and how you may exercise your rights.
1.2 In this Policy, “we,” “us,” or “Biyoo” means the Biyoo service provider. The identity and registered address of the personal information controller and our privacy contact details are set out in Section 18.
1.3 This Policy applies to accounts, voice matching, text matching, one-to-one calls, voice rooms, posts, direct messages, memberships, virtual gifts, Coins, hosts or creators, customer support, safety review, and other Biyoo services. Third-party websites and services are governed by their own privacy policies.
2. Personal Information We Collect
2.1 Account and login identifiers: user ID, Apple or Google third-party identifiers and tokens, email address, email verification status, mobile number (if you choose to link it or if it is required for account security, identity verification, or a specific feature), login method, account status, and registration and cancellation times. We mainly use this information for registration, login, account linking, recovery, security verification, and preventing duplicate or abusive accounts.
2.2 Profile information: display name, profile photo, gender/matching preference, date of birth or age, zodiac sign, language, country/region, city or broader area, interest tags, bio, voice introduction, and verification status. We mainly use this information to display profiles, enable matching and recommendations, apply age restrictions, support social interaction, and maintain safety.
2.3 User content and communications: text messages, posts, comments, images, voice content, room content, gift messages, reports, customer-support communications, and other content you choose to submit. We mainly use this information to transmit and display content, preserve conversations, moderate content, investigate reports, and resolve disputes.
2.4 Live voice, recordings, and audio analysis: live microphone audio streams, recordings of one-to-one voice sessions and voice rooms, audio clips, automated transcripts, risk keywords or classification labels, voice activity, mute status, connection quality, call duration, and human-review records. We mainly use this information to connect calls, maintain content safety, prevent harassment, handle reports, investigate disputes, improve quality, and improve safety models.
2.5 Social connections and interactions: matching history, reveal/profile-card selections, likes, friends/follows, blocks, reports, response rates, interaction duration, room participation, gifts, and relationship status. We mainly use this information for relationship management, matching order, cooldown and deduplication, recommendations, analytics, and safety.
2.6 Payments and virtual entitlements: product, amount, currency, order number, payment-channel transaction identifier, subscription status, records of Coins, gifts, and related transactions, refunds, chargebacks, and settlement status. We generally do not receive complete bank-card numbers. We mainly use this information to complete purchases, restore entitlements, reconcile accounts, issue refunds, handle tax and settlement, and prevent fraud.
2.7 Device, network, and log information: IP address, device model, operating system, App version, language, time zone, network type, carrier, device or installation identifier, push token, crash logs, performance data, and login and activity logs. We mainly use this information for security, compatibility, troubleshooting, analytics, anti-cheating, and risk control.
2.8 Location and region: the country/region, city, or broader area you select, and an approximate location inferred from your IP address. We collect precise location only when a clearly identified feature requires it and the relevant system permission has been obtained. We mainly use this information for localization, time-zone settings, matching, regional restrictions, compliance, and risk detection.
2.9 Safety and review: reports, blocks, penalties, risk labels, anomalous devices or networks, review results, age or identity-verification results, and necessary copies of evidence. We mainly use this information to protect users, investigate violations, enforce rules, handle appeals, and respond to legal requests.
3. How We Obtain Information
- Information you provide directly: registration information, profile information, content, voice, messages, purchases, reports, customer-support communications, and identity/age-verification materials.
- Information collected automatically: device, network, log, interaction, call-quality, push-token, safety, usage, recording, and content-recognition data.
- Information provided by third parties: Apple/Google login information, App Store/Google Play order and subscription status, logs from cloud/communications/review vendors, reports from other users, and information from lawfully authorized partners.
- Public or lawful sources: when verifying infringement, fraud, sanctions, major security incidents, or compliance with legal obligations, we may use publicly available information that can reasonably be obtained.
Do not provide customer support with your account password, complete bank-card password, or email verification code, and do not voluntarily disclose unnecessary sensitive information in public profiles, voice rooms, or chats.
4. Purposes and Legal Bases for Processing Personal Information
4.1 Providing the services: creating accounts; enabling login, matching, communications, voice features, voice rooms, profiles, memberships, gifts, settlements, and customer support. Where applicable law requires us to identify a legal basis, we primarily process this information as necessary to perform our contract with you or to take steps at your request.
4.2 Recording, content safety, and community governance: recording voice, automatically transcribing or detecting risky content, conducting human review, handling reports, protecting minors, preventing harassment, and enforcing rules. Where applicable law requires us to identify a legal basis, we may rely on contract performance, legitimate interests, protection of life and safety, compliance with legal obligations, or your consent when required by law.
4.3 Personalization and recommendations: we may rank matching candidates or content based on your choices, basic profile, usage, interactions, and necessary safety factors to improve relevance, reduce waiting time, and maintain platform safety. Where applicable law requires us to identify a legal basis, we may rely on providing the service, legitimate interests, or your consent when required by law.
4.4 Payments, settlements, and tax: processing orders, subscriptions, refunds, Coins, gifts, host settlements, and financial records. Where applicable law requires us to identify a legal basis, we primarily rely on contract performance and compliance with legal obligations.
4.5 Analytics and improvement: measuring usage, conducting A/B tests, fixing faults, and evaluating matching, retention, audio quality, and review systems. Where applicable law requires us to identify a legal basis, we may rely on legitimate interests or obtain your consent for non-essential SDKs and sensitive processing.
4.6 Account and platform security: detecting bots, anomalous logins, device risk, fraud, stolen-payment activity, chargebacks, and abuse. Where applicable law requires us to identify a legal basis, we may rely on contract performance, legitimate interests, and compliance with legal obligations.
4.7 Communications: sending verification codes, security alerts, service notices, customer-support responses, and marketing messages to which you have consented. Where applicable law requires us to identify a legal basis, we may rely on contract performance, compliance with legal obligations, legitimate interests, or your consent.
4.8 Legal and corporate matters: responding to regulatory or law-enforcement requests and handling disputes, audits, mergers, reorganizations, or business transfers. Where applicable law requires us to identify a legal basis, we may rely on compliance with legal obligations and legitimate interests.
5. Voice Recording, Transcription, Automated Detection, and Human Review
5.1 Scope of recording: when you use one-to-one voice matching, one-to-one voice calls, or voice rooms, Biyoo processes live microphone audio and records the relevant voice communications. Recordings may contain your voice, other people’s voices, background sounds, and information that may be inferred from them. Audio recordings are personal information when they can identify an individual.
5.2 Processing methods: we may perform real-time or later automated speech transcription, keyword and risk-pattern detection, voice-activity detection, call-quality analysis, content classification, and safety scoring. Content that is reported, triggers a risk rule, or is sampled may be manually reviewed by authorized reviewers or service providers.
5.3 Purposes: providing real-time communications; identifying sexual content, fraud, harassment, hate, risks involving minors, and other prohibited content; handling reports, appeals, and disputes; protecting life and property; preventing fraud; and improving audio quality, product experience, and safety-review capabilities.
5.4 Notice and choices: before the relevant recording or content-recognition processing begins, we will provide any required notice and obtain separate or express consent where required by applicable law. If you do not agree to the processing, do not enter or use the corresponding voice feature. If you disable microphone permission, features that require voice will not work properly.
5.5 Voiceprints and biometrics: unless we provide a separate prominent notice identifying the specific purpose, retention period, and legal basis, and obtain express consent when required, we will not create voiceprint biometric templates used to uniquely identify an individual, or use ordinary speech transcription, content classification, or call-quality analysis for undisclosed identity recognition.
5.6 Access: recordings and transcripts are accessible only to authorized employees, reviewers, cloud/communications/content-safety service providers, and authorities legally entitled to access them, to the extent necessary for the purposes above. We reduce unauthorized-access risk through least-privilege access, logging and audits, encryption, and contractual restrictions.
5.7 Retention: we retain recordings, transcripts, risk labels, and review records only for as long as necessary to provide real-time communications, maintain content safety, handle reports, resolve disputes, and comply with legal obligations. Content that is not reported and does not trigger a high-risk rule will be deleted or anonymized after the relevant purpose is fulfilled. Content connected with a report, appeal, dispute, security incident, fraud, or legal proceeding may be retained for as long as necessary to handle the matter. See Section 11 for specific retention rules.
5.8 Recordings by other users: other participants may use external devices, system screen-recording tools, or other means to preserve your communications without authorization. We prohibit recording, distribution, or misuse without consent, but cannot completely prevent actions taken using third-party devices.
6. Matching, Recommendations, and Automated Processing
6.1 To provide matching, recommendation, and safety services, we may rank matching candidates or content based on your choices, basic profile, usage, interactions, and necessary safety factors. Relevant information may include your matching preferences, language, region, interests, activity, interaction feedback, and information relating to account and platform safety.
6.2 Automated processing is used to improve relevance, reduce waiting time, and reduce risk; it is not a judgment about a user’s identity, conduct, or relationship outcome. Unless permitted by law and accompanied by appropriate safeguards, we will not make decisions that produce legal or similarly significant effects on you solely through automated processing.
6.3 You may influence some processing through your profile, privacy settings, blocking, reporting, reduced personalization options, or by contacting customer support. Certain safety and anti-fraud processing cannot be completely disabled.
7. How We Share or Disclose Information
7.1 With other users: depending on your settings and the feature, other users may see your display name, profile photo, age range/zodiac sign, region, interests, posts, voice-room statements, gifts, and relationship status. During anonymous matching, only the information expressly listed on the relevant page is displayed. After a reveal, the scope of information displayed depends on both users’ choices and the page description.
7.2 With service providers: we provide cloud-hosting, real-time audio, instant-messaging, content-delivery, push, email, login, payment, analytics, crash-monitoring, risk-control, content-review, and customer-support vendors with the information necessary to perform their services, and restrict their processing through contracts, permissions, and security measures.
7.3 Payment platforms: Apple, Google, and other approved channels generally process payment accounts and complete payment credentials independently. We receive order and transaction identifiers and subscription and entitlement status.
7.4 Legal and safety disclosures: we may disclose necessary information when we reasonably believe disclosure is required to comply with law or a regulatory or law-enforcement request, protect life and safety, investigate fraud, enforce agreements, or protect the rights of Biyoo or others.
7.5 Corporate transactions: if financing, a merger, reorganization, asset sale, change of operator, bankruptcy, or another corporate transaction occurs, relevant information may be lawfully transferred subject to confidentiality and appropriate safeguards. The new personal information controller must continue to comply with applicable law and the privacy commitments then in effect.
7.6 Selling personal information is not our primary business model, and we do not sell your private voice recordings or messages solely for monetary consideration. If we conduct advertising activities that constitute a “sale” or “sharing” of personal information under applicable law, we will update the relevant disclosure and provide any opt-out required by applicable law.
8. Third-Party Service Providers and SDKs
8.1 To provide login, payment, cloud storage, real-time audio, instant messaging, content delivery, push, email verification codes, analytics, crash monitoring, content review, customer support, and anti-fraud functions, we may integrate third-party services or software development kits (SDKs).
8.2 We provide a List of Third-Party SDKs and Service Providers in the App or on a publicly accessible webpage. The list identifies each service or SDK, its provider, purpose, types of personal information it may process, relevant permissions or processing methods, and a link to the third party’s privacy policy.
8.3 If a third-party service or SDK collects, transmits, shares, or independently processes personal information, or provides capabilities involving login, payment, real-time audio, instant messaging, push, analytics, advertising, location, device identifiers, audio, or content review, we will disclose it in that list as appropriate.
8.4 Data that a third party processes as an independent personal information controller, such as Apple or Google account data, payment-account data, and data for purposes independently determined by that third party, is governed by the third party’s own privacy policy. When a third party processes data only on our behalf, it is subject to contractual, confidentiality, security, and processing-instruction restrictions.
8.5 We will update this Policy and the relevant list based on the third-party services actually used by the App and their personal-information processing. If a new service materially changes the processing purpose, information type, or scope of sharing, we will update the disclosure as required by law and obtain your consent when required.
9. Data Storage Locations and Cross-Border Transfers
9.1 Biyoo’s primary servers and data-storage nodes are currently located in Singapore. Because Biyoo serves multiple countries and regions, your information may be transferred from your country or region to Singapore and may also be processed by service providers in the locations where they operate.
9.2 Rivers Technology (HK) Limited is the current personal information controller. It determines the purposes and means of the relevant personal-information processing and handles your information in accordance with applicable data-protection laws.
9.3 For the European Economic Area, United Kingdom, Switzerland, or other regions with specific cross-border-transfer requirements, we will use an adequacy decision, Standard Contractual Clauses, a data-processing agreement, a risk assessment, contractual safeguards, or another lawful mechanism as required by applicable law, and will apply encryption, access controls, and data-minimization measures.
10. Information Security and Incident Response
We use reasonable measures, including encryption in transit and at rest, access controls, least-privilege access, logging and audits, environment segregation, backups, anti-abuse controls, vendor management, and employee confidentiality obligations. No Internet service can guarantee absolute security.
If a data incident may pose a risk to your rights, we will investigate, contain, and remediate it, and notify regulators and affected users as required by applicable law. You should protect your device, email account, and verification codes. If you suspect that your account or information has been compromised, contact support@hibiyoo.com immediately.
11. Retention Periods
11.1 Account and profile information: retained while your account remains active and as necessary to provide the services. After account cancellation or fulfillment of the relevant processing purpose, we will delete or anonymize the information, except as necessary to comply with legal obligations, resolve disputes, maintain safety, or prevent fraud.
11.2 Login, verification-code, and security logs: verification codes expire after use or at the end of their validity period. Sending, login, and security logs are retained only for as long as necessary to protect account security, prevent fraud, troubleshoot issues, and comply with legal obligations.
11.3 Direct messages and matching conversations: retained as necessary to provide conversations, synchronize messages, handle deletion requests, and maintain account and platform safety. After a user deletes relevant content or cancels an account, the data will be deleted from active systems or anonymized within a reasonable period, and backup copies will be handled through normal rotation, unless law, safety, or dispute-resolution needs require otherwise.
11.4 Voice recordings that are not reported and do not trigger a high-risk rule: retained only for the shortest period necessary to provide voice services, maintain content safety, and complete required review, and then deleted or anonymized after those purposes are fulfilled.
11.5 Reported or high-risk voice content and related evidence: retained while a report, appeal, dispute, security incident, fraud investigation, or legal proceeding is being handled, and may be retained for an additional necessary period after the matter closes to prevent repeated abuse, address later disputes, or comply with legal obligations.
11.6 Automated transcripts, risk labels, and review records: retained as necessary for content safety, appeals, risk detection, and preventing repeated abuse. The specific period is determined by the level of risk, processing outcome, and applicable legal requirements.
11.7 Public posts, voice introductions, and replayable content: retained while the content remains active, the account remains active, or until you delete it. Reported or disputed content may be retained for as long as necessary to handle the relevant matter.
11.8 Reports, blocks, and penalty records: retained as necessary to process reports, enforce community rules, protect users, handle appeals, and prevent repeat violations.
11.9 Orders, subscriptions, virtual entitlements, and settlement records: retained in accordance with applicable tax, accounting, payment, anti-fraud, and financial-regulatory requirements.
11.10 Customer-support records: retained as necessary to handle your inquiries, complaints, appeals, and disputes, and may be retained for a reasonable period after the matter closes for later inquiries, service quality, and legal compliance.
11.11 Anonymized statistics: we may retain and use anonymized statistics for an extended period when a particular individual cannot reasonably be identified.
We determine the shortest necessary retention period based on the processing purpose, nature of the personal information, potential risk, legal requirements, and whether a dispute or security incident exists. At the end of the retention period, we delete or anonymize the information. If backup mechanisms prevent immediate deletion, we restrict access to and use of the data and handle it through normal backup rotation.
12. Your Choices and Rights
Depending on the law where you live, you may have the right to access, obtain a copy of, correct, supplement, or delete personal information; restrict or object to processing; withdraw consent; receive a portable copy; opt out of certain marketing or advertising processing; and complain to a regulator.
You may modify your profile, notifications, privacy settings, blocks, and certain recommendation options in the App, and submit a privacy request through support@hibiyoo.com. To protect your account and other people’s privacy, we may ask you to verify your identity and may lawfully refuse a request that is manifestly unfounded, excessive, or adversely affects another person’s rights.
Withdrawing consent does not affect the lawfulness of processing conducted before withdrawal. Refusing to provide information necessary for a service, or withdrawing consent required for voice recording or recognition, may make the corresponding voice, matching, payment, or safety feature unavailable.
We will not discriminate against you solely because you lawfully exercise a privacy right. However, if information is deleted or processing is restricted, the corresponding feature may no longer be available.
13. Account Cancellation and Data Deletion
13.1 You may request account cancellation in the App through Settings > Account > Delete Account, or contact us at support@hibiyoo.com to request account cancellation or data deletion.
13.2 The deletion process may include identity verification and resolution of incomplete transactions, refunds, subscriptions, host settlements, appeals, and security risks. After deletion is completed, account information generally cannot be restored. Information retained as required by law will be segregated from active business use and deleted or anonymized when the applicable period ends.
13.3 Deleting your Biyoo account does not automatically cancel an Apple or Google subscription; you must manage and cancel the subscription on the relevant platform. Account deletion also cannot delete content that another user has saved, captured in a screenshot, quoted, or lawfully retained.
14. Device Permissions
14.1 Microphone: used for one-to-one voice, voice rooms, voice posts, and voice introductions. The relevant features involve recording and content recognition.
14.2 Camera/photos: used to capture or upload profile photos, images, videos, and evidence for reports.
14.3 Notifications: used for verification codes, security, messages, calls, transactions, and service alerts.
14.4 Location: approximate or precise location is obtained only when a clearly identified feature requires it and permission has been granted. We generally prioritize the region you select or an approximate location inferred from your IP address.
14.5 Bluetooth/nearby devices: used to connect headphones, microphones, and other audio devices, as managed by the operating system.
You may withdraw permissions in your device settings. We do not access the corresponding device resource without system permission. Withdrawing a required permission will make the corresponding feature unavailable.
15. Children and Minors
Biyoo is not intended for anyone under 18. We do not knowingly collect information from a minor who does not meet the minimum age. If you believe a minor has provided information to us, contact us at support@hibiyoo.com. We will investigate and take appropriate steps, which may include restricting or deleting the information.
16. Supplemental Terms for Specific Regions
16.1 Hong Kong SAR
Where Hong Kong’s Personal Data (Privacy) Ordinance applies, Rivers Technology (HK) Limited is the data user. You may request access to and correction of personal data as permitted by law and contact us at support@hibiyoo.com. We will follow applicable principles concerning purpose of collection, accuracy, retention, security, use limitations, and access and correction.
16.2 Singapore
Where Singapore’s Personal Data Protection Act applies, you may request access to and correction of personal data, withdraw consent, and contact us regarding cross-border transfers and personal-data processing as permitted by law. We take steps to ensure that overseas recipients provide protection comparable to that required by applicable law.
16.3 European Economic Area, United Kingdom, and Switzerland
Where the GDPR, UK GDPR, or related law applies, you may exercise rights of access, correction, deletion, restriction, objection, portability, and withdrawal of consent, and may complain to your local data-protection authority. We will identify the applicable legal basis and, when required, use Standard Contractual Clauses or another cross-border mechanism. If required by law, we will appoint an EU or UK representative and update the contact details.
16.4 Taiwan
Where Taiwan’s personal-data-protection laws apply, we will identify the collector, purposes, categories of data, period, region, recipients, and methods of use; your rights; and the consequences of not providing data. As permitted by law, you may inquire about or review data, request a copy, request supplementation or correction, or request that collection, processing, or use stop or that data be deleted.
16.5 Indonesia
Where Indonesia’s Personal Data Protection Law No. 27 of 2022 applies, you may, as permitted by law, receive processing information; access or correct data; request cessation or deletion; withdraw consent; object to certain automated processing; and seek remedies. We will handle cross-border transfers and incident notifications as required by applicable law.
16.6 California, United States
If the CCPA/CPRA applies to us, California residents may request information, access, correction, deletion, and a portable copy; opt out of the sale of personal information or its sharing for cross-context behavioral advertising; and limit certain uses of sensitive personal information, as permitted by law. We will not unlawfully discriminate against users for exercising statutory rights.
17. Updates to This Policy
We may update this Policy due to legal, regulatory, technical, product, or business changes. We will notify you of material changes through the App, website, email, or another prominent method, and obtain consent again when required. The updated Policy will identify its last-updated and effective dates.
18. Languages and Contact Information
18.1 This Policy may be provided in Simplified Chinese, Traditional Chinese, and English, and each version is intended to have the same meaning. If an inconsistency exists, the Simplified Chinese version controls, except where applicable law, a regulator, or a court with jurisdiction requires the local-language version to control or requires an interpretation favorable to the data subject.
18.2 The Simplified Chinese version controls only for resolving translation differences and does not exclude or reduce any mandatory right you have under applicable data-protection law.
18.3 Operator and personal information controller: Rivers Technology (HK) Limited. Registered address: Unit 903A, 9/F., Cameron Commercial Centre, 458–468 Hennessy Road, Causeway Bay, Hong Kong. Customer support, privacy, and data-protection email: support@hibiyoo.com.
— End —