Privacy Policy for Yonbo Services

Last Updated: October 26, 2025

Effective Date: December 20, 2024

1. Introduction

1.1. Scope of This Policy

This Privacy Policy describes how Xorigin-ABC INC. ("we," "us," or "our") collects, uses, and discloses personal information when you use our integrated services, which include the Yonbo mobile application (the "App") and the connected Yonbo AI Robot (such as the Yonbo Robot and Yonbo Camera (the "Robot")). Together, the App and Robot are referred to as the "Services."

By downloading, accessing, or using our Services, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree to this Privacy Policy, please do not use or access any of the Services.

1.2. Our Product Philosophy: App for Parents, Robot for Children

Our Services are designed with a clear distinction to safeguard privacy: the App is intended for use by parents or legal guardians ("you"), while the Robot is designed for interaction with and use by children. You, the parent or guardian, use the App to set up, manage, and monitor the Robot. All information about your child is provided by you through the App, which serves as the gateway for parental consent and control. This structure is fundamental to how we approach children's privacy and data protection.

1.3. The Data Controller

For the purposes of applicable data protection laws, including the EU General Data Protection Regulation (GDPR), the data controller responsible for your personal information is:

Xorigin-ABC INC.

9036 MISSION BLVD #10

RIVERSIDE, CA, 92509

United States

As the data controller, we are responsible for determining the purposes and means of processing your personal information.

2. Our Commitment to Children's Privacy

This section serves as our direct notice to parents regarding our practices for collecting, using, and disclosing personal information from children, in compliance with the U.S. Children’s Online Privacy Protection Act (COPPA) and applicable data protection laws such as the GDPR. We do not collect personal information from a child without first obtaining verifiable parental consent, where required by applicable law (e.g., under 13 under COPPA; under 16, or the lower age provided by local law, under the GDPR).

2.1. Operator Information

The operator collecting and maintaining your child's personal information is:

• Name: Xorigin-ABC INC.
• Address: 9036 MISSION BLVD #10, RIVERSIDE, CA, 92509, United States
• Email: dpo@yonbo.ai

This is the operator who will respond to all inquiries from parents concerning our privacy policies and the use of children's information.

2.2. Information We Collect from Children

We collect personal information about your child only after you, the parent, provide it through the App or when it is generated through your child's interaction with the Robot. The types of personal information we collect include:

• Identifiers and Profile Information: Your child's name, nickname, gender, date of birth, and education level, which you provide when creating their "AI Character" profile.
• Biometric Data (with Explicit Consent): A facial photograph of your child, which you can choose to upload to enable the Robot's face recognition wake-up feature. This is sensitive personal information.
• Audio Data: In its active state, the robot's microphones are on. Voice recordings of conversations between your child and the Robot are processed in real-time, converted into text transcripts, and then sent to our cloud servers. This data is essential for the voice interaction feature and for generating summaries and analyses for you.
• Visual Data: The Robot's camera may capture photographs of its surrounding environment. This is used to enable AI multimodal features, such as recognizing objects your child shows the Robot, which allows for a more interactive and context-aware experience.
• Usage and Activity Data: Information about your child's interactions with the Robot, such as the number of conversations, topics discussed, and games played. This is used to generate the "Activity Log" for your review.
• Inferred Data: We may analyze conversation data to generate insights for you, such as a potential MBTI personality type or mood analysis.

2.3. How We Use Children's Information

We use the personal information collected from your child for the following purposes:

• To Personalize the Experience: To create and maintain your child's unique AI Character, which develops a memory of conversations and topics to provide a more engaging and supportive companionship experience.
• To Provide Core Functionality: To enable voice interaction, face recognition (if activated), multimodal recognition, storytelling, and interactive games.
• To Provide Insights for Parents: To generate the Activity Log and psychoanalytical reports (such as MBTI analysis and mood summaries) that help you better understand your child's interactions and well-being.
• To Improve Our Services: To analyze usage data to improve the Robot's performance, safety features, and conversational abilities. This may include using anonymized or aggregated data to train our AI models.

2.4. Our Practices for Disclosing Children's Information

We do not sell children's personal information, and we do not make it publicly available. We only disclose children's personal information to the following categories of third parties under strict confidentiality and data protection terms:

• Service Providers: We use third-party vendors to provide essential services like cloud hosting (e.g., Microsoft Azure) and technical infrastructure. These providers are contractually prohibited from using the data for any other purpose.
• AI Technology Partners: Certain AI features, such as advanced natural language processing, are powered by third-party AI service providers (e.g., OpenAI). We have entered into Data Processing Agreements (DPAs) with these partners that contractually obligate them to protect the data and only process it according to our instructions.
• As Required by Law: We may disclose information if required by law, such as in response to a court order or subpoena.

2.5. Verifiable Parental Consent

Before we collect, use, or disclose any personal information from your child, we require your verifiable parental consent. We obtain this consent when you register for our Services and set up your account. For the collection of sensitive information, such as your child's facial photograph for the recognition feature, we will ask for your separate, explicit consent via a clear pop-up notice in the App.

2.6. Parental Rights and Choices

As a parent, you have full control over your child's personal information. You have the right to:

• Review the personal information we have collected from your child.
• Direct us to delete the personal information we have collected from your child.
• Refuse to permit the further collection or use of your child's personal information.

You can exercise these rights at any time through the "AI Character Management" and "Settings" sections of the App. For example, you can disable the face recognition feature (which will also delete the associated photo) or delete the entire AI Character profile, which will remove all associated personal information. You can also contact us directly at dpo@yonbo.ai to make these requests.

3. Personal Information We Collect and Process

The tables below provide a transparent overview of the personal information we have collected over the past 12 months, its sources, and the purposes for which we process it, in line with the disclosure requirements of the California Consumer Privacy Act (CCPA).

Table 3.A: Information We Collect from Parents (Account Holders)

Table 3.B: Information We Collect About Children (via Parent and Robot)

4. Lawful Basis and Purpose for Using Personal Information (GDPR Focus)

We only process your personal information when we have a valid legal basis to do so under the GDPR. Our lawful bases include:

• 4.1. Performance of a Contract: We process personal information that is necessary to provide the Services you have requested. This includes creating your account, processing your payments, and delivering the core functionalities of the App and Robot.
• 4.2. Legitimate Interests: We process some information for our legitimate business interests, such as for service improvement, analytics, and security. We only rely on this basis when we have balanced our interests against your rights and freedoms, particularly those of your child.
• 4.3. Your Explicit Consent: For processing special categories of personal data, such as your child's facial photograph (biometric data), we rely on your explicit consent, which you provide through a specific, clear affirmative action in the App. We also rely on your consent for sending marketing communications and placing non-essential cookies.
• 4.4. Legal Obligation: We may process your information to comply with our legal and regulatory obligations, such as responding to valid requests from law enforcement or government authorities.

5. Disclosure and Sharing of Personal Information

We do not sell your or your child's personal information. We only share personal information in the following circumstances:

• 5.1. Service Providers: We engage third-party companies to perform functions on our behalf, such as cloud hosting (Microsoft Azure), data analytics, and customer support. They are contractually bound to process your information only on our instructions and to implement appropriate security measures.
• 5.2. AI Technology Partners: To provide advanced AI functionalities, we may share conversation data (in a way that does not directly identify your child) with our AI technology partners (such as OpenAI). We have robust Data Processing Agreements (DPAs) in place with these partners that contractually restrict them from using this data for their own purposes and require them to uphold strict confidentiality and security standards.
• 5.3. Family Members You Invite: When you use the "Bind Member" feature to share access to the Robot with other family members, we will share basic device information and your invitation with the person you invite, allowing them to view the Robot's Activity Log.
• 5.4. Business Transactions & Legal Requirements: We may disclose your information in connection with a merger, acquisition, or sale of assets, or if we believe in good faith that disclosure is necessary to comply with a legal obligation or protect our rights and safety.

6. Artificial Intelligence and Your Data

Transparency about our use of artificial intelligence is a core commitment.

• Automated Analysis and Profiling: We use automated AI systems to analyze conversation data to generate the insights provided to you, such as the MBTI personality analysis and daily mood summaries. Under GDPR, this may be considered "profiling". We want to be clear that these insights are provided for your information only. They are not used to making any automated decisions that would have a legal or similarly significant effect on your child.
• Your Control: You have control over this data by deleting the entire AI Character profile through the App, which will remove the underlying data from our active systems and prevent it from being used in future analyses.

7. Data Security, Integrity, and Retention

7.1. Our Security Measures

We have implemented appropriate technical and organizational security measures designed to protect the personal information we collect from unauthorized access, disclosure, alteration, and destruction. These measures include:

• Encryption: Using industry-standard SSL/TLS encryption for all data transmitted between the App, the Robot, and our servers. We also encrypt sensitive data, such as account passwords and facial recognition data, at rest in our databases.
• Access Controls: Implementing strict role-based access controls to ensure that only authorized personnel with a legitimate business need can access personal information.
• Security Audits: Regularly conducting security assessments and vulnerability scans to identify and remediate potential risks.

While we take data security seriously, no system is impenetrable. We cannot guarantee absolute security. The security of your account also depends on you protecting your password.

7.2. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, to comply with our legal obligations, and to resolve disputes.

• Parent Account Information: Retained for as long as your account is active. Upon account deletion, we will delete this information in accordance with our policies, subject to any legal retention requirements.
• Child's AI Character and Conversation Data: Retained to provide the long-term memory and personalized experience of the Robot. You can delete the entire AI Character profile at any time through the App. If you delete the AI Character, all associated personal information, including the facial photo and conversation history, will be permanently deleted from our active systems.
• Facial Recognition Data: The facial photograph you upload is deleted immediately if you disable the face recognition feature or delete the corresponding AI Character profile.

8. Global Data Storage and International Transfers

We operate globally, which means your personal information may be transferred to, stored, and processed in countries other than your own, including the United States. These countries may have data protection laws that are different from the laws of your country.

We take appropriate safeguards to ensure that your personal information remains protected in accordance with this Privacy Policy. For individuals in the European Economic Area (EEA), UK, and Switzerland, we provide specific details on our transfer mechanisms in the "Region-Specific Disclosures" section below.

9. Your Privacy Rights and Choices

You have certain rights and choices regarding your personal information. These rights can be exercised through the settings in your App or by contacting us. The specific rights available to you depend on your region and are detailed in the section below.

10. Region-Specific Disclosures

10.1. For Residents of the European Economic Area (EEA), UK, and Switzerland

If you are a resident of the EEA, UK, or Switzerland, you have the following rights under the GDPR:

• Lawful Basis: As detailed in Section 4, our legal bases for processing your data include the performance of our contract with you, our legitimate interests, your explicit consent, and compliance with legal obligations.
• Your GDPR Rights: You have the right to:
  • Access your personal data.
  • Rectify inaccurate personal data.
  • Erasure of your personal data ('right to be forgotten').
  • Restrict the processing of your personal data.
  • Data Portability (receive your data in a machine-readable format).
  • Object to the processing of your personal data, including for profiling.
  • Withdraw consent at any time where consent is our lawful basis.
  • Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you.
• Data Protection Officer (DPO): We have appointed a Data Protection Officer. You can contact our DPO with any questions or to exercise your rights at dpo@yonbo.ai.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.
• International Data Transfers: Your personal information will be processed in the United States and other countries outside of the EEA, UK, and Switzerland. To ensure your data is protected, we rely on legal transfer mechanisms such as Standard Contractual Clauses (SCCs) approved by the European Commission for transfers of data to our service providers in the United States.

10.2. For Residents of California

This section supplements our Privacy Policy to comply with the California Consumer Privacy Act (CCPA), as amended.

• Your CCPA Rights: You have the right to:
  • Know/Access: Request disclosure of the personal information we collect, use, disclose, and sell/share.
  • Delete: Request the deletion of your personal information, subject to certain exceptions.
  • Correct: Request the correction of inaccurate personal information.
  • Opt-Out of Sale / Sharing: We do not “sell” or “share” personal information as those terms are defined under applicable privacy laws. This means we do not exchange your personal information for monetary or other valuable consideration, nor do we disclose it for cross-context behavioral advertising purposes. Therefore, there is no need for you to take any action to opt out of such activities.
  • Limit Use of Sensitive Personal Information: You have the right to limit our use and disclosure of your sensitive personal information. We collect sensitive data such as your child's facial photo and your account credentials. We use this information only for necessary purposes permitted by law (e.g., to provide the face recognition feature you requested or secure your account). You can effectively limit its use at any time by disabling the feature or changing your password.
  • Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
• Disclosures for the Past 12 Months: The tables in Section 3 of this policy detail the categories of personal information we have collected, the sources from which it was collected, and the business purposes for which it was collected over the past 12 months.
• Authorized Agents: You may designate an authorized agent to make a request on your behalf. To do so, we will require written permission signed by you and may need to verify your identity directly with you. An authorized agent must implement reasonable security procedures and cannot use your information for any other purpose.
• Minors Under 16: We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

11. Contact Us

If you have any questions, comments, or concerns about this Privacy Policy or our data practices, or if you wish to exercise your rights, please contact us at:

Xorigin-ABC INC.

Attn: Privacy Office

Email: dpo@yonbo.ai