Released: July 15, 2026
Effective: July 15, 2026
HappyShrimp Privacy Policy
Thank you for using HappyShrimp! Before using HappyShrimp, please read this Privacy Policy carefully to learn how we collect, use, disclose, and protect your Personal Data. This Privacy Policy will also provide you with more information about the bases upon which we may lawfully collect, use, and/or disclose your Personal Data, where permitted by applicable law.
This HappyShrimp Privacy Policy ("Privacy Policy") applies to your access and/or use of the HappyShrimp services (“Services”) provided by SLEEPLESS HORIZON TECHNOLOGY PRIVATE LIMITED and available at [happyoyster.cn] and/or such other location as we may designate from time to time. By accessing and/or using any Services, you agree and consent to us and Alibaba related corporations (collectively, the "Companies") as well as their respective representatives and agents ("Representatives") (the Companies and Representatives collectively referred to as “we”, “us” or “our” hereinafter) collecting, using, disclosing, and/or sharing your Personal Data, and disclosing your Personal Data to our authorised service providers and relevant third parties in the manner and for any of the purposes set forth in this Privacy Policy.
If you do not agree with the terms of this Privacy Policy, you must not access or use any Services.
This Privacy Policy supplements but does not supersede nor replace any other consents you may have previously provided to us in respect of your Personal Data, and any consents you may have provided in connection with this Privacy Policy are cumulative and additional to any rights which we may have under applicable law to handle or process your Personal Data.
Unless otherwise specified, the Privacy Policy does not apply to any products and/or services provided by any third party independently through our Services, such as the products or websites displayed as your search results or other websites linked via our Services. We are not responsible for the privacy practices of third parties. If you access or use any third party products or services, you should check the applicable third party privacy policy to determine how they will handle any Personal Data you provide to them or which they collect from you. We are not responsible for any third party’s improper use or disclosure of any Personal Data.
This Privacy Policy will help you understand the following:
I. How Do We Collect and Process Your Personal Data
II. How Do We Use Your Personal Data
III. How Do We Use Cookies and Similar Technologies
IV. How Do We Disclose Your Personal Data
V. How’s Your Personal Data Transferred Globally
VI. How Do We Retain Your Personal Data
VII. How Do We Protect Your Personal Data
VIII. How Do We Process Children’s Personal Data
IX. Your Rights to Your Personal Data
X. How to Update the Privacy Policy
XI. How to Contact Us
I. How We Collect Your Personal Data
For the purposes of the Privacy Policy, “Personal Data” refers to any information relating to an identified or identifiable natural person. We collect Personal Data for more efficient operation and to provide you with best usage experience. The ways in which we collect Personal Data include: (a) where you provide Personal Data to us; (b) where you access or use the Services; and/or (c) where we obtain Personal Data from third parties.
Generally, we collect Personal Data in the following ways:
Data Description | Source |
Account Information: We may collect your Personal Data, such as your nickname, email address when you sign up for an account, or where you otherwise provide us with your Personal Data (such as to receive information on our Services). | Information directly provided by you to us |
User Content: We may collect Personal Data that you provide or upload when accessing or using our Services, including your prompts and other content you upload, such as text, files, images, and audio (if any), depending on the features you use. When you use the Services, we may collect information relating to the images and audio included in your User Content, including, for example, recognition of objects and scenes shown, whether audio is present and its characteristics, and text transcripts of spoken words, in order to enable special video effects, conduct content moderation, support tone operations, and carry out other operational activities that do not identify any individual. Where you use our AIGC (Artificial Intelligence Generated Content) features to generate content that includes portraits, we may analyse the materials you upload and upload facial feature points (e.g. vector points for eyes, nose and mouth) and contour lines from the input materials for portrait processing.Where you use our AIGC (Artificial Intelligence Generated Content) features to generate content that includes portraits (for example, Character Face Mode), we may analyse the materials you upload and upload facial feature points (e.g. vector points for eyes, nose and mouth) and contour lines from the input materials for portrait processing. | |
Financial information: If you use paid Services (including redeeming voucher codes and purchasing paid Services), we collect (with your consent) information relating to the relevant payment transactions. Such information may include payment card data (e.g. card account number), billing details, order information, the Services purchased, and transaction records for transactions, transfers, invoice details (e.g. legal name, tax registration number and registered address), withdrawals, rewards, tipping, and/or other identification information required to verify users and/or accounts. We use this information to process payments and to protect transaction security. | |
Feedback: We appreciate feedback, including ideas and suggestions for improvement or rating an output in response to a prompt. If you rate an output in response to a prompt—for example, by using the thumbs up/thumbs down icon—we will store the related conversation as part of your feedback. | |
Communication Information: If you communicate with us, such as via email or our pages on social media sites, we may collect Personal Data such as your name, contact information, and the contents of the messages you send. | |
Log Data: We may collect information that your browser or device automatically sends when you use our Services. This may include the brand, model, and ID of your device, your Internet Protocol (IP) address, browser type and settings, the date and time of your request,advertising identifiers, Wi‑Fi/WLAN and Bluetooth information, mobile network information, device operating system type and version, device manufacturer and model, online actions and usage records on HappyShrimp, screen resolution, RAM and storage capacity, CPU usage, language settings, app/file names,and how you interact with our Services. | Information we automatically collect during your use of the Services |
Usage Data: We may collect information about your use of the Services, such as the types of content that you view or engage with, the features you use and the actions you take, as well as your time zone, country, the dates and times of access, user agent and version, type of computer or mobile device, and your computer connection. We may also collect information such as the pages or screens you visit, time spent on each page or screen, browsing history, navigation paths, activity within particular pages, and access times and session duration. | |
Location information: We may automatically determine your approximate location (such as your country, state/province or city) based on your IP address and/or SIM-related information. | |
Cookies and similar technologies: To improve your experience, we may use cookies and similar technologies to operate our Services. For details about our use of cookies, please refer to the Section III of this Privacy Policy. | |
Analytics: We may use one or more online analytics tools that rely on Cookies to understand how users use the Services and to improve the user experience. The types and extent of Data collected may change from time to time depending on how you choose to use and interact with HappyShrimp and the country or region from which you access HappyShrimp. Where appropriate, we will notify you of such changes. | |
Cookies: Account Information: We may offer you an option to log in using your existing account with certain third-party social networking sites ("SNSs") such as Google. If you elect to do so, we may obtain your Personal Data from the SNS pursuant to your agreement with that SNS. The Personal Data we collect may depend on the privacy settings you have set with the SNS. We suggest that you check the privacy and data policies and practices of the SNS to learn how they handle Personal Data. | Information we collect from third parties |
Payment Status: When you make purchases, we use third-party payment processors to collect your card brand, desensitized card number, issuing country, funding method, the billing information and payment status |
If you provide us with any Personal Data relating to a third party (e.g. your spouse, children, parents, and/or friends), by submitting such Personal Data to us, you represent to us that you have obtained the consent of such third party to you providing us with their Personal Data, and for the collection, use and disclosure of their Personal Data for all purposes set out herein and by or for the benefit of the persons referenced herein.
You should ensure that all Personal Data submitted to us is complete, accurate, true and correct. Failure on your part to do so may result in our inability to provide you with any products and/or services you have requested.
II. How Do We Use Your Personal Data
We may collect, use, process and/or disclose your Personal Data for the purposes set out in the table below:
Purpose/Activity | Type of Personal Data | Lawful basis for processing |
To provide, maintain and facilitate our Services | - Account Information - User Content - Feedback - Financial information - Communication Information - Log Data - Usage Data - Analytics - Cookies and similar technologies - Payment Status | - To perform a service contract with you |
To send you marketing communications, where you have signed up to receive them | - Account Information - Communication Information | - Consent (where required under applicable law) |
To prevent fraud, illegal activity, or misuses of our Services, and to protect the security of our systems and Services | - Account Information - User Content - Financial information - Log Data - Usage Data - Analytics - Cookies and similar technologies | - Legitimate interests (managing the security of our Services) - Legal obligation |
To provide you with technical support, and to maintain and improve our Services | - Account Information - Feedback - Log Data - Usage Data - Analytics - Cookies and similar technologies | - Legitimate interests (managing the security of our Services) |
To improve the accuracy and quality of our services (including our AI models) | - De-identified User Content - Feedback - Analytics | - Legitimate interests (to provide you more accurate and helpful services) |
To comply with legal obligations and to protect the rights, privacy, safety, or property of our users, us, or third parties. | - Account Information - User Content - Financial information - Feedback - Communication Information - Log Data - Usage Data - Analytics - Cookies and similar technologies | - Legitimate interests (managing the security and stability of our Services) - Legal obligation |
In addition, where permitted under applicable law, we may also collect, use and disclose your Personal Data for the following purposes:
(a) responding to, processing and handling your queries, requests, feedback and suggestions, or otherwise providing customer support;
(b) verifying your identity;
(c) managing the administrative and business operations of the Companies and complying with internal policies and procedures;
(d) facilitating business asset transactions (which may extend to any mergers, acquisitions or asset sales) involving any of the Companies;
(e) making media announcements and providing responses to media queries;
(f) in connection with any claims, actions or proceedings (including but not limited to drafting and reviewing documents, transaction documentation, obtaining legal advice, and facilitating dispute resolution), and/or protecting and enforcing our contractual and legal rights and obligations;
(g) managing and preparing reports on incidents and accidents; and/or
(h) any other purpose relating to or reasonably necessary for any of the above.
In addition to the matters set forth above, subject to and in accordance with applicable law, you shall be deemed to have consented to us collecting, using, disclosing and sharing amongst ourselves your Personal Data, and disclosing such Personal Data to our authorised service providers and relevant third parties:
(a) where in response to a request for your Personal Data in connection with identified purposes, you voluntarily provide such Personal Data to us for such purpose(s) and it is reasonable that you would voluntarily provide such Personal Data; and
(b) where the collection, use and/or disclosure of your Personal Data is reasonably necessary for the conclusion and/or performance of a contract, between you and us or any other organisation entered into at your request, which may include recipients of your Personal Data not indicated in this Privacy Policy.
Further, in relation to particular products or services or in your interactions with us, we may also have specifically notified you of other purposes for which we collect, use and/or disclose your Personal Data. If so, we will collect, use and/or disclose your Personal Data for these purposes as well.
III. How Do We Use Cookies and Similar Technologies
1. Cookies and similar technologies we used
We may use cookies and similar technologies to gather information resulting from access and/or use of our Services. The technologies we use may include:
2.1 Cookies or Browser Cookies
Cookies are small text files stored in your computing or other electronic devices when you visit our website and platforms for record keeping purposes. Cookies can allow us to provide you with a personalised user experience, such as by allowing us to retrieve information which you previously provided us.
Cookies can be "Persistent" or "Session" Cookies. Persistent Cookies may remain on your personal computer or mobile device across browsing sessions, while Session Cookies are generally deleted as soon as you close your web browser. We may use both Session and Persistent Cookies for the purposes set out below:
●
Necessary / Essential Cookies
Type: Session Cookies
Purpose: These cookies are essential to provide you with our Services. They help to authenticate users and prevent fraudulent use of our Services. Without these cookies, we will not be able to provide you with the Services. We only use these Cookies to provide you with those services.
●
Cookies Policy / Notice Acceptance Cookies
Type: Persistent Cookies
Purpose: These cookies identify if users have accepted the use of cookies on Services.
●
Functionality Cookies
Type: Persistent Cookies
Purpose: These cookies allow us to remember choices you make when you use our Services, such as remembering your login details or language preference. The purpose of these cookies is to provide you with a more personal experience and to avoid you having to re-enter your preferences every time you use our Services
In addition, we may also use cookie or similar tracking technologies to analyze trends, manage website, track user behavior on the Services, and better understand how users use our Services. We automatically collect certain information to analyze cumulative trends and manage our website. The aforementioned information may include Internet Protocol (IP) address, browser type, Internet Service Provider (ISP), reference/exit pages, files you view on our website (such as HTML pages, graphics, etc.), operating system, date/time stamp and/or click-stream data.
2.2 Web Beacons
Certain sections of our services may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us, for example, to count users who have visited those pages and understand how our Services are used (for example, to assess the popularity of certain pages and services) and to improve the performance and reliability of our Services.
2. Manage cookies
You can turn on the cookie related functions or perform corresponding operations through methods to manage cookies or set cookie preferences in commonly used browser software disclosed below, and we will strictly follow your decision to use cookies and similar technologies.
Some functions of our services depend on cookies. If you do not consent to our use of cookies and similar technologies, or if you disable or delete cookies, some features of the Services may not operate as intended. You may wish to refer to the documentation provided by your web browser for information about how to manage your cookie preferences. We have included some links to documentation for commonly used browsers below for your convenience only and we disclaim all liability for the accuracy, reliability, and completeness of the information linked:
3. More information about cookies
For more information about cookie and instructions on how to set up your browser to accept, delete or disable cookies, see www.allaboutcookies.org.
IV. How Do We Disclose Your Personal Data
We may disclose your Personal Data to the following categories of recipients:
1. our affiliated companies and/or their designated service providers, who provide data processing services necessary to provide you with our Services;
2. payment processors who collect and process any payment card information you provide when making a purchase through our Services (e.g., Stripe), and who may process such payment data in accordance with their applicable privacy policies (for Stripe: https://stripe.com/privacy);
3. third party service providers and partners who provide data processing services to us as necessary to provide you with our Services, or who otherwise process Personal Data for purposes described in this Privacy Policy;
4. analytics, search engine providers or other third party service providers that assist us in delivering our products, services, websites and platforms as well as improving and optimising the same;
5. any business partner, investor, assignee or transferee (actual or prospective) to facilitate business asset transactions (which may extend to any merger, acquisition or any debt or asset sale) involving any of the Companies;
6. any competent law enforcement body, regulatory, government agency, court or other third party (such as our professional advisers) where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights or so a third party can defend theirs, or (iii) to protect your vital interests or those of any other person;
7. other users and the public. Your profile and other user-generated content (excluding private messages) may be accessible to other users of the Service and/or the general public. For example, where you choose to make your profile or other information available through the Service, others may view, collect and use that information. Such information may also be cached, copied, screen-captured, indexed or stored by third parties (including, for example, search engines). We are not responsible for any third-party use of information that you choose to make available through the Service.
8. any other person, with your consent to the disclosure.
V. How Your Personal Data May Be Transferred Globally
1. Depending on where you are located and the features of our Services which you access or use, your Personal Data may be transferred out of and processed outside of the jurisdiction in which you are located, such as to an affiliated company or third party (as explained in section IV) located overseas. These countries may have data protection laws that are different from the laws of your jurisdiction (and, in some cases, may not be as protective).
2. We generally provide the Services from Singapore, and our group companies and their designated service providers are generally located in Singapore, Indonesia and/or China. Your Personal Data if therefore generally processed in one or both of these countries.
3. We take appropriate safeguards to ensure that your Personal Data will remain protected in accordance with this Privacy Policy and applicable laws and we only transfer your data overseas in accordance with applicable law and legally valid transfer mechanisms.
VI. How Do We Store and Retain Your Personal Data
1. We host and store your Personal Data on servers in Singapore. To operate the platform and deliver the Services, we may also rely on support, engineering, content moderation and other operational teams located in various countries or regions. We implement strict internal access controls so that only authorised personnel with a legitimate need may access Data.
2. We retain the Personal Data we collect from you where we have an ongoing legitimate need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements). In certain circumstances, we may need to retain your Personal Data after your account has been deleted. The specific retention periods depend on the nature of the Personal Data and why it is collected and processed and the nature of the legal requirement. For example, we will retain your Personal Data when we have a legal obligation to do so (for example pursuant to a court order); or to deal with requests and complaints and for litigation or regulatory matters (for example, where there is an ongoing legal claim).
3. When we have no further legitimate need or legal reason to retain your Personal Data, we will either delete it in a secure manner or anonymise it such that can no longer be associated with you.The applicable retention period may vary depending on factors such as the volume, nature and sensitivity of the Data, the risk of harm from unauthorised use or disclosure, the purposes for which we process it, and any legal or regulatory requirements.
4. Certain Data may be kept after you stop using the Services where necessary to satisfy our legal obligations (for example, tax or accounting requirements).
5. Where applicable, we will delete your Data upon request unless we are required to retain it under applicable law. We may delete your Data without prior notice, and you will not be entitled to any compensation in connection with any such deletion.
6. If you have questions regarding the retention periods applicable to your Data, please contact us using the details in the “Contact Information” section of this Policy.
VII. How We Protect Your Personal Data
1. We use appropriate technical and organizational measures to protect the Personal Data that we collect, use, disclose, and process. These measures are designed to provide a level of security appropriate to the risk of processing. Specific measures we use include encrypting your Personal Data in transit and at rest; developing and implementing an Information Security Programme in accordance with a standard industry framework; employing advance malware protections; implementation of other reasonable security defences (including vulnerability management, access management and recovery/resilience measures).
2. Nevertheless, no data transmission over the internet or any wireless network can be guaranteed to be perfectly secure. As a result, while we take reasonable measures protect your Personal Data, we cannot completely guarantee the security of any Personal Data you transmit to us and you do so at your own risk. We cannot and do not guarantee security of your account, devices, or Personal Data in connection with your use of the App. Where you have created an account with us and set a password to access our App, it is your responsibility to keep this password secure and confidential.
VIII. How Do We Process Children’s Personal Data
Our Services are not directed to, or intended for, the individual under 13 years of age, or under the minimum age required by the laws applicable in your jurisdiction (the “Minimum Age”). We do not knowingly collect Personal Data from children under Minimum Age. If you have reason to believe that a child under Minimum Age has provided Personal Data to us through the Services, please contact us at Feedback@contact.happyshrimp.ai. We will investigate any notification and, if appropriate, delete the Personal Data from our systems. Users who are under 18 may use the Services only with the consent of a parent or legal guardian.
IX. Your Rights to Your Personal Data
1. Depending on the jurisdiction in which you are residing, you may have the right to:
1.1 access your Personal Data and information relating to how it is processed;
1.2 erasure or delete your Personal Data;
1.3 update or correct your Personal Data;
1.4 data portability;
1.5 restrict or object to how we process your Personal Data;
1.6 withdraw your consent; and/or
1.7 make a complaint to the data protection agency in your country.
You can exercise some of these rights through your Services account. If you are unable to exercise your rights through your account, please submit your request to Feedback@contact.happyshrimp.ai. We will respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.
X. How to Update the Privacy Policy
We may update this Privacy Policy from time to time in response to changing legal, regulatory, technical or business developments. Any changes to this Privacy Policy will be communicated by us updating the Privacy Policy accessible via the Services. The updated Privacy Policy will become immediately effective once updated or at such date as we may specify. We may also in our discretion provide notice to you changes to the Privacy Policy via such means as we deem appropriate, such as by email (sent to the e-mail address specified in your account) or by means of a notice via the Services prior to the change becoming effective. To the maximum extent permissible under applicable law, you agree to be bound by the prevailing terms of the Privacy Policy as modified from time to time. Please check back regularly for updated information on the handling of your Personal Data.
You can see when this Privacy Policy was last updated by checking the “last updated” date displayed at the top of this Privacy Policy.
XI. How to Contact Us
If you have any questions about this Privacy Policy, or have any questions, complaints or requests regarding your Personal Data, you can contact our Data Protection Officer (DPO) via the contact details set out below:
- Attention: Data Protection Officer/SLEEPLESS HORIZON TECHNOLOGY PRIVATE LIMITED
- E-mail address: Feedback@contact.happyshrimp.ai
Please note that if your Personal Data has been provided to us by a third party, you should contact such party directly to make any queries, feedback, and access and correction requests to us on your behalf.
You may withdraw your consent as provided for under the applicable law. However, if you withdraw your consent to any or all collection, use, and/or disclosure of your Personal Data for one or more purposes, depending on the nature of your request, we may not be in a position to continue to provide our products or services to you, administer any contractual relationship already in place, or perform or conclude an existing or prospective agreement. This may also result in the termination of any agreements you have with us and/or you being in breach of your contractual obligations or undertakings. Our legal rights and remedies in such event are expressly reserved.
GENERAL NOTE ON ANNEX APPLICABILITY
Each Annex below applies to HappyShrimp users located in the specified jurisdiction, supplementing the Privacy Policy above. In the event of any conflict between an Annex and the general terms of the Privacy Policy, the Annex shall supersede.
Note for Enterprise Account Users: Where HappyShrimp acts as a data processor on behalf of your enterprise (as data controller), the controller-specific obligations described in the Annexes below (such as providing legal bases for processing, responding to data subject rights requests, and determining data retention periods) are the responsibility of your enterprise. HappyShrimp will assist your enterprise in fulfilling these obligations in accordance with applicable law and your enterprise’s instructions. Enterprise Account Users should refer to their enterprise’s own privacy policy for how the enterprise meets its controller obligations under the applicable jurisdiction-specific laws.
ANNEX I.SPECIFIC TERMS FOR THE EUROPEAN ECONOMIC AREA AND UK
This Annex applies to users located in the European Economic Area (“EEA”) and UK.
1.
LEGAL BASIS OF GDPR FOR PROCESSING YOUR PERSONAL DATA
We process your Personal Data for the following purposes and based on the following legal grounds:
●
On the basis of our legitimate interests for example when required by us to conduct our business, in particular:
○
use your information to identify you and provide you with a consistent service experience throughout HappyShrimp Services;
○
use your information to respond to any comments or complaints you may send us;
○
use your information to help us maintain, improve and optimize HappyShrimp Services;
○
use data to provide personalized display services;
○
use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including disclosure of such information in connection with legal process or litigation); and
○
notify you about changes to HappyShrimp Services, where applicable.
●
On the basis of your consent:
○
providing you with information relating to HappyShrimp Services or promotional materials that may be of interest to you, or other communications;
○
place cookies and use similar technologies in accordance with the “COOKIES AND SIMILAR TECHNOLOGIES” section of the Privacy Policy and the information provided to you when those technologies are used; and
○
on other occasions where we ask you for consent, we will use the data for the purpose which we explain at that time.
●
As this might be necessary for compliance with a legal obligation that is applicable to us, such as: in response to requests by government or law enforcement authorities conducting an investigation, or to comply with the requirements imposed by applicable law or any court order.
Aggregated Personal Data refers to data that has been carefully de-identified and anonymized to ensure that it cannot be linked back to any specific individual. We may aggregate Personal Data or collect aggregated data from our users to analyze user behavior, improve features, develop new products and services, conduct research, and similar purposes, helping us make data-driven decisions to enhance the user experience. In some cases, we may also choose to share or publish this aggregated data.
From time to time, we may share or publish aggregated data like general user statistics with third parties. We collect this data through HappyShrimp Services, through cookies, and through other means described in this Privacy Policy. We will maintain and use de-identified data in anonymous or de-identified form, and we will not attempt to re-identify the data, unless required by law.
2.
TRANSFER OF PERSONAL DATA OUTSIDE OF THE EEA AND UK
To support our global operations, We store the personal information described in section “1.HOW WE COLLECT AND USE YOUR PERSONAL DATA” in servers located in Singapore.
Certain entities within the Group may be granted limited remote access to this information for functions such as system maintenance, technical support, troubleshooting, and security monitoring. Such access is limited, secure, and only granted where necessary under strict security controls and authorization protocols.
We disclose or share personal information with our affiliates, as described in “Section2. SHARING, TRANSFERRING AND DISCLOSING PERSONALDATA”. These entities may be located outside your country of residence and commit to processing information in compliance with applicable privacy laws and implementing appropriate security measures.
When we transfer your information outside of the EEA, the UK, or Switzerland, we rely on Standard Contractual Clauses (“SCCs”) approved by the European Commission to ensure your data receives a level of protection comparable to GDPR standards. To learn more about these safeguards or obtain a copy of the SCCs, you may contact our Data Protection Officer (“DPO”) via the “CONTACT INFORMATION” section of this Annex.
Regardless of processing location, we apply unified high-standard security measures (as detailed in the “Security Measures” section) and ensure all data recipients are bound by strict confidentiality and data protection obligations.
3.
CONTACT INFORMATION
If you have any questions about this Privacy Notice or would like to contact us for any reason related to our processing of personal data, please reach out to our Data Protection Officer:
- Attention: Data Protection Officer/SLEEPLESS HORIZON TECHNOLOGY PRIVATE LIMITED
- Mail: 51 Bras Basah Road #03-06, Lazada One; Singapore 18955 Singapore
ANNEX II. SPECIFIC TERMS FOR CALIFORNIAPRIVACY DISCLOSURES
This Annex applies to California residents under the California Consumer Privacy Act of 2018 (“CCPA”) and other California laws.
1.
INTRODUCTION
The CCPA grants you specific privacy rights regarding your Personal Data, as detailed in Section 5 below.
2.
CATEGORIES OF INFORMATION WE MAY COLLECT
We or the Organization collect information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device (“Personal Data”). The following categories of Personal Data may have been collected within the last twelve (12) months:
A. Identifiers, specifically include: HappyShrimp ID, email address.
B. Personal Data categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), specifically include: name, cell phone number.
C. Protected classification characteristics under California or federal law, specifically include: Gender, Birthday.
D. Internet or other electronic network activity information, such as the usage data we receive when you access or use HappyShrimp Services, specifically include: logs of audio and video communications relevant to Chat.
E. Sensory data, specifically includes: content of audio and video communications.
F. Professional or employment-related information, specifically includes: Work Experience, identity information of relevant employees (typical fields may include department, occupation, employee number, whether supervisor or not, direct supervisor, onboarding date, Organization), OKR and performance results of employees, resume information of candidates.
G. Inferences that can be drawn from any of the above categories, including your preferences and characteristics.
We obtain the categories of Personal Data listed above from the following categories of sources:
●
Information and data directly provided by you on HappyShrimp Services.
●
Information and data indirectly from you through HappyShrimp Services.
Personal Data does not include:
●
Publicly available information from government records.
●
Deidentified or aggregated consumer information.
●
Information excluded from the CCPA’s scope, like health or medical information covered by the Health Insurance Portability and Accountability Act (“HIPAA”), clinical trial data, or other qualifying research data; and Personal Data covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (“FCRA”), the Gramm-Leach-Bliley Act (“GLBA”) and the Driver’s Privacy Protection Act (“DPPA”).
For more detail on how we collect, use, disclose, and share your information, please review the general terms of the Privacy Policy.
3.
PERSONAL DATA WE MAY USE OR DISCLOSE
We may use, disclose, or sell (if authorized) the Personal Data we collect for one or more of the following business purposes:
●
To provide you with HappyShrimp Services or otherwise fulfil the reason for which you provided the information.
●
To provide support and respond to your inquiries, including investigating user-reported issues.
●
To provide, support, personalize, improve, analyze, and develop HappyShrimp Services, and to deliver content and offerings relevant to your interests.
●
To notify you about changes to our services or this policy, where applicable.
●
To carry out our obligations and enforce our rights arising from any contracts entered into between you and us.
●
To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
●
To help maintain the safety, security, and integrity of HappyShrimp Services, our databases and other technology assets, and business.
●
To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by us about our users is among the assets transferred.
●
As described to you when collecting your Personal Data or as otherwise set forth in the CCPA.
4.
PERSONAL DATA THAT WE MAY SHARE
We may share your Personal Data by disclosing it to third parties for business purposes under written contracts that describe the specific purposes, require the recipient to keep the Personal Data confidential, and prohibit use for any purpose except performing contract obligations.
As stated in the general terms of the Privacy Policy, we do not sell your Personal Data unless we obtain your consent. We do not knowingly collect Personal Data from individuals under age 16; and therefore, our Personal Data sales do not include information about individuals we know are under age 16.
In the preceding twelve (12) months, HappyShrimp has shared the following categories of Personal Data to the following categories of third parties:
Personal Data Category | Category of Third-Party Recipients
| Sales |
Depends on specific SDKs | Third-party SDKs | N/A |
5.
YOUR RIGHTS AND CHOICES
Right to Know and Data Portability
The CCPA provides California residents specific rights to know about our collection and use of their Personal Data over the past twelve (12) months (the “right to know”). Once we receive and verify your request, we will disclose to you:
●
The categories of Personal Data we collected about you.
●
The categories of sources for the Personal Data we collected about you.
●
Our business or commercial purpose for collecting or selling (if applicable) that Personal Data.
●
The categories of third parties with whom we share that Personal Data.
●
If we sold or disclosed (if applicable) your Personal Data for a business purpose, we will provide two separate lists that:
○
identify the Personal Data categories that each category of recipient purchased in connection with sales of your Personal Data; and
○
dentify the Personal Data categories that each category of recipient obtained in connection with disclosures of your Personal Data for a business purpose.
●
The specific pieces of Personal Data we collected about you (also called a data portability request).
Right to Delete
The CCPA provides California residents specific rights to delete their Personal Data that we collected and retained, subject to certain exceptions (the “right to delete”). We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:
●
Provide the service that you requested from HappyShrimp Services, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you.
●
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
●
Debug HappyShrimp Services to identify and repair errors that impair existing intended functionality.
●
Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
●
Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
●
Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
●
Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
●
Comply with a legal obligation.
Once we receive and verify your request, we will delete or de-identify Personal Data and direct our service providers to take similar action unless subject to one of these exceptions.
How to Exercise the Rights to Know or Delete
To exercise your rights to know or delete described above, please submit a request via the contact details in the “CONTACT US” section.
Only you, or someone legally authorized to act on your behalf, may make a request to know or delete related to your Personal Data.
You may only submit a request to know twice within a 12-month period. Your request to know or delete must:
●
Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Data or an authorized representative, which may include: your identification information, a signed permission authorizing the representative, and any other information permitted or recommended by the CCPA and applicable regulations.
●
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
We cannot respond to your request or provide you with Personal Data if we cannot verify your identity or authority to make the request and confirm the Personal Data relates to you.
We will only use Personal Data provided in a request to verify the requestor’s identity or authority to make the request, or to review and comply with the request.
Response Timing and Format regarding Requests to Know or Delete
We will confirm receipt of your request within fifteen (15) business days. If you do not receive confirmation within this timeframe, please contact us (see Section XI).
We endeavour to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing. We may deliver our written response by email.
Any disclosures we provide will only cover the 12-month period preceding receipt of your request. The response will also explain any reasons we cannot comply, if applicable. For data portability requests, we will provide your Personal Data in a readily usable format that allows transmission from one entity to another without hindrance.
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded, or as otherwise permitted by the CCPA. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
Personal Data Sales Opt-Out Rights
Under the CCPA, consumers have the right to direct us to not sell their Personal Data at any time (the “right to opt-out”). As stated in the general terms of our Privacy Policy, we do not sell your Personal Data of consumers unless we obtain consent for the sale. Consumers who opt-in to Personal Data sales may opt-out of future sales at any time.
To exercise your right to opt-out, you (or your authorized representative) may submit a request to us (see Section XI).
Non-Discrimination
We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:
●
Deny you goods or services.
●
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
●
Provide you a different level or quality of goods or services.
●
Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.
Other California Privacy Rights
●
Shine the Light Law Disclosure.
California’s “Shine the Light” law (Civil Code Section § 1798.83) permits Users of HappyShrimp Services that are California residents to request certain information regarding our disclosure of Personal Data to third parties for their direct marketing purposes. To make such a request, see Section XI.
●
“Do Not Track” Disclosure.
We do not monitor, recognize, or honor any opt-out or do not track mechanisms, including general web browser “Do Not Track” settings and/or signals that provide consumers the ability to exercise choice regarding the collection of personally identifiable data about an individual consumer’s online activities over time and across third-party websites or online services.
When you use HappyShrimp Services, certain third parties may use automatic information collection technologies to collect information about you or your device. They may collect information, including Personal Data, about your online activities over time and across different websites. We do not control these third parties’ tracking technologies or how they may be used. If you have questions about targeted content, you should contact the responsible provider directly.
●
Eraser Law Disclosurefor Minor Users.
If you are a user under the age of 18, California Business and Professions Code Section 22581 allows you to request and obtain removal of content or information you have publicly posted. You can send a request to remove any content or information you posted on HappyShrimp Services (see Section XI). Please notice that the removal does not ensure the complete or comprehensive removal of your posted content or information in certain circumstances.
ANNEX III. SPECIFIC TERMS FOR HONG KONG SAR
This Annex applies to users located in Hong Kong SAR (“Hong Kong”). For these Terms, the term “Personal Data” is used as it is defined in the Personal Data (Privacy) Ordinance.
DIRECT MARKETING
We may use your Personal Data for marketing and promotional purposes, including:
●
Sending or showing updates on the latest news, offers, and promotions in connection with HappyShrimp Services.
●
Sending or showing joint marketing offers about HappyShrimp Services, rewards, privileges programmes, promotional offers and related services, and invitations to events.
We may also use Personal Data to analyse our customers’ preferences and market trends and derive insights, which we may use to tailor the types of products and offers presented to you. This may involve combining Personal Data about your use of HappyShrimp Services with other information we have collected about you and other customers to establish market trends. We may provide these insights to third party partners for their marketing and promotional purposes.
We may communicate marketing, promotions, and research invitations to you by email, system message, or online banner advertisement and, as appropriate and where required, will ask for your consent or provide you with the opportunity to opt out at the time we collect your Personal Data.
You have the right to ask us not to process your Personal Data for direct marketing purposes. You can exercise this right by indicating non-consent at the point of collection, using the unsubscribe or opt-out option on any direct marketing communication, or contacting us (see Section XI).
If you choose to opt out of marketing communication, we will still send you communications about services and products we provide to you, including administrative updates and account summaries.
ANNEX IV. SPECIFIC TERMS FOR INDONESIA
This Annex applies to users located in Indonesia. For these Terms, the term “Personal Data” is used as it is defined in the Indonesia Personal Data Protection Law (Law No.27 of 2022 concerning Personal Data Protection, the “PDP Law”).
1.
AGE, PARENTAL, AND GUARDIAN CONSENT
By using HappyShrimp Services, you represent that you are at least 21 years of age or married or not under guardianship. If you are below 21 years old and you are not married, or under guardianship:
●
You must obtain approval from your parents or legal guardians; and
●
Your parents or legal guardians are responsible for
○
all your actions in connection with your use of HappyShrimp Services;
○
your compliance with this Privacy Policy; and
○
ensuring that your use of HappyShrimp Services will not, in any event, result in any violation of applicable laws and regulations relating to child protection.
If you do not have consent from your parents or legal guardians, you must cease using the HappyShrimp Services.
2.
YOUR PERSONAL DATA RIGHTS
You have the right to access, update, correct, and request the erasure or disposal of Personal Data stored on HappyShrimp’s servers from time to time in accordance with applicable data privacy laws and regulations in Indonesia.
You may withdraw your consent to HappyShrimp’s disclosure of Personal Data to third parties. Upon your request, we will cease to display, publish, transmit, disseminate, and/or open access to your Personal Data to third parties.
Please note that by requesting erasure, disposal, or withdrawing consent to disclosure and/or collection of your Personal Data, you may not be able to use some of the features and functionality of HappyShrimp Services.
To exercise these rights, please contact us (see Section XI).
3.
DATA RETENTION
We retain your Personal Data for as long as necessary to provide you with HappyShrimp Services and thereafter only as long as we have a legitimate business reason or legal obligation to do so. For full details, see Section VI of the Privacy Policy.
4.
DATA BREACH NOTIFICATION
In the event we fail to maintain the confidentiality of your Personal Data, we will notify you through the contact information provided by you or via HappyShrimp, to the extent required by applicable data privacy laws and regulations in Indonesia.
5.
CROSS-BORDER DATA TRANSFER
We may transfer your Personal Data to a controller and/or processor outside the jurisdiction of the Republic of Indonesia per following conditions:
●
When the country where the controller and/or processor receiving the transfer has a level of personal data protection at least equivalent to that stipulated in the PDP Law;
●
When there are adequate and binding personal data protection measures; or
●
When we obtain your consent for the transfer.
ANNEX V. SPECIFIC TERMS FOR THAILAND
This Annex applies to users located in Thailand. For these Terms, the term “Personal Data” is used as it is defined in the Thailand Personal Data Protection Act 2019.
1.
YOUR PERSONAL DATA RIGHTS
In accordance with the applicable data privacy laws and regulations in Thailand, you have the following rights:
●
You may withdraw your consent to the processing of your Personal Data (only when the legal basis for HappyShrimp’s processing is consent). Please be aware that if consent is required for the processing of your Personal Data, we may not be able to provide the expected service without it.
●
You may request access to, correction of, cessation of any automated processing or profiling (if applicable), discontinuation, restriction of the use or provision of, and/or erasure of your Personal Data.
●
You may request us to provide your Personal Data, stored by us in a machine-readable format, to you or a third party.
To exercise these rights, please contact us (see Section XI).
When you make a reasonable request, and when HappyShrimp cannot waive such request on the basis of a statutory obligation, HappyShrimp will process your request within no more than 30 days from the date of receipt.
2.
TRANSFER YOUR PERSONAL DATA TO A FOREIGN COUNTRY
We may send or transfer your Personal Data to a foreign country or international organization in the following circumstances:
●
Where the destination country or international organization has adequate data protection standard, and the transfer complies with rules prescribed by the Personal Data Protection Committee of Thailand;
●
Where it is for compliance with the law;
●
Where we have obtained your consent;
●
Where it is necessary for the performance of a contract to which you are a party, or to take pre-contractual steps at your request;
●
Where it is for compliance with a contract between HappyShrimp and other individuals or juristic persons for your interests;
●
Where it is to prevent or suppress a danger to the life, body, or health of you or other individuals, when you are incapable of giving consent at such time;
●
Where it is necessary for carrying out activities in relation to substantial public interest.
ANNEX VI. SPECIFIC TERMS FOR PHILIPPINES
This Annex applies to users located in the Philippines. For these Terms, the term “Personal Data” is used as it is defined in the Philippine Data Privacy Act of 2012.
1.
CRITERIA FOR LAWFUL PROCESSING OF PERSONAL DATA
The processing of Personal Data shall be permitted only if not otherwise prohibited by applicable laws, and when at least one of the following conditions exists:
●
You have given your consent;
●
The processing is necessary and related to the fulfillment of a contract with you or to take pre-contractual steps at your request;The processing is necessary for compliance with a legal obligation to which we are subject;
●
The processing is necessary to protect your vitally important interests (including life and health);
●
The processing is necessary to respond to national emergency, comply with public order and safety requirements, or fulfill functions of public authority necessarily including processing Personal Data for its mandate; or
●
The processing is necessary for legitimate interests of us or a third party to whom Personal Data is disclosed, except where overridden by your fundamental rights and freedoms under the Philippine Constitution.
2.
YOUR RIGHT AS A DATA SUBJECT
You have the right to:
●
Be informed whether your Personal Data shall be, are being, or have been processed;
●
Reasonable access to the contents, sources, recipients, processing methods, reasons for third-party disclosure, automated decision-making information (if any), and last access/modification date of your Personal Data;
●
Suspend, withdraw, or order the blocking, removal, or destruction of your Personal Data upon discovery and substantial proof that the data is incomplete, outdated, false, unlawfully obtained, used for unauthorized purposes, or no longer necessary for the purposes for which it was collected;
●
Dispute inaccuracy or error in the Personal Data and have it corrected, unless the request is vexatious or otherwise unreasonable;
●
Obtain a copy of data undergoing processing in an electronic or structured format, but only where your Personal Data is processed by electronic means in a structured and commonly used format.
To exercise these rights, please contact us (see Section XI).
ANNEX VII. SPECIFIC TERMS FOR MALAYSIA
This Annex applies to users located in Malaysia. For these Terms, the term “Personal Data” is used as it is defined in the Malaysia Personal Data Protection Act 2010.
1.
LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA
We may process your Personal Data in the following circumstances:
●
If you have given your consent to the processing of your Personal Data; or
●
If the processing is necessary
○
for the performance of a contract to which the data subject is a party;
○
for the taking of steps at the request of the data subject with a view to entering into a contract;
○
for compliance with any legal obligation to which the data user is the subject, other than an obligation imposed by a contract;
○
in order to protect the vital interests of the data subject;
○
for the administration of justice; or
○
for the exercise of any functions conferred on any person by or under any law.
2.
YOUR DATA SUBJECT RIGHTS
You are entitled to:
●
Make a written data access request, upon payment of a prescribed fee, for information of your Personal Data being processed by or on behalf of HappyShrimp, and to receive a copy in an intelligible form.
●
Make a written data correction request if your Personal Data is inaccurate, incomplete, misleading, or not up-to-date.
●
Withdraw your consent to the processing of your Personal Data by written notice.
●
Require HappyShrimp by written notice, at the end of a reasonable period, to cease or not begin processing your Personal Data where such processing is causing or likely to cause substantial and unwarranted damage or distress to you or another person.
●
Require HappyShrimp by written notice, at the end of a reasonable period, to cease or not begin processing your Personal Data for direct marketing purposes.
To exercise these rights, please contact us (see Section XI).
3.
TRANSFER OF YOUR PERSONAL DATA TO PLACES OUTSIDE MALAYSIA
We may transfer your Personal Data to a place outside Malaysia if
●
Such place is specified by Malaysia’s Digital Minister, by notification published in the Gazette;
●
You have given your consent to the transfer;
●
The transfer is necessary for the performance of a contract between you and HappyShrimp;
●
The transfer is necessary for the conclusion or performance of a contract between HappyShrimp and a third party entered into at your request or in your interests;
●
The transfer is for the purpose of legal proceedings, obtaining legal advice, or establishing, exercising, or defending legal rights;
●
We have reasonable grounds for believing that the transfer is for the avoidance or mitigation of adverse action against you, it is not practicable to obtain your written consent, and if it were practicable you would have given consent;
●
HappyShrimp has taken all reasonable precautions and exercised all due diligence to ensure the personal data will not be processed in that place in any manner that, if that place were Malaysia, would contravene the Malaysia Personal Data Protection Act 2010;
●
The transfer is necessary in order to protect your vital interests; or
●
The transfer is necessary as being in the public interest in circumstances as determined by Malaysia’s Digital Minister.
ANNEX VIII. SPECIFIC TERMS FOR BRAZIL
This Annex applies to all users located in Brazil (referred to below as “you”, “your”, “yours”), according to the Lei Geral de Protecao de Dados (the “LGPD”). For these Terms, the term “Personal Data” is used as it is defined in the LGPD.
1.
LEGAL BASIS OF LGPD FOR PROCESSING YOUR PERSONAL DATA**
We can process your Personal Data solely if we have a legal basis for such processing. Legal bases are as follows:
●
With your consent;
●
For compliance with a legal or regulatory obligation by us;
●
By the public administration, for the processing and shared use of data necessary for the execution of public policies provided in laws or regulations, or based on contracts, agreements or similar instruments;
●
For carrying out studies by research entities, ensuring, whenever possible, the anonymization of Personal Data;
●
When necessary for the execution of a contract or preliminary procedures related to a contract of which you are a party, at the request of the data subject;
●
For the regular exercise of rights in judicial, administrative or arbitration procedures;
●
For the protection of life or physical safety of you or a third party;
●
To protect the health, exclusively, in a procedure carried out by health professionals, health services or sanitary authorities;
●
When necessary to fulfill the legitimate interests of us or a third party, except when your fundamental rights and liberties requiring Personal Data protection prevail; or
●
For the protection of credit.
2.
YOUR DATA SUBJECT RIGHTS
You have the right to:
●
Obtain confirmation of the existence of processing activities on your Personal Data;
●
Access to your Personal Data;
●
Have incomplete, inaccurate or outdated Personal Data corrected;
●
Obtain the anonymization, blocking or elimination of your unnecessary or excessive Personal Data, or of Personal Data that is not being processed in compliance with the LGPD;
●
Obtain, upon your express request, portability of your Personal Data to another service or product provider, provided that our commercial and industrial secrets are protected;
●
Delete your Personal Data being processed if the processing was based upon your consent;
●
Obtain information about public and private entities with which we have shared your Personal Data with;
●
Obtain information about the possibility of denying consent and the consequences of such denial;
●
Revoke your consent at any time;
●
Submit a complaint related to your Personal Data with data protection authorities or with consumer protection bodies.
To exercise these rights, please contact us (see Section XI).
3.
INTERNATIONAL TRANSFER OF YOUR PERSONAL DATA
We are allowed to transfer your Personal Data outside of the Brazilian territory in the following cases:
●
When the transfer is to countries or international organizations that provide a level of protection of Personal Data that is adequate to the LGPD;
●
When we offer and prove guarantees of compliance with the principles, your data subject rights and the regime of data protection provided in the LGPD, in the form of:
○
specific contractual clauses for a given transfer;
○
standard contractual clauses;
○
binding corporate rules;
○
regularly issued stamps, certificates and codes of conduct;
●
When the transfer is necessary for international legal cooperation between public intelligence, investigative and prosecutorial agencies, in accordance with the instruments of international law;
●
When the transfer is necessary to protect the life or physical safety of you or of a third party;
●
When the national authority authorizes the transfer;
●
When the transfer results in a commitment undertaken through international cooperation;
●
When the transfer is necessary for the execution of a public policy or legal attribution of public service;
●
When you have given your specific, unambiguous and informed consent for the transfer; or
●
When the transfer is necessary for compliance with a legal or regulatory obligation, the carrying out of a contract or preliminary procedures related to a contract, or the regular exercise of rights in judicial, administrative, or arbitration procedures.