Updated: August 11, 2026

Effective: August 11, 2026

BunToon Privacy Policy

Welcome to BunToon. Shanghai Yizhitu Information Technology Co., Ltd. ("we," "us," or "our") respects and protects your privacy and personal information. This Privacy Policy explains how we collect, use, store, share, disclose, and protect your personal information when you download, install, open, browse, register, sign in to, or use BunToon and related services (collectively, the "Services").

Before using the Services, please read and understand this Privacy Policy carefully. Important information about your rights and sensitive personal information is highlighted in bold where appropriate. If you do not agree with this Privacy Policy, please do not use the Services.

This Privacy Policy explains:

1. Scope of Application2. How We Collect and Use Personal Information3. Cookies and Similar Technologies4. How We Share, Transfer, and Publicly Disclose Personal Information5. How We Store Personal Information6. Your Choices, AI Consent, and Account Deletion7. Updates to this Privacy Policy8. Protection of Minors9. Contact Us10. Other Terms

1. Scope of Application

This Privacy Policy applies to the Services provided by BunToon.

The specific Services may vary depending on your device model, operating system, app version, region, account status, and the features you use. The actual product and service features are subject to the version of BunToon and related Services that you use.

2. How We Collect and Use Personal Information

We collect and use personal information under the principles of lawfulness, legitimacy, necessity, and transparency.

2.1 Device permissions you may grant

1. Camera permissionWhen you use photo-taking or image creation features, we may request access to your camera and collect the image content you provide. If you decline this permission, you may be unable to use the related feature, but this will not affect other features that do not require camera access.

2. App tracking permission and advertising identifierWhere required by your device system or applicable rules, we may request tracking permission and collect your device advertising identifier, such as IDFA, for identity recognition, analytics, security, attribution, or service improvement purposes. If you decline this permission, you may still use core features of the Services.

3. Photo library permissionWhen you select photos from your device to create or process images, we may request access to your photo library and collect the selected image content. If you decline this permission, you may be unable to use the related feature, but this will not affect other features that do not require photo access.

4. Storage permissionWhere applicable, we may request storage access to save generated creations to your local album, cache necessary service data, or support normal app operation. If you decline this permission, you may be unable to save creations locally or use related functions.

5. Clipboard accessWhen you actively use paste-related features, we may read clipboard content to provide convenient input, invite-code recognition, link recognition, or similar functions. We do not continuously monitor or store your clipboard content in the background.

2.2 Information we collect directly

1. Information necessary for service operation and securityWhen you use BunToon, we may collect device model, operating system version, app version, network type, IP address, operation logs, Android ID, OAID, IDFV, device language, time zone, crash logs, and other information necessary to operate, secure, troubleshoot, and improve the Services.

2. Registration, authentication, and login informationYou may use guest access, mobile number login, Sign in with Apple, or other third-party login methods supported by us. When you use third-party login, you authorize us to obtain the public information necessary for login and account linking, such as nickname, avatar, email address, or third-party account identifier, subject to your authorization.

3. Photo-to-image and AI generation featuresPhoto stylization and AI generation are core features of BunToon. When you choose to use one of these features, we collect the specific photos you take, upload, or select, together with any prompt, style, editing instruction, aspect-ratio choice, or other generation parameter you provide. Photos may contain faces and other personal information visible in the image. We collect this content directly from you when you select it and submit an AI generation request.

To improve generation quality, we may perform face detection during processing to locate facial areas, facial bounding boxes, facial landmarks, optional face masks, hair masks, or similar analysis results. We use this information only for face alignment, distortion reduction, quality optimization, and completion of the generation request you initiate.

We do not use face data to identify you, authenticate your identity, build advertising profiles, or track you across apps. We do not create or store face recognition templates, biometric vectors, embeddings, or biometric profiles for identity recognition. Facial landmarks, masks, and similar analysis results are used temporarily during processing and are deleted or destroyed after processing is completed.

To produce the image you request, we process your selected photos and generation instructions on our servers and may send them to the third-party AI service providers specifically identified in Section 4.1. Depending on model availability and the feature you select, a request is sent to one applicable AI provider; it is not sent to both providers listed in this Policy. These providers process the data to interpret the image and instructions, apply the selected visual style or transformation, generate the requested output, return the output to BunToon, and maintain the security and reliability of that processing.

For clarity, the image content sent to the applicable third-party AI provider is the photo you select for the generation request, which may include a visible face and other personal information shown in the photo. We do not send facial bounding boxes, facial landmarks, face masks, hair masks, face recognition templates, biometric vectors, identity-recognition embeddings, or similar face-analysis results to OpenAI or Google.

Before BunToon sends a selected photo, prompt, or other personal data to a third-party AI service, we provide a just-in-time in-app notice that identifies the data to be sent, the applicable third-party recipients, and the purpose of the transfer, and we ask for your explicit permission. Accepting this Privacy Policy, granting camera or photo-library access, or merely opening an AI feature is not treated as permission to share your data with a third-party AI service. Unless and until you affirmatively allow the transfer, we will not send the data to that AI service and the applicable AI request will not proceed. Declining does not prevent you from using BunToon features that do not require that transfer.

We do not send your phone number, email address, Apple account identifier, advertising identifier, or BunToon login credentials to third-party AI providers as part of an image-generation request.

4. Information from third partiesWhen you use a third-party account to sign in, we may receive information from that third-party platform after your authorization, such as nickname, avatar, email address, or account identifier.

2.3 Changes in purpose

If we need to collect or use your personal information for a purpose that is not directly or reasonably related to the original purpose, we will notify you again and obtain your consent where required by applicable law.

2.4 Exceptions to consent

To the extent permitted by applicable law, we may collect and use personal information without your separate consent in the following circumstances:

1. where necessary for national security or public security;

2. where necessary for public health or major public interests;

3. where necessary for criminal investigation, prosecution, trial, or enforcement of judgments;

4. where necessary to protect your or another person's life, property, or other major lawful rights and interests and it is difficult to obtain consent;

5. where the information has been publicly disclosed by you;

6. where the information is collected from lawful public sources;

7. where necessary to enter into or perform a contract at your request;

8. where necessary to maintain the safe and stable operation of the Services;

9. where otherwise permitted by laws and regulations.

3. Cookies and Similar Technologies

Cookies and similar technologies are commonly used on the internet. When you use the Services, we may use cookies, local storage, device identifiers, or similar technologies to collect and store information.

We use these technologies mainly to ensure secure and efficient operation, verify login status, prevent fraud, improve response speed, remember preferences, and provide a smoother user experience.

We will not use cookies or similar technologies for purposes outside this Privacy Policy.

4. How We Share, Transfer, and Publicly Disclose Personal Information

4.1 Sharing and transfer

We do not share or transfer your personal information to third parties unless:

1. we have obtained your prior authorization or consent;

2. the information has been de-identified or anonymized and cannot identify you;

3. sharing is necessary to provide a feature or service you request;

4. sharing is required by laws, regulations, legal procedures, or competent authorities.

For clarity, item 3 above does not replace the separate explicit permission required before we share personal data with a third-party AI service.

Third-party AI recipients

The following third parties may receive the personal data identified below when you explicitly allow the transfer and use the applicable feature:

The photo itself may contain a visible face or other personal information. The data sent to OpenAI or Google does not include facial bounding boxes, facial landmarks, face masks, hair masks, face recognition templates, biometric vectors, identity-recognition embeddings, or similar face-analysis results.

Provider privacy information is available from OpenAI and Google. Depending on model availability and the feature you select, a request is sent to one applicable provider; it is not sent to both providers. We do not authorize these recipients to use your data for advertising, identity recognition, tracking, sale, or training a general-purpose AI model.

We may also use Shanghai Qiniu Information Technology Co., Ltd. (Qiniu Cloud) to receive, securely store, deliver, and screen the photos you upload and the images generated for you. Qiniu Cloud receives the uploaded or generated image, its storage object name, and technical request information necessary to provide storage, delivery, and security services. It does not receive the image for the purpose of training or operating a generative AI model on our behalf.

Before we authorize any service provider to receive personal data, we require it, through contractual or other binding terms, to process the data only for the disclosed purpose, apply safeguards that provide the same or equivalent protection described in this Policy, restrict access to authorized personnel, protect the data against unauthorized access or disclosure, and impose equivalent obligations on any subprocessor. We remain responsible for selecting and overseeing service providers that process personal data on our behalf.

We only provide each recipient with the data necessary for its stated purpose. If we add a new third-party AI recipient or materially change the data or purpose, we will update this Policy and the just-in-time disclosure and obtain your explicit permission before sending personal data under the new arrangement.

We do not share your photos, generated creations, face landmarks, face masks, or similar face-analysis results with unrelated third parties for advertising or identity recognition.

4.2 Business transfers

If our business is involved in a merger, acquisition, restructuring, asset transfer, bankruptcy, or similar transaction, your personal information may be transferred as part of that transaction. We will require the successor to continue protecting your personal information under standards no lower than those described in this Privacy Policy, or require the successor to obtain your consent again where required by law.

4.3 Public disclosure

We do not publicly disclose your personal information unless required by law, authorized by you, or necessary to publish limited information relating to account violations, fraud prevention, or legal compliance.

5. How We Store Personal Information

We retain personal information only for the shortest period necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

For photo-to-image and AI generation features:

1. facial landmarks, masks, and similar analysis results are temporarily used during processing and deleted or destroyed after processing is completed;

2. photos you upload or select and generated results are retained for the period necessary to provide the Services and are deleted or anonymized after the retention period expires;

3. third-party AI providers may retain request or response content only for the limited period permitted by our agreement with them and necessary to complete the request, prevent abuse, maintain security, or comply with law; we do not authorize retention for advertising, identity recognition, tracking, sale, or general-purpose AI model training;

4. if you actively delete relevant creations in the product, we will delete the corresponding data earlier where technically feasible and legally permitted.

After the necessary retention period expires, we will delete or anonymize your personal information unless otherwise required by laws or regulatory authorities.

6. Your Choices, AI Consent, and Account Deletion

You may decline permission to send personal data to a third-party AI service. If you previously gave permission, you may withdraw it through an applicable consent control made available in the Services or by contacting us at support@yitu.art. After withdrawal, we will not make new transfers based on that consent. Withdrawal does not affect processing that was lawfully completed before withdrawal. A feature that requires third-party AI processing will not be available unless you give permission for that processing, but other features that do not require the transfer remain available.

You may delete your BunToon account through the account settings page where this feature is available. After account deletion, we will stop providing account-based products and services to you and will delete or anonymize personal information related to your account in accordance with applicable laws, unless laws or regulatory requirements require a longer retention period.

7. Updates to this Privacy Policy

We may update this Privacy Policy from time to time as our Services, technology, business, or legal requirements change. Updated terms form part of this Privacy Policy.

For material changes, we will provide a more prominent notice where required, such as an in-app notice, pop-up notice, or other appropriate method. If new sensitive personal information is collected or a new processing purpose requires separate consent, we will request your consent again where required by law.

Material changes may include:

1. material changes to the purpose, type, or method of personal information processing;

2. material changes in our ownership structure or organizational structure;

3. material changes to the main recipients of shared, transferred, or publicly disclosed personal information;

4. material changes to your personal information rights and how to exercise them;

5. changes to our contact information or complaint channels.

8. Protection of Minors

If you are under 18 years old, you should read this Privacy Policy and use the Services under the guidance and consent of your parent or legal guardian.

We protect minors' personal information in accordance with applicable laws and regulations. We collect, use, share, or disclose minors' personal information only where permitted by law, with guardian consent where required, or where necessary to protect minors. If we discover that we have collected a minor's personal information without verifiable guardian consent where such consent is required, we will take steps to delete the relevant information as soon as reasonably practicable.

If you are a parent or guardian and have questions about a minor's personal information, please contact us through the channels below.

9. Contact Us

If you have questions, complaints, suggestions, requests related to personal information, or questions about this Privacy Policy, you may contact us at:

Company: Shanghai Yizhitu Information Technology Co., Ltd.Email: support@yitu.art

We will respond to your request within a reasonable period and within the period required by applicable law.

10. Other Terms

"BunToon" refers to software and services operated by Shanghai Yizhitu Information Technology Co., Ltd., including but not limited to websites, apps, mini programs, and other service carriers.

To the extent permitted by law, we reserve the right to interpret and update this Privacy Policy.