Stoala California Consumer Privacy Statement

Stoala California Consumer Privacy Statement

Effective: Aug. 19th, 2026

This California Consumer Privacy Statement supplements the Stoala Privacy Policy and applies solely to visitors, users, and others who reside in the State of California ("consumers" or "you"). This Statement does not apply to workforce-related personal information collected from California-based employees, job applicants, contractors, or similar individuals.

This Statement uses certain terms as defined in the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations (collectively, the "CCPA"). Capitalized terms not defined herein have the meanings given in the Stoala Privacy Policy.

1. Notice of Collection and Use of Personal Information

We may collect the following categories of personal information about you:

Identifiers: such as device identifiers; cookies, beacons, pixel tags; IDFA, ADID, and similar mobile ad identifiers; other persistent or probabilistic identifiers; online identifiers; Internet Protocol addresses; email address (collected only when you contact us with a customer inquiry); account name, and other similar identifiers.
Protected Classifications: characteristics of protected classifications under California or federal law, such as gender and age range that you voluntarily provide to configure AI characters. We do not use uploaded photos for identification or authentication, and any biometric feature values extracted during AI generation are handled as described in Section 13(C) of the Privacy Policy.
Commercial Information: records of paid content or services purchased or obtained through the Service (such as in-app purchases processed via Apple App Store or Google Play), and other purchasing or consumption histories or tendencies within the Service.
Online Activity: Internet and other electronic network activity information, including your interaction with the Stoala application and in-app advertisements.
Geolocation Data: general access region inferred from your IP address (e.g., country or region level). We do not collect precise geolocation data (such as GPS coordinates) from your device.
Sensory Information: photos and voice recordings you upload to generate AI characters and AI voices, feature vectors transiently extracted from them during AI generation, and the AI-generated outputs. See Section 13 of the Stoala Privacy Policy for details.
Inferences: inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, and behavior related to Service usage.
Sensitive Personal Information: We transiently process biometric feature values (facial and voice feature vectors) extracted from your uploaded photos and voice recordings. Such feature values may constitute Sensitive Personal Information under the CCPA. We limit our use of these feature values strictly to generating the AI output you request; we do not retain them beyond the inference request, disclose them to any third party, or use them for identification, authentication, or profit. See Section 13(C) of the Stoala Privacy Policy for details.

We may use the categories of personal information listed above for the purposes described in the Stoala Privacy Policy. In addition, we may use these categories for certain business purposes specified in the CCPA, as described below:

Purposes	Categories of Personal Information
Providing customer service, verifying customer information, processing in-app purchase records, providing targeted advertising or marketing services (with your consent where required by law), providing analytics services, or providing similar services	• Identifiers • Commercial Information • Online Activity • Geolocation Data • Sensory Information
Auditing related to a current interaction with you, including counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance	• Identifiers • Online Activity • Geolocation Data
Short-term, transient use, including the contextual customization of ads shown as part of the same interaction	• Identifiers • Online Activity • Geolocation Data
Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity	• Identifiers • Online Activity • Sensory Information
Debugging to identify and repair errors that impair existing intended functionality	• Identifiers • Online Activity • Geolocation Data
Undertaking internal research for product development and demonstration	• Identifiers • Online Activity • Geolocation Data
Undertaking activities to verify or maintain the quality or safety of a service or product that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance such service or product	• Identifiers • Online Activity • Geolocation Data • Sensory Information
Providing AI character and AI voice generation as requested by you	• Identifiers • Protected Classifications (voluntary) • Sensory Information

※ AI service inputs are not used for training. Photos, voice recordings, and derived outputs are used solely to produce the specific AI output you request and are not used to train, develop, fine-tune, or otherwise improve any AI model. AI generation is performed on SNOW's own infrastructure and is not transferred to any third-party AI model provider. See Section 13 of the Stoala Privacy Policy.

2. Our Prior Collection, Use, and Disclosure of Personal Information

As of the effective date of this Statement, we may collect, use, and share your personal information as described in Section 1. The 12-month disclosure required by the CCPA will be incorporated into this section once 12 months have elapsed from the effective date of this Statement.

Sources of Personal Information

Categories of Sources	Categories of Personal Information
Directly from you (character setup, AI service use, in-app purchases, or when you voluntarily contact us for customer support)	• Identifiers (account name; email address only when you contact us) • Protected Classifications (voluntary) • Commercial Information (in-app purchase records) • Sensory Information (photos, voice recordings)
From your devices	• Identifiers • Online Activity • Geolocation Data (region-only)
Our affiliates	• Identifiers • Online Activity
Vendors who provide services on our behalf	• Identifiers • Online Activity

Sharing of Personal Information

We may share your personal information with the following categories of third parties. Actual sharing depends on service configuration and may not occur in all cases.

Categories of Third Parties	Categories of Personal Information
Our affiliates (entities under common ownership or control with SNOW)	• Identifiers • Online Activity • Geolocation Data
Vendors who provide services on our behalf (analytics, customer support, marketing tools)	• Identifiers • Online Activity
Payment processors (Apple App Store, Google Play) for in-app purchase completion	• Identifiers • Commercial Information (in-app purchase records)
Advertising networks	• Identifiers • Online Activity • Inferences
Data analytics providers	• Identifiers • Online Activity • Geolocation Data

AI service data (photos, voice recordings, AI outputs) are not shared with any of the third parties listed above. AI generation is performed entirely on SNOW's own infrastructure.

Sale and Sharing of Personal Information

Under the CCPA:

Sale: We do not sell your personal information for monetary consideration.
Sharing (Cross-Context Behavioral Advertising): We share certain categories of personal information with advertising networks for the purpose of cross-context behavioral advertising. As of the effective date of this Statement, the following categories may be shared:
- Identifiers (device identifiers, IDFA/ADID, cookies/pixel tags, IP address, and similar online identifiers)
- Online Activity (interaction with the Stoala application and in-app advertisements)
- Inferences drawn from the above to reflect preferences and behavior

Photos, voice recordings, and AI-generated outputs are NOT sold or shared for any purpose beyond providing the AI generation service you requested.

We do not sell or share the personal information of consumers we know to be under 16 years of age. Because Stoala's Age Gate excludes all users under 17 by design, this requirement is satisfied at entry.

Disclosure of Personal Information for a Business Purpose

We may have disclosed to third parties for a business purpose the following categories of personal information:

Identifiers
Commercial Information (limited to payment processors — Apple App Store / Google Play — for in-app purchase completion)
Online Activity
Inferences
Sensory Information (limited to affiliates and service providers as necessary for security, fraud prevention, and support)

Retention of Personal Information

For information about how long we retain each category of personal information, please see Section 7 (How Long We Keep Your Information) of the Stoala Privacy Policy. In brief:

Uploaded photos: deleted immediately after the AI character is generated.
Voice recordings: retained for up to one (1) year from the date of collection, and deleted earlier upon user deletion, consent withdrawal, or account withdrawal
AI-generated outputs: up to 5 years, or until deleted or account is withdrawn (whichever comes first).
Logs and device/ad identifiers: typically 12–24 months.
Account information: retained while your account is active and destroyed upon account withdrawal (may be retained for up to 30 days after withdrawal for prevention of impersonation, fraud, or misuse).
In-app purchase records: retained as required by applicable tax, accounting, and consumer-protection laws.

※ Grace period: Where personal information is scheduled to be destroyed upon your account withdrawal, we may retain such information for up to 30 days after withdrawal for the prevention of impersonation, fraud, or misuse before final destruction.

3. California Consumer Privacy Rights

You have the following rights regarding your personal information under the CCPA.

Right to Know / Access: You have the right to request, twice in a 12-month period, that we disclose to you the personal information we have collected, used, disclosed, and sold or shared about you during the preceding 12 months, including:

The categories of personal information we collected about you;
The categories of sources from which we collected the personal information;
Our business or commercial purpose for collecting, selling, or sharing that personal information;
The categories of third parties with whom we shared that personal information;
If we sold, shared, or disclosed your personal information for a business purpose, separate lists disclosing (i) sales/shares by recipient category, and (ii) business-purpose disclosures by recipient category;
The specific pieces of personal information we collected about you (data portability request).

Right to Correct: You have the right to request that we correct inaccurate personal information we maintain about you. We will use commercially reasonable efforts to verify the accuracy of the information at issue and may request supporting documentation. If we determine the information is inaccurate, we will correct it and, where feasible, instruct our service providers to do the same.

Right to Delete: You have the right to request that we delete personal information we have collected from you. We may deny your request if retention is necessary for the exceptions permitted under the CCPA, including:

Completing the transaction for which the personal information was collected or performing our contract with you;
Detecting security incidents or protecting against malicious, deceptive, fraudulent, or illegal activity;
Debugging to identify and repair errors;
Exercising free speech or complying with legal rights of another consumer;
Complying with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et seq.);
Engaging in public or peer-reviewed scientific, historical, or statistical research in the public interest;
Enabling internal uses reasonably aligned with consumer expectations based on your relationship with us;
Complying with a legal obligation;
Making other internal and lawful uses compatible with the context in which you provided the information.

We will delete or deidentify personal information not subject to an exception from our records and will direct our service providers to do the same.

Right to Opt Out of Sale or Sharing: You have the right to opt out of the sale or sharing of your personal information at any time. "Sharing" means disclosing personal information to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration. Consumers who previously opted in may opt out of future sales or sharing at any time. We do not sell or share the personal information of consumers we know to be under 16 years of age; Stoala's Age Gate blocks all users under 17 at entry. To opt out, please email us at sn_service_privacy@snowcorp.com, or use the device-level controls described below.

iOS:
For iOS 14 and later, you can opt out of cross-app tracking via Apple's App Tracking Transparency framework: Settings > Privacy & Security > Tracking — turn off "Allow Apps to Request to Track," or deny tracking when Stoala prompts you.
More info: Here

Android:
In Google Ads settings within your Android settings, toggle "Opt out of Ads Personalization" on (path/name may vary by Android version and OEM).
More info: Here

When you opt out via device settings, advertisers will not use in-app information collected from that device to infer your interests or serve interest-based ads to that device. Opting out will not block general non-interest-based advertisements. You may opt back in at any time. You do not need to create an account to exercise your opt-out rights.

You may learn more about behavioral advertising and how to opt out at the Digital Advertising Alliance (www.aboutads.info) and the Network Advertising Initiative (www.networkadvertising.org/choices/).

Right to Limit Use of Sensitive Personal Information. Under the CCPA, you have the right to direct us to limit the use and disclosure of Sensitive Personal Information to permitted purposes. Because we process biometric feature values (which may constitute SPI) strictly to generate the AI output you request — with no persistent storage, no third-party disclosure, no use for identification or authentication, and no sale, lease, trade, or profit — our processing already conforms to the permitted-use limitation under the CCPA. If you wish to stop this processing entirely, you may withdraw your consent for the AI generation services at any time via in-app settings or by contacting sn_service_privacy@snowcorp.com.

Right to Non-Discrimination. You have the right not to receive discriminatory treatment for exercising your CCPA rights.

How to Submit a Request to Know, Correct, or Delete. We provide the following methods:

(a) Email. Send your request to sn_service_privacy@snowcorp.com.
(b) In-app self-service. In addition to submitting a formal request by email, you may exercise the following actions directly within the app at any time before scheduled destruction:
- Delete uploaded photos, voice recordings, character settings, and AI-generated outputs;
- Withdraw your consent for the AI generation services, which will stop further AI processing of the affected information.

Your request must:

Provide sufficient information to reasonably verify you are the person about whom we collected personal information (or an authorized representative);
Describe your request with sufficient detail to allow us to properly understand, evaluate, and respond.

We cannot respond to a request or provide personal information if we cannot verify your identity, your authority to make the request, and that the personal information relates to you.

You do not need to create an account to submit a request. We use personal information in the request only to verify identity/authority.

Authorized Agent. An authorized agent legally authorized to act on your behalf may submit a request. To designate an agent, provide your contact information, the agent's contact information, and a description of how and when the agent will contact us.

Response Timeframe.

Requests to Know, Correct, or Delete: We confirm receipt within ten (10) business days. We aim to substantively respond within forty-five (45) days; if more time is needed (up to another 45 days), we will notify you in writing of the reason and extension period.
Opt-Out Requests (Right to Opt Out of Sale/Sharing): We will comply as soon as feasibly possible and no later than fifteen (15) business days from receipt of the request.

No Financial Incentives. We do not offer financial incentives, price differences, or service level differences in exchange for the collection, sale, or sharing of your personal information. Any paid content or services within Stoala (such as in-app purchases) reflect the price of the content or service itself and are not tied to any personal information disclosure or opt-out choice.

Additional Information. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request. This Statement is available in alternative formats upon request; contact sn_service_privacy@snowcorp.com.