Updated: Aug. 19th, 2026

This Privacy Policy explains how SNOW Corp. ("SNOW," "we," "us," or "our") collects, uses, shares, and protects personal information in connection with the Stoala service. It applies to the Stoala mobile application and any related services where a link to this Privacy Policy is displayed (collectively, the "Service").

Stoala is a service directed exclusively at parents and other caregivers who meet the Service's minimum age requirement. It is not a service for children. Eligible users use Stoala to create and curate AI-generated stories, characters, and voices that they can then share with the children in their care. All accounts are held, and all personal information is provided, by an eligible parent or caregiver acting on their own behalf. This Privacy Policy accordingly addresses the eligible account holder.

Because the Service is intended solely for eligible parents and caregivers, access is restricted through an age verification step ("Age Gate") at the point of entry, and children are not permitted to register for or independently use the Service. See Section 8 (Children's Privacy) for details.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. Where applicable law requires, we will obtain your consent separately at the point of collection.

We may update this Privacy Policy from time to time. Material changes will be notified through the Service or by other reasonable means.

1. SCOPE OF PRIVACY POLICY

This Privacy Policy is part of the Terms of Service for the Application and includes any separate privacy notices and/or notices posted on particular pages of the Application that may provide more detail regarding the information we collect on those pages, why we need that information, and choices you may have about the ways we use that information.  No matter where your information is collected, used, transferred or stored, if it was collected through the Application, it will be subject to the terms of this Privacy Policy.

2. INFORMATION WE COLLECT

We collect and use the following categories of personal information in connection with your use of the Service.

A. Information You Provide Directly

Account Information: Stoala provides account access only through third-party login providers (such as Apple, Google, or similar sign-in services). When you sign in, we receive only a unique user identifier from the login provider. We do not directly collect an email address, password, or profile details for account creation.

Age Verification Data: At first entry to the Service, we ask you to enter your year of birth so we can verify that you meet the minimum age requirement (Age Gate). The year of birth is used only to make this eligibility determination at the point of entry and is not stored or retained. We retain only the result of this verification (pass or fail) and the timestamp.

User Content for AI Services. When you use the AI generation features, we collect:

• Photos you upload for AI character generation;
• Voice recordings you provide for AI voice generation;
• Character name (nickname of the story's protagonist), gender, and age range that you associate with the AI result;
• The AI-generated character images and AI-generated voice outputs.

Customer Service Information: When you voluntarily contact us for support or otherwise correspond with us, we collect the email address you provide (this is the only point at which we collect an email address), the contents of your inquiry, and our records of the correspondence.

B. Information Collected Automatically

Analytics Information: We use third-party analytics tools to help us measure traffic and usage trends for the Service. These tools collect information sent by your device to our Service, including the content you view and interact with, and other information that assists us in improving the Service. We collect and use this analytics information in aggregate with information from other users so that it cannot reasonably be used to identify any particular individual user.

Location Information: We infer only your general access region from your IP address (e.g., country or region level). We do not collect precise location data from your device (such as GPS coordinates). This regional information is used for purposes such as delivering region-appropriate content, analytics, and ad performance measurement.

Behavioral Advertising Information: When you use the Service, we allow third-party companies to collect certain information. These companies may utilize cookies, pixels, or other similar technologies to collect and use non-personally identifiable information in order to provide advertisements about goods and services likely to be of interest to you. To learn more or to opt out, you can visit the Digital Advertising Alliance at www.aboutads.info and the Network Advertising Initiative at www.networkadvertising.org/choices/.

Log Information: When you use the Service, we may automatically collect and store certain information in server logs. This may include:

• Information on how you interact with the Service;
• Your IP address;
• Device event information such as crashes, system activity, hardware settings, browser type, browser language, the date and time of your request, and referral URL.

Device and Usage Information: We may collect device and usage information such as:

• Precise geolocation data pertaining to your device (only upon your consent), expressed by latitude-longitude coordinates obtained through GPS tools, WiFi data, cell tower triangulation, or other techniques (collectively, "Device Geolocation Data"), linked to a device identifier such as IDFA for iOS devices or Android ID for Android devices;
• Mobile ad identifiers such as Apple IDFA (iOS) and Google Advertising ID (ADID, Android);
• Other information about your device, such as device type (e.g., tablet, smartphone), operating system, IP address, network provider, mobile carrier, mobile browser type (e.g., Firefox, Chrome, Safari), other apps and SDKs installed on the device, timestamp, time zone, and information about the speed, bearing, orientation, and altitude of the device, or other device-identifying information;
• Information about the possible relationships among your devices;
• Data about user activities (e.g., the pages you view, the time and duration of your activities in the Service) that helps us determine how you interact with content and advertising.

We may collect this information when the Service runs in the background on your device. If you do not want this information to be linked to your device, you may go to your device settings and opt out of interest-based or personalized advertising. See Section 5 (Your Choices) for details.

Local Storage and On-Device Metadata: We may access metadata and other information associated with files you provide to the Service.

Information Collection and Tracking Technologies:

Cookies (or mobile cookies): A cookie is a small file placed on your smartphone. It may be possible to refuse to accept mobile cookies by activating the appropriate setting on your smartphone. However, if you select this setting you may be unable to access certain parts of the Service.

Web Beacons: In-app web views or linked web pages of the Service may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us, for example, to count users who have visited those pages and for other related statistics.

※ Biometric feature values (transient processing). To generate the AI outputs you request, we extract facial or voice feature vectors ("biometric feature values") from your uploaded photos and voice recordings. These are processed in memory during the inference request only and are not written to any storage, cache, or backup — they are discarded immediately upon completion. Uploaded photos and voice recordings are used solely for generating AI outputs (characters and voices) and are not used to identify or authenticate you. See Section 13 (AI Services) for details.

3. HOW WE USE YOUR INFORMATION

We use the information described in Section 2 for the purposes set forth below. Where applicable law requires a specific legal basis, we rely on the bases described in Section 11 (Your Regional Privacy Rights).

A. To provide and operate the Service

• Deliver core Service features, including account setup, content playback, and personalization of stories;
• Generate AI character images from photos you upload, and generate AI voice from voice recordings you provide;
• Link the generated AI results with your personal storybooks and account;
• Provide customer support and respond to your inquiries and requests;
• Diagnose, troubleshoot, and resolve technical issues.

B. To improve and secure the Service

• Analyze usage patterns to develop, test, and improve features;
• Detect, prevent, and address fraud, abuse, security incidents, and violations of the Terms of Service;
• Verify age eligibility and enforce access restrictions (Age Gate).

C. To communicate with you

• Send Service announcements, updates, and administrative communications;
• With your permission, send marketing communications about Stoala features and events. You may opt out of marketing at any time.

D. To provide relevant advertising (where permitted)

• Show and measure the performance of interest-based advertising, subject to your device-level controls and applicable regional opt-out rights.

E. To comply with law and protect rights.

• Meet legal and regulatory obligations and respond to lawful requests;
• Enforce our Terms of Service and protect the rights, property, and safety of SNOW, our users, and the public.

※ Purposes we do NOT use your information for: We do not use uploaded photos, voice recordings, or the feature vectors derived from them to (i) identify or authenticate you as an individual, (ii) build or maintain a persistent database that links biometric feature values to identifiable individuals, or (iii) share, lease, trade, or otherwise disclose biometric feature values to any third party for profit.

4. INFORMATION SHARING AND DISCLOSURE TO THIRD PARTIES

We share your information only in the following limited circumstances.

A. Service Providers

We share information with vendors who process data on our behalf, such as analytics, customer support, payment processing (in-app purchase processing via Apple App Store and Google Play), and marketing tools. These providers are contractually required to use the information only to perform services for us, to protect it consistent with this Privacy Policy, and not to use it for their own independent purposes.

B. Advertising Partners

We may share aggregated or de-identified information, device-level information, and advertising identifiers with unaffiliated advertising partners for the purposes described in Section 3(D). See Section 6 for opt-out options.

C. Affiliates and Corporate Transactions

We may share information with SNOW's affiliates for operational purposes consistent with this Privacy Policy. In connection with any reorganization, merger, acquisition, sale of assets, joint venture, or bankruptcy proceeding, information may be transferred to the successor entity, subject to this Privacy Policy or a successor policy.

D. Legal and Safety

We may preserve or disclose information when we reasonably believe it is necessary to comply with law, regulation, legal process, or governmental request; to protect the safety of any person; to address fraud, security, or technical issues; or to protect the rights, property, or safety of SNOW, our users, or the public. Nothing in this Privacy Policy limits any legal defenses or objections you may have to a third party's (including a government's) request to disclose your information.

E. With Your Direction or Consent

We may share information at your direction or with your consent.

※ We do NOT sell biometric identifiers: We do not sell, lease, trade, or otherwise profit from photos, voice recordings, or any data derived from them for any commercial purpose beyond providing the AI generation service you requested.

5. PERSONAL INFORMATION WE SOLD OR DISCLOSED FOR A BUSINESS PURPOSE

The following categories of personal information, as defined under the California Consumer Privacy Act ("CCPA") as amended, apply to information we collect. This section helps you understand what type of information is involved and your regional rights (see Section 12).

※ Sensitive Personal Information. We do not use or disclose "sensitive personal information" (as defined under the CCPA) for purposes that would trigger a right to limit its use. Uploaded photos and voice recordings are processed solely to generate the AI outputs you request and are not used to identify individuals or to infer characteristics.

6. YOUR CHOICES ABOUT YOUR INFORMATION

Marketing Communications

You may opt out of marketing communications at any time by adjusting the notification settings within the Service or on your device. Because we do not collect an email address at account creation, marketing communications are delivered through in-app messages and push notifications only. Once you opt out, we will stop sending you promotional messages. However, we will continue to send transactional or service-related messages that are necessary to operate the Service — for example, account status notifications (such as password resets or login alerts), updates to the Terms of Service or this Privacy Policy, responses to your inquiries, and similar non-promotional communications. These are not subject to marketing opt-out because they are required to provide the Service you have signed up for.

Interest-Based Advertising

You may limit interest-based ads by enabling your device's ad-tracking limit.

• iOS: Settings → Privacy & Security → Tracking → turn off "Allow Apps to Request to Track"
• Android: Settings → Privacy → Ads → "Delete advertising ID"

You may also opt out via the Digital Advertising Alliance (www.aboutads.info) and the Network Advertising Initiative (www.networkadvertising.org/choices/). Opt-out will not block all ads, only interest-based targeting.

Location Information

Because we only infer general region from your IP address, there is no device-level precise location tracking to disable.

Push Notifications

You can deactivate push notifications by changing the notification settings within the Service or your device settings.

AI Service Content

Uploaded photos are automatically deleted immediately after the AI character image is generated, so no manual deletion is required. For the items that are retained, you may delete them at any time within the Service — this includes voice recordings (originals), generated AI outputs (character images and AI voice), and the associated metadata such as character name, gender, and age range. For details on default retention periods, refer to Section 7.

Withdrawal of Consent

Where we process your data based on your consent, you may withdraw consent at any time. In most cases you can withdraw directly within the Service — for example, by deleting the relevant content in the AI service screen or by adjusting the consent-related toggles in your account or notification settings. If the in-app option is not sufficient for your case, you may also contact us at sn_service_privacy@snowcorp.com. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Opt-Out Preference Signals (including GPC)

Global Privacy Control ("GPC") is a browser-based signal that expresses a user's request to opt out of the sale or sharing of personal information. Because Stoala is provided as a mobile application (not a browser), GPC signals are not technically received by the Service. If you wish to exercise your right to opt out of the sale or sharing of personal information under applicable law, please send a request to sn_service_privacy@snowcorp.com. We will process your request in accordance with applicable law.

7. HOW LONG WE KEEP YOUR INFORMATION

We retain personal information only as long as necessary to fulfill the purposes described in this Privacy Policy or as required by law. When retention is no longer needed, we delete or de-identify the information.

A. AI Service Data — Photos and AI Outputs

• Uploaded photo (original): deleted immediately after the AI character image is generated.
• Character name (nickname), gender, age range, and AI-generated character image: retained until you delete the item, or until you withdraw from your account, whichever comes first, and in no event longer than five (5) years.

B. AI Service Data — Voice Recordings and AI Voice Outputs

• Voice recording (original): retained for up to one (1) year from the date of collection, after which it is permanently deleted. You may delete the voice recording directly within the Service at any time, and it will also be deleted upon your withdrawal of consent or your withdrawal from your account.
• AI-generated voice output: retained until you delete the item, or until you withdraw from your account, whichever comes first, and in no event longer than five (5) years.

C. Account Data: Retained while your account is active, and destroyed upon account withdrawal (may be retained for up to 30 days after withdrawal for prevention of impersonation, fraud, or misuse).

D. Service Records and Support Inquiries

• Records of service provision: until service completion or termination;
• Customer inquiries: until resolution, retained for a reasonable period for quality and audit purposes.

E. Logs, Device, and Advertising Identifiers: Retained for the period necessary for security, fraud prevention, analytics, and legal compliance, typically up to 12–24 months depending on the category, unless a longer period is required by law.

F. Legal or Regulatory Holds: Where investigation, dispute, or legal process is pending, information may be retained until resolution or as required by applicable law.

※ Secure destruction. When retention is no longer required, we delete or permanently de-identify personal information using industry-standard methods. Electronic data is deleted from storage, and physical records, if any, are destroyed by shredding or incineration.

8. CHILDREN’S PRIVACY

Stoala is designed for eligible parents and other caregivers, not for children. The Service and this Privacy Policy address the eligible parent or caregiver as the account holder.

A. Age Verification (Age Gate)

At first entry to the Service, we verify that the user meets the minimum age requirement (17 years or older). Users who do not meet this requirement are denied access.

B. No Knowing Collection from Children Under 17

The Service is not intended for children under 17. We do not knowingly collect personal information from anyone under this age or knowingly allow them to register for the Service. If we become aware that we have inadvertently collected such information, we will promptly delete it.

C. Children Under 13 (COPPA)

Consistent with the U.S. Children's Online Privacy Protection Act ("COPPA"), we do not knowingly collect personal information from children under 13. Because our Age Gate excludes all users under 17, this requirement is satisfied by design.

D. Consumers Under 16 (CCPA)

We do not sell or share the personal information of consumers we know to be under 16 years of age. Our Age Gate excludes all users under 17, so this requirement is satisfied by design.

E. Reporting

If you believe a child under 17 has accessed the Service, please contact sn_service_privacy@snowcorp.com and we will take appropriate action, including deletion.

9. TRANSFERRING YOUR DATA

SNOW is headquartered in the Republic of Korea, and personal information collected through the Service is stored and processed in Korea. Depending on the service providers we work with (such as analytics or marketing tool vendors), limited categories of information may be processed on their own infrastructure located outside Korea.

For users in the European Economic Area, the United Kingdom, or Switzerland: personal information collected by SNOW is stored in Korea in reliance on the European Commission's adequacy decision for the Republic of Korea (adopted 17 December 2021), which recognizes Korea as providing an adequate level of data protection.

Where our service providers process information in other jurisdictions on our behalf, we require appropriate contractual and technical safeguards under our data processing agreements to ensure a comparable level of protection.

You may contact us at sn_service_privacy@snowcorp.com for additional information about our international data practices.

10. SECURITY

SNOW implements reasonable and appropriate technical, administrative, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, or destruction. These measures include:

• Encryption of personal information in transit and, where applicable, at rest;
• Access controls limiting personal information to authorized personnel with a business need;
• Regular monitoring, logging, and testing of the security of our systems;
• Employee training on data protection and confidentiality obligations.

No system is entirely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security.

11. EXTERNAL LINKS

The Service may contain links to third-party websites, applications, or services. Their information practices are governed by their own privacy policies, not by this Privacy Policy. We are not responsible for the content or practices of any third-party sites you access through the Service.

12. CALIFORNIA CONSUMER PRIVACY RIGHTS

Depending on where you reside, you may have specific rights under applicable privacy laws. To exercise any of the rights described below, contact sn_service_privacy@snowcorp.com. We will verify your identity and respond within the timeframe required by applicable law.

A. California — CCPA

If you are a California resident, you have rights under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA"), which you may exercise free of charge. For a detailed description of these rights, the categories of personal information we handle, and how to submit a verifiable consumer request, please see our separate California Consumer Privacy Notice: [LINK]

B. European Economic Area, United Kingdom, and Switzerland — GDPR / UK GDPR

Where the GDPR or UK GDPR applies, you have rights to access, rectify, erase, restrict, and port your personal data; to object to certain processing; and to withdraw consent (without affecting the lawfulness of prior processing). You also have the right to lodge a complaint with your local supervisory authority.

13. AI SERVICES

A. AI Character Generation

Stoala allows you to generate an AI character image by uploading a photo. The photo is used only to produce the character image and is not used for identification or authentication. The uploaded photo (original) is deleted immediately after the AI character is generated. The generated character image is retained until you delete it, or until you withdraw from your account, whichever comes first, and in no event longer than five (5) years.

B. AI Voice Generation

Stoala allows you to generate an AI voice by providing a voice recording. The recording is used only to produce the AI voice output and is not used for identification or authentication. The voice recording (original) is retained for up to one (1) year from the date of collection, after which it is permanently deleted. You may delete it directly within the Service at any time, and it will also be deleted upon your withdrawal of consent or your withdrawal from your account. The AI voice output is retained until you delete it, or until you withdraw from your account, whichever comes first, and in no event longer than five (5) years.

C. Processing of Biometric Feature Values

To perform the AI character and AI voice generation you request, we transiently extract feature vectors from uploaded photos and voice recordings — these include facial feature vectors and voice feature vectors that may constitute biometric identifiers under applicable law (such as facial geometry or voiceprints).

• Extraction. Facial or voice feature vectors are extracted from your inputs.
• Purpose. Solely to generate the AI output you request. Not used to identify or authenticate you.
• Method. Extracted in memory at the time of the inference request. Not written to any persistent storage, cache, or backup.
• Retention. Discarded immediately upon completion of the inference request.
• No sale/lease/trade. We do not sell, lease, trade, or otherwise profit from these feature values.
• No third-party disclosure. All processing occurs on SNOW's own infrastructure. See Section 13(E).

D. Consent and Withdrawal

Where applicable law requires, we obtain your consent before collecting a photo or voice recording for AI generation. You may withdraw your consent at any time directly within the app. Withdrawal will stop further processing of the affected information for the AI service, without affecting the lawfulness of prior processing.

E. In-House AI Processing

AI character and AI voice generation is performed entirely on SNOW's own infrastructure. Photos and voice recordings you provide (and any data derived from them) are NOT shared with, transferred to, or processed by any third-party AI model provider or external service. This design reduces exposure and keeps your inputs within our controlled environment.

F. No Use for AI Model Training

We do not use uploaded photos, voice recordings, or the AI outputs generated from them to train, develop, fine-tune, or otherwise improve any AI model. Your inputs are processed solely to generate the specific AI output you request.

14. DO NOT TRACK AND OPT-OUT PREFERENCE SIGNALS

Do Not Track ("DNT") and Global Privacy Control ("GPC") are browser-based signals that allow users to express tracking or opt-out preferences. Because Stoala is provided as a mobile application and not a browser-based service, these signals are not technically received by the Service, and we therefore do not currently respond to them within the app.

Where you wish to exercise your right to opt out of the sale or sharing of personal information under applicable law, please send a request to sn_service_privacy@snowcorp.com. We will process the request in accordance with applicable law.

15. CHANGES TO OUR PRIVACY POLICY

SNOW may modify or update this Privacy Policy from time to time, so please review it periodically.  We may provide you additional forms or notice of modifications or updates as appropriate under the circumstances.  Your continued use of the Application after any modification to this Privacy Policy will constitute your acceptance of such modification.

16. HOW TO CONTACT US

If you have questions or concerns about Stoala’s Privacy Policy or to submit a request for information, please contact us at sn_service_privacy@snowcorp.com