Privacy Policy

Effective Date: September 15, 2026

This Privacy Policy (hereinafter referred to as the “Policy”) is issued by the operator of the olétoken large model service platform (hereinafter referred to as “olétoken”, “we”, “us”, or “our”) to its individual end-users (hereinafter referred to as “you” or “User”). olétoken is an online service platform that provides large language model (“LLM”) question-and-answer services and large model API access services to individual users.

We recognize that the protection of your personal data is of fundamental importance. This Policy describes the categories of personal data we collect, the purposes and legal basis for processing such data, how we share data with upstream LLM suppliers and other third parties, the security measures we implement, the rights you enjoy with respect to your personal data, and the mechanism for resolving any disputes that may arise between you and olétoken. This Policy is formulated in accordance with applicable personal information protection laws and regulations.

By registering an account, accessing, browsing, or using the Services in any manner, you confirm that you have read, understood, and agreed to be bound by this Policy. If you do not agree with any provision of this Policy, you should cease using the Services immediately. If you are under the age of eighteen (18), you must read this Policy together with your parent or legal guardian and obtain their consent before using the Services.

Article 1 Definitions and Interpretation

For the purposes of this Policy, the following terms shall have the meanings ascribed to them below unless the context otherwise requires. Defined terms are intended to provide clarity and consistency throughout this Policy, and any reference to a defined term shall carry the same meaning wherever it appears.

“Services” means the large language model question-and-answer services, large model API access services, and any related ancillary services provided by olétoken to individual users through the Platform, including but not limited to conversational AI interactions, text generation, code generation, and API-based model invocation.

“Platform” means the olétoken website, mobile applications, mini-programs, API endpoints, and any other online channels through which the Services are made available to you.

“Personal Data” means any information relating to an identified or identifiable natural person, including but not limited to name, contact information, account credentials, device identifiers, location data, transaction records, and behavioral data, whether collected directly from you or generated automatically during your use of the Services.

“Sensitive Personal Information” means personal information that, once leaked or illegally used, may lead to infringement of personal dignity or harm to the safety of person or property of the natural person, including but not limited to passwords, biometric data, financial account information, and other information designated as sensitive under applicable laws.

“Processing” means any operation performed on Personal Data, whether or not by automated means, including collection, storage, organization, retrieval, use, transmission, provision, disclosure, alteration, erasure, or destruction.

“Data Controller” means the entity that independently determines the purposes and means of Processing Personal Data. For the purposes of this Policy, olétoken acts as the Data Controller with respect to your Personal Data.

“HKIAC” means the Hong Kong International Arbitration Centre.

Headings are for convenience only and shall not affect the interpretation of this Policy. References to a statute include any subordinate legislation made under it and any modification or re-enactment of it. The singular includes the plural and vice versa, and reference to one gender includes all genders.

Article 2 Data Controller

olétoken, as the operator of the Platform, is the Data Controller responsible for the collection, use, disclosure, and protection of your Personal Data described in this Policy. We determine, independently and jointly with our upstream LLM suppliers where applicable, the purposes and means of Processing your Personal Data in connection with the provision of the Services.

If you have any questions, requests, or complaints regarding the Processing of your Personal Data, you may contact us using the details set forth in Article 19 (Contact Us) of this Policy. We will respond to your inquiry in accordance with applicable legal timeframes.

Article 3 Personal Data We Collect

In order to provide, maintain, and improve the Services, we collect Personal Data from you through the means described in this Article. The Personal Data we collect is organized into the following categories. Some fields are collected upon the launch of the Services, while others are collected during subsequent phases (Phase II) as indicated in the tables below. We will only collect Personal Data that is necessary for the stated purposes and will not collect data in excess of what is required.

3.1 Basic Identity Information

We collect basic identity information to establish your user profile, verify your identity, and enable core account functionalities. This category includes your nationality, mobile number, email address, postal address, and postal code. The nationality, postal address, and postal code fields are scheduled for collection during Phase II of the Platform launch and will be used for billing, invoicing, and account management purposes.

3.2 Account and Authentication Information

We collect account and authentication information to create and manage your account, authenticate your identity upon login, and enable third-party account binding. Your password is stored exclusively in hashed form using industry-standard cryptographic algorithms; we never store passwords in plaintext. Third-party OAuth authorization is used to enable login via GitHub and Google accounts, streamlining the registration and authentication process.

3.3 Device and Network Information

When you access or use the Services, we automatically collect certain device and network information to ensure system stability, optimize user experience, perform troubleshooting, and prevent fraud or abuse. This information is collected through automated technical means and does not require separate user action. Device identifiers such as IMEI, IDFA, GAID, and Android ID are used to distinguish unique devices for security and analytics purposes.

3.4 Location Information

We collect coarse-grained location information derived from your IP address to provide region-appropriate Services, comply with legal obligations, and optimize content delivery. This location information is at the city or regional level and is not precise GPS-level positioning. Wi-Fi or cell tower-based location may also be collected where you have granted the corresponding permission to the Platform application.

3.5 Financial and Transaction Information

Financial and transaction information is collected to enable paid Services, process payments, issue invoices, and maintain accurate financial records.

3.6 Behavioral and Usage Data

We collect behavioral and usage data to understand how you interact with the Services, identify areas for product improvement, optimize model performance, and enhance overall user experience. This data is collected automatically through automated technical means during your use of the Services and includes browsing history, search history, click and interaction logs, dwell time, purchase preferences, usage frequency metrics, and crash or performance logs.

3.7 Other Information

We may also collect other categories of information that you voluntarily provide or that are generated through your interactions with our customer support and feedback channels. This includes user feedback and complaints, customer service communication records, survey and questionnaire responses, and data collected through cookies and similar technologies. These data categories help us understand your needs, resolve issues, and continuously improve the quality of the Services.

Article 4 How We Collect Your Personal Data

We collect your Personal Data through the following methods. The specific collection method for each data field is indicated in the tables under Article 3 of this Policy. We will only collect Personal Data through lawful and fair means and will not obtain your Personal Data through deception, coercion, or other unlawful methods.

4.1 Information You Provide

You provide certain Personal Data directly to us when you register an account, complete your profile, top up your account balance, submit feedback or complaints, participate in surveys, or otherwise interact with the Platform. This includes your email address, mobile number, password, postal address, bank card number, invoice information, and any other information you voluntarily submit through forms or input fields.

4.2 Information Automatically Collected

When you access or use the Services, our systems automatically collect certain Personal Data through technical means, including but not limited to your Account ID, device identifiers, IP address, browser type and version, operating system, network type, location information derived from your IP address, browsing history, search history, click and interaction logs, dwell time, usage frequency, and crash or performance logs. This automated collection is necessary for the proper functioning, security, and improvement of the Services.

4.3 Information Obtained from Third Parties

Where you choose to log in to the Platform using a third-party account such as GitHub or Google, we obtain certain Personal Data from such third-party providers pursuant to the authorization you grant. The scope of Personal Data obtained from third parties is limited to what is necessary for account authentication and basic profile creation, and is subject to the privacy policy and authorization scope of the respective third-party provider. We do not collect any additional Personal Data from third parties beyond what you have authorized.

Article 5 Purposes and Legal Basis of Processing

We process your Personal Data only for specific, explicit, and legitimate purposes and shall not process your Personal Data in a manner incompatible with those purposes. The purposes for which we process your Personal Data, together with the corresponding legal basis under applicable personal information protection laws, are set forth below.

5.1 Provision of the Services

We process your account information, authentication credentials, device and network information, and behavioral and usage data for the purpose of providing, maintaining, and improving the Services, including account registration and login, identity verification, service delivery, billing and payment processing, technical support, and troubleshooting. The legal basis for such Processing is the performance of the contract between you and olétoken for the provision of the Services.

5.2 Service Improvement and Optimization

We process behavioral and usage data, crash and performance logs, and device and network information to analyze user behavior, identify usage patterns, optimize model performance, improve Service quality, and develop new features. The legal basis for such Processing is our legitimate interests in improving and optimizing the Services we provide to you and other users.

5.3 Security and Fraud Prevention

We process device identifiers, IP addresses, location information, and account information to detect, prevent, and respond to fraud, abuse, unauthorized access, and other security threats, as well as to comply with our legal obligations regarding cybersecurity and data security. The legal basis for such Processing is our legitimate interests in protecting the security of the Platform and our users, and our compliance with applicable legal obligations.

5.4 Customer Support and Communication

We process your contact information, feedback and complaints, customer service records, and survey data to respond to your inquiries, resolve disputes, provide technical support, and gather your opinions for Service improvement. The legal basis for such Processing is the performance of the contract and our legitimate interests in maintaining effective communication with our users.

5.5 Payment and Billing

We process your bank card number, payment account information, transaction records, and invoice information to process payments, issue invoices, maintain financial records, and handle refunds or chargebacks. The legal basis for such Processing is the performance of the contract and our compliance with applicable financial and tax regulations. These Processing activities will commence upon the launch of Phase II paid Services.

5.6 Your Consent

Where we process your Personal Data for purposes that are not necessary for the performance of the contract or otherwise permitted under applicable laws without consent, we will obtain your separate explicit consent prior to such Processing. You have the right to withdraw your consent at any time, and withdrawal of consent shall not affect the lawfulness of Processing conducted prior to such withdrawal.

Article 6 Sensitive Personal Information

Certain categories of Personal Data collected by olétoken are classified as Sensitive Personal Information under applicable laws, including but not limited to your hashed password, bank card number, and payment account information. The leakage or misuse of such Sensitive Personal Information may result in harm to your personal dignity or to the safety of your person or property. We therefore apply enhanced protection measures to such data.

We shall not collect your Sensitive Personal Information without obtaining your separate explicit consent. When seeking your consent, we will provide you with clear information regarding the necessity of collecting such Sensitive Personal Information and the potential impact on your personal rights and interests. You have the right to refuse to provide Sensitive Personal Information; however, please be aware that certain Services, particularly paid Services and payment-related functionalities, may not be available to you if you choose not to provide the relevant Sensitive Personal Information.

Sensitive Personal Information is stored using enhanced encryption and access control measures. Access to such data is restricted to authorized personnel with a legitimate need to know, and all access is logged and monitored. We conduct regular security assessments and audits to ensure the continued protection of your Sensitive Personal Information.

Article 7 Upstream LLM Suppliers and Third-Party Sharing

As described in the introduction to this Policy, the models and computing power underlying the Services are provided to olétoken by upstream LLM suppliers pursuant to commercial agreements. In order to deliver the Services, it is necessary for us to share certain of your Personal Data with such upstream LLM suppliers. This Article describes the circumstances under which we share your Personal Data and the safeguards we implement.

7.1 Upstream LLM Suppliers

When you submit a prompt, query, or API request through the Services, the content of your request, together with the minimum necessary metadata (such as your Account ID and session identifier), may be transmitted to our upstream LLM suppliers for the purpose of generating the model response. Upstream LLM suppliers act as processors or sub-processors on behalf of olétoken and are contractually bound to process your Personal Data solely for the purpose of providing the model inference services to olétoken and in accordance with applicable data protection laws.

We select our upstream LLM suppliers through a due diligence process that evaluates their technical and organizational security measures, data protection practices, and compliance with applicable laws. We enter into written data processing agreements with each upstream LLM supplier that define the scope of Processing, confidentiality obligations, security requirements, and restrictions on secondary use of your Personal Data. Upstream LLM suppliers are prohibited from using your Personal Data for any purpose other than providing the agreed services to olétoken.

7.2 Third-Party Service Providers

We engage third-party service providers to support various aspects of our operations, including but not limited to cloud infrastructure providers, payment processors, analytics providers, customer support tools, and email delivery services. These providers may have access to your Personal Data solely for the purpose of performing services on our behalf and are contractually obligated to protect the confidentiality and security of your Personal Data.

7.3 Third-Party OAuth Providers

Where you choose to log in to the Platform using a third-party account such as GitHub or Google, your Personal Data will be shared between olétoken and the respective third-party provider in accordance with the authorization you grant. The Processing of your Personal Data by such third-party providers is governed by their respective privacy policies, and we encourage you to review those policies before authorizing access.

7.4 Legal Disclosures

We may disclose your Personal Data to competent governmental or regulatory authorities, law enforcement agencies, or other third parties where such disclosure is required by applicable laws, regulations, legal process, or governmental requests, or where necessary to protect the rights, property, safety, or security of olétoken, our users, or the public. We will disclose only the minimum Personal Data necessary to comply with such requirements.

7.5 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or similar transaction involving olétoken, your Personal Data may be transferred to or shared with the successor entity as part of the transaction. We will notify you of any such transfer and ensure that the successor entity is bound by obligations no less protective than those set forth in this Policy.

Article 8 Cross-Border Transfer of Personal Data

Given that our upstream LLM suppliers and certain third-party service providers may be located outside the jurisdiction in which you reside, your Personal Data may be transferred to, stored in, or processed in countries or regions other than your country of residence. We will only transfer your Personal Data across borders where necessary for the provision of the Services and in compliance with applicable cross-border data transfer laws and regulations.

Where cross-border transfer of your Personal Data is subject to specific legal requirements, we will implement appropriate safeguards, which may include entering into standard contractual clauses, obtaining your separate consent, conducting personal information protection impact assessments, or completing required governmental filings or certifications. We will ensure that the level of protection afforded to your Personal Data after cross-border transfer is not undermined and remains substantially equivalent to the protection described in this Policy.

You may contact us using the details in Article 19 (Contact Us) to obtain a list of the countries or regions to which your Personal Data may be transferred, the purposes of such transfers, and the safeguards we have implemented. We will provide such information in accordance with applicable legal requirements.

Article 9 Data Retention

We retain your Personal Data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements, and to establish, exercise, or defend against potential legal claims. The specific retention periods for different categories of Personal Data are determined based on the nature of the data, the purposes of Processing, and applicable legal requirements.

9.1 Account Information

We retain your account information, including your username, Account ID, email address, and authentication credentials, for the duration of your use of the Services and for a reasonable period thereafter to allow for account reactivation, dispute resolution, and compliance with legal obligations. Upon your request for account deletion, we will delete or anonymize your account information within a reasonable period, except where retention is required by applicable laws.

9.2 Transaction and Financial Records

We retain your transaction records, bank card information, payment account information, and invoice information for the period required by applicable tax, accounting, and financial regulations, which may extend beyond the termination of your account. Such records are retained in encrypted form with restricted access.

9.3 Behavioral and Usage Data

We retain behavioral and usage data, including browsing history, search history, click and interaction logs, dwell time, and usage frequency, for a period necessary to achieve the purposes of product improvement and analytics, after which such data is aggregated, anonymized, or deleted. Crash and performance logs are retained for a shorter period sufficient for troubleshooting and security analysis.

9.4 Customer Service Records

We retain customer service communication records, user feedback, and complaints for a period necessary to resolve your inquiries, maintain service quality, and respond to potential disputes. Survey data is retained for the period necessary to analyze and act upon the results.

9.5 Deletion and Anonymization

Upon expiration of the applicable retention period, we will delete your Personal Data or render it anonymous in such a manner that it can no longer be associated with you. Where deletion is not technically feasible or is prohibited by law, we will continue to store the Personal Data securely and restrict its Processing to the minimum necessary for compliance purposes.

Article 10 Data Security

We implement appropriate technical and organizational measures to protect your Personal Data against unauthorized access, alteration, disclosure, destruction, or other unlawful Processing. The specific measures we implement are designed to provide a level of security appropriate to the nature, scope, context, and purposes of Processing, as well as the risks of varying likelihood and severity to your rights and freedoms.

10.1 Technical Measures

We employ industry-standard security technologies, including but not limited to encryption in transit using TLS/SSL protocols, encryption at rest for stored Personal Data, hashed storage of passwords using strong cryptographic algorithms, firewalls, intrusion detection and prevention systems, regular security vulnerability scanning and penetration testing, and access controls based on the principle of least privilege. Sensitive Personal Information is subject to enhanced encryption and access restrictions.

10.2 Organizational Measures

We maintain internal policies and procedures governing the access, use, and disclosure of Personal Data. Access to your Personal Data is restricted to authorized personnel who require such access for the performance of their duties, and all access is logged and monitored. We conduct regular training for our personnel on data protection, information security, and privacy practices. We have established an incident response plan to address any suspected or actual Personal Data breaches.

10.3 Personal Data Breach Notification

In the event of a Personal Data breach that is likely to result in a risk to your rights and freedoms, we will, to the extent required by applicable laws, notify the competent regulatory authorities and affected users without undue delay. Such notification will include the nature of the breach, the categories and approximate number of data subjects and Personal Data records concerned, the likely consequences, and the measures taken or proposed to address the breach and mitigate its adverse effects.

10.4 Limitations

While we implement reasonable measures to protect your Personal Data, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee absolute security of your Personal Data, and you acknowledge that you provide your Personal Data to us at your own risk. We encourage you to take appropriate measures to protect your account credentials, including using strong passwords and not sharing your login information with others.

Article 11 Your Rights Regarding Personal Data

Subject to applicable laws, you enjoy certain rights with respect to your Personal Data processed by olétoken. This Article describes your rights and the procedures for exercising them. We will respond to your requests in accordance with applicable legal timeframes and without undue delay.

11.1 Right to Know and to Access

You have the right to know whether we process your Personal Data and, where we do, to access and obtain a copy of your Personal Data. You may request information regarding the categories of Personal Data processed, the purposes and legal basis of Processing, the categories of recipients with whom your Personal Data has been shared, the retention period, and the source of your Personal Data.

11.2 Right to Correction and Completion

You have the right to request the correction of any inaccurate or incomplete Personal Data we hold about you. Where your Personal Data is incomplete, you may request that we complete it by providing supplementary information. We will correct or complete your Personal Data without undue delay upon verification of your identity and the accuracy of your request.

11.3 Right to Deletion

You have the right to request the deletion of your Personal Data where the Processing is no longer necessary for the purposes for which it was collected, you have withdrawn your consent and no other legal basis for Processing exists, you object to the Processing and there are no overriding legitimate grounds, or the Processing is otherwise unlawful. We will delete your Personal Data without undue delay, subject to exceptions where retention is required by applicable laws.

11.4 Right to Restriction of Processing

You have the right to request that we restrict the Processing of your Personal Data in certain circumstances, including where you contest the accuracy of the data, the Processing is unlawful but you oppose deletion, we no longer need the data but you require it for the establishment, exercise, or defense of legal claims, or you have objected to Processing pending verification of our legitimate grounds.

11.5 Right to Data Portability

Where the Processing of your Personal Data is based on your consent or the performance of a contract and is carried out by automated means, you have the right to receive your Personal Data in a structured, commonly used, and machine-readable format and to transmit such data to another data controller, where technically feasible.

11.6 Right to Withdraw Consent

Where we process your Personal Data based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent shall not affect the lawfulness of Processing conducted prior to such withdrawal. However, please be aware that withdrawal of consent may result in our inability to continue providing certain Services to you.

11.7 Right to Object

You have the right to object to the Processing of your Personal Data where such Processing is based on our legitimate interests or is conducted for direct marketing purposes. We will cease Processing your Personal Data for such purposes unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where Processing is necessary for the establishment, exercise, or defense of legal claims.

11.8 Right to Account Cancellation

You have the right to cancel your account and request the deletion of your Personal Data at any time through the account settings page of the Platform or by contacting us using the details in Article 19. Upon account cancellation, we will delete or anonymize your Personal Data in accordance with the retention periods specified in Article 9, except where retention is required by applicable laws.

11.9 How to Exercise Your Rights

To exercise any of the rights described above, please contact us using the details provided in Article 19 (Contact Us). We may need to verify your identity before responding to your request and may request additional information necessary for verification. We will respond to your request within fifteen (15) business days of receipt, or such other period as may be required by applicable laws. If we are unable to comply with your request, we will provide you with an explanation of the reasons therefor.

Article 12 Cookies and Similar Technologies

We use cookies, local storage, software development kits (SDKs), and similar technologies (collectively, “Cookies”) to operate, maintain, and improve the Services, remember your preferences, analyze how you use the Services, and provide a personalized experience. Cookies are small text files stored on your device that allow us to recognize you on subsequent visits to the Platform.

12.1 Types of Cookies We Use

We use essential Cookies that are necessary for the basic functioning of the Platform, including session management and security. We also use non-essential Cookies, including analytics Cookies that help us understand how you interact with the Services, and functionality Cookies that remember your preferences and settings. We do not use Cookies for the purpose of displaying third-party advertising on the Platform.

12.2 Managing Cookies

You can manage or disable Cookies through your browser or device settings at any time. Most browsers allow you to refuse Cookies or alert you when Cookies are being sent. Please note that if you disable essential Cookies, certain features of the Platform may not function properly, and your ability to use the Services may be limited. Where required by applicable laws, we will obtain your consent before placing non-essential Cookies on your device.

Article 13 Children’s Privacy

The Services are intended for use by individuals who are at least eighteen (18) years of age, or the age of legal majority in their jurisdiction of residence. We do not knowingly collect Personal Data from children under the age of eighteen (18) without the consent of their parent or legal guardian. If you are under the age of eighteen (18), you must use the Services only with the involvement and consent of your parent or legal guardian.

If we become aware that we have collected Personal Data from a child under the applicable age of consent without parental or guardian consent, we will take reasonable steps to delete such Personal Data as soon as practicable. If you are a parent or legal guardian and you believe that we have collected Personal Data from your child without your consent, please contact us using the details in Article 19, and we will take appropriate action to address the situation.

Article 14 Links to Third-Party Websites

The Platform may contain links to websites, applications, or services operated by third parties that are not affiliated with olétoken. We are not responsible for the privacy practices or the content of such third-party websites or services. We encourage you to review the privacy policies of any third-party websites or services you visit before providing them with your Personal Data. This Policy applies solely to Personal Data collected by olétoken through the Platform and does not extend to Personal Data collected by third parties.

Article 15 Automated Decision-Making and Profiling

The Services involve the use of large language models that generate responses based on your inputs and historical interaction data. While these models may produce outputs that reflect patterns in your usage data, we do not use automated Processing to make decisions that produce legal effects or significantly affect your rights, freedoms, or legitimate interests, such as credit scoring, eligibility assessments, or employment decisions. Where automated decision-making is used for non-essential purposes, you have the right to request human intervention, express your point of view, and contest the decision in accordance with applicable laws.

Article 16 Changes to This Privacy Policy

We may update or modify this Policy from time to time to reflect changes in our practices, legal requirements, or the features of the Services. When we make material changes to this Policy, we will notify you through a prominent notice on the Platform, by email, or by other appropriate means, and we will update the “Effective Date” at the top of this Policy. We encourage you to review this Policy periodically to stay informed about how we collect, use, and protect your Personal Data.

Your continued use of the Services after the effective date of any revised Policy constitutes your acceptance of the revised Policy. If you do not agree with the revised Policy, you should cease using the Services and request the deletion of your account and Personal Data in accordance with Article 11. Where required by applicable laws, we will obtain your consent before implementing material changes that affect your rights or that introduce new Processing activities requiring consent.

Article 17 Severability

If any provision of this Policy is held to be invalid, illegal, or unenforceable by a court or tribunal of competent jurisdiction, such invalidity, illegality, or unenforceability shall not affect the validity, legality, or enforceability of the remaining provisions of this Policy, which shall remain in full force and effect. The invalid provision shall be deemed modified to the minimum extent necessary to make it valid, legal, and enforceable, while preserving the original intent of the parties to the greatest extent possible.

Article 18 Dispute Resolution

This Article sets forth the mechanism for resolving any disputes that may arise between you and olétoken in connection with the Services or this Policy. We are committed to resolving disputes in a fair, efficient, and transparent manner.

18.1 Amicable Resolution

In the event of any dispute, claim, or controversy arising out of or relating to the Services, this Policy, or your relationship with olétoken (hereinafter referred to as a “Dispute”), you and olétoken shall first attempt to resolve the Dispute amicably through good-faith negotiations. You may initiate such negotiations by contacting us using the details provided in Article 19 (Contact Us) and providing a clear description of the nature of the Dispute and the relief sought. The parties shall endeavor to resolve the Dispute within thirty (30) calendar days from the date of receipt of the written notice.

18.2 Arbitration

If the Dispute cannot be resolved amicably through negotiations within the period specified above, the Dispute shall be submitted to and finally resolved by arbitration administered by the Hong Kong International Arbitration Centre (HKIAC) in accordance with the HKIAC Administered Arbitration Rules in force at the time of the commencement of the arbitration. The following provisions shall apply to the arbitration:

(a) The seat of arbitration shall be Hong Kong Special Administrative Region of the People’s Republic of China;

(b) The arbitration shall be conducted in the English language;

(c) The arbitration shall be conducted by a sole arbitrator appointed in accordance with the HKIAC Administered Arbitration Rules. Where the amount in dispute is significant or the Dispute is complex, the parties may agree to refer the Dispute to a panel of three (3) arbitrators;

(d) The arbitration proceedings shall be conducted in a confidential manner, and the existence, content, and outcome of the arbitration shall not be disclosed to any third party except as required by applicable laws or by the rules of the HKIAC;

(e) The arbitral award shall be final and binding on both parties. Judgment upon the award may be entered and enforced in any court of competent jurisdiction in accordance with the Convention on the Recognition and Enforcement of Foreign Arbitral Awards of 1958 (the “New York Convention”) or other applicable treaties or laws;

(f) The costs of the arbitration, including the arbitrator’s fees and the administrative fees of the HKIAC, shall be borne by the parties in such proportion as the arbitrator shall determine in the award. Each party shall bear its own legal fees and expenses, except as otherwise determined by the arbitrator;

(g) Notwithstanding the foregoing, olétoken may seek interim or injunctive relief from any court of competent jurisdiction to protect its intellectual property rights, confidential information, or other proprietary rights, or to prevent irreparable harm, pending the outcome of the arbitration.

18.3 Governing Law

This Policy and any Dispute arising out of or relating to this Policy shall be governed by and construed in accordance with the laws of the Hong Kong Special Administrative Region of the People’s Republic of China, without regard to its conflict of laws principles. The application of the United Nations Convention on Contracts for the International Sale of Goods is expressly excluded.

18.4 Limitation Period

Any Dispute must be submitted to arbitration within the limitation period prescribed by the governing law. Failure to submit a Dispute to arbitration within the applicable limitation period shall constitute a waiver of the right to pursue such Dispute.

Article 19 Contact Us

If you have any questions, concerns, requests, or complaints regarding this Policy or the Processing of your Personal Data, please contact us using the following details. We are committed to addressing your inquiries in a timely and transparent manner and to working with you to resolve any issues that may arise.

Customer Support: support@oletoken.ai

We will acknowledge receipt of your inquiry within five (5) business days and provide a substantive response within fifteen (15) business days, or such other period as may be required by applicable laws. If you are not satisfied with our response, or if you believe that we have not complied with applicable data protection laws, you have the right to lodge a complaint with the competent data protection authority in your jurisdiction of residence. We encourage you to contact us first so that we may have the opportunity to address your concerns.

This Privacy Policy is provided in the English language. In the event of any inconsistency between the English version and any translated version of this Policy, the English version shall prevail to the extent permitted by applicable laws.