Sutyo AI Privacy Policy

Updated: August 14, 2026
Effective Date: August 14, 2026

---

Introduction

Sutyo AI (hereinafter referred to as the "App" or "we") recognizes the importance of your personal data. We strictly comply with applicable laws and regulations and adhere to industry-standard security practices to protect the security of your personal data. This Privacy Policy is intended to explain how we collect, use, store, share, and protect your personal data, as well as the rights you have regarding your personal data.

Applicability across platforms: This Policy applies to both the iOS and Android platforms. The Android Google Play version (listed as "Sutyo AI") delivers push notifications via Firebase Cloud Messaging (FCM); the iOS version delivers push notifications via Apple Push Notification Service (APNs).

Before using this App, please carefully read and fully understand this Privacy Policy. By tapping "Agree" or commencing use of this App, you acknowledge that you have understood and consent to our processing of your personal data in accordance with this Privacy Policy. If you do not agree with any provision of this Privacy Policy, please discontinue use of this App.

---

1. Information We Collect

1.1 Information You Voluntarily Provide

1.2 Information Collected Automatically During Use

1.3 Audio Data (Core · Sensitive Personal Data)

Audio recording is the core functionality of this App, and recorded audio constitutes sensitive personal data.

• Collection method: Audio is recorded via the phone's microphone.
• Purpose of use: Used for speech recognition (ASR), voiceprint recognition, and AI processing (summaries, memory, insights, conversations, etc.).
• Separate consent: Under the GDPR (General Data Protection Regulation), voiceprints constitute special category personal data (biometric data), and your explicit consent must be obtained before processing. When you first enable the recording or voiceprint recognition feature, this App will display a separate prompt to inform you and obtain your explicit consent. If you decline to consent, the relevant features will be unavailable, but this will not affect your use of other features of this App.

1.4 Derived Data from Speech Recognition and AI Processing

---

2. How We Use Collected Information

The personal data we collect will be used for the following purposes:

De-identification / anonymization: We may, on the premise that specific individuals cannot be identified and the data cannot be restored after technical processing, use de-identified data for statistical analysis, product optimization, and other purposes.

---

3. System Permissions

To provide full service functionality, this App requires the following system permissions.

3.1 Android (Google Play Version) Permissions Table

Note: This App has removed the advertising ID permission (AD_ID) and does not collect advertising identifiers. This App does not request permissions related to Bluetooth, location, or Companion Device Manager.

3.2 iOS Permissions Table

You may enable or disable these permissions at any time in your device's system settings. However, disabling required permissions will prevent the corresponding features from functioning properly.

3.3 Foreground Services Disclosure

The Android Google Play version of this App uses the following 3 foreground services:

• Purpose description: After you initiate a recording / transcription / inference task, the foreground service ensures that the task completes and no data is lost even if the App goes to the background. While the foreground service is running, a persistent notification is displayed in the system notification bar.
• Scope of data processing: The foreground service only processes the audio/text data involved in tasks you have actively initiated. It does not proactively activate the microphone, nor does it collect any data without your action.

---

4. Third-Party SDKs and Information Sharing

This App integrates the following third-party SDKs to deliver specific functionality. Details of the data collected by each SDK are as follows:

4.1 Push Notifications

4.2 App Analytics and Crash

Note: Firebase Crashlytics data collection is controlled by the user consent toggle (see "Consent Management for Data Collection"). This App does not use the advertising ID.

4.3 Speech Recognition and Audio Processing

4.4 AI Services

4.5 Data Storage

4.6 Other

Regarding Agora: The App's source code includes API endpoints for obtaining Agora RTM/RTC tokens, but this functionality is not active in the current version. This App does not provide Agora real-time audio/video services to you, nor does it collect your audio/video data through Agora.

We require the above third-party service providers to maintain confidentiality of the information they collect and to use it only for the purposes described in this Privacy Policy. We recommend that you also review the privacy policies of these third-party service providers for a comprehensive understanding of how they handle your personal data.

---

Consent Management for Data Collection

To ensure you have control over your personal data collection, this App provides the following consent management mechanisms:

Consent Options

This App seeks your consent before collecting data in the following three areas:

Note: Crash reporting serves our legitimate interest in maintaining app stability and security. Where consent is required by law (EU/EEA), we collect crash data only after you opt in. In all regions, you may disable crash reporting at any time.

Regional Differences

• EU/EEA Users: On first launch, a consent dialog is displayed with options defaulting to off. You must actively check each option to enable the corresponding data collection. This approach ensures compliance with the GDPR's requirement for freely given, specific, informed, and unambiguous consent.
• Non-EU Users: All options are enabled by default. You may disable any option at any time in Settings.

EU/EEA region detection is based on your SIM card country code or system language region setting.

How to Manage Consent

You can manage the above consent options at any time in the App under "Settings → Privacy & Security". Each option has an independent toggle. Disabling any option triggers a confirmation dialog informing you of the impact.

Withdrawing Consent

You may withdraw your consent at any time by disabling the corresponding option in Settings. Withdrawing consent does not affect the lawfulness of data collection and processing carried out based on your prior consent.

---

5. Information Storage and Protection

5.1 Storage Location

Your personal data is primarily stored on cloud servers. The Dify service used for AI processing is deployed on our self-hosted servers.

5.2 Retention Period

We retain your personal data only for the minimum period necessary to fulfill the purposes of collection, unless otherwise required by applicable laws and regulations. Once the necessary period has expired, we will delete or anonymize your personal data.

5.3 Security Measures

We have adopted security measures consistent with industry standards to protect your personal data. All data transmission is encrypted. Specific measures include, but are not limited to:

• Encrypted data transmission: Data transmission between the App and servers is encrypted using HTTPS/TLS;
• Access control: Strict access permission controls are implemented on servers and databases;
• Security auditing: Regular security assessments and vulnerability scanning are conducted;
• Security incident response: An information security incident response plan is in place. In the event of a security incident, you will be notified in a timely manner.

Despite adopting the above protective measures, please understand that due to technical limitations and potential malicious attacks, we cannot guarantee the absolute security of information. If your personal data is compromised due to a security incident, we will notify you in a timely manner and report to the relevant regulatory authorities as required by law.

5.4 Cross-Border Data Transfer

This App uses service providers located in the People's Republic of China (Alibaba Cloud, Volcano Engine, iFLYTEK) and the United States (Mixpanel, Firebase). Personal data may be transferred to and processed in these jurisdictions. We ensure that such transfers are governed by appropriate safeguards, including but not limited to Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with GDPR Chapter V.

---

6. Your Rights

Under the GDPR and applicable data protection laws and regulations, you have the following rights:

We will respond to your request within one month of receipt. We may extend this period by two further months where necessary, taking into account the complexity and number of the requests. We will inform you of any such extension within one month of receipt of the request. We may ask you to provide relevant information to verify your identity.

Please note: Withdrawal of consent does not affect the lawfulness of personal data processing carried out based on your prior consent. Prior to completing deletion or account cancellation, we have an obligation to retain certain necessary information as required by applicable laws and regulations.

We may be unable to respond to your request under the following circumstances:

• Related to obligations under applicable laws and regulations;
• Directly related to national security or national defense;
• Directly related to public safety, public health, or significant public interests;
• Directly related to criminal investigations, prosecutions, trials, or enforcement of judgments;
• We have sufficient evidence that you are acting with subjective malice or abusing your rights;
• Necessary to protect the life, property, or other significant legitimate interests of you or another individual, where obtaining consent from the individual is difficult;
• Responding to your request would cause serious harm to the legitimate interests of you or another individual or organization;
• Involving trade secrets.

---

7. Protection of Minors

7.1 This App is primarily intended for adults. If you are a minor under the age of 18, please read this Privacy Policy with the accompaniment and guidance of your legal guardian, and obtain the explicit consent of your legal guardian before using this App.

7.2 For children under the age of 16 in the EU/EEA (or such lower age as may be set by applicable member state law), the processing of their personal data is only lawful where consent is given or authorized by the holder of parental responsibility.

7.3 We do not proactively collect personal data from minors. If we discover that we have collected personal data from a minor without verifiable guardian consent obtained in advance, we will delete the relevant data as soon as possible.

7.4 If a minor's guardian has questions about our processing of the minor's personal data, please contact us using the contact details at the end of this Privacy Policy.

---

8. Cookies and Related Technologies

This App itself does not use cookies. When you access web content through the in-app WebView, the relevant websites may use cookies and similar technologies. The use of such technologies by those websites is governed by their respective privacy policies.

---

9. Updates to This Privacy Policy

9.1 We may update this Privacy Policy from time to time. When updated, we will notify you within the App via pop-up or notification and publish the latest version on this page.

9.2 For material changes, we will provide more prominent notice (including but not limited to in-app pop-ups, in-app announcements, email notifications, etc.).

Material changes referred to in this Privacy Policy include but are not limited to:

• Significant changes in our service model, such as changes in the purposes of personal data processing, types of personal data processed, or methods of using personal data;
• Significant changes in our ownership structure or organizational framework, such as changes of owner due to business adjustments, bankruptcy, mergers and acquisitions, etc.;
• Changes in the primary recipients with whom personal data is shared, transferred, or publicly disclosed;
• Significant changes in your rights regarding personal data processing and how to exercise them;
• Changes in the department responsible for personal data security, our contact information, or complaint channels.

9.3 If you do not agree with the updated Privacy Policy, please discontinue use of this App. Your continued use constitutes acceptance of the updated Privacy Policy.

---

10. Contact Us

If you have any questions, comments, or suggestions regarding this Privacy Policy, or if you wish to exercise your personal data rights, please contact us at:

• Email: dev@sutyo.ai
• Website: https://www.sutyo-eyewear.com/
• EU Representative: [To be designated — contact us at the email above for GDPR inquiries.]

We will respond to your request within one month of receipt, in accordance with GDPR Article 12. We may extend this period by two further months where necessary, taking into account the complexity and number of the requests. We will inform you of any such extension within one month of receipt.

---

Appendix A: iOS Permission Prompt Reference

To help you better understand the purpose of each permission, the following are the original prompt messages displayed when the iOS system requests permissions:

---

Appendix B: Android Permission Prompt Reference

To help you better understand the purposes of each permission in the Android Google Play version, the following are the prompt descriptions for the relevant permissions:

---

*Last updated: August 14, 2026*