Effective Date: 06 February 2026
Last Updated:03 March 2026
Dear Users,
This Privacy Policy (the “Policy”) applies to the mobile application Weight Loss with a Samurai AI (in Japanese: “ダイエットお助けAIアバター”) (hereinafter referred to as the “SOULRiZA App”), developed and published by AI AVATAR.
The policy is adopted by Neksai Inc., a company with headquarter address at the offices of Conyers Trust Company (Cayman) Limited, Cricket Square, Hutchins Drive, PO Box 2681, Grand Cayman, KY1-1111 and is represented by CFO Tran Anh Tuan (“we”, “us” or “our”), which acts as the data controller in respect of the processing of personal data in connection with the mobile application Weight Loss with a Samurai AI, its related websites, and any other services operated under the Weight Loss with a Samurai AI brand (collectively, the “Services”). The Services are developed and published by AI AVATAR - a Japanese subsidiary of Neksai Inc.
By accessing or using the SOULRiZA App and/or the Services, you may generate, provide, share, upload, or otherwise disclose your personal data to us. Any such personal data shall be processed in accordance with, and protected pursuant to, the terms and conditions of this Policy. If you do not agree with this Policy, you should not use the Services.
PERSONAL DATA COLLECTION
Your use of the Services will result in the generation, provision or disclosure of your personal information.
Categories of Personal Information Collected (CCPA Disclosure)
In the preceding 12 months, we have collected the following categories of personal information from consumers, as defined under the California Consumer Privacy Act (CCPA):
| CCPA Category | Examples Collected | Collected |
| Identifiers | Email address, name, device IDs, IP address, advertising identifiers | Yes |
| Personal information under Cal. Civ. Code § 1798.80(e) | Name, email address, date of birth | Yes |
| Protected classification characteristics | Age, gender (if provided) | Yes |
| Commercial information | Purchase history, transaction details, subscription status | Yes |
| Biometric information | Voice recordings | Yes |
| Internet or network activity | App usage data, interactions with advertisements, features used | Yes |
| Geolocation data | IP-based location | Yes |
| Sensory data | Audio recordings (voice data) | Yes |
| Professional or employment information | Not collected | No |
| Education information | Not collected | No |
| Inferences | Preferences and characteristics derived from usage patterns, wellness goals | Yes |
| Sensitive personal information | Account credentials; health-related data (height, weight, body fat, calorie intake, body photos, meal photos, activity data); biometric data (voice recordings); racial/ethnic origin, health data, sexual orientation (if voluntarily disclosed through AI conversations) | Yes |
Sources of Personal Information
We collect personal information from the following categories of sources:
Directly from you: When you create an account, provide profile information, input health and wellness data, interact with AI features, or communicate with our support team.
Automatically from your devices: Through cookies, pixels, and similar technologies when you access or use our Services, including device identifiers, IP address, and usage data. Activity data (e.g., steps taken, distance traveled, calories burned) may also be obtained from your device or connected features.
From third parties: When you log in via social media or third-party accounts (such as Facebook or TikTok), we receive limited profile information from those platforms.
From service providers: We may receive information from analytics providers, advertising networks, and payment processors that assist in operating our Services.
Categories of Collected Personal Data
The categories of collected personal data are specified as below:
| Categories | Collection Methods and Processing Purposes |
| Account Data | We collect account-related information that you provide when you create or manage an account. This may include your username, display name, email address, password (in encrypted form), profile information, account preferences, and other information necessary to authenticate you, maintain your account, and provide core app/Services functionality. |
| Social Media and Third-Party Account Data |
If you choose to interact with the A2V App through social media features or connect your social media accounts, we may collect data that you make available via those platforms. This may include your social media username, profile information, profile image, and other content or data that you authorize the social media platform to share with us, in accordance with its privacy settings and policies. If you choose to register or log in to the A2V App using a third-party account (such as Apple ID, Google, or other supported services), we will receive certain information associated with that account, such as a unique user identifier, email address, and basic profile details, as permitted by the third-party provider and your privacy settings. We do not control how third-party providers process your data, and their use of your information is governed by their own privacy policies. |
| Voice Data |
If you interact with the Services using voice-enabled features. we may collect and process your voice data This includes real-time voice analysis and recognition to enable responsive avatar interactions, as well as voice recordings that may be recorded and retained as part of the communication data generated through use of the Services.
During your use of our Services, your voice recordings may be considered biometric information, which may be sensitive personal data under appliable data protection laws. For avoidance of doubt, we do not use any special technology to process your voice recordings for the purpose of converting them into data for identification or authentication purposes. That means we do not analyze, extract, store, or otherwise process the biometric information derived from your voice recording for the purpose of identifying individuals. Your voice data will be processed solely for your enjoyment of the Services upon your effective and explicit consents. |
| User Communication Data |
If you have conversations with AI, the contents of your conversations with AI, in text, chat, or voice and video, will be collected on our Services. Further, intimate conversations with AI may directly or indirectly disclose personal information that may be deemed protected and sensitive.
Those data may include, but are not limited to:
● Physical, physiological, mental, economic, cultural, or social identity of the users; ● Racial or ethnic origin; religious or philosophical beliefs; citizenship or immigration status; ● Medical or health condition information; and/or ● Sexuality data (sex life or sexual orientation).
For the avoidance of doubt, we do not require you to provide any personal data that may be considered sensitive or otherwise required special protection under applicable data protection laws for your usage of this feature. Any personal data that you choose to share, generate, record, or otherwise disclose through your use of the recording feature of the SOULRiZA App is provided at your sole discretion and responsibility. |
| Health & Wellbeing Data | If you choose to provide through the Services to support habit formation, wellness routines, and personalized coaching experiences, we may collect or generate your health and wellbeing–related information. This may include physical metrics such as height, weight, body fat, and calorie intake, as well as body photos, meal photos, and activity data (e.g., steps taken, distance traveled, and calories burned) obtained from your device or connected features. |
| Marketing Preferences | We collect information about your marketing and communication preferences, such as your choices regarding receiving promotional messages, newsletters, product updates, and other communications from us. This may include your opt-in or opt-out status, preferred communication channels (e.g., email, in-app notifications), and related interaction data (such as whether a message was opened or acted upon). You may update your communication preferences or withdraw consent at any time through the App settings or by following the instructions included in our communications. |
| Technical Data | We automatically collect your hardware and software information such as IP address, operating system type and version, app version, device ID and type, performance logs, crash data, advertising IDs and identifiers associated with cookies or other technologies that may uniquely identify a device or browser |
| Usage Data | Using the Services will generate data about your activity, including how you use it (e.g., when you logged in, features you’ve been using, actions taken, information shown to you, referring webpages, ads you interacted with) and how you interact with others (e.g., searching, matching, communicating). We may also receive data related to interactions you had with our ads on third party websites or apps. |
THE PURPOSE OF OUR PERSONAL DATA PROCESSING
Your collected personal data will be processed for the main purposes of:
a. Our provision of the Services;
b. Your entertainment, training, and performance tracking while using our Services;
c. Improving the Services and user experience;
d. Advertisement and promotion purposes to the extent permitted by laws; and
e. Compliance and legal purposes.
Our data processing activities may include but are not limited to collection, recording, organisation, structuring, storage, retrieval, use, disclosure by transmission, dissemination or activities affecting available of your personal data.
Business and Commercial Purposes for Collection (CCPA Disclosure)
We collect personal information for the following business and commercial purposes:
Providing, maintaining, and improving our Services
Processing transactions and enabling in-app purchases
Personalizing user experience, wellness missions, and avatar interactions
Supporting habit formation, wellness routines, and personalized coaching
Communicating with you about your account, purchases, and updates
Conducting research and analytics to improve our products
Detecting, preventing, and addressing fraud, abuse, or security issues
Complying with legal obligations and enforcing our terms
Advertising and marketing (to the extent permitted and with your consent)
You agree and understand that before generating, uploading, providing or otherwise disclosing any personal information through your use of our Services, you must consent to us and our authorized processors to process your personal data. Otherwise, we may not be able to provide the Services to you.
Your personal data will be processed by us for the following specific purposes:
| Data Processing Purposes | Legal Basis for Data Processing | Categories of Processed Data |
| Account creation and maintenance of your profile on the Services | Your effective and explicit consent for personal data processing | Account Data, Social Media and Third-Party Account Data |
| Enabling your use and enjoyment of various functions and features of the Services | Your effective and explicit consent for personal data processing. | Account Data, Social Media and Third-Party Account Data, Voice Data, User Communication Data, Health & Wellbeing Data, Marketing Preferences |
| Monitoring the well functioning of the Services and troubleshooting and fixing issues as needed | Your effective and explicit consent for personal data processing. | Technical Data, Usage Data |
| Advertisement and marketing purposes | Your effective and explicit consent for personal data processing; Our legitimate interest: It is our legitimate interest to promote the Services. | Account Data, Social Media and Third-Party Account Data, Technical Data, Usage Data |
| Research and development to improve the Services and user experience | Your effective and explicit consent for personal data processing; Our legitimate interest: It is our legitimate interest to improve the Services over time. | Account Data, Social Media and Third-Party Account Data, Voice Data, User Communication Data, Health & Wellbeing Data, Marketing Preferences, Technical Data, Usage Data |
| For compliance with applicable law, disclosure upon requests of competent State authorities; reporting of crimes or illegal activities; and/or litigation | It is our legitimate interests and obligations to comply with applicable laws, to respond to law enforcement upon request, and to protect the legal rights of ourselves and other users of the Services. | The categories of shared personal data will be determined based on the specific circumstances |
DATA PROCESSING
Your data will be disclosed to our authorized processors and/or third parties for the purposes set forth under Section 2 of this Policy. All authorized processors will have the following responsibilities:
Provide sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of applicable laws and ensure the protection of your rights as a data subject;
Cooperate with us to enable the timely response to and fulfillment of your lawful and valid requests;
Process your data in an accurate manner in accordance with applicable law on personal data protection and data processing contracts signed between us and each authorized processor;
Not to engage any other processor without prior specific or written authorization from us; and
Authorized processors act solely on our documented instructions and are contractually prohibited from using personal data for their own purposes.
TRANSFER OF PERSONAL DATA
Given our Services are operated globally, by disclosing your personal data while using our Services, your data may be transferred to authorized processors and/or third parties who operate in different jurisdictions who partner with us to process for the purposes set forth under Section 2 of this Policy. Any such cross-border transfer will be carried out in accordance with applicable data protection laws, and data processing agreements between us and our authorized processors and/or third parties, which bind the processors to apply appropriate safeguards to protect the privacy and security of your data and your rights as a data subject.
We may use and/or share your information with law enforcement agencies, public authorities or other organizations if legally required to do so, or if such use is reasonably necessary to comply with legal obligation or to reporting of crimes or illegal activities; and/or litigation.
SALE AND SHARING OF PERSONAL DATA
We do not sell personal information for monetary consideration, nor do we “share” personal information for cross-context behavioral advertising purposes, as those terms are defined under the California Consumer Privacy Act (CCPA). Because we do not sell or share personal information, we have not included a “Do Not Sell or Share My Personal Information” link on our website. If our practices change in the future, we will update this Policy and provide the required opt-out mechanism.
Disclosure of Personal Information for Business Purposes
We may disclose personal information to our service providers and processors for the business purposes described in this Policy. In the preceding 12 months, we have disclosed the following categories of personal information to service providers: identifiers, commercial information, internet/network activity, geolocation data, sensory data, and health-related data. These disclosures are made under written contracts that prohibit the service provider from retaining, using, or disclosing the personal information for any purpose other than performing the services.
YOUR RIGHTS
As a data subject, you retain rights and exercise control over our processing of your personal data. The scope and extent of these rights may vary depending on the jurisdiction in which you reside, and we will comply with and give effect to such rights in accordance with applicable laws and regulations. For the purposes of this Policy, we recognize and observe the following standard rights of data subjects to the extent permitted by applicable laws:
Request us to provide you with the following information at any time: (1) The identity and contact details of us and our legal representatives; (2) The contact details of our data protection officers; (3) The purpose of data processing and relevant legal bases; (4) Our legitimate interests for lawful data processing; (5) Recipients or categories of recipients of the personal data, if any; (6) Information on data transfer, applicable safeguards for data protection in the case of data transfer; (7) Confirmation of existence of the processing; (8) Access to your personal data; (9) Correction of incomplete, inaccurate or outdated data, other rectification of your data; (10) The existence of automated decision-making used by us; (11) Anonymization, blocking or erasure of unnecessary or excessive data or data processed; (12) Portability of data to another service provider or product provider; (13) Erasure of your personal data despite you had given a consent; (14) Information on entities with which we have shared your data; (15) Information on the possibility of denying consent and the consequences of such denial; and (16) Revocation of your consent.
Request us to restrict our data processing to the extent permitted by applicable laws;
Object our legitimate rights for lawful data processing;
Object our processing for direct marketing purposes;
Object to being subjected to a decision based solely on automated processing, including profiling which produces legal effects and similar significant effects for you;
Oppose to the processing based on the events of waiver of consent and/or our noncompliance of applicable laws on personal data protection;
Petition regarding your data before the competent authorities;
Brazilian-Specific Rights (LGPD): In accordance with Article 18 of the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados – LGPD), Brazilian users have the right to obtain confirmation of the existence of processing, access to personal data, correction of incomplete or outdated data, anonymization, blocking or deletion of unnecessary data, portability, information regarding data sharing with public and private entities, and revocation of consent. Brazilian users also have the right to lodge complaints with the Brazilian National Data Protection Authority (ANPD).
Vietnam-Specific Rights: Users may lodge complaints with competent Vietnamese authorities where applicable. Users in Vietnam have the rights to be informed, consent or not consent or withdraw consent to processing; access, correct; request the provision, delete, restrict, and object to the processing of their personal data and other rights in accordance with the Law on Personal Data Protection.
Users in Vietnam may lodge complaints or initiate lawsuits with competent Vietnamese authorities or courts where applicable. Users in Vietnam also have certain obligations regarding their personal data in accordance with the Law on Personal Data Protection.[
Japan-Specific Rights: We will cease to provide personal data that can be used to identify Japan users to a third party at the request of Japan users in accordance with the Act on the Protection of Personal Information of Japan (“APPI”).
California-Specific Rights:
This section applies to California residents and supplements the information provided elsewhere in this Privacy Policy. If you are a California resident, you have the following rights under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA”):
Right to Know/Access. You have the right to request that we disclose to you the categories of personal information we have collected about you, the categories of sources from which we collected the personal information, the business or commercial purposes for collecting, selling, or sharing the personal information, the categories of third parties to whom we have disclosed personal information, and the specific pieces of personal information we have collected about you.
Right to Delete. You have the right to request that we delete personal information we have collected from you, subject to certain exceptions permitted by law.
Right to Correct. You have the right to request that we correct inaccurate personal information that we maintain about you.
Right to Opt-Out of Sale or Sharing. You have the right to opt out of the “sale” of your personal information or the “sharing” of your personal information for cross-context behavioral advertising purposes. As stated in this Policy, we do not sell or share your personal information for these purposes.
Right to Limit Use of Sensitive Personal Information. If we collect sensitive personal information (as defined under the CCPA), you have the right to limit our use of such information to purposes necessary to provide the Services.
Sensitive Personal Information Collected
This app may collect the following categories of sensitive personal information as defined under the CCPA: (i) health-related information, including physical metrics (height, weight, body fat, calorie intake), body photos, meal photos, and activity data; (ii) biometric information (voice recordings); and (iii) account login credentials. You have the right to limit our use and disclosure of sensitive personal information to purposes necessary to provide the Services. To exercise this right, please contact us at dpo@aiavatar.work.
Note Regarding Health Privacy Laws
Neksai Inc. is not a “covered entity” or “business associate” as defined under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and the health and wellbeing data collected through this app is not subject to HIPAA protections. However, we are committed to protecting your health-related data in accordance with the CCPA and other applicable privacy laws.
Right to Non-Discrimination. We will not discriminate against you for exercising any of your CCPA rights. We will not deny you goods or services, charge you different prices, provide a different quality of service, or suggest you will receive a different price or quality based on your exercise of these rights.
How to Exercise Your California Rights. To submit a request to exercise any of the rights described above, please contact us at: dpo@aiavatar.work. We will verify your identity before processing your request and may require you to provide additional information to confirm your identity. If you use an authorized agent to submit a request, we may require verification that you authorized the agent to act on your behalf.
Authorized Agents. You may designate an authorized agent to submit a request to exercise your California privacy rights on your behalf. To do so, you must provide the authorized agent with written permission to act on your behalf, and we may require you to verify your own identity directly with us and confirm that you provided the authorized agent permission to submit the request.
Verification Process. When you submit a request to know, delete, or correct personal information, we will verify your identity by matching the information you provide with information we already maintain about you. For requests for specific pieces of personal information, we apply a heightened verification standard and may require a signed declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request.
Response Timing. We will respond to verifiable consumer requests within 45 days, or notify you if we require additional time (up to an additional 45 days).
Metrics Disclosure. In accordance with CCPA requirements, we will publish annually the number of requests to know, delete, and opt-out received, complied with in whole or in part, and denied.
OUR PROCESS OF HANDLING YOUR REQUESTS TO EXERCISE YOUR DATA SUBJECT RIGHTS
We have appointed Data Protection Officers responsible for overseeing data protection compliance. For any request to exercise your rights, please contact our Data Protection Officers via email: dpo@aiavatar.work.
Your request to exercise your above rights will be handled by us free of charge, within the time periods and terms provided under applicable laws. Nevertheless, we may reject your requests including if we are unable to authenticate you; if the request is unlawful or invalid; or if it may infringe on trade secrets or intellectual property, or the privacy and other rights of others.
Once your request is accepted and performed accordingly by us, we are further obligated to ensure that our authorized processors take necessary actions to conform with your rightful requests.
EXISTENCE OF AUTOMATED-DECISION MAKING
We may use automated processing, including profiling, to support certain functionalities of the Services, such as content personalization, performance analytics, service optimization, security monitoring, and the delivery of relevant advertisements or recommendations. Such automated processing is used solely to enhance user experience and improve the performance, safety, and efficiency of the Services. Where automated processing is used, appropriate safeguards are implemented to protect your relevant rights and interests.
RETENTION OF PERSONAL DATA
We retain information for as long as necessary to provide the Services and for the other purposes set out in this Policy. In case you delete your account from our Services, to the extent permitted and/or requested by applicable laws, we will retain your personal data for legal and compliance purposes for a maximum period of 05 years from the date of your account closure. The criteria to determine the retention window are as follows:
| Scope of Retained Data | Purposes | Retention Period |
| All Personal Data | For compliance with applicable laws and regulations, and for the establishment, exercise, or defense of legal claims arising out of or in connection with the Services. | Six months from the date of account closure |
| Customer services exchange, records, supporting data | For compliance with applicable laws and regulations, and for the establishment, exercise, or defense of legal claims arising out of or in connection with the Services. | Two years from the date of the exchange |
| All Personal Data | Where there is a reasonable basis to believe that the Services may have been used in violation of applicable law or our terms, we may retain relevant personal data as necessary for investigation, compliance, and the establishment, exercise, or defense of legal claims. | Five years from the date of account closure |
Following the expiration of the applicable retention period, personal data will be deleted or restricted from further processing unless continued retention is required or permitted by law for compliance, legal, or legitimate business purposes. Where possible, data will be anonymized or aggregated so that it can no longer be attributed to an identifiable individual and may be used for service improvement and development purposes.
Retention by Category of Personal Information (CCPA Disclosure)
We retain each category of personal information for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following table summarizes our retention practices:
| Category of Personal Information | Retention Period or Criteria |
| Identifiers (account data, device IDs) | Duration of account plus six months after account closure; up to five years if required for legal compliance |
| Transaction and financial data | Two years from transaction date for general records; up to five years for tax/legal compliance |
| Biometric data (voice recordings) | Only for the session in which it is used, unless retained as part of user-generated content; deleted or anonymized upon account closure |
| Usage and technical data | Two years from collection |
| User communication data (AI conversations) | Duration of account plus six months after closure; may be anonymized for research |
| Health and wellbeing data | Duration of account plus six months after closure; subject to user deletion requests |
| Sensitive personal information | Retained only as long as necessary for the disclosed purpose; subject to user deletion requests |
CHILDREN’S PRIVACY
Our Services are intended solely for individuals who are 13 years of age or older. We do not knowingly collect, use, or process personal data from children under the age of 13, and individuals under 13 are not permitted to create accounts or otherwise use the Services.
If we become aware that personal data has been collected from a child under the age of 13, we will take appropriate steps to promptly delete such data and terminate the associated account.
Parents or legal guardians who believe that a child under the age of 13 has provided personal data to us may contact us at dpo@aiavatar.work to request review or deletion of such information. We may take reasonable steps to verify the identity and authority of the requesting party before acting on such requests.
We reserve the right to implement age-verification or other measures, where required or appropriate, to prevent access to the Services by individuals under the age of 13 and to ensure compliance with applicable child protection and data protection laws.
Additional Rights for California Minors
If you are a California resident under 18 years of age and a registered user of the Services, you may request removal of content or information you have publicly posted on the Services. To request removal, please contact us at dpo@aiavatar.work with a description of the content you wish to have removed. Please note that removal does not ensure complete or comprehensive removal of the content, as there may be circumstances under which the law does not require or allow removal.
POLICY CHANGES
We may update this Privacy Policy periodically. Material changes will be communicated, and we will obtain your consent if required by applicable laws, to you before material changes take effect.
SHARED USE OF PERSONAL DATA
We may jointly use personal data within our corporate group or with designated service providers for the purposes described in this Policy.
The shared personal data may include Account Data, Social Media and Third-Party Account Data, Voice Data, User Communication Data, Health & Wellbeing Data, Marketing Preferences, Technical Data, Usage Data, interaction content (such as chat messages or voice inputs), interaction memory and preferences, user-generated media metadata, customer support communications, subscription and transactional metadata, security and fraud-prevention signals, health and wellness data, and compliance-related records, to the extent necessary for service operation, safety, and legal compliance.
The purpose of shared use is limited to service operation, security, customer support, analytics, and legal compliance.
The entity responsible for the management of jointly used personal data is Neksai Inc, a company with headquarter address at the offices of Conyers Trust Company (Cayman) Limited, Cricket Square, Hutchins Drive, PO Box 2681, Grand Cayman, KY1-1111 and is represented by CFO Tran Anh Tuan.
Shared use will be conducted in accordance with APPI and subject to appropriate safeguards.
CONTACT INFORMATION
If you have questions, concerns, or requests related to this Privacy Policy or the processing of your personal data, please contact our Data Privacy Officers: dpo@aiavatar.work. AI AVATAR (represented by Ichiro Kato), as the lead operator of the Services, shall be responsible for the resolvement of matters regarding your personal data.