LEGALS

VONDER PRIVACY POLICY

This Privacy Policy (the “Policy”) explains how we collect, use, store, disclose, and share (collectively “process”) your personal data when you use VONDER smart glasses (the “Device”), the companion VONDER application (the “App”), and the related services we provide (collectively the “Services”).

Depending on how you purchased your Device, the data controller responsible for your personal data differs:
• Vonderful Inc., registered at 254 Chapman Rd, Ste 208 #23943, Newark, Delaware 19702, USA, is the data controller for personal data collected from users who purchase through our official website (https://www.vonder.ai/).
• Vonderful HK Inc., registered at UNIT 1003,10/F TOWER 2, SILVERCORD, 30 CANTON RD, TSIM SHA TSUI, HONG KONG, is the data controller for personal data collected from users who purchase through other authorized sale channels.

If you are located in the EU/EEA, you may also contact our EU representative, Eden Future NL B.V., at Airborne Avenue 79, Office C05, 2133LV Hoofddorp, Netherlands. For any privacy questions or complaints, please contact us at legal@vonder.ai

For users in the United Kingdom, this Policy applies in the same way as it does to users in the EEA. References to the GDPR are to the UK GDPR and the Data Protection Act 2018; references to the EEA include the UK, and the relevant supervisory authority is the UK Information Commissioner’s Office (ICO).

This Policy may be updated from time to time. Where changes are material, we will notify you in advance through in-App notice, push notification, email, or other appropriate means.

1. What data do we collect

For the purpose of this Policy, “personal data” means any information relating to an identified or identifiable individual.

1.1 Categories of personal data we collect

We collect the following categories of personal data:

Account Information — the email address and authentication information associated with your Google, Apple, and email sign-in, your account status, and profile data you choose to provide. We do not require you to provide your personal identification information to create an account.

Device & Technical Information — device identifiers, device model, operating system and version, app version, Bluetooth and connection data, IP address, network information, device settings, and device operation logs.

Location Information — where you enable location access, the location data used to provide location-based features such as weather and location-tagged memories.

Firmware Information — during firmware updates, information about the firmware version and update packages.

Order & Purchase Information — when you purchase a Device or subscription plan, the information necessary to fulfil your order, such as your name, postal address, phone number, email address, and subscription billing record.

Audio & Transcription Data — when you use a recording mode (described below) or voice chat, audio captured by the Device and the text transcribed from it. The original audio is deleted from our systems immediately after transcription. Where a service provider processes audio to perform the transcription, it is retained only for as long as necessary for that purpose and is then deleted. Real-time translation works differently and is described in Section 1.3.

AI Summary, Input and Output — the input content of the AI assistant on the App or the web Service, the summaries we generate from transcriptions, and the responses of the AI assistant generated in reply to your inputs.

Connected Services Data — if you choose to connect a third-party service to VONDER (such as Google Workspace, Granola), the data we receive from that service to provide the related features, which may include information about other people (for example, meeting attendees). Details for specific services are set out in Section 12.

Prescription Information (health data) — if you order prescription lenses, the optical prescription you provide. This is health data and constitutes a special category of personal data under Article 9 GDPR; we process it only as described in Sections 2, 4 and 5.

Usage & Diagnostic Information — feature usage, settings, logs, and crash data used to maintain, secure, and improve the Services.

Memory (subscription feature). Memory is part of paid subscription feature that stores content from your interactions with the AI assistant (including content from your connected service and your translation sessions), together with behavioural data from your use of the in-app News feature, to give you a more personalised experience over time. This content is organised by topic into “memory tags.” You can delete your Memory data both locally and in the cloud; please note that deleting a memory tag deletes all underlying data associated with that tag.

Personalisation and profiling. Where you use the Memory and News features, we analyse your memory content and keywords, and your in-app News browsing and interests, to build a profile of your preferences in order to personalise and recommend content to you, including news topics. This profiling is not used to make decisions that produce legal or similarly significant effects for you, and we do not use it to infer sensitive characteristics about you or for advertising.

You can opt out of Memory-based profiling at any time by deleting your Memory data. Personalised recommendation is an inherent part of the News feature and cannot be separately switched off; if you do not wish to receive it, you can stop using or discontinue your subscription to the News feature.

1.2 How VONDER processes audio

How the recording modes work. VONDER offers two recording modes. Both are off by default and must be actively enabled by you. In both modes, audio is transcribed into text, and the original audio is deleted from our systems immediately after transcription.

All-day auto-pilot notetaking mode. When enabled, the Device acts as your always-available note-taking assistant and is designed to focus on the wearer's voice while the Device is worn. We apply technical measures to minimise the capture of other surrounding voices. This mode is off by default and is enabled only with your consent. The original audio is handled as described in Section 1.1.

Meeting mode. When enabled, the Device indicates its recording status through an indicator light. The Device captures meeting audio for the provision of transcription and summary. It distinguishes the wearer’s voice from other sound sources by the physical means described below; it does not separate or identify individual participants’ voiceprint data or other biometric data.

How we separate speakers/voice data

VONDER distinguishes the wearer’s voice from other sound sources in the surrounding environment while the Device is worn, which is not based on identifying or distinguishing individuals. In this process, VONDER does not collect, extract, store, or compare voiceprints or any other biometric identifiers, does not create any voiceprint template or database, and is not capable of recognising the same individual across different recordings or sessions. VONDER does not process voice data for the purpose of identifying a natural person.

Your responsibility in multi-person settings

Where a meeting mode may capture the voices of other people, you are responsible for ensuring that you have obtained any consent required under the laws applicable to you before recording.

Access permissions

Your use of Services requires the following access to your device. You may manage the access permission under Settings.

1.3 Real-time translation

Real-time translation helps you talk with people across languages. When you turn it on, VONDER sends speech from the conversation to our AI service providers, which translates it into text and speech as you talk. To keep the conversation natural, the translated voice follows the tone and speaking style of the person speaking. VONDER does not use this to identify anyone and does not create voiceprints.

When the session ends, VONDER uploads the recording to our servers and prepares a transcript and summary for you. We keep the audio for up to 7 days to deliver these features and resolve technical issues. Your transcripts and summaries stay in your account until you delete them and, if you subscribe to Memory, help personalise your experience.

Because translation involves other people's voices, please let them know when you are using this feature and obtain any consent required by law.

2. How we use your data

We only use your personal data where applicable law permits.

Our legal bases depend on the data and the context in which we process it:
• performance of a contract;
• your consent;
• our legitimate interests (providing, maintaining and securing the Services, including features that work with third-party services you choose to connect, preventing misuse and fraud, and protecting our and others’ legal rights); and
• compliance with legal obligations.

The purposes for which we process personal data and the legal bases are set out below:

3. How do we retain and protect your data?

You can choose to sync up your data to the cloud or stay with your Device.

Retention. Original audio recordings are deleted from our systems immediately after transcription and are not retained by us thereafter, except for audio from translation sessions, which is processed as described in Section 1.3. Where a service provider processes audio to perform the transcription, it is retained only for as long as necessary for that purpose. Transcripts, AI summaries, chat content, and Memory data are retained until you delete them or delete your account. Other categories of personal data are retained for the period required to fulfil the purpose for which they were collected; where legal obligations require longer retention, we retain that data for the period prescribed by applicable law. Once the purpose for which it was collected no longer applies, personal data will be deleted or anonymised in accordance with applicable law.

Security. We implement appropriate technical and organisational measures, including encryption in transit, access controls, and security obligations imposed on our processors, to protect your data against loss, misuse, and unauthorised access. Please note no method of internet transmission is completely secure, so while we take reasonable steps to protect your data, we cannot guarantee absolute security.

4. How will we disclose your data?

We may disclose your information in the following ways:

Affiliated entities We may disclose information among our affiliated companies to deliver and support the Services and operate our business.

Service providers We use selected third-party vendors to help provide the Services, including cloud hosting and data storage, speech-to-text transcription, AI model providers, logistic service providers, etc. These providers may access your information only to perform services for us or to comply with legal requirements.

Lens manufacturer Where you order prescription lenses, we disclose your prescription to our lens manufacturer for the sole purpose of producing your lenses. The manufacturer processes this data on our behalf under a data processing agreement incorporating the EU Standard Contractual Clauses. As prescription data constitutes health data, this disclosure is subject to enhanced contractual safeguards. Cross-border transfer of this data is addressed in Section 5.

Marketplace platforms If you purchase through other authorized sale channels, your order and fulfilment information is handled through those platforms under their terms and our agreements with them.

Connected third-party services Some features let you connect VONDER to third-party services that you choose to use. When you initiate such a connection, we disclose the information necessary to enable that service (for example, your login credentials or a request you direct to that service). These connections are optional and initiated by you; your use of the connected service is governed by that third party’s own terms and privacy policy. We encourage you to review their policies before connecting. For data we receive from services you connect, see Section 12.

Third-party SDKs and similar technologies The VONDER Products, including the App and the web Service, incorporate third-party software development kits, and similar technologies that process certain device, usage, and online identifier information to provide functions such as log-in, analytics, crash reporting, payment, push notifications, etc. Depending on the specific technology, these providers act as our processors or as independent controllers under their own privacy policies. For details of the third-party technologies we use and the information they process, see our List of Third-Party SDK and Cookie Policy.

Protection of VONDER and others We may disclose the information we collect about you if required to do so by law or in a good faith belief that such disclosure is reasonably necessary to: (a) comply with legal process (for example, a subpoena or court order); (b) enforce our terms of service or sale, this Privacy Policy, or other contracts with you, including investigation of potential violations; (c) respond to claims that any content violates the rights of third parties; or (d) protect the rights, property, or personal safety of Vonderful or others.

Business transfers If we are involved in a merger, acquisition, asset sale, or similar transaction, your information may be disclosed as part of, or in contemplation of, that transaction.

Online Analytics and Advertising

Online analytics. We use third-party analytics services on our website, including Google Analytics and Microsoft Clarity. These providers set and access cookies and similar technologies to help us understand how visitors arrive at and use our website, see how Google uses this data for more details. Microsoft acts as an independent controller and may use the data it collects for its own purposes, including advertising, as described in the Microsoft Privacy Statement.

Online advertising. We work with advertising partners, including Meta and Google, to help us reach people who may be interested in VONDER and to understand whether our advertising is effective. To do this, these partners may use cookies and similar technologies on our website and on other online services, which allows them to recognize your browser or device and show you VONDER advertisements that are more likely to be relevant to you. We also use Google Analytics Advertising Features (such as Google Ads integration), which work together with Google’s advertising cookies. In some cases, we may share information about purchases you make on our website (not your payment details such as bank account information) with our advertising partners so they can measure and better tailor the advertisements you see on other services.

Your choices. You can opt out of analytics and advertising cookies at any time via the “Cookie Settings” button on our Cookie Policy page. You can also manage ad personalization through Google Ads Settings and your Meta ad preferences. For more details, see our Cookie Policy.

5. How we transfer your data internationally

Your personal data may be processed on servers, or accessed by our affiliates, service providers, and business partners, located outside the country where you live, including in jurisdictions that may not provide the same level of data protection as the one where you are located.

Where personal data is transferred outside the EEA or UK to a jurisdiction that has not been recognised as providing an adequate level of protection, we rely on appropriate transfer mechanisms, such as the European Commission’s Standard Contractual Clauses, UK Addendum to the EU SCCs, or another lawful transfer mechanism, and we implement appropriate safeguards designed to ensure an equivalent level of protection for your personal data.

Our operations involve entities and service providers in several jurisdictions, including the United States, Hong Kong SAR, and Mainland China. Where audio is processed by our affliates or service providers outside your country for transcription purposes, such processing is subject to the safeguards described in this Section.

You may request more information about the safeguards we apply to international transfers using the contact details in Section 10.

6. Your data subject rights and choices

Subject to applicable law and depending on where you reside, you may request the following by contacting us as detailed in Section 10. We may need to verify your identity before responding.
• Access to, or a copy of, your personal data
• Confirmation of whether we process your personal data
• Correction of inaccurate or incomplete personal data
• Deletion of your personal data
• Transfer (portability) of certain personal data to you or another controller
• Restriction of, or objection to, certain processing
• Lodging a complaint with your local data protection authority

Where we rely on your consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

7. Children’s privacy

Our Services are intended for general audiences and are not directed at children. If we become aware that we have collected data without legally valid parental consent from children under an age where such consent is required, we will take reasonable steps to delete it as soon as possible.

8. Notice to California Residents

If you are a California resident, the CCPA requires us to provide the following additional information about the personal information we collect, use, and disclose, including the categories of third parties to which we (a) disclose personal information for a business purpose, and (b) “share” or “sell” personal information for advertising and analytics purposes.

Under the CCPA, “sharing” means disclosing personal information to third parties for cross-context behavioral advertising, and “selling” means disclosing personal information to third parties in exchange for monetary or other valuable consideration. We do not disclose your personal information to third parties in exchange for money. However, our use of third-party analytics and online advertising services on our website may result in the sharing of online identifiers (such as cookie data, IP addresses, device identifiers, and browsing information) in a way that may be considered “sharing” or a “sale” under the CCPA.

Disclosure of personal information. In the past 12 months, we have collected and disclosed the following categories of personal information

Your choices regarding “sharing” and “selling”. You can opt out of the sharing or sale of your personal information for online analytics and advertising at any time via the “Cookie Settings” button on our Cookie Policy page.

Automated profiling. We use automated profiling based on your Memory content and News preference, to personalise and recommend content. We do not use it to make decisions with legal or similarly significant effects, for advertising, or to infer sensitive characteristics, and you can opt out by deleting your Memory data or cancelling the subscription, or contact us for further assistance.

Sensitive personal information. Certain information described above constitutes “sensitive personal information” under the CCPA, namely your prescription (health) information and the contents of any recordings or translation session you elect to create. Such information is used solely to provide the features you request and for other permitted business purposes, and is not used to infer characteristics about you. We do not collect biometric information for the purpose of identifying you (see Section 1).

9. HIPAA Compliance [US Only]

We do not provide medical care or advice and are thus not a covered entity under HIPAA. The only health data we collect is your optical prescription, which we collect at checkout with your separate, explicit consent and use solely to produce your prescription lenses.

10. How to contact us

For questions about this Policy or to exercise your rights, contact us at legal@vonder.ai

EU/EEA representative: Eden Future NL B.V., Airborne Avenue 79, Office C05, 2133LV Hoofddorp, Netherlands.

11. Changes to this Policy

We may update this Policy from time to time. Where changes are material, we will notify you in advance through in-App notice, push notification, email, or other appropriate means. Please review it periodically for the latest version.

12. Connected Services

If you choose to connect a third-party service to VONDER, such as Google Calendar or Granola, that service shares with us the data you authorise, such as your calendar events or meeting notes. This data may include information about other people, such as meeting attendees.

We use this data to provide the features you request, such as answering your questions, importing content into your Notes, and enriching your Memory.

Unless otherwise stated below, imported content and other data from connected services are kept until you delete them or delete your account. Your use of each connected service remains subject to that service’s own terms and privacy policy.

12.1 Google User Data

This subsection applies to data we obtain from your Google account through Google APIs (“Google user data”) and, for that data, prevails over the rest of this Policy.

Data we access
Google Calendar: With your permission, we access your Google account ID and email address, your list of calendars, and events on your own calendars that you authorise, including event titles, descriptions, dates, times, locations, meeting links, and attendees’ names and email addresses. You can use VONDER to create, edit, and delete events on your calendars.

How we use it
We use Google user data to power the features you turn on. With Google Calendar, VONDER can answer questions about your schedule, remind you before meetings, prepare your daily briefing, and update your calendar when you ask. If you subscribe to Memory, VONDER also uses it to personalise your experience, including the content we recommend to you.

Who we share it with
We work with service providers that help us run VONDER, including AI model providers that process your requests and generate responses. We do not sell your Google user data or use it for advertising.

Disconnecting
You can disconnect a Google service at any time. When you do, we delete the data we synced from it along with your access token, and any remaining copies in our backups and logs are cleared within 30 days. Your chats and Memory stay with you until you choose to delete them.

Limited Use
VONDER’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Appendix A: Web version of the AI assistant (EU/US)

This appendix applies when you use the web version of the VONDER AI assistant in a browser (app.vonder.ai). This appendix is incorporated into the main Privacy Policy.

You need a VONDER account to use the web Service. You can create a VONDER account by signing in with your Google account, Apple account, or email. The same account works across the web version and the VONDER Device. Your account data (including chat history) is shared across both as described in the main Policy.

On the web Service, you can interact with the assistant by typing or by voice instruction; the web Service does not support the recording modes available on the VONDER Device (Section 1.2).

We process the text and voice input you provide, together with the responses we generate, to provide the features you ask for. This input may include personal information you choose to provide, and sometimes sensitive information. We process it on the same terms set out elsewhere in this Policy — including how long we keep it (Section 3), who we share it with (Section 4), and how it may be transferred internationally (Section 5).

The web Service uses cookies and similar technologies. To learn more about our use of cookies and similar technologies, your choices, and how to manage them, please refer to our Cookie Policy.