AboxShow Privacy Policy

Effective date: 3 August 2026

NOVAPULSE AI PTE. LTD. (UEN 202624393D) ("AboxShow", "we", "us" or "our") operates the AboxShow mobile application (the "App") and https://aboxshow.com/ (the "Website", together the "Services"). This Privacy Policy explains how we collect, use, disclose, transfer, retain and protect personal data in connection with the Services under Singapore's Personal Data Protection Act 2012 ("PDPA").

1. Personal Data We Collect

Depending on how you use the Services, we may collect:

• Account and profile data: email address, password authentication information, email verification records, account ID, nickname, avatar, telephone number if provided, gender if provided, country if provided, profile settings and account status.

• Device and identifier data: IP address, device model, operating system, App version, language, time zone, network information, Firebase app-instance identifier, advertising or attribution identifier where permitted, push-notification token and similar technical identifiers.

• Usage and playback data: screens viewed, searches, taps and interactions, content selected, playback progress, viewing history, favourites, likes, comments, follows, blocks, reports, session timestamps and feature usage.

• Community and message data: profile content, comments, selected images, messages, sender and recipient identifiers, delivery status, moderation reports and other information you choose to submit.

• Diagnostic and security data: crash information, performance and playback quality data, error logs, fraud signals, security events and technical logs.

• Purchase and subscription data: Google Play product or plan selected, price, currency, Google Play order or purchase token, transaction status, purchase time, renewal and entitlement status. Google Play processes payment-card details; AboxShow does not receive or store your complete payment-card number.

• Support communications: contact details, messages, attachments and information needed to investigate and respond.

2. How We Collect Personal Data

We collect data directly from you when you register, manage a profile, submit content, communicate, purchase or contact support. We collect data automatically from the App, Website and device through application interfaces, SDKs, cookies, beacons, local storage or similar technology. We may receive data from Google Play, analytics and attribution providers, messaging, video delivery, hosting, storage, security and other service providers.

3. How We Use Personal Data

We use personal data to create, authenticate, administer and secure accounts; provide video playback and remember progress; deliver community, messaging and notification features; process and verify purchases, subscriptions and entitlements; personalise and improve content and features; provide support and service communications; measure usage and advertising attribution; diagnose faults and playback quality; prevent fraud, abuse and security incidents; moderate content; comply with law and lawful requests; and establish, exercise or defend legal claims.

Where the PDPA requires consent, we will obtain it unless an applicable legal exception applies. You may withdraw consent subject to legal or contractual restrictions and reasonable notice.

4. Device Permissions and User Choices

The Android App may request permission to send notifications. This permission is optional and can be managed in device settings. When you choose an avatar or attach an image to a comment or message, the App uses the Android system photo picker and receives only the image you select; the released App does not request broad photo or storage-library access. Network access and wake-lock capabilities support online playback, messaging, purchases, downloads of streaming data and reliable video playback.

Disabling a permission or identifier may limit the related feature. Where required, advertising or tracking identifiers are used only after the applicable platform permission or consent.

5. SDKs, Providers and Disclosure

We disclose or transmit data only as reasonably necessary to operate the Services. Principal providers in the released Android App include:

• Google Play Billing: processes coin and membership purchases and provides product, order, purchase-token and entitlement information. Privacy: https://policies.google.com/privacy

• Google Firebase Analytics and Firebase Cloud Messaging: provides usage analytics, app-instance identifiers, device and event information, and push-notification delivery and tokens. Privacy: https://policies.google.com/privacy

• Airbridge: provides install attribution, campaign measurement and direct or deferred deep links using device, advertising or app-instance identifiers, install/open events and link data where permitted. Privacy: https://www.airbridge.io/privacy-policy

• Tencent Cloud Chat: provides conversations and direct messaging using account and IM identifiers, message content, selected images, delivery status and technical logs. Privacy: https://www.tencentcloud.com/document/product/301/17345

• Volcengine Video on Demand: provides video playback, delivery, preloading and playback-quality monitoring using video identifiers, device/network information, playback events and diagnostic data. Privacy: https://www.volcengine.com/docs/6256/64902

• Amazon Web Services: provides cloud storage for uploaded avatars and user-selected images, and may process object data, network information and service logs. Privacy: https://aws.amazon.com/privacy/

• Cloudflare: provides Website delivery, security and Web Analytics, and may process IP address, browser/device information, page views, referrals and timing information. Privacy: https://www.cloudflare.com/privacypolicy/

We may also disclose data to professional advisers; regulators, courts or authorities where required or permitted by law; a buyer or successor in a corporate transaction; or other parties with your consent. Service providers are permitted to process data for the services they provide and as otherwise allowed or required by law.

6. Cookies, Similar Technologies and Analytics

The Website uses Cloudflare Web Analytics. The Services and supporting providers may use SDKs, cookies, pixels, beacons, local storage or similar technologies for operation, authentication, analytics, attribution, security and performance. Browser and device controls may allow you to limit some technologies, but doing so may affect functionality.

7. Cross-Border Transfers

Our infrastructure and providers may process or store personal data in Singapore and other countries or regions where they operate. For transfers outside Singapore, we take steps required by the PDPA to provide protection comparable to the PDPA, including contractual safeguards, provider assessments or other recognised mechanisms where applicable.

8. Data Retention

Account and profile data is generally retained while your account remains active. Viewing history, progress, preferences, community data and messages are retained as needed to provide the relevant features or until the account or data is deleted, subject to backup, moderation, security and legal requirements. Purchase and transaction records may be retained for accounting, fraud prevention, dispute resolution and legal obligations. Analytics, attribution, diagnostic, push and technical records are retained according to operational needs and provider configurations. Support and safety records are retained as needed to resolve requests, enforce rules and protect users. When data is no longer required, we delete or anonymise it where reasonably practicable and legally required.

9. Data Security

We use reasonable administrative, technical and organisational measures to protect personal data under our control against unauthorised access, collection, use, disclosure, copying, modification or disposal. Account tokens are protected using secure device storage, and network communications use encrypted transport where supported. No system is completely secure. We assess and address data breaches in accordance with applicable law, including notification duties where required.

10. Your Rights and Choices

Subject to the PDPA and applicable exceptions, you may request access to personal data under our control and information about its use or disclosure, request correction, withdraw consent with reasonable notice, manage device permissions, or complain about our handling of personal data. We may verify your identity and may charge a reasonable access fee where law permits after giving notice. Withdrawal does not affect earlier lawful processing and may limit certain features.

11. Account and Data Deletion

You may request account deletion in the App through Profile → Settings → Delete Account, or email [email protected]. After verification, we delete or anonymise associated personal data unless retention is required or permitted for legal obligations, transaction records, fraud prevention, safety, dispute resolution or enforcement. Deleting the App from a device does not by itself delete your account or server-held data. Account deletion does not automatically cancel a Google Play subscription; subscriptions must also be cancelled through Google Play.

12. Children

The Services are not intended for children under 13. Users who are below the age at which they may consent to personal-data processing where they live may use the Services only with the involvement and consent of a parent or legal guardian where required. We do not knowingly collect children's personal data contrary to applicable law. Contact us if you believe a child has provided data improperly.

13. Third-Party Links and Services

The Services may link to or integrate third-party services. Their independent processing is governed by their own privacy policies. Review those policies before using their services or providing data.

14. Store Disclosures

Our Google Play Data safety declaration is intended to reflect the released App's collection, sharing, security and deletion practices. If a store disclosure and this Policy differ, contact us so we can investigate and correct inaccurate information.

15. Changes to This Policy

We may update this Policy for changes to the Services, SDKs, practices or law. We will publish the updated version and revise the effective date. Where required, we will provide additional notice or obtain consent. Material changes may also be communicated in the App or through available contact details.

16. Contact Us

For questions, access or correction requests, consent withdrawals, account or data deletion, or complaints, contact:

NOVAPULSE AI PTE. LTD.

UEN: 202624393D

7500A Beach Road, #14-303

The Plaza

Singapore 199591

Email: [email protected]