Updated on: August 10, 2021

Effective on: August 10, 2021

As the platform operator of HeeSay mobile device software application, website, and any other mobile services owned, controlled, or offered by HeeSay now or in the future (collectively, the “HeeSay Services”), iRainbow Hong Kong Limited (hereinafter “HeeSay”, “we”, “us” or “our”) is fully aware of the importance of your Personal Information to you, and we respect and attach great importance to the protection of your privacy. In order for you to fully understand how we collect, use, process and store your Personal Information as well as your rights during your use of products or services on HeeSay platform, we have formulated this Privacy Policy (this “Policy”).

You shall understand and acknowledge that you have clicked to agree to this Policy during your registration process, and have agreed that we may lawfully use and protect your Personal Information in accordance with this Policy. If you do not agree with or understand any or all provisions of this Policy, you shall immediately stop using HeeSay products and services, and contact us via the contact details below.

Company name: BlueCity Group, iRainbow Hong Kong Limited Data Security and Compliance Department

Contact address: 3400 COTTAGE WAY, STE G2#23531SACRAMENTO, CA 95825

Contact information regarding Personal Information protection:data_protection@heesay.com

For other matters, please contact:global_appeal@heesay.com

You may consult the following indexes for more details of this Policy:

I. How We Collect Information

II. How We Store Information

III. How We Use, Share /Provide Information with/to Third Parties

IV. How We Protect Information

V. How We Use Cookie Information

VI. How You Access and Manage Your Information

VII. How We Protect Information of Minors

VIII. Disclaimer for Third Party Websites and Services

IX. Application and Update of the Policy

X. Miscellaneous

I. How We Collect Information

During your use of HeeSay products and services, we will collect information voluntarily provided by you during, and generated from, your use of services in the following ways for the purpose of providing and improving our services and safeguarding your account security.

1. We Collect Personal Data You Provide

(1) When you create a HeeSay ID, you are only required to provide your Personal Information that is necessary for you to register including yournickname, email address (phone number in South Korea, to prevent minors) and profile picture.Refusal to provide the above categories of information may prevent you from registering.

(2) In order to obtain better services, you can create a HeeSay Profile during or after your registering. When you edit the profile for your HeeSay ID, you can choose to provide us Personal Information about yourself for your public HeeSay profile. For example, in the HeeSay App, you may voluntarily provide your Personal Information, such as <span className="point">your photo, name for display, sexual orientation, date of birth, height, weight, body type, language, ethnicity, role, “Looking For,” relationship status, position and any other information</span> (“Personal Information”) that you add to your profile on the HeeSayApp (“Profile Information”). You should carefully consider what Personal Information to include in your Community Profile, and you can review and change that information at any time by accessing the “Edit Profile” section of the App. If you refuse to provide Profile Information, you may be unable to use all of our services normally.

(3) When you use the posts function, your uploadedphotos, videos, comments, likesand other information will be stored. You can also delete this information at any time. Unless after your voluntary choice or requested by relevant laws and regulations, we will not provide the above information or use it for other purposes.

(4) When you conduct "Top-Up" or "Withdrawal", we or a third-party payment channel will require you to upload yourcredit/debit card information. If you refuse to provide such information, you may not be able to use top-up or income withdrawal service, but it will not affect you using services such as browsing, chatting, initiating live stream and watching live stream.We will not collect your credit/debit card information.

(5) When you use live streaming services, we or our third party service provider may process your facial information in order to create special visualization effects such as adding virtual makeup, applying beautifying filter, etc. We or our third party service providers will not use your facial information for the purpose of facial recognition or use your facial information to recognize your identity. We currently use SenseME SDK for such purpose.

(6) If you provide us feedback or contact customer support, we collectyour e-mail address and possibly other Personal Data (e.g. IP address), as well as any other content that you send to us in order for us to reply and solve the issue. If you contact customer support, we also collect and retain certain technical diagnostic data, such asyour phone model. We may keep records of our communication with you, including any complaints we receive from you about other users (and from other users about you).

2. Personal Data We Receive From Your Device

(1) When you use our service, in order to ensure your normal use of our services, to maintain the normal operation of our services, and to optimize and improve our services and protect the safety of your account, we will collect information about your device model, operating system, unique device identifier(UID), login IP address, HeeSay version number,GPS location (current and last), browsing history, operation log and service log information, date/time stamp for your visit, app crashes, advertising IDs (e.g. Google’s ADID and Apple’s IDFA) which can be reset by going to your device’s setting).

(2) During your use of “Explore” function and “Travel Pass” function, after your consent, we will collect your precise location (e.g. your latitude and longitude) ("Location") to determine your distance in feet or meters from other users (“Distance Information”), and will record your IP address, to provide such function. Please see“How We Store Information” section for information on storage of this information. Should you choose not to allow the HeeSay App to access your Location, certain features (such as displaying nearby user profiles or features that include Location Sharing) of the HeeSay Services will not function properly. You may also revoke this permission and disable the location services on your device. You can do so on an iPhone by going to Settings-Privacy-Location-Services-HeeSay; and on Android, by going to Settings- Location-HeeSay-Permissions-Location.

(3) When you use “Search” or “Filter” functions, we will collect information of your usage includingyour search history, reading history, the time of your access, your comments and interactions recordsin order to provide you with more accurate and personalized services and content.

(4) When you use functions of voice dictation, text input and embedded translation functions, we will collect your voice recordings, the text information, and the text information to be translated because collection is necessary to achieve the above functions. After the real-time processing, we will return the processed result to you. Such information is necessary for the functions.

(5) HeeSay utilizes a HeeSay -generated device identifier which enables us to track your in-app HeeSay purchases over time. This device identifier is not used for third-party advertising and is used by HeeSay to deliver you the HeeSay Services including to ensure you receive effective and relevant marketing campaigns from HeeSay.

(6) If you upload a photo or video, or send an audio message, while using the HeeSay Services, you will be required to permit HeeSay to access your camera, photo gallery, and microphone in which case HeeSay will have access to the photos and videosstored in your photo gallery.

(7) When you send a message using the HeeSay Services (which could include content such as photos, location, audio, video, emoji, etc.) to other users of the HeeSay Services, the content of the message will be stored locally for 7 days. If you are reported by another user in a private chat, we will collect the chat history provided by the reporting user.

(8) We collect certain Personal Information that is generated through your use of the HeeSay Services. This Personal Information includes information about whose user profiles you have viewed, products and services you have purchased through the HeeSay Services, how you’ve interacted with the App, and how you communicate with other users.

3. Personal Data We Receive From Third Parties

(1) When you choose to make a purchase through the HeeSay Services, you submit Personal Information such asyour name, payment card information, billing information, address, telephone number, and email addressto one of our third-party payment processors. HeeSay does not receive or process payment card information directly; however, our third-party service providers may provide certain information to us (e.g.,your name, phone number, partial payment card number, and email address) We will use such information only for the purpose of verifying the purchases. We use Google Play for purchases on Android devices, Apple for purchases on IOS devices. Please review the Google and Apple privacy policies to better understand their practices.

(2) If you use or connect to the HeeSay Services or download the HeeSay Services through a third-party platform (such as Apple, Facebook, Google, or Twitter), you allow us to access and/or collect certain information (e.g., date of birth, account identifier, etc.) from your third-party profile/account (“Third-Party Data”). We may also access information contained in tracking technology placed on your device by the third-party platform. Remember, when you elect to create a HeeSay account via a third party, we may also provide such Personal Information to the third parties, so we recommend you read their privacy policies which control how they use your information and they may also provide additional data management tools you can use.

II. How We Store Information

1. Location of storage

The Personal Information collected, such asyour photo, name for display, sexual orientation, date of birth, height, weight, body type, language, ethnicity, role, “Looking For,” relationship status, position and any other information, will be transmitted to and stored in Singapore by our service provider: UCloud, unless:
(1) otherwise expressly requested by laws and regulations;
(2) otherwise expressly authorized by you; or
(3) you choose to conduct cross-border activities like live streaming/publishing posts via the Internet.

2. Storage period

HeeSay will retain your Personal Information as set out in the following table, and the retention period is in accord with statutory minimum storage period. As a principle, we will not retain any of your Personal Information beyond the period necessary to satisfy the purpose for which your Personal Information is processed, except where we are otherwise required by law. Should you or we terminate your account for any reason, we will take steps to ensure that your Personal Information is no longer available through HeeSay or otherwise retained by us, within a reasonable period of time (subject to technical limitations) after such account termination. Personal Information stored beyond such period will be physically deleted by HeeSay unless otherwise required by law. In some cases, HeeSay may retain chat messages record that results in account suspension due to reporting. Please note that HeeSay may also retain your personal data in accordance with valid legal requirements.

III. How We Use, Share /Provide Information with/to Third Parties

1. How We Use Information

(1) For the purposes specified in “How We Collect Information” in this Policy to operate and manage HeeSay;

(2) communicating with you, and sending important notices on products or services to you, such as:

A. notices regarding software updates and upcoming events of HeeSay . You may opt out by turning off notification permissions in the phone setting or replying to our email if you do not want to be sent notifications or included in our mailing list;

B. notices regarding any lucky draws, contests or similar promotion events organized by us in which you are a participant;

C. information related to your purchase, and changes in terms, conditions and policies (you may not opt out, as these are essential in the communications between you and HeeSay );

(3) providing services to you by us or our Affiliates during your continued use of HeeSay products or services; and

(4) to personalize HeeSay and provide value-added services.

when you register and use HeeSay , we may analyze part of your profile information, location information, interaction records, etc. And use such data for HeeSay value-added services, including but not limited to HeeSay X, Boost, Spotlight, Shadow privilege packages, etc.

(5) to improve our services; we collect information and reports about usage trends without identifying individual users (e.g., daily active users, monthly active users, usage time, etc.)

(6) for security and verification purposes, including to prevent and detect fraudulent activity;

(7) address and remediate technical issues and bugs.

2. How We Share Information

You agree and authorize us to share your Personal Information with our Affiliates and partners for providing better products and services to you as follows. In each case, we will request such Affiliates and partners to store and process your Personal Information in accordance with our instructions, this Policy and any other agreement:

(1) The HeeSay App is designed to allow users to share Distance Information. Distance Information is public and indicates to other users of the HeeSay App the distance you are in feet or meters from them. Your Distance Information will be displayed in your profile in those users' search results should you elect to display your relative distance. HeeSay App users can use "Shadow Privileges Pack" searches other users near the shadow location or the “Explore” feature in the HeeSay App to search for other users in a geographic location outside of their immediate location. Users who use the unauthorized malware, or other users who change their location while you remain in the same location, may use Distance Information to determine your exact location and may be able to determine your identity. You can revoke location authorization on an iPhone by going to Settings-Privacy-Location-Services, and on Android, by going to Settings-Location- HeeSay - Permissions-Location.

(2) We share the Identifier for Vendor associated with advertising IDs (e.g. Google’s ADID and Apple’s IDFA), a portion of your Profile Information, and Location Information, with our advertising partners. These third parties may also collect information directly from you as described in this Privacy. Our advertising partners are aware that such data is being transmitted from HeeSay . The privacy policies of these third-party companies apply to their collection, use and disclosure of your Personal Information. We will share the collected advertising IDs of your device to the advertising media for our advertising. Our advertising partner with which we share the collected advertising IDs of your device is ADTIMING TECHNOLOGY CO. Ltd. Please note that we currently do not share information about your Personal Information with any advertising companies. Note that for California consumers, if you accept sharing with our advertising partners you are directing us to disclose the information described in this paragraph to third-party advertising companies. You can limit third parties’ uses of your Personal Information by going to the Settings-Privacy-Advertising. You can also contact us through the contact information in this policy.

(3) Our advertisers and certain service providers in the following table also use their own cookies or other tracking technologies (such as software development kits or “SDKs”) which may collect information about you within the HeeSay Services. They will, however, receive the advertising ID associated with your device and know that the ID was identified on HeeSay . You can find more information about third-party tracking technologies in our Cookie Policy section.

In the mobile environmet, most mobile operating systems offer device-based opt-out choices that are transmitted to companies providing interest-based advertising.To set an opt-out preference for a mobile device identifier (such as Apple's IDFA or Android's GAID), visit the device manufacturer's current choice instructions pages, or read more about sending signals to limit ad tracking for your operating system here:http://www.networkadvertising.org/mobile-choices

3. In Order To Better Use Our Software, You Share Your Personal Data In The Following Circumstances:

(1) The HeeSay App is a social networking platform, designed to allow users to connect and share information. When you use the HeeSay Services, your Profile Information is public, and other users of the HeeSay App can see your Profile Information and other Personal Information (probably including sensitive personal data) posted by you. For example, other users can search for you, search for your profile characteristics, see if you’ve viewed their profile, or see you listed as being within their vicinity. Do not include information in your profile that you want to keep private.

(2) You may choose to send messages, including photos, audio, location, emoji or videos, to other users. If you send messages, you will be providing your Personal Information to the user who views your message. Please don't send messages or share content that you wouldn't want someone to save or share as users may save content or copy it outside the HeeSay Services. Chat messages are stored locally on devices. Therefore, if you choose to delete your account, messages you sent to another user may still be available on that user’s device. Do not share your Account Credentials or payment information via messages (or any third-party platforms).

(3) Social Features. The HeeSay Services permits interactions that you initiate between the HeeSay Services and third-party websites or services, including third-party social networks (collectively "Social Features"). For example, you may be able to "like" or "share" content from the HeeSay Services on other websites or services, such as Facebook. If you use Social Features on the HeeSay Services, both HeeSay and the third-party services that operate those Social Features may have access to certain Personal Information about you and your use of both the HeeSay Services and theirs. The Personal Information collected and stored by third parties remains subject to those third parties' practices about privacy, including whether the third parties continue to share Personal Information with us.

4. Providing information to others

At the moment, we will not take initiative to share your Personal Information with or transfer your Personal Information to any third party other than our Affiliates. If we intend to or if you request us to share or transfer your Personal Information with or to any third party other than our Affiliates, we will obtain or ensure that such third party will obtain your express consent of such sharing or transfer.

We will not disclose the Personal Information we collected to the public. If it is necessary to do so, we will inform you of the purpose of the public disclosure, the type of information to be disclosed and the Sensitive Personal Information that may be involved, and obtain your express consent.

With the continuous development of our business, it is likely that we will carry out transactions such as merger, acquisition and asset transfer, in which case we will inform you of the relevant situations and continue to protect, or request the new controller to continue to protect, your Personal Information in accordance with laws and regulations at standards no less stringent than those in this Policy.

We will not make available (including share, transfer and publicly disclose) your Personal Information to any third party without your permission; if we want to use your information for other purposes or new business purposes not specified in this policy, we will inform you in advance and seek your consent.

5. Exceptions

In accordance with relevant laws and regulations and national standards, in the following circumstances, we may collect and process your relevant personal information without asking for your consent:

(1) When it is necessary to protect and promote major public interests such as public safety, public health, and public knowledge;

(2) When it is necessary to respond to a criminal investigation, prosecution, trial or execution of judgments;

(3) When it is necessary to protect vital legitimate interests of you or of other individuals, such as right of life, property, and reputation, while it is impractical to obtain the consent of the individual;

(4) When the personal information is disclosed to the public by yourself and such processing is within your reasonable expectation having regard to the context of such processing;

(5) When it is necessary for other reasonable purposes after taking into consideration—

• (a) the interest of you in processing for that purpose;
• (b) whether we can reasonably be expected to obtain your consent;
• (c) any public interest in processing for that purpose;
• (d) the effect of the processing activity on your rights; and
• (e) your reasonable expectations having regard to the context of the processing.

The “reasonable purposes” may include —

• (a) prevention and detection of any unlawful activity including fraud;
• (b) whistle blowing;
• (c) mergers and acquisitions;
• (d) network and information security;
• (e) credit scoring;
• (f) recovery of debt;
• (g) processing of publicly available personal data; and
• (h) the operation of search engines

(6) When it is necessary to respond to other circumstances as stipulated by laws and regulations.

IV. How We Protect Information

1. The security of your Personal Information is highly valued by us. We will adopt encryption technology to protect your Personal Information during transmission. Data will be stored in an encrypted form, including those stored at third parties.

2. In order to protect your Personal Information, we will adopt access control, malicious code prevention mechanism and security audit for your Personal Information in addition to encryption. We will take various security protection measures to ensure information security with a reasonable security level. Encryption, de-identification and other means will be used to protect your Personal Information.

3. To prevent your Personal Information from leakage, we will strengthen the security capability of the app installed on your device by constantly improving technical means. For secured transmission, we will carry out part of the information encryption on your device locally, and in order to prevent computer viruses, Trojan horses or other malicious programs or websites, we will collect the information on applications installed or processes running on your device.

4. We have set up and designated the department and the personnel responsible for Personal Information protection to supervise and administer the collection, use, sharing and authorized processing of Personal Information, and to conduct Personal Information security impact assessment. We will deploy access control mechanism to ensure to the maximum extent possible that the access to Personal Information is restricted to authorized personnel only, and will hold training sessions on security and privacy protection to enhance our employees’ awareness of the importance of Personal Information protection.

5. We have set up special management system, process and organization to ensure information security. We will strictly limit the scope of personnel with access to information, request them to abide by confidentiality obligations, and conduct audits.

6. We have prepared emergency plan for Personal Information security incidents, and will arrange emergency response trainings and emergency drills for our employees on a regular basis, so as to familiarize them with job responsibilities and emergency response strategies and procedures. In case of any security incident such as Personal Information leakage, we will activate the emergency plan to prevent its escalation, and inform you via push notification, announcement or in other forms.

7.Please properly keep your HeeSay ID . During your use of certain HeeSay services or applications, or when you publish posts in other forums, chat rooms or social networks, the Personal Information and contents you share will be accessible to, and may be read, collected or used by, other users. You shall be solely responsible in respect of the Personal Information that is shared or published by you. If you become aware that your HeeSay ID and/or other Personal Information might be or have been leaked other than through your own disclosure, please contact us immediately so that we may take corresponding measures in a timely manner to avoid or mitigate the relevant losses.

8. Your safety and security are important to us. As such, we use automated decision-making as a part of our platform moderation efforts (for example, removing spammers) including to assist in our efforts to prevent and respond to illegal, malicious, and unauthorized activity. If you are notified that your account has been suspended and you believe this is an error, please email a Customer Support representative at global_appeal@heesay.com to seek an appeal.

9. We have the right to refuse to deal with any request if it is meaningless/importuning or extremely unrealistic, or will impair others’ privacy rights, or where access to information can be denied pursuant to local laws.

10. HeeSay takes the privacy and security of your personal data very seriously. Even so, transferring data on the Internet or storing data electronically is not completely secure. If, as required by law, we need to notify you about any unauthorized access to your personal data, then we may send you a notice in electronic or written form in accordance with applicable law.

V. How We Use Cookie Information

Cookie and other similar technologies may be used in HeeSay’s website, online services, interactive application, email boxes and advertisements. Such technologies help us better understand the behaviors of our users, let us know which sections of our website have been visited, and measure the effects of advertisements and web searches so that we can make improvements. Information collected through cookie and other technologies will be treated as non-Personal Information, provided that we will treat Internet Protocol (IP) addresses or similar identifiers as Personal Information if it is so required by local laws. Similarly, for the purpose of this Policy, in the case of combination of non-Personal Information with Personal Information, we will treat the combined information as Personal Information.

Like most Internet service providers, we will automatically collect certain information and store it in logs, including IP address, browser type and language, Internet service provider (ISP), referring/exit pages, application, operating system, date/time stamp, and clickstream data.

We use such information to understand and analyze trends, administer our website, track users’ behaviors on our website, improve our services and collect demographic information about our user base as a whole. HeeSay may use such information for marketing and advertising services.

VI. How You Access and Manage Your Information

1. Manage your information

(1) You may update or correct your Personal Information during your access to or update of your Personal Information or if you find that we have made errors in processing your Personal Information. You may exercise your access right and update or correct any part of your Personal Information at any time through the following path:

A. For inquiry about your Personal Information, click “Me” at the bottom right corner and click the top right corner to view your profile; and

B. For correction of your Personal Information, click “Me” at the bottom right corner, click the percentage icon at the top right corner to go to the profile page, and then edit your profile;

(2) For deletion of your Personal Information, click “Me” at the bottom right corner and click the percentage icon at the top right corner to change the information to “Do Not Show”. In case of any situation where the information cannot be deleted by yourself, you may send an email toglobal_appeal@heesay.comspecifying the situation, and our staff will reply within 15 working days.

2. Your Rights

Some jurisdictions may give you the right to request that we:

(1) Provide you with information about our processing of your Personal Information and give you access to your Personal Information.

(2) Update or correct inaccuracies in your Personal Information.

(3) Delete your Personal Information.

(4) Transfer a machine-readable copy of your Personal Information to you or a third party of your choice.

(5) Restrict the processing of your Personal Information.

(6) Withdraw consent that you have previously given us. You may make this request at any time. Revocation of your consent will only apply to future processing activities and will not apply retroactively.

(7) Where your jurisdiction’s law allows, object reliance on our legitimate interests as the basis for processing of your Personal Information.

While we honor the above requests if required to do so by law, there are situations in which we may not be able to agree to a particular request. For example, it is not possible for us to delete your Personal Information if we are required by law to keep it (e.g., for tax and accounting purposes), or if we need it to perform a contract with you. Similarly, access to your Personal Information may be refused if making the information available would reveal Personal Information about another person or if we are legally prevented from disclosing such information. If we decline your request, we will tell you why, subject to legal restrictions.

Please note that due to HeeSay’s retention practices, some historical data may not be available as it is no longer held in HeeSay’s systems. Please see "How We Store Information"above. You can submit a request by emailing to data_protection@heesay.com or our postal address provided below. Where necessary, we may request specific information from you to verify your identity prior to processing your request. If you invoke your rights as listed in this section, HeeSay utilizes third parties to help fulfill your requests to exercise your rights under this document.

Addendum for California Residents

The terms of this Addendum apply to residents of California under the California Consumer Privacy Act (“CCPA”) and other applicable laws. The CCPA provides California residents with certain legal rights such as access, deletion, disclosure, or “do not sell.” These rights are not absolute and are subject to certain exceptions.

Collection and Disclosure of Personal Information

Over the past 12 months, through your use of HeeSay , we may have collected and disclosed the following categories of personal information from or about consumers, as defined in the CCPA:

• Identifiers, such as phone number, name, nickname, token, username, IP address, mobile application store user ID, mailing address, emergency contact information, and contact list. This information is collected directly from the consumer or device.

• Geolocation data, including geolocation information derived from GPS coordinates, Wi-Fi access points, the compass, the accelerometer, IP address, and public posts. This information is collected directly from the consumer or device.

• Internet or other electronic network activity information, including your device model, network type, OS type and version, client version, call history, chat data, invitations data, call credits history, search history, log data, information linked to social media accounts linked to use of HeeSay , and survey information. This information is collected directly from a device.

• Biometric information, such as voiceprints and facial recognition data. This information is collected directly from the consumer or device.

• Commercial information, including payment card information and transaction verification information. This information is collected directly from the consumer or device.

• Audio, electronic, visual, thermal, olfactory, or similar information, including a profile picture. This information is collected directly from the consumer.

• Other information that is described in subdivision (e) of Section 1798.80, such as nationality and gender (this information is being collected in the consumer context rather than the employer context). This information is collected directly from the user.

We collect personal information for the following purposes:
• To operate and administer HeeSay ;
• To communicate with consumers;
• To personalize HeeSay, including providing personalized advertisements and value-added services;
• To improve our services;
• For security and verification purposes, including to prevent and detect fraudulent activity; and
• To address and remediate technical issues and bugs.

For additional information about what each type of personal information is used for, see “How We Use, Share /Provide Information with/to Third Parties” t of this Policy.

We disclose personal information to the following types of entities:
• Our affiliate companies within our corporate group who process your personal information in order to operate the HeeSay Services
• Other companies that provide services on our behalf who are prohibited by contract from retaining, using, or disclosing personal information for any purpose other than for providing the services to us
• Other users of HeeSay with respect to personal information you publicly post throughHeeSay
• Regulators and judicial authorities and law enforcement agencies
• Entities that acquire all or substantially all of our business

In the past 12 months, we have not sold personal information of California residents within the meaning of “sold” in the CCPA.

Rights under the CCPA

If you are a California resident and the CCPA does not recognize an exemption that applies to you or your personal information, you have the right to:

• Request we disclose to you free of charge the following information covering the 12 months preceding your request:

(a) the categories of personal information about you that we collected;

(b) the categories of sources from which the personal information was collected;

(c) the purpose for collecting personal information about you;

(d) the categories of third parties to whom we disclosed personal information about you and the categories of personal information that was disclosed (if applicable) and the purpose for disclosing the personal information about you; and

• Request we delete personal information we collected from you, unless CCPA recognizes an exemption; and

• Be free from unlawful discrimination for exercising your rights including providing a different level or quality of services or deny goods or services to you when you exercise your rights under the CCPA.

We aim to fulfill all verified requests within 45 days pursuant to the CCPA. If necessary, extensions for an additional 45 days will be accompanied by an explanation for the delay.

How to Exercise Your Rights

For consumers in California, by accepting this privacy policy and clicking "Agree and Accept" when creating a HeeSay account, you agree that we will disclose, share, and use the relevant information in the manner described in this policy. If you decide that you no longer want HeeSay or partners to use your information for their commercial purposes, or if you do not want partners to retain information after providing services to us, you can turn off the relevant permissions on your device and log in to your Account and manage your data from there. Of course, HeeSay may add different preference settings in subsequent versions, you can turn off the sharing of specific information by setting in the app. We will not give any special notice for this, please pay attention to the changes in HeeSay . If you are a California resident to whom the CCPA applies, you may exercise your rights, if any, to other data by contacting us at data_protection@heesay.com

Addendum for Korean Users

The personal information we provide to third-parties located outside of Korea for the HeeSay service is as follows:

The mandatory retention periods for personal information required by law in Korea is as follows:

We destroy personal information upon the extinguishment of need for such personal information, such as the expiration of its retention period and achievement of its purpose for processing, except where there is a law or regulation that requires us to retain that personal information. Personal Information that needs to be destroyed is destroyed in accordance with our data deletion and retention protocols under the supervision of our Data Protection Officer.

For residents of the Republic of Korea, this Policy and any disputes arising from and in connection with this Policy between you and theHeeSayshall be governed by, construed and executed under the laws and regulations of the Republic of Korea. If any such dispute cannot be settled, such dispute shall be referred to and finally settled by international arbitration at the Korea Commercial Arbitration Board.

Additional Privacy Requests for Users in Brazil

Residents of Brazil, can exercise certain data subject rights available to them under applicable data protection laws. Where such rights apply, we will comply with requests to exercise these rights in accordance with applicable law. Please note, however, that we are not legally required to accommodate such requests under all circumstances, which may include if we need to keep processing your information for our legitimate interests or to comply with a legal obligation. We may request you provide us with information necessary to confirm your identity (such as your IP address, date of birth, transaction IDs, and email address) before responding to your request.

3. App permission management

(1)Permission to access location information: After you log in to HeeSay app, you may choose to grant such permission for you to receive location-based service recommendations. If you choose not to grant such permission, you will not receive location-based service recommendations, while your use of other services of HeeSay app will not be affected.

(2)Permission to read cellphone status: During your installation of HeeSay app, we will request such permission from you to read your device identification information, device status information and device contexts information in order to complete security risk control verification of your account. If you choose not to grant such permission, you may still use our services, while you may be unable to complete the security risk control verification.

(3)Permissions to access camera and photo album: You will be requested to grant permission to access camera and/or photo album (subject to the specific function to be used) before you use certain functions such as camera, instant video, live streaming and scanning, so that you can take or upload real-time photos/videos. If you choose not to grant the corresponding permission, you will be unable to use the specific functions related to real-time photo/video shooting or uploading, while your use of other services of HeeSay app will not be affected.

(4)Permissions to access microphone: You shall grant such permission and use microphone device for voice input when you use such functions as voice dictation, instant video and live streaming. If you choose not to grant such permission, you will be unable to use the specific functions related to voice input, while your use of other services of HeeSay app will not be affected.

4. Cancellation and deletion of your account

To apply for cancellation and deletion of an account, please log in to such account and complete the cancellation procedures in the app through the following path: [Me]-[Settings]-[Account and Security]-[Cancellation of Accounts]. The preconditions, cautions and possible consequences will be displayed in detail before the process. If you log in within 7 days after the cancellation procedure is completed, the cancellation shall be deemed as withdrawn; the account will be permanently canceled and deleted, and can no longer be recovered after 7 days. Please proceed prudently. After the permanent cancellation of your account, we will delete or anonymize your Personal Information.

VII. How We Protect Information of Minors

We value the protection of minors’ Personal Information. If you are under the age of 18 (or similar minimum age stipulated in the relevant jurisdiction, for example, 19 in South Korea), you may not create any HeeSay ID and we will not provide services to you. HeeSay does not knowingly collect or process minors’ information. We will delete your Personal Information collected by us once we become aware of such collection. If you know that any child or minor has submitted personal data in the HeeSay service, please use the information provided above or use the application reporting tool to contact us so that we can take appropriate measures.

VIII. Disclaimer for Third Party Websites and Services

There may be links to third parties’ websites, products and services on or in HeeSay’s website, app and services. Information collected by a third party which may contain location data or contact information will be subject to the third party’s privacy policy. You are advised to understand such policy. We do not control or review the privacy policy or practices of such third parties, nor shall we be liable for any responsibilities arising therefrom. After clicking a link directing to an external website or third-party application, this policy shall not be applicable.

IV. Application and Update of This Policy

This Policy applies to all of our services.

We will update this Policy as appropriate in the event of any of the following major changes:

(1) change in our basic conditions, such as change of ownership as a result of merger, acquisition or restructuring;

(2) change in the scope, purpose and rules of collecting, storing and using Personal Information;

(3) change of the third parties to whom we provide Personal Information or in the scope or purpose of providing Personal Information to third parties;

(4) change in how you may access and manage your Personal Information;

(5) change in data security capability or information security risks;

(6) change of the channels and mechanisms for user inquiries and complaints or of the external dispute resolution agencies or their contact details; or

(7) other changes that may have a significant impact on your rights and interests in and to your Personal Information.

Given the large number of our users, we will notify you of any update of this Policy via app push notification, pop-up prompt, or email/SMS or announcement on the app. You are advised to promptly inform us of any change in your contact details in order for you to receive our notice in time. By continuing to use our services after the updated Policy takes effect, you acknowledge that you have fully read, understood and accepted, and are willing to be bound by, the updated Policy.

XI. Miscellaneous

1. Data Transfer

As stated in this Policy, all the information you provide may be transmitted or shared by us to third-party organizations outside your country or region of residence, and because our advertising partners and service providers are located globally, we may transfer or share your Personal Information with third-party organizations outside your country or region of residence for the purpose of providing services to you. To ensure the safety of your Personal Information, we will implement a strict cross-border data transfer mechanism including requiring the data recipient to provide appropriate safeguards to your Personal Information.

2. Company-wide commitment to your privacy

In order to ensure the security of your Personal Information, we have communicated HeeSay’s privacy and security guidelines to all our employees and strictly implemented privacy protection measures in our group company.

3. Contact us

Should you have any questions or concerns about HeeSay’s privacy policy or data processing, or intend to file a complaint about potential violations of local privacy laws, please contact us through the following methods. All such communications will be investigated and, if possible, responded to within 15 working days.

Company name: BlueCity Group, iRainbow Hong Kong Limited Data Security and Compliance Department

Contact information of the person in charge of Personal Information protection: data_protection@heesay.com

Contact for other matters: global_appeal@heesay.com

Contact address: UNIT 417 4/F LIPPO CENTRE TOWER TWO NO.89 QUEENSWAY ADMIRALTY HK

4. Certain definitions in this Policy

“Affiliates” means the subsidiaries controlled by BlueCity Group, including but not limited to iRainbow Hong Kong Limited and Blued Japan株式会社. “Affiliate” means, with respect to any person, any company or lawful organization that now or hereafter controls, is controlled by or under common control with such person, or the legal successor thereof.