This English version is the legally binding one. A Traditional Chinese translation is provided for convenience only.

1. Who is responsible

Chen Law Cultural Enterprise Co., Ltd. (誠律文化事業有限公司, unified business no. 62107935), a limited company incorporated in Taiwan that operates the Service under the name OpenStela, is the controller of the personal data described here. Until 11 October 2026 the controller was OpenStela, a sole proprietorship established in Taiwan; on 12 October 2026 the Service and the data it holds passed to the company unchanged — the same data, used for the same purposes, kept for the same periods, with the same contacts below. The Service was named Avatar Lab (avatar-lab.app) until 16 September 2026; the controller and your data are unchanged by the rename to OpenStela (openstela.io).

Privacy contact: privacy@openstela.io · General contact: support@openstela.io

2. Summary — the four things that matter most

3. What we collect

3.1 Account data

3.1A Public creator page and notifications

Public creator page. If you set a handle, a page at /u/<handle> shows your handle, display name, bio, the characters that have a registry number and the works you have registered — all of them unless you mark an item private. That page is visible to anyone, including search engines and social-media link previews, and can be shared by anyone. Your email address and internal user ID are never shown. Your page and your record cards also show a public account number (AC-…), generated at random and not derived from your email or internal ID; from version 2 onward, registration records name the registrant by this number. Records written before 28 September 2026 contain an internal identifier and are kept unchanged because anchored records cannot be altered, but public endpoints no longer return their contents; only your own Proof Pack includes the full record. Remove the handle in Account settings and the page is gone; links you have already shared will stop working.

Notifications. We keep the most recent 200 notifications per account. They are included in your data export and deleted with your account. Product-notice emails (deal progress, new messages, anchoring, channel expiry, billing and security) are sent to your sign-in email through our email provider (section 5) as part of providing the Service. Deal and message notices are batched into at most one email per 15 minutes; everything else goes into a daily digest. Every email carries a one-click unsubscribe link, and you can turn product-notice emails off in Account → Preferences at any time; in-product notifications continue regardless. Marketing emails are separate and are sent only with your explicit opt-in.

We request only the minimum OAuth scopes: openid email profile from Google, user:email from GitHub. We do not receive your password, contacts, files, calendar or any other data from those providers.

3.2 Content you create or upload

• Character specifications — the text you write, or confirm after we read a draft out of your images.
• Images and files you upload: source images for a character, and the files you register as works (or the URL, when you register a work by link).
• Reference sets assembled from the images you uploaded.
• Adapter packs and platform anchor text derived from the above.

3.3 Usage and technical data

• Model-processing events: timestamp, model used, token counts, error and failure modes — from reading a draft specification out of your images and from evidence checks. This is the metadata referred to in Section 2.
• Funnel milestones: internal user ID plus which step of the product you reached (signed up, created a character, registered, and so on). Deliberately milestones only — not every click — and it records the internal user ID, not your email.
• Billing records for deal fees: status, amount, currency, payment provider event ID.
• Cookies. Two, both first-party and strictly necessary: a signed session cookie that keeps you logged in, and a short-lived cookie (10 minutes) that remembers where to send you after login. We use no advertising or tracking cookies.
• Server logs. Our hosting and CDN providers process request logs which may include IP address, user agent and timestamps, for security and reliability. Aggregate page-view analytics may be collected at the network layer without cookies.

4. Why we process it, and on what legal basis

Where we rely on legitimate interests, you may object — see Section 8.

5. Who we share it with

We do not sell personal data and do not share it for advertising. We use the following processors and providers:

We may also disclose data where required by law, court order, or to establish or defend legal claims.

6. International transfers

Your data is stored in Japan and transmitted to providers in the United States and elsewhere. Where a transfer is from the EEA or UK, it is made on the basis of the European Commission's Standard Contractual Clauses or an adequacy decision, as applicable to the provider concerned.

7. How long we keep it

8. Your rights

Subject to your location, you may have the right to: access your data; correct it; delete it; export it in a portable format; restrict or object to processing based on legitimate interests; and withdraw consent where processing rests on consent.

Export is partly built into the product: character specifications, reference images and adapter packs can be downloaded from the interface at any time, in open formats (JSON, standard image files, plain text).

Export and deletion are built into the product. Settings → Your data downloads a complete copy of your account; Settings → Delete account removes it, and the account is held recoverable for 14 days before it is purged. All other requests are handled on request — write to privacy@openstela.io. We acknowledge within 5 working days and complete within 30 days. There is no charge unless a request is manifestly unfounded or excessive.

• Taiwan (Personal Data Protection Act): you may request review, duplication, supplementation or correction, cessation of collection, processing or use, and deletion.
• EEA / UK (GDPR): the rights above, plus the right to lodge a complaint with your supervisory authority.
• California (CCPA/CPRA): the right to know, delete, correct, and to opt out of sale or sharing — noting that we do not sell or share personal information as those terms are defined.

9. The limit on deletion — blockchain anchoring

If a character of yours was issued a Character ID and anchored, a hash of its specification forms part of a Merkle tree whose root was written to a public blockchain.

• The chain stores a 32-byte root only. It contains no name, no email, no image, and no readable text.
• The hash is one-way: the specification cannot be reconstructed from it.
• It cannot be deleted, by us or by anyone. Public blockchains are append-only. It will remain after you delete your account.

We can, and on request will, delete the local batch record that connects your character to a position in that tree — after which the on-chain root can no longer be used to demonstrate anything about your character. Please note that doing so also destroys your ability to use the anchor as evidence.

9A. Registered works, evidence records, channels and the deal room

Works. If you register works (audio, video, images, or links), with or without a character, we store the uploaded files and their metadata to operate the feature: title, private notes, the rights declaration, the attribution name you give (which may be a pen name), the creation date you claim, whether AI tools were used and, if so, the description of your own contribution, and timestamps. Attribution, claimed date, AI-use and contribution form the work's authorship record; only the SHA-256 fingerprint of that record and of the file — never the work or the text itself — enters the public blockchain anchoring described in Section 9, but the record cannot be edited after registration. Public by default: unless you switch the work off, its title, attribution, claimed date, contribution description, fingerprints, anchoring status and bound characters are shown on your public page and on the work's own public page, which anyone can read and share. Private notes are never shown. Deleting a work removes the file from our storage; the authorship record, any binding record and the anchored fingerprints cannot be removed, and the public verification endpoint will state the work has been deleted. For linked works we store a snapshot of the linked page or its oEmbed record fetched once at registration; we do not monitor the link afterwards. When a character is sold through the deal room, the works bound only to that character move to the buyer's account with their files and records; the authorship record continues to show your display name as the original registrant, and the buyer sees it.

Evidence records. For each work bound to a character we run automated checks on how it relates to that character: file dates against the character's registration date, the names and dates found on the linked page, the rights you declared, how long the work has been public, and whether the link falls under a channel you have verified. The results, a timestamp and the method version are stored as records and their fingerprints are anchored. These checks do not analyse image content. The marker, palette and face-similarity checks that earlier versions of this policy described were withdrawn on 18 September 2026; no biometric measurement of any kind is performed, and no biometric templates exist or are created. Earlier records of those checks remain in the registry (they are anchored and cannot be removed) but are no longer displayed.

Channel verification. If you verify a channel (a website or social account), we store the channel URL, the one-time code, the date and method of verification and a snapshot of the page where the code was found. Verification lapses after 90 days.

YouTube sign-in verification. This service uses YouTube API Services. If you verify a YouTube channel by signing in with Google, we read the list of channels owned by your Google Account once, with read-only access, to match the channel; we store only the channel ID and title, never keep the access token, and do not read your videos, comments or any other YouTube data. You can revoke this access at any time at myaccount.google.com/permissions. Use of this feature is also subject to the Google Privacy Policy and the YouTube Terms of Service.

Deal room. If you negotiate or sign a contract in the deal room, we store the draft and signed contract text, the parameters and clauses each party set, in-app messages between the parties, signature timestamps, payment-sent and payment-received confirmations, dispute notes and the resulting transfer record. The counterparty sees the legal names and contact details you enter into the contract; the public character page shows only platform handles. Signed contract fingerprints are anchored (Section 9); the text itself is never published. Deal records are kept for as long as either party's account exists and for 6 years thereafter, because they evidence a transfer of rights that either party may need to prove later.

Posts. If you post, we store the text, the time, any character or work you attach and your account, and any images, video or link you add. Images are re-encoded before they are stored, which removes their metadata (including camera details and location); in mp4 and mov videos we blank the location and device data before storing them (other embedded data in a video may remain, so check your file before posting). For a link we store the preview we fetched from that page (title, summary and a copy of its image), so viewers' browsers do not contact the linked site until they open it or play an embedded player. Posts are public on your profile and in your followers' feeds. Deleting a post deletes it; deleting your account deletes all your posts, and they are included in your account copy. Posts are not anchored.

Comments, quotes, likes, saves, reposts, mutes and blocks. If you comment or quote, we store the text, the time, the item it is on and your account; if you mention someone, they are notified unless they have muted or blocked you. Comments are public: anyone who can see the item sees the comment with your profile name, address and avatar. Likes (including likes on comments) and reposts are shown as counts, and anyone can open the list of accounts with a public profile that liked an item; a repost or quote is shown to your followers with your name. Who you follow and who follows you are shown on your public profile, together with any links you add and the platform accounts you add (marked self-declared until you verify them). Anyone, signed in or not, can search public profiles and posts by name, handle, bio or text. Saves, mutes and blocks are visible only to the account that set them; the holder of an item sees how many times it was saved, but not by whom. You may follow a character; its holder sees how many people follow it, but not who. Series you create (title, description, which works and in what order) are shown on your profile when you make them public. We suggest accounts to follow based on who the people you follow follow and on recent public activity. Push notifications are off until you turn them on for a device; we then store that device's push subscription (an address at your browser's push service and its keys) until you turn it off or delete your account, and send messages, deal steps and mentions (and likes, follows and comments only if you choose), end-to-end encrypted, through that service (for example Google, Mozilla, Apple or Microsoft). In our iPhone, iPad and Android apps, push is delivered instead through Apple Push Notification service or Google Firebase Cloud Messaging: we store the device token they issue, on the same terms, and the app tells us its version and platform (iOS or Android) with each request. When we act on a report, the reporter is told the outcome (not who was reported) and the author of removed content is told it was removed and why. If you report a comment or a post (a character or work) we store your account, the reason and any note you add, and keep the report for up to 2 years to handle it and to deal with repeated abuse. Deleting a comment deletes its text. Deleting your account deletes the text of all your comments (a comment that has replies keeps a "deleted" placeholder so the replies still make sense) and removes your follows, likes (including likes on comments), saves, reposts, mutes and blocks. Your account copy (Section 8) includes your comments and quotes, follows, likes, saves, reposts, mutes and blocks. None of this is anchored.

9B. The browser extension, social post links and files sent from Higgsfield

Browser extension. The OpenStela extension runs only on StreetVoice, Suno, SoundCloud and Higgsfield. On those pages it reads the page address, song titles and the addresses of video and image files shown on the page, so it can offer a "Register on OpenStela" button. It does not read your account on those sites, your cookies, your browsing on other sites or anything you type, and it sends nothing anywhere until you press its button. Pressing it opens OpenStela with the song or file address filled in; nothing is registered until you submit the form. The extension has no analytics and stores nothing.

Links to social posts. When you register a link to an Instagram, TikTok, X, Facebook or Threads post, we read the post's public preview (TikTok's and X's public oEmbed service, or the page's preview tags) and keep that snapshot as part of the record, as we do for other links. If the platform gives no public preview, we record only the address you supplied and mark the record "link supplied by the registrant".

Files sent from Higgsfield. When you register a Higgsfield creation through the extension, we download that file from Higgsfield's file servers using the address on the page and store it like an uploaded file. The record notes that the file came from Higgsfield; the download address itself is kept only in your account and is not shown on public pages.

10. Security

Sessions use signed cookies with expiry; login tokens are stored hashed, never in plain text; unverified email addresses are rejected outright; webhook payloads from the payment provider are signature-verified and processed idempotently. Access to production data is limited to the operator.

No system is perfectly secure. Where a breach is likely to result in a risk to your rights, we will notify you and the relevant authority as the law requires.

11. Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us with personal data, contact privacy@openstela.io and it will be deleted.

12. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you by automated means. Evidence-check results are measurements about content, presented to you and — if you list the character — to the public; they are not decisions taken about you. Quota and storage limits are applied automatically as contractual rules, not as profiling. The platform's dispute decisions in the deal room (Terms, Section 4B) are taken by a person.

12A. Additional information for users in the EEA, the United Kingdom and Switzerland

This Section applies if you are in the European Economic Area, the United Kingdom or Switzerland, and supplements the rest of this Policy under the GDPR, the UK GDPR and the Swiss FADP.

Controller and representative. The controller is Chen Law Cultural Enterprise Co., Ltd., a company incorporated in Taiwan that operates the Service as OpenStela (Section 1). We have not appointed a representative in the EU or the UK under Article 27 GDPR, relying on the exemption for occasional, low-risk processing; if our processing of data of persons in the EEA or UK ceases to be occasional, we will appoint one and name it here. We have not appointed a data protection officer; the privacy contact in Section 1 handles all requests.

Legal bases. The table in Section 4 states the Article 6 basis for each purpose. Where we rely on legitimate interests (security, abuse prevention, quality improvement from generation metadata), we have balanced those interests against your rights and concluded that the processing is limited to technical metadata and does not concern the content of your characters. You may object at any time (Section 8). Where processing rests on consent (none of the current processing does, other than your choice to list a character publicly), you may withdraw it at any time without affecting prior processing. We do not process special categories of personal data (Article 9) and ask you not to upload any.

International transfers. We are established in Taiwan, which is not the subject of an adequacy decision. Data you provide to us is processed by us in Taiwan and stored with our hosting provider in Japan (Section 5). Onward transfers to our processors in the United States (Google, Cloudflare, Polar) are made under the European Commission's Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum, or under the EU-U.S. Data Privacy Framework where the provider is certified. You may request a copy of the relevant safeguards from the privacy contact.

Your rights. You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and the right not to be subject to solely automated decisions (Art. 22). Export and deletion are built into the product (Section 8); other requests go to the privacy contact and are answered within one month, extendable by two further months for complex requests with notice. You also have the right to lodge a complaint with the supervisory authority of your habitual residence, place of work or place of the alleged infringement; a list is published by the European Data Protection Board, and in the UK the authority is the Information Commissioner's Office.

The limit on erasure. Section 9 explains that fingerprints anchored to a public blockchain cannot be erased. Those values are 32-byte hashes that contain no personal data and cannot be reversed to recover any content; everything we hold ourselves is erased on request or on account deletion, subject to the retention periods in Section 7 and Section 9A.

Retention. Section 7 and Section 9A state the retention periods. We do not retain personal data longer than stated there.

Children. The Service is not offered to anyone under 18 (Section 11), which exceeds the age-of-consent thresholds under Article 8 GDPR in every member state.

13. Changes

We will post any change here with a new version date, and give notice by email or in-product at least 14 days before a material change takes effect.

Contact: privacy@openstela.io