This English version is the legally binding one. A Traditional Chinese translation is provided for convenience only.

1. Who is responsible

OpenStela, a sole proprietorship established and operating in Taiwan, is the controller of the personal data described here. The Service was named Avatar Lab (avatar-lab.app) until 16 September 2026; the controller and your data are unchanged by the rename to OpenStela (openstela.io).

Privacy contact: [email protected] · General contact: [email protected]

2. Summary — the four things that matter most

3. What we collect

3.1 Account data

3.1A Public creator page and notifications

Public creator page. If you set a handle, a page at /u/<handle> shows your handle, display name, bio and the characters you have chosen to list publicly. That page is visible to anyone, including search engines and social-media link previews, and can be shared by anyone. Your email address and internal user ID are never shown. Remove the handle in Account settings and the page is gone; links you have already shared will stop working.

Notifications. We keep the most recent 200 notifications per account. They are included in your data export and deleted with your account. Product-notice emails (deal progress, new messages, anchoring, channel expiry, billing and security) are sent to your sign-in email through our email provider (section 5) as part of providing the Service. Deal and message notices are batched into at most one email per 15 minutes; everything else goes into a daily digest. Every email carries a one-click unsubscribe link, and you can turn product-notice emails off in Account → Preferences at any time; in-product notifications continue regardless. Marketing emails are separate and are sent only with your explicit opt-in.

We request only the minimum OAuth scopes: openid email profile from Google, user:email from GitHub. We do not receive your password, contacts, files, calendar or any other data from those providers.

3.2 Content you create or upload

• Character specifications (text you write or answer in the Lab).
• Images you upload (for example when importing an existing character).
• Reference images and training sets generated for you.
• Adapter packs and platform anchor text derived from the above.

3.3 Usage and technical data

• Generation events: timestamp, model used, parameters, token counts, image counts, consistency scores, error and failure modes. This is the metadata referred to in Section 2.
• Funnel milestones: internal user ID plus which step of the product you reached (signed up, created a pack, generated, and so on). Deliberately milestones only — not every click — and it records the internal user ID, not your email.
• Credit balance and consumption, and billing records (plan, status, amount, currency, payment provider event ID).
• Cookies. Two, both first-party and strictly necessary: a signed session cookie that keeps you logged in, and a short-lived cookie (10 minutes) that remembers where to send you after login. We use no advertising or tracking cookies.
• Server logs. Our hosting and CDN providers process request logs which may include IP address, user agent and timestamps, for security and reliability. Aggregate page-view analytics may be collected at the network layer without cookies.

4. Why we process it, and on what legal basis

Where we rely on legitimate interests, you may object — see Section 8.

5. Who we share it with

We do not sell personal data and do not share it for advertising. We use the following processors and providers:

We may also disclose data where required by law, court order, or to establish or defend legal claims.

6. International transfers

Your data is stored in Japan and transmitted to providers in the United States and elsewhere. Where a transfer is from the EEA or UK, it is made on the basis of the European Commission's Standard Contractual Clauses or an adequacy decision, as applicable to the provider concerned.

7. How long we keep it

8. Your rights

Subject to your location, you may have the right to: access your data; correct it; delete it; export it in a portable format; restrict or object to processing based on legitimate interests; and withdraw consent where processing rests on consent.

Export is partly built into the product: character specifications, reference images and adapter packs can be downloaded from the interface at any time, in open formats (JSON, standard image files, plain text).

Export and deletion are built into the product. Settings → Your data downloads a complete copy of your account; Settings → Delete account removes it, and the account is held recoverable for 14 days before it is purged. All other requests are handled on request — write to [email protected]. We acknowledge within 5 working days and complete within 30 days. There is no charge unless a request is manifestly unfounded or excessive.

• Taiwan (Personal Data Protection Act): you may request review, duplication, supplementation or correction, cessation of collection, processing or use, and deletion.
• EEA / UK (GDPR): the rights above, plus the right to lodge a complaint with your supervisory authority.
• California (CCPA/CPRA): the right to know, delete, correct, and to opt out of sale or sharing — noting that we do not sell or share personal information as those terms are defined.

9. The limit on deletion — blockchain anchoring

If a character of yours was issued a Character ID and anchored, a hash of its specification forms part of a Merkle tree whose root was written to a public blockchain.

• The chain stores a 32-byte root only. It contains no name, no email, no image, and no readable text.
• The hash is one-way: the specification cannot be reconstructed from it.
• It cannot be deleted, by us or by anyone. Public blockchains are append-only. It will remain after you delete your account.

We can, and on request will, delete the local batch record that connects your character to a position in that tree — after which the on-chain root can no longer be used to demonstrate anything about your character. Please note that doing so also destroys your ability to use the anchor as evidence.

9A. Registered works, evidence records, channels and the deal room

Works. If you register works (audio, video, images, or links) under a character, we store the uploaded files and their metadata (title, notes, rights declaration, timestamps) to operate the feature. Only the SHA-256 fingerprint of each work — never the work itself — enters the public blockchain anchoring described in Section 9. Deleting a work removes the file from our storage; the anchored fingerprint cannot be removed, and the public verification endpoint will state the work has been deleted. For linked works we store a snapshot of the linked page or its oEmbed record fetched once at registration; we do not monitor the link afterwards.

Evidence records. For each work we run automated checks on how it relates to the character (file dates, names found on the linked page, presence of the character's declared markers or palette, and — on request — a face or body similarity measurement against the character's own reference images). The results, a timestamp and the method version are stored as records and their fingerprints are anchored. These checks analyse content, not you: the face-similarity check compares images of a character to other images of the same character. It is not used to identify any natural person, and we do not build biometric templates of real people. If a work depicts a real person, do not request the visual-match check for it.

Channel verification. If you verify a channel (a website or social account), we store the channel URL, the one-time code, the date and method of verification and a snapshot of the page where the code was found. Verification lapses after 90 days.

Deal room. If you negotiate or sign a contract in the deal room, we store the draft and signed contract text, the parameters and clauses each party set, in-app messages between the parties, signature timestamps, payment-sent and payment-received confirmations, dispute notes and the resulting transfer record. The counterparty sees the legal names and contact details you enter into the contract; the public character page shows only platform handles. Signed contract fingerprints are anchored (Section 9); the text itself is never published. Deal records are kept for as long as either party's account exists and for 6 years thereafter, because they evidence a transfer of rights that either party may need to prove later.

10. Security

Sessions use signed cookies with expiry; login tokens are stored hashed, never in plain text; unverified email addresses are rejected outright; webhook payloads from the payment provider are signature-verified and processed idempotently. Access to production data is limited to the operator.

No system is perfectly secure. Where a breach is likely to result in a risk to your rights, we will notify you and the relevant authority as the law requires.

11. Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us with personal data, contact [email protected] and it will be deleted.

12. Automated decision-making

We do not make decisions producing legal or similarly significant effects about you by automated means. Consistency scores and evidence-check results are measurements about content, presented to you and — for evidence results, if you list the character — to the public; they are not decisions taken about you. Quota and storage limits are applied automatically as contractual rules, not as profiling. The platform's dispute decisions in the deal room (Terms, Section 4B) are taken by a person.

12A. Additional information for users in the EEA, the United Kingdom and Switzerland

This Section applies if you are in the European Economic Area, the United Kingdom or Switzerland, and supplements the rest of this Policy under the GDPR, the UK GDPR and the Swiss FADP.

Controller and representative. The controller is OpenStela, a sole proprietorship established in Taiwan (Section 1). We have not appointed a representative in the EU or the UK under Article 27 GDPR, relying on the exemption for occasional, low-risk processing; if our processing of data of persons in the EEA or UK ceases to be occasional, we will appoint one and name it here. We have not appointed a data protection officer; the privacy contact in Section 1 handles all requests.

Legal bases. The table in Section 4 states the Article 6 basis for each purpose. Where we rely on legitimate interests (security, abuse prevention, quality improvement from generation metadata), we have balanced those interests against your rights and concluded that the processing is limited to technical metadata and does not concern the content of your characters. You may object at any time (Section 8). Where processing rests on consent (none of the current processing does, other than your choice to list a character publicly), you may withdraw it at any time without affecting prior processing. We do not process special categories of personal data (Article 9) and ask you not to upload any.

International transfers. We are established in Taiwan, which is not the subject of an adequacy decision. Data you provide to us is processed by us in Taiwan and stored with our hosting provider in Japan (Section 5). Onward transfers to our processors in the United States (Google, Cloudflare, Polar) are made under the European Commission's Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum, or under the EU-U.S. Data Privacy Framework where the provider is certified. You may request a copy of the relevant safeguards from the privacy contact.

Your rights. You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and the right not to be subject to solely automated decisions (Art. 22). Export and deletion are built into the product (Section 8); other requests go to the privacy contact and are answered within one month, extendable by two further months for complex requests with notice. You also have the right to lodge a complaint with the supervisory authority of your habitual residence, place of work or place of the alleged infringement; a list is published by the European Data Protection Board, and in the UK the authority is the Information Commissioner's Office.

The limit on erasure. Section 9 explains that fingerprints anchored to a public blockchain cannot be erased. Those values are 32-byte hashes that contain no personal data and cannot be reversed to recover any content; everything we hold ourselves is erased on request or on account deletion, subject to the retention periods in Section 7 and Section 9A.

Retention. Section 7 and Section 9A state the retention periods. We do not retain personal data longer than stated there.

Children. The Service is not offered to anyone under 18 (Section 11), which exceeds the age-of-consent thresholds under Article 8 GDPR in every member state.

13. Changes

We will post any change here with a new version date, and give notice by email or in-product at least 14 days before a material change takes effect.

Contact: [email protected]