ZEPETO: Avatar, Connect & Live

"If you use an Apple device, we may access the TrueDepth camera system to collect face blendshape data in order to provide real-time facial tracking features as part of our 3D Avatar service. ... Image data generated from your user content is maintained on your device to provide you with more suitable filters and better photo effects when the Application processes your photos. We also may use software on your images to provide you with relevant features. While we do not use this information to identify you, some jurisdictions may consider this information biometric data."

The app accesses the device's TrueDepth camera for facial geometry data and processes user photos with software that may generate biometric data, which is a sensitive category of personal information.

"Device and Log information: Device and log information such as device model, OS version, IP address, setting of devices, nation or U.S. state associated with your IP address, URL and network type."

The company automatically collects IP addresses and derives geographic location (country or U.S. state) from them, enabling passive location tracking of users.

"The Company may share any of the categories of information described in Article 2 with relevant affiliated corporations, subsidiary companies, and third parties when necessary to provide Service efficiently or as required to achieve the purposes listed under Article 1 above. ... We may disclose your information to companies that provide Services such as companies that help us develop and operate systems for the Service with customer service centers, as well as advertising (including customized advertising on our websites, third-party websites, or online platforms)."

The company may share all categories of collected personal information with affiliates, subsidiaries, and third-party service providers, including for customized advertising across third-party websites and platforms.

"Through certain Services, we and third parties may use cookies, web beacons, pixels, tags, SDKs and other tracking technologies (which we will refer to collectively as 'cookies') to help us gather statistical information in order to improve your experience with the Services, save your preferences, and to provide you offers. These cookies may be used to track you across devices and websites over time."

The company explicitly states that cookies and tracking technologies may be used to track users across devices and websites over time, enabling cross-service profiling.

"Company may process and retain your personal information for the period necessary to accomplish the purpose of the task specified in the Terms of Use and Privacy Policy. ... In the event that an investigation is in progress due to violation of relevant laws and regulations in each service country: until the investigation is completed or as necessary to comply with legal or contractual obligations or serve a business or commercial purpose related to the investigation."

Retention periods are vaguely defined as 'necessary to accomplish the purpose,' and data can be kept indefinitely during investigations or when a 'business or commercial purpose' exists, giving the company broad discretion to retain data.

"This Privacy Policy may be updated to reflect changes in our personal information practices with respect to the Service, or changes in the applicable law. We will post a notice on our Service to notify you in advance of material changes to our Privacy Policy and indicate at the top of the notice when it was most recently updated."

The company can unilaterally change the privacy policy at any time, with only a posted notice on the service. There is no requirement for user consent or opt-in to new terms.

"At the time of account deletion: in case of damage caused by stolen information, etc., up to the minimum period specified by the Company for recovery and victim protection (90 days after deletion of account). In the event that an investigation is in progress due to violation of relevant laws and regulations in each service country: until the investigation is completed."

After account deletion, the company retains user data for at least 90 days and potentially longer if any investigation is in progress, meaning data survives deletion for an extended period.