TokenFab Open Platform Privacy Policy

Effective date of the latest version: September 22, 2026

Version: V1.0

TOKENFAB AI PTE. LTD. (hereinafter referred to as “TokenFab” or “we”) is well aware of the importance of personal data to you, and has always taken the protection of your personal data security as one of the core principles of our operation. To this end, we have formulated this “TokenFab Open Platform Privacy Policy” (hereinafter referred to as “this Policy”) in accordance with the applicable data and privacy protection regulations.

This Policy aims to clearly explain to you: when you access the TokenFab Open Platform (domain name: tokenfab.com and its subdomains, hereinafter referred to as the “Platform”) and use our various services, how we collect, use, store, share and protect your personal data, as well as the various rights you are entitled to according to law.

【Please Read Carefully】 Prior to using this platform, please read this policy in its entirety and carefully. Provisions marked in bold and bold underlined are closely related to your rights and interests, so please pay special attention to them. If you have any objection to any content of this policy, please stop using this platform immediately. By clicking “Agree”, completing registration, or otherwise starting to use the services of this platform, you are deemed to have fully understood and accepted all the provisions of this policy.

【Contact Information】 If you have any questions or suggestions regarding this policy, you may contact us via service@tokenfab.com.

This policy covers the following key contents:

I. Definitions and Scope of Application II. Collection and Use of Personal Data III. Sharing, Transfer and Public Disclosure of Personal Data IV. Storage, Protection and Security Assessment of Personal Data V. Your Rights Regarding Personal Data VI. Protection of Minors’ Information VII. Cookies and Similar Technologies VIII. Updates to This Policy and Notification IX. Contact Us

I. Definitions and Scope of Application

1.1 Core Definitions

TokenFab Open Platform: refers to a comprehensive platform operated by TOKENFAB AI PTE. LTD., which provides users with technical services such as AI model inference, API calls, computing power services, and model fine-tuning via the Internet (domain name: tokenfab.com and its subdomains).
Personal Data: refers to various information recorded in electronic or other forms that can identify a specific natural person’s identity either alone or in combination with other information, or reflect the activities of a specific natural person; information that has undergone anonymization processing does not fall into the category of personal data.
Sensitive Personal Data: refers to personal data that, once leaked or illegally used, is likely to infringe upon the personal dignity of natural persons or endanger their personal and property safety, including biometric information, religious belief information, specific identity information, medical and health information, financial account information, location tracking information, as well as the personal data of minors under the age of 14. In this policy, Sensitive Personal Data will be prominently marked in bold and underlined format.
User / You: refers to natural persons, legal persons or other organizations that register and use the services of this platform.
Anonymization: refers to the process of technically processing personal data so that the personal data subject cannot be identified and the processed information cannot be restored.
Children: natural persons who are recognized as children or minors under the laws applicable to the relevant personal data processing activities. The term “children” or “minors” as used in this Policy shall be determined in accordance with the age standards stipulated by the applicable laws of the country or region where the relevant individuals are located.

Unless otherwise specified in this Policy, the meanings of relevant terms shall be consistent with those defined in the TokenFab Open Platform User Agreement.

1.2 Scope of Application

This Policy applies to all products and services provided to you by the TokenFab Open Platform. If we have formulated a separate privacy policy for a specific service, that separate privacy policy shall apply to such service; for any service without a separate privacy policy, this Policy shall apply.

This Policy does not apply to the products or services provided to you by third parties through this Platform. The personal data processing rules for such third-party services shall be subject to the privacy policies published by such third parties themselves.

II. Collection and Use of Personal Data

We collect your personal data only to the minimum extent necessary to realize service functions, and strictly follow the principles of legality, legitimacy, necessity and good faith. Specifically:

Required Information: If you refuse to provide the information necessary to enable the basic service functions, you will be unable to use the corresponding services;
Non-essential Information: You may choose whether to provide the information required for extended functions, and refusal to provide it will not affect your use of the basic services.

Special Reminder: The types of personal data collected through the various functions provided by this platform may vary, subject to the specific functions you actually use. When we launch new functions or need to change the purpose or method of processing personal data, we will separately notify you and obtain your consent through prominent means such as updating this policy or pop-up prompts.

To create your account on this platform, we need to collect your email address and SMS verification code. If you refuse to provide them, you will not be able to complete the registration. If you choose to log in via authorization of a third-party account (such as Google), we will obtain certain information of said third-party account (such as its OpenID) to associate it with your account on this platform, complete your account profile and safeguard account security. Refusing authorization will result in the inability to log in with the third-party account.

2.2 Business Consulting and Customer Service Support

When you submit a business cooperation inquiry through this platform, we need to collect your name, mobile phone number, email address, company name, job title, industry and main purpose and other information so as to get in touch with you and respond to you.

When you contact our customer support team, we will collect your mobile phone number, account ID and problem description to verify your identity and provide effective support, and may also obtain your device information (device brand and model, operating system version), network information (IP address, network status, carrier information) and browser log information. If you contact us via email, we will also collect your email address.

To improve service quality and retain processing records, we will keep the communication records between you and our customer service, and the retention period shall be subject to legal requirements.

2.3 Model Trial and Interaction

You can voluntarily try various artificial intelligence models on this platform. Depending on your usage, we may receive text conversations, pictures, audio, documents and other input content that you actively input, and generate corresponding output results accordingly.

If you use the Real Time Communication interactive feature, we need to obtain your camera permission and microphone permission to transmit real-time images and audio. You can turn off these permissions at any time in your browser settings. After being turned off, the corresponding functions will be unavailable, but this will not affect other functions of the platform.

Important Reminder: Neither this platform nor the models connected to it require you to input personal data. To avoid personal data security risks, we strongly advise you not to input content containing personal sensitive information (such as biometric features, financial account passwords, medical and health records, etc.) into the model. Whether you provide personal data in the conversation and what kind of personal data you provide is entirely at your own discretion and at your own risk.

2.4 Exceptions Requiring No Authorization

According to the applicable laws and regulations, your authorization and consent are not required for the collection and use of your personal data in the following circumstances:

necessary for the conclusion and performance of a contract to which you are a party;
necessary for the performance of statutory duties or statutory obligations;
it is necessary for responding to public health emergencies or protecting the lives, health and property safety of natural persons in emergency situations;
process your personal data that you have voluntarily made public or that has been lawfully disclosed, to the extent reasonably permitted by law;
other circumstances as stipulated by the applicable laws.

2.5 Anonymization Processing

When we perform anonymization on the collected information (i.e., take technical measures to make it impossible for data recipients to re-identify specific individuals and render the information irrecoverable), such data will no longer fall under the category of personal data in accordance with relevant laws and regulations, and no additional consent from you is required for subsequent use. We may use anonymized data for platform optimization, statistical analysis, model improvement (including the use of anonymized data for Machine Learning training) and commercial decision support.

2.6 Handling after Service Shutdown

If we discontinue all or part of the services of this platform, we will notify you in advance via announcement, immediately stop the collection of relevant personal data, and delete or perform anonymization on the personal data we already hold. If the case involves children’s personal data, we will simultaneously inform their guardians.

In principle, we will not share, transfer or publicly disclose your personal data to any third parties. Should any such operation be required, we will strictly comply with the provisions of this Policy and obtain your prior consent in accordance with the law.

3.1 Entrusted Processing and Third-Party SDKs

To ensure the stable operation and functionality implementation of our services, we may entrust third-party service providers to process some personal data, or introduce services from our partners by embedding SDK/API. We will sign strict Non Disclosure Agreement with such third parties, and conduct security assessments and supervision to ensure that they protect your information in accordance with standards no less stringent than those set forth in this policy.

3.2 Transfer

In the event of a merger, division, dissolution, acquisition or bankruptcy liquidation of TokenFab, if personal data transfer is involved, we will inform you of the name and contact information of the recipient in advance. The recipient must continue to perform the obligations under this policy; if it is necessary to change the purpose or method of processing, your consent will be re-obtained.

3.3 Public Disclosure

We may only disclose your personal data to the extent necessary when required by laws and regulations, judicial procedures, or the mandatory orders of competent government authorities.

Pursuant to laws and regulations, your authorization and consent shall not be required for the sharing, transfer or public disclosure of personal data under any of the following circumstances:

necessary for the conclusion and performance of a contract to which you are a party;
necessary for the performance of statutory duties or statutory obligations;
it is necessary to respond to a public health emergency, or to protect the life, health and property safety of natural persons in an emergency;
process your personal data that you have voluntarily made public or that has been lawfully disclosed, within the reasonable scope permitted by law;
other circumstances as stipulated by the applicable laws.

Where data has undergone anonymization such that the data recipient cannot re-identify specific individuals and the information is irrecoverable, no additional consent from you is required for the sharing, transfer or public disclosure of such data.

IV. Storage, Protection and Security Assessment of Personal Data

4.1 Storage Location

The personal data collected with your consent will be stored in accordance with the laws and regulations on the personal data protection of the countries concerned. To the extent not prohibited by local laws and regulations, we may also store the collected personal data in countries or regions outside the country where the business is located.

Currently personal data we collect and generate during our operations is stored on servers located in Singapore.

Whether we store personal information in the country where the business is located, or in other countries or regions to the extent that doing so does not violate laws and regulations, we will retain it in accordance with the relevant laws and regulations on data storage. At the same time, we will consider the characteristics, scope and purpose of personal information processing, the risks that may be encountered in the processing, and the serious consequences caused by the damage, etc., to implement the necessary security measures. For example, we will use encryption and de-identification methods to store the personal information collected.

4.2 Retention Period

We will retain your personal data only for the shortest period necessary to fulfill the purposes outlined in this Policy, unless otherwise required by mandatory retention provisions of applicable laws and regulations. The primary criteria for determining the retention period include:

complete the business records related to you to respond to possible inquiries or complaints;
the need to guarantee the security and quality of services;
mandatory retention provisions of laws and regulations;
any other special agreements with you.

If there are mandatory retention requirements for specific information under applicable laws, we will be unable to delete or perform anonymization on such information before the expiration of the statutory period, even if you cancel your account or request deletion of the relevant information. We will immediately complete the deletion or anonymization process upon the expiration of the statutory retention period.

4.3 Safety Technical Measures

We have established a multi-level security protection system, which includes but is not limited to technical measures such as data classification and grading protection, transmission encryption (SSL/TLS), storage encryption, access control and identity authentication, network firewalls, intrusion detection, and malicious code protection, so as to prevent unauthorized access, use, tampering or leakage.

4.4 Safety Management Measures

We have established a management system centered on data security, which covers aspects including system design, personnel management, and process control.

formulate and strictly implement the personal data protection management system;
establish the position of a personal data protection officer, who is specifically responsible for personal data protection work;
provide regular safety and privacy protection training to employees to strengthen their safety awareness;
follow the principle of least privilege, and strictly limit the scope of personnel who can access personal data.

4.5 Emergency Response to Security Incidents

In the event that a personal data security incident occurs or is likely to occur, we will immediately activate the emergency response plan, take effective measures to mitigate the impact, and promptly inform you in accordance with the requirements of laws and regulations: the basic situation and potential impact of the incident, the remedial measures we have taken or will take, the measures you can take to reduce risks, and our contact information. We will notify you via one or more channels including email, phone calls, and in-app notifications. If individual notification is not required according to laws, we will release the information via public announcement. Meanwhile, we will report the incident handling status to the regulatory authorities as required.

4.6 Your Responsibility for Self-Protection

Please properly keep your account and password, use a complex password different from those for other platforms, and do not log in to your account in a public network environment. If you find your account stolen or information leaked, please contact our customer service team immediately. Please note that any information (including personal data of others) that you actively provide when using the service shall be subject to your own careful judgment and you shall bear corresponding responsibilities.

4.7 Personal Data Protection Impact Assessment

When it comes to statutory scenarios such as the processing of Sensitive Personal Data, the use of personal data for automated decision-making, the entrusted processing of personal data, the provision of personal data to third parties, the disclosure of personal data, and the provision of personal data overseas, we will conduct a prior personal data protection impact assessment in accordance with the provisions of applicable laws and keep records of the processing activities.

V. Your Rights Regarding Personal Data

Pursuant to relevant laws and regulations, you have the following rights with respect to your personal data, which we will respond to and safeguard in accordance with the law:

5.1 Access to, Copying of and Correction of Data

You may access, copy and correct your personal data at any time by logging into this platform and navigating to the “Personal Center”. If certain information cannot be processed online, you may contact us through customer service channels for assistance.

5.2 Deletion of Personal Data

You may request the deletion of your personal data if any of the following circumstances applies:

the purpose of the processing has been achieved, cannot be achieved, or is no longer necessary;
we discontinue the provision of the products/services, or the retention period has expired;
you withdraw your consent;
we process your personal data in violation of laws, administrative regulations or agreements;
other circumstances as stipulated by the applicable laws.

You may submit a deletion request through the ticket system of this platform, or send an email to service@tokenfab.com. After deletion, due to technical limitations, the corresponding information in the backup system may not be cleared immediately. We will securely isolate it and suspend any processing other than storage until it can be completely erased or anonymized. If a statutory minimum retention period applies, the processing will be completed as soon as possible upon the expiration of such period.

You may withdraw your previous consent to our collection and processing of your personal data. Upon withdrawal, we will cease processing the relevant personal data. The decision to withdraw consent shall not affect the lawfulness of the processing activities that have been carried out based on your consent prior to the withdrawal.

5.4 Account Deactivation

You may submit an account cancellation application via the path: “Personal Center — Account Settings — Cancel Account”. After your account is cancelled, we will cease providing services and delete or anonymize your personal data in accordance with legal requirements. For personal data subject to statutory minimum retention periods, we will process it as soon as the retention period expires.

5.5 Description of Request and Response

To ensure account security, we may need to verify your identity (such as requesting a written application, verification code, etc.) before processing the above request. We will reply to you within 15 working days after receiving the request.

We will process legitimate requests free of charge; for requests that are repeated multiple times, or go beyond a reasonable scope, we may charge a reasonable fee as appropriate, or decline to respond under applicable statutory circumstances.

VI. Protection of Minors’ Information

This platform primarily provides artificial intelligence technology services to adult users. We attach great importance to the protection of minors’ personal data.

If you are a minor as defined by the laws of your locality, please read this Policy in the company of your parents or other legal guardians, and may only use this platform after obtaining their explicit consent. If you are a child, in addition to your guardian’s consent, please complete the registration process and use the services under their guidance.

We will not proactively collect personal data of minors. If we discover that we have collected information of a minor without the consent of their guardian, we will immediately cease processing such information and delete it. If you are the guardian of a minor and believe that we may hold information pertaining to the minor under your guardianship, please contact us promptly.

VII. Cookies and Similar Technologies

To ensure the proper functioning of this platform and continuous optimization of user experience, we will store small data files such as Cookies on your device. Cookies are mainly used to identify session status, guarantee the normal response and operation of the platform, record preference settings and statistics of access data.

We will not use cookies for any purpose other than those described in this policy. You can manage or clear cookies through your browser settings. However, please note that disabling cookies may result in some service functions being unable to function properly.

VIII. Updates to This Policy and Notification

With the development of business and changes in laws and regulations, we may revise this policy in a timely manner. Without your affirmative consent, we will not reduce the rights you enjoy under this policy. For significant changes, we will notify you through in-app announcements, pop-up prompts and other prominent ways.

IX. Contact Us

If you have any questions, comments, or suggestions about this policy, or if you encounter any problems with personal data processing and need to complain, please contact us through the following methods. We will respond within 15 working days:

Online channel: After logging in to this platform, submit your question through “Personal Center - Ticket Record - Create Ticket”.
E-mail: Send an email to the personal data protection officer’s dedicated email service@tokenfab.com. Please note that we may not respond to emails that are not related to this policy or personal data protection.

If there is a dispute over our personal data processing behavior under this agreement, either party may file a lawsuit with the court with jurisdiction over the domicile of TOKENFAB AI PTE. LTD.

The establishment, effectiveness, performance, interpretation and dispute resolution of this policy shall be governed by the laws of Singapore.

TOKENFAB AI PTE. LTD.

Contact email for personal data protection: service@tokenfab.com

This policy was last updated on September 22, 2026