Privacy Policy

In order to provide the Service and its related functions—including image-based scam-risk identification, anonymous sharing, community-case creation, popular-case aggregation, similar-case matching, voting, reporting, browsing, anti-fraud database maintenance, service-quality improvement, usage-behavior analysis, system-security maintenance, abuse prevention, fraud prevention, legal compliance, and other legitimate business purposes related to the operation of the Service—the Company collects, processes, and uses your data.

The purposes for which the Company may collect data in connection with the Service are limited to the following scope:

1. Scam-Risk Identification To provide scam-risk determinations, the Company processes content that you proactively upload or submit, such as images, screenshots, text descriptions, queries, URLs, telephone numbers, or accounts, as well as your reports, votes, or comments on community cases.

2. Image and AI Processing Data Images you upload are transmitted to the Company's systems through an encrypted channel and may be processed by the Company's systems and by third-party AI or image-recognition services for text recognition, image-feature analysis, scam-risk analysis, similar-image matching, deduplication, and anti-fraud database matching. The Company may retain the original images, the analysis results, and the de-identified technical data necessary to support the functioning of the Service. The scope of such third-party service providers is set out in Section 4.

3. Community Cases and Anti-Fraud Alerts To help other users identify similar scam risks, content you submit may, after de-identification or masking, be incorporated into the anti-fraud database or community-alert materials. The processing methods, protective measures, and your opt-out rights are set out in Section 8.

4. Data Processing for ChatGPT Apps and Third-Party Platforms When you link to or use the Service through ChatGPT Apps or another related third-party platform, that platform may, in order to complete your request, transmit to the Company the data relevant and necessary to that request. The Company will receive, process, and use, on a one-time basis, only the data necessary to complete that particular service request, including but not limited to the image or image reference you submit, the content of your query, language settings, region or market code, and necessary technical logs. Except as necessary to provide the Service, the Company will not proactively request, collect, or store your complete conversation history with ChatGPT or such third-party platform, broad contextual information, precise location information (such as GPS coordinates or street address), or any data field unrelated to the particular risk analysis. The methods of collection, processing, and use of such data are set out in Section 2 of this Policy.

5. Automatically Logged System Data To maintain service security, detect abnormal use, and ensure system operation, the Company automatically records technical information regarding your use of the Service, such as IP address, time of use, browser type, language settings, operating system, server and error logs, security-event logs, and your operational records within the Service (such as the timestamps of queries, reports, or votes).

6. Cookies and Similar Technologies (Website Version Only) When you use the Website version of the Service, the Company may record your use of the Service through cookies or similar technologies. In the ChatGPT Apps version, the Service does not use cookies or website-analytics tools to track your conversation content or cross-site behavior. The distinction is further described in Sections 9 and 10.

7. Customer Service, Complaints, and Rights-Request Data When you submit a complaint, inquiry, or personal-data rights request to the Company's customer service or privacy contact, the Company will process the name, contact information, request content, and handling records you provide in order to verify your identity, locate the relevant data, and respond to your request.

The Service collects your personal data in accordance with the principle of data minimization and does not require you to proactively provide personal data not directly related to the functions of the Service, such as scam-risk analysis. However, the images or text content you upload may themselves contain personal data, sensitive data, special category of personal data, or third-party data, such as names, telephone numbers, email addresses, social-media accounts, addresses, transaction information, bank account numbers, conversation content, or other identifiable information. Please confirm and mask any unnecessary personal data or sensitive information before uploading.

You may use the platform and/or the Service through a third-party platform, application, or website, such as ChatGPT, OpenAI-related applications, or other third-party services. In such a case, that third-party platform may, in accordance with its terms of service, privacy policy, and your authorization or privacy settings, provide or transmit to the Company data relating to your use of the Service.

The scope of data the Company may obtain will depend on the functionality and data-sharing mechanisms of that third-party platform and on your privacy settings and authorizations within that third-party platform or application. The Company will collect, process, use, and retain such data only to the extent necessary to provide the Service and in accordance with this Privacy Policy and applicable law.

The Service may provide image-based scam-risk identification through ChatGPT. When you use the Service within ChatGPT, the Company receives, processes, and uses the relevant data only to the extent directly necessary to fulfill the seven collection purposes listed in Section 1.

This section further explains the data-processing practices of the ChatGPT Apps version. With respect to the processing of data when you use the Service through ChatGPT, this section shall apply with priority; matters not addressed in this section remain subject to the other applicable provisions of this Privacy Policy.

This section supplements the special data-disclosure scenarios and the third-party-link disclaimers not fully covered in Section 3.

In order to provide the Service, operate its systems, improve the user experience, build the anti-fraud database, and enhance scam-detection capabilities, the Company may, to the extent necessary, provide data to the following third-party service providers, cooperating parties, or recipients for processing or use, and will, by contract with the Company, require them to bear data-confidentiality obligations and security-maintenance measures no lower than those in this Policy:

1. Website-analytics tool — Google Analytics ("GA") Used for anonymous statistical analysis of traffic and usage behavior on the Website version of the Service, such as page views, dwell time, source region, and device type, for the purposes of service-quality improvement and product analysis. You may disable tracking through your browser settings or by installing the GA opt-out add-on. For the distinction between the ChatGPT Apps version and the Website version with respect to GA / cookies, see Section 10 of this Policy.

2. Security-incident response units Upon detecting malicious attacks, fraud, abuse, or abnormal use, the Company may share necessary technical data with relevant units in order to maintain system security, service stability, and the public interest. The scope of sharing is limited to technical information and does not include personal data that can directly identify you.

3. Disclaimer regarding third-party website links The Service may contain links to other websites or applications. When you link to such a third-party website through the Service:

   • your data will be processed in accordance with that third party's privacy policy and terms of use;
   • the Company is not responsible for the data-processing practices of such third parties; and
   • you are advised to review that third party's privacy policy carefully before use.

The Service does not require you to upload or provide the following data, and you should not submit, through ChatGPT Apps, the Website version of the Service, an application, or any other channel of the Service, any image or text containing the following:

1. credit-card numbers, complete payment-card data, or other data subject to the Payment Card Industry Data Security Standard (PCI DSS);
2. protected health information, medical records, case histories, diagnoses, prescriptions, medical-examination results, or other medical-related sensitive data;
3. government-issued identity-card numbers, social-security numbers, passport numbers, driver's-license numbers, residence-permit numbers, or other government identifiers;
4. passwords, API keys, access tokens, refresh tokens, MFA / OTP verification codes, private keys, mnemonic phrases, or other authentication secrets; and
5. data that, under applicable law, constitutes sensitive or special-category personal data and is not necessary to complete the scam-risk analysis.

If the foregoing data inadvertently appears in your submitted content

Because a scam message itself may contain the foregoing sensitive information (for example, a phishing SMS disguised as a bank notice), if you inadvertently include such data in an image or text, the Company will process it only to the extent necessary to identify and reduce the scam risk; where technically feasible, the Company will proactively mask, ignore, or decline to process unnecessary sensitive data, and will not use such data for advertising delivery, cross-service tracking, commercial-behavior profiling, or AI-model training, or for any purpose unrelated to scam-risk analysis.

If you discover that content you have submitted contains the foregoing data, please notify the Company immediately through the contact methods set out in this Policy, and the Company will assist in handling the matter within thirty (30) days.

To ensure the security of personal data, the Company has established information-security and management systems. Data in transit is protected by SSL / TLS encrypted communication mechanisms to reduce the risk of unauthorized interception or tampering. In accordance with internal access-control rules, the Company implements account management, role-based permissions, access controls, and operation-log management to ensure that only authorized personnel may process the relevant data. The Company also conducts security audits, vulnerability scans, abnormal-event monitoring, and risk assessments on a regular or ad hoc basis, and has established procedures for the reporting of, and response to, abnormal events, in order to promptly prevent and address data leakage, tampering, loss, unauthorized access, or other information-security incidents. With respect to service providers, partners, or other third parties engaged by the Company, or that assist the Company in processing, using, or retaining users' personal data, in the course of providing the Service, the Company will, according to the nature of their services and the scope of their data processing, require them to comply with the information-security standards, confidentiality obligations, and personal-data-protection requirements agreed by contract with the Company, and may, as appropriate, periodically review their performance, in order to ensure that the overall data-protection measures remain continuously effective. If an information-security incident involving a third party occurs, the Company will take necessary measures in accordance with applicable law and its internal procedures, including incident investigation, risk control, performance of notification obligations, and assisting users in exercising their relevant rights, and will clarify, in accordance with the law, the respective responsibilities of the Company, the third party, and the relevant parties.

Except as otherwise provided by law, you may request that the Company:

1. inquire into or review the personal data relating to you that the Company holds;
2. provide a copy of such data;
3. supplement or correct such data;
4. cease the collection, processing, or use of such data;
5. delete such data;
6. delete the images, question text, analysis results, or related records you uploaded through the Service or ChatGPT;
7. remove the relevant images, cases, or analysis results from community cases, similar cases, popular cases, or public-display pages; and
8. object to or restrict the non-necessary use of data.

Upon receiving your request, the Company will review it and respond within a reasonable period in accordance with applicable law, in principle no later than thirty (30) days. If, due to business needs, data location, identity verification, technical limitations, legal obligations, dispute handling, information-security-incident investigation, or other legitimate reasons, the Company is unable to process the request within that period, the Company will separately notify you of the reasons and the estimated handling schedule.

To protect data security, the Company may ask you to provide information necessary to help locate the data and verify the request—for example, the date and platform of your submission, the image or case link, your contact email, relevant screenshots, or other information sufficient to confirm the scope of the request.

Where, in accordance with legal provisions, as necessary to carry out its business, to prevent fraud or abuse, to maintain service security, to handle disputes, to preserve an audit trail, or for other legal-compliance purposes, the Company is unable to delete, cease the use of, or change your personal data in whole or in part as you request, the Company will explain the reasons to you in accordance with applicable law and will, to the extent necessary, adopt alternative measures, such as restricting processing, ceasing external display, archiving, or reducing the identifiability of the data. Where the data has been irreversibly anonymized, or has been aggregated into statistics that cannot identify a specific individual, the Company will no longer be able to process, change, or delete the data as you request. You may freely choose whether to provide the relevant personal data and its categories; however, if you decline to provide the data necessary for the operation of the Service, the Company may be unable to provide image analysis, community-case matching, risk reports, the location of data for deletion or removal requests, or other necessary services.

To help users identify scam risks, the Service may incorporate the images, text, telephone numbers, URLs, accounts, analysis results, risk indicators, or de-identified data submitted by users into the anti-fraud database, community cases, similar cases, popular cases, public alerts, or other anti-fraud information made available for users' reference.

According to the nature of the data and technical feasibility, the Company will adopt masking, de-identification, anonymization, aggregation, or other reasonable protective measures to reduce the risk of directly identifying an individual. However, if the image or text you submit itself contains identifiable information—such as a name, account, avatar, conversation content, address, telephone number, email, transaction data, or other personal data—other users or third parties may still infer the identity of the data subject from the content, tone, context, or associated information.

Therefore, please confirm the content before uploading or sharing, and avoid submitting personal data, sensitive data, confidential data, or third-party privacy information not necessary for the scam determination. The Website version of the Service provides an image-masking function, and you are advised to use that function to mask information you do not wish to make public or have processed before sharing. ChatGPT Apps does not provide an image-masking function; please mask or remove unnecessary information yourself before uploading through ChatGPT.

If you believe that any community case, popular case, or publicly displayed content involves the personal data, privacy, rights infringement, or other improper content concerning you or a third party, you may submit a request for deletion, removal, cessation of use, or a complaint to the Company through the contact methods set out in this Policy.

When you use the Service or related websites, the system records your visit or usage footprint through cookies or other similar technologies—such as local storage, pixel tags, fingerprinting, SDKs, or device identifiers—in order to provide a more complete service experience and to help the Company understand and manage the use of the Service.

The foregoing purposes include but are not limited to:

1. ensuring the operation of the basic functions of the website or application, such as login status, language settings, and security verification;
2. conducting platform traffic analysis, user-behavior statistics, and research on product or service usage patterns;
3. optimizing interface design and functionality to improve the smoothness and stability of platform operation;
4. providing relevant content or notifications based on user preferences in order to improve the overall user experience; and
5. maintaining service security, preventing abuse, and detecting abnormal use.

The Company may, on its own or by engaging trusted partners, use cookies or other technical tools to record, access, and collect your online-behavior data, and to analyze and process it within a reasonable scope.

Online-behavior data refers to non-directly-identifiable data generated when you use the Service on related platform websites or social media, including but not limited to IP address, cookie ID and its content, unique identifiers, domain name, device information, time of use, browser type, language settings, approximate geographic location, operating system, server logs, web searches, browsing and click records, usage patterns and statistical information, or behavioral tags generated by partners through their analysis and inference.

The Company does not sell users' personal data. Except for the purposes expressly disclosed in this Policy, the Company will not use the foregoing data for cross-service tracking, commercial-behavior profiling, or advertising delivery unrelated to the Service.

You may refuse, delete, or restrict the use of cookies through your browser or device settings. However, if you disable necessary cookies, certain functions or personalization settings of the Service may not operate normally. The Company will comply with the relevant laws and regulations and will appropriately handle the foregoing data in accordance with this Policy.

The Website version of the Company's Service may use cookies, Google Analytics, or similar technologies in accordance with the Cookies section of this Policy.

However, when you use only the image-based scam-risk-analysis tool of the Service within ChatGPT Apps, the Company does not track your complete conversation content within ChatGPT or your cross-site browsing behavior through the Company's website cookies or Google Analytics.

The ChatGPT Apps version processes the images, question text, language, region or market code, community-case query settings, analysis results, and necessary technical logs needed to complete the tool request, and uses them for the purposes listed in Section 2 of this Policy.

If you click a link from ChatGPT Apps to go to the Company's website, a forum page, a case page, or a third-party website, the cookies, analytics tools, privacy policy, and terms of use of that website will apply separately.

The Service is a free anti-fraud tool and does not require users to register, log in, or provide any identity or age information. The Company cannot, and will not proactively, verify a user's age.

The content of the Service (scam-risk identification and anti-fraud alerts) is designed for the general public, including users aged 13 or older (or the minimum age at which, under local law, an individual may independently consent to the processing of personal data). The Service is not designed for children under the age of 13 and does not proactively market to, or provide services to, children under the age of 13.

However, if the content submitted by a user (for example, an image or text) clearly indicates a child's identity (for example, the user states in the question that they are a child, or the submitted image is clearly of an object belonging to a child), the Company will:

• not incorporate that content into community anti-fraud alert materials; and
• where technically feasible, handle the relevant records in accordance with the deletion mechanism in Section 7 of this Policy.

If you are a parent or legal guardian and become aware that your child has provided personal data to us, please contact us immediately. We will take reasonable measures to delete such data to the extent permitted by law, unless we are under a legal obligation to retain it.

Recommendations for Minor Users Aged 13–17

The Service is suitable for use by adolescents and can help them identify scam patterns commonly targeted at adolescents (such as fake romance, fake part-time jobs, and gaming scams). The Company encourages parents or legal guardians to accompany and guide their children in using the Service, in particular by:

• helping to confirm that uploaded images do not contain sensitive or third-party personal data;
• helping to understand the risk-analysis results provided by the Service (which are for reference only and are not legal or professional advice); and
• guiding them to seek help from a trusted adult when they encounter a suspected scam.

To protect your privacy rights, the Company will amend this Policy from time to time in light of business needs, adjustments to service functions, changes to third-party services, changes in law, requirements of competent authorities, information-security needs, and technological developments.

Amendments to this Policy take effect upon announcement. If an amendment involves the purpose of data processing, the categories of data, the scope of public display, third-party recipients, user controls, or other material changes, the Company will notify users by website announcement, in-service notice, email, or other appropriate means.

Your continued use of the Service after an amendment to this Policy takes effect is deemed to constitute your having read and understood the amended content. If you do not agree to the amended content, please cease using the Service; you may also submit a personal-data rights request to the Company through the contact methods set out in this Policy.

If you wish to exercise any of the foregoing rights, or have any comment or question regarding this Privacy Policy, the data-processing practices of the Service, data use in the ChatGPT Apps version, the display of community cases, the removal of popular cases, the deletion of images, or any matter relating to your personal data, you may contact the Company's customer service or privacy contact:

• Privacy contact email: trustlens-privacy@gogolook.com
• Service hours: available year-round, without interruption.

Reminder: This English text is a reference translation only. The official Traditional Chinese Privacy Policy (version 1.2.0) shall prevail in the event of any discrepancy.