EBD Translate Privacy Policy

1. Who we are

EBD Translate is operated by HongKong QVOL Technology Limited, registered in Hong Kong, China. We determine the purposes and means of processing described here and are responsible for it as the data controller. Our developer display name is EMBEDRONE.

Company address: Room C, 9/F, WINNING HSE, 72–76 Wing Lok Street, Sheung Wan, Hong Kong.

This policy covers EBD Translate and its activation, cloud processing and support services, including Android versions distributed directly or through Google Play. It will also cover an iOS version when available. Features may differ by platform and version. The current App provides free services subject to usage quotas, without in-app purchases or bank-card collection.

2. Information we process

Activation and authorization: activation-code records, authorization status, quotas, installation or session identifiers, and protected earbud identifiers needed for binding and misuse prevention. Android may process a compatible connected earbud's name and identifier. A future iOS version using Apple App Attest will process installation-verification information instead of binding through a Bluetooth MAC address. Protected or hashed identifiers are not necessarily anonymous.
Voice, translation and AI: microphone audio when you start voice input; translation and spoken-output text; language selections; AI questions and limited current conversation context. These are sent to the relevant cloud services to produce results. AI web search is currently disabled. Some older Android licence types may use phone-selected speech services.
Usage and technical information: speech duration, character counts, requests and token usage; authorization identifiers; App and operating-system versions; IP addresses, request times, errors and network-security metadata. These support quotas, service operation and misuse prevention.
Optional feedback and privacy requests: the reply email and content you provide, App version, operating system, platform, language and existing device-session identifier. We do not automatically attach complete activation codes, earbud addresses, recordings or conversation content. Feedback is used for support and product improvement, not marketing, model training or AI analysis. Replies are handled manually; the email is not a login account or proof of ownership.
Optional AI content reports: the selected answer, report category, language and model name where available. We do not separately attach your question, contact details or audio. The selected answer may itself contain information from your conversation.
Website privacy requests: the name or alias, reply email and message you submit through our support form, and any optional product or country information you choose to add. Website delivery and anti-abuse services also process IP addresses, browser/device information and security signals. A real name is not required merely to submit a request.
Privacy choices and eligibility: the minimum age-eligibility result, your consent choices, the notice version and relevant timestamps, so we can enforce your choices and demonstrate compliance.

The App stores preferences, languages, authorization state and necessary security credentials locally. EBD does not create a permanent archive of ordinary recordings, camera images, translation content or personal AI conversations. Content included voluntarily in feedback or reports is retained as described below. Cloud providers may retain submitted content separately.

We do not use your voice to identify you, create voiceprints, or use your recordings, translations, conversations or feedback to train AI models. Do not submit passwords, identity documents or unnecessary sensitive information. Obtain any permission required before recording or submitting another person's information.

3. Permissions and choices

Microphone: for voice input you initiate; no background listening or recording archive.
Bluetooth / Nearby Devices: where required to identify or use compatible earbuds.
Camera: optional local activation-QR scanning; EBD does not upload camera images, and manual code entry is available.
Internet: for activation and cloud speech, translation and AI services.

The App does not request contacts, SMS, photo-library or location access. Manage permissions in your phone settings; refusing a permission may prevent the related feature from working. Using a cloud feature requires online processing of its input. Feedback is optional. This policy does not replace a separate notice or consent required by applicable law.

Why processing is permitted: the applicable legal basis depends on your country and the purpose:

Requested services: activation, binding, quota administration and support needed to provide the service rely on performance of our agreement with you where that basis is available, or on consent where required. We explain mandatory fields before collection; without necessary activation or quota information, the corresponding service cannot be provided.
Feature-specific consent: before cloud voice, translation or AI processing, optional QR scanning with ML Kit diagnostics and usage analytics, feedback, or AI reporting begins, we explain the relevant data, purpose and recipients and ask for an affirmative choice. Consent is specific to the feature or submission, not bundled with unrelated optional processing or inferred from silence.
Security and legal duties: necessary fraud prevention and service security rely on legitimate interests only where local law permits and our assessment shows that your rights are not overridden; otherwise we use the applicable consent or statutory exception. Processing required to answer rights requests, comply with law or preserve legally required records relies on the relevant legal obligation. These grounds do not authorize advertising profiles or unrelated reuse.

Withdrawal: use Settings → Privacy Policy → Privacy choices or a contact method in section 7. You can withdraw consent as easily as you give it. We stop the relevant consent-based collection and use; refusing or withdrawing optional consent does not block unrelated features. Declining QR scanning leaves manual activation available. Withdrawal does not affect processing already lawfully performed; we explain any limited processing that must continue under another applicable legal basis. Switching off a phone permission alone does not delete earlier server records.

4. Service providers and disclosure

We use Alibaba Cloud for speech recognition, translation, speech generation and AI, and Cloudflare for hosting, database storage, delivery and security. Android QR scanning uses Google ML Kit for on-device image processing; its SDK separately collects installation identifiers and device, App, usage and performance information for diagnostics and usage analytics. A future iOS version may use Apple's installation-integrity services.

Our website support form also uses Cloudflare Turnstile for anti-abuse checks and email-delivery providers to send your request and our reply. They receive the information necessary for those functions, not permission to market to you. Our privacy team may handle requests from Hong Kong.

International processing: we use the Singapore access and storage region for Alibaba Cloud Model Studio. This does not mean inference remains in Singapore: its international deployment can process requests on global nodes outside mainland China. Other cloud, SDK and support services may also process data outside your country. Before a feature transfers data, its notice identifies the relevant recipients, purposes and processing locations or deployment scope. See Model Studio's Singapore deployment scope.

For international transfers we use applicable legal transfer mechanisms, written processor obligations, access controls and safeguards providing the protection required by your local law. We obtain any required separate consent and complete required assessments or filings before the relevant transfer. We do not enable a transfer if those requirements cannot be met. You may request information about recipients and safeguards through section 7.

We do not sell personal information. Necessary information may be disclosed to service providers or to meet legal obligations and address fraud or security incidents. External advertiser websites and platforms such as WhatsApp or TikTok process information under their own policies when you choose to use them.

5. Advertising

The App may show image advertisements arranged directly by EBD. It does not integrate an advertising-network SDK, use an advertising ID or create personal advertising profiles. EBD's advertising statistics are daily campaign impression and click totals, without licence, earbud or device-session identifiers. General network-security processing may still apply. Advertiser websites have their own privacy practices.

6. Retention and deletion

Ordinary voice, translation and AI content under EBD's control: temporary buffers are cleared when the request or conversation session ends, and no later than 24 hours after collection. We exclude this content from ordinary application logs and backups. Voluntary reports and feedback follow the separate periods below.
AI content reports: expire 30 days after submission. App and website support feedback: expires 90 days after submission. Expired records are blocked from ordinary access immediately; daily cleanup removes them, including retries, within 72 hours after expiry unless an earlier legal deadline applies.
Detailed usage and security logs: request-level quota and usage records are kept for up to 90 days; EBD-controlled security logs for up to 30 days after the event. Aggregate quota balances, without conversation content, follow the authorization period below. Truly anonymous totals may be kept longer.
Authorization, binding and age eligibility: maintained while the authorization remains usable. On closure, revocation or an eligible deletion request, we remove binding and associated personal records within 30 days, or sooner where required by law. A minimal protected revocation record may remain only while necessary to prevent reuse of that code, with necessity reviewed at least annually; it contains no conversation content, contact details or raw earbud address. Stopping use or exhausting a quota alone does not close an authorization.
Privacy requests and consent records: request correspondence and the minimal record of its outcome are kept for up to 12 months after closure. Consent evidence is kept while the relevant processing continues and for up to 12 months afterwards. Additional identity-verification evidence is deleted within 30 days after verification is completed or the request is closed, whichever occurs first. Access is restricted to rights handling, accountability and legal needs.

Alibaba Cloud: its published Model Studio policy normally retains inference inputs and outputs for up to 30 days, with legal or service-security exceptions. Content flagged by safety filtering may be retained for up to two years under that policy. Stateful conversation and file features can retain data until deleted; EBD does not enable those persistent features for ordinary translation or AI conversations. Operational, billing and security metadata follow separate rules. This Model Studio period does not automatically cover other Alibaba Cloud speech products or third-party models; the feature notice explains the applicable provider retention before use. We do not promise zero retention. See Alibaba Cloud's retention policy.

Cloudflare: the published Workers Logs retention is 3 days on the Workers Free plan or 7 days on the Workers Paid plan, where this logging is enabled. D1 Time Travel keeps database recovery history for 7 days on Workers Free or 30 days on Workers Paid. These are specific service windows, not expiry limits for live database records, all security logs or separately exported backups. Other infrastructure and SDK records follow applicable provider rules. See Workers Logs retention, D1 recovery history, Cloudflare's privacy policy and Google ML Kit's disclosure.

Backups: EBD's separately exported recovery copies expire within 30 days of creation; they are access-restricted and are not used for ordinary operations. A deletion from the active service may remain in such backups until expiry. If a backup is restored, we will reapply applicable completed deletion requests before returning the restored data to ordinary use. We do not create a fresh backup of expired records to restart their retention period.

Limited exceptions: a documented legal obligation, active dispute or security investigation may require specific records to be held longer, only for that purpose and with restricted access. We review such holds at least every 90 days and delete eligible records within 30 days after the reason ends, subject to any shorter legal deadline. We explain relevant exceptions in our reply unless prohibited by law. Uninstalling the App does not automatically delete server records or provider-held information. System-managed secure storage or phone backups may also retain local information after uninstalling.

7. Your rights and how to contact us

Depending on applicable law, you may request access, correction, deletion or a portable copy of your data, withdraw consent, request restriction, object to processing or complain to the relevant authority. You may use the contact methods below to exercise these rights. You do not have to contact us before approaching your data-protection authority.

Automated checks use activation validity, binding status and remaining quota to allow or refuse service requests. They do not create advertising profiles. If a check incorrectly denies access or affects your rights, you can ask our privacy team for an explanation and human review.

In the App: use Settings → Privacy Policy → Request access, correction or deletion. You can also open Settings → Help & feedback, start your message with “Privacy request”, describe the request and provide a reply email.

On the web, including after uninstalling: use the EBD Translate privacy-request contact form. Select the other-support topic and begin the message with “Privacy request — EBD Translate”. Give a name or alias, reply email and the request; product and country fields are optional. No App installation, login or activation is required to submit. You may request deletion of your EBD Translate data, including an account and its associated data if your version provides an account. The form reaches our privacy team and any designated data-protection officer.

By post, including if you cannot use the App:

Privacy Requests — HongKong QVOL Technology Limited
Room C, 9/F, WINNING HSE
72–76 Wing Lok Street
Sheung Wan, Hong Kong

Provide a licence identifier or activation-code last four characters if available. Do not send complete activation codes, passwords, cloud credentials, recordings or unrelated private content. We may request limited additional evidence; an email or code suffix alone does not establish ownership.

We acknowledge requests within 48 hours and normally complete them within 30 calendar days of receipt, or within any shorter period required by applicable law. Verification does not automatically restart that period. If a lawful extension or refusal applies, we explain the reason, expected timing and available complaint route within the applicable deadline. We do not charge for ordinary requests; any legally permitted exceptional fee is explained in advance.

After proportionate verification, we process eligible records and coordinate deletion or correction with relevant providers. A submission receipt confirms receipt, not completed deletion. Deleting authorization information may end service access and permanently disable the affected activation code; it does not create or restore quotas. We explain any necessary retained records, their purpose and retention period in our reply.

8. Children

EBD Translate is intended only for people aged 18 or over and is not offered to children under 18. Where an otherwise eligible user still needs parental or guardian consent under local law, that consent must be obtained before processing; if it cannot be obtained, the service is not enabled. Age screening uses only the minimum age-range or eligibility information needed, not routine collection of identity documents or a full date of birth. If we learn that an ineligible child has submitted personal information, we stop the affected processing and delete eligible information. A parent or guardian may contact us through section 7.

9. Security and updates

We use encrypted network connections, encryption for stored personal data under our control, least-privilege access, protected authorization information and contractual safeguards for processors. We keep content and credentials out of routine logs and investigate suspected breaches. Where required, we notify the relevant authority and affected people within applicable legal deadlines. No system guarantees absolute security.

We may update this policy as services or requirements change, display the revision date and communicate material changes through the App or an official service page before new processing begins. We obtain fresh consent where required for a new purpose or material change; continued use alone is not consent to unrelated processing.