Privacy Policy

1. Collection and use of personal data

Under Article 8 of Taiwan's Personal Data Protection Act, we notify you of the following matters concerning the collection, processing and use of customer data:

1. Scope. (1) When you register, sign in, purchase products, participate in online events, marketing or product promotions, questionnaires or prize activities, or receive customer services such as satisfaction surveys, feedback, answers to questions or information requests, service provision and improvement, and user experience research and analysis, ORRA collects, processes and uses your personal data as described below. Please also refer to the Service's terms for personal data collection, processing and use notices. When you browse ORRA, we automatically receive and record computer and mobile device information, including IP addresses, cookie data, software and hardware attributes, and app download records. Such data generally cannot directly or indirectly identify an individual; where it can, this notice applies. (2) We may disclose some of your information to ORRA partners for the specific purposes above and ensure that they strictly comply with this Policy. Except as necessary to comply with laws or requests from competent authorities or judicial bodies, preserve legal claims or defenses, or prevent fraud or other unlawful acts, we will not use or transfer your personal data to third parties for purposes unrelated to its collection. ORRA will not sell or market your personal data to third parties. (3) ORRA may link to other websites or pages or use third-party services. Their data collection, content and privacy policies are independent of 8 Interactive.
2. Purposes. Marketing; consumer and customer management and services; online shopping and other e-commerce; surveys, statistics, research and analysis; contractual, quasi-contractual or other legal relationships; other business consistent with registered business activities or organizational articles; and other consulting and advisory services (statutory purpose codes 040, 069, 090, 148, 157, 181 and 182). Personal data is collected during registration or transactions.
3. Categories. Under the Ministry of Justice's specific purposes and personal data categories, data may include C001 individual identifiers, C002 financial identifiers, C003 identifiers in government records, C011 personal descriptions, C021 family circumstances, C035 leisure and interests, C036 lifestyle, C051 school records, C081 financial details (income, earnings, assets and investments), C093 financial transactions and C102 agreements or contracts, and other information specified in applicable activity notices or contracts. The actual categories depend on our business or services with you and the data actually collected from you or third parties.
4. Period, locations, recipients and methods. Unless law provides otherwise, use continues until you request that we stop using your personal data or the relevant Service ceases. Locations include the Republic of China (Taiwan), the United States (where third-party AI providers' servers are located), and other regions necessary for cross-border transfers to provide the Service. Recipients include the Company, affiliates, outsourced service providers, delivery and freight operators, processors and sub-processors (including cloud infrastructure providers and AI providers such as Anthropic, PBC), and relevant partners. Data is used through automated or non-automated methods in compliance with personal data protection laws.
5. Under Article 3 of the Personal Data Protection Act, you may inquire about or inspect your data, request copies, request supplementation or correction, request that collection, processing or use stop, and request deletion. Contact customer support to exercise these rights.
6. You may choose whether to provide personal data to ORRA. Refusing to provide information necessary for registration, or providing incomplete information, may prevent full or any use of the Service. For example, without a national identification number you cannot participate in related marketing activities organized by the Service.
7. ORRA cannot verify your identity from the information you provide or determine whether information is impersonated, misappropriated or false. You bear all civil and criminal liability for forged or false information you provide.

2. Sharing and disclosure

1. When you browse the Service, ORRA automatically receives and records computer and mobile device data, including IP addresses, cookie data, software and hardware attributes and browsing history ("Related Data"). We use it to improve and personalize services and send specific information such as service announcements, marketing advertisements and administrative messages.
2. ORRA advertisers include financial providers (such as banks, insurance agents, securities brokers and mortgage institutions) and non-financial companies (such as retailers, airlines and software companies). Advertisers, including ad delivery companies, may assume that people who view, click or interact with advertisements meet their targeting criteria. Viewing or interacting with an advertisement means you agree that advertisers may make these assumptions about the criteria used for display advertising.
3. Affiliates and other trusted companies or persons processing data for us must follow 8 Interactive's instructions, this Policy and other appropriate confidentiality and security measures. We share personal information when access, use, preservation or disclosure is reasonably necessary to (1) comply with applicable laws, regulations, legal processes or government orders; (2) enforce the Service's terms, including investigating possible violations; (3) detect, prevent or address fraud, security or technical issues; or (4) protect the rights, property or safety of 8 Interactive, users or the public as required or permitted by law.

3. Cookies

1. A cookie is sent to your computer by a website or page you visit and can recognize your browser on later visits. Cookies may store preferences and other information. You can set your browser to reject all cookies or warn you when one is sent, but some features or services may then not function properly.
2. ORRA sets and accesses 8's cookie data on your computer or mobile device.
3. Other companies advertising on certain ORRA pages may set and access cookies on your devices under their own privacy policies, rather than this Policy. Advertisers and other companies cannot access ORRA's cookie data.
4. ORRA uses web beacons to access cookies related to our products and services on and off our websites.

4. Confidentiality and security

1. Some services require a member account and personal information, usually your name, email address and password. We use account information to authenticate you and prevent unauthorized account access.
2. 8 Interactive provides personal data to employees whom it reasonably believes need it to provide products or services to you or perform their work.
3. 8 Interactive's servers use firewalls, antivirus protection and other procedural and technical information security measures.
4. 8 Interactive has implemented physical, electronic and procedural safeguards.
5. If personal data is stolen, leaked, altered or otherwise compromised, we will immediately activate our emergency response to mitigate harm, notify affected individuals in a timely manner as required by law via email, system announcements or other appropriate means, and provide follow-up inquiries and assistance at support@no8.io.

5. Changes to this Policy

8 Interactive reserves the right to revise this Policy at any time. Material changes to the handling of personal data will be announced on 8's official product website.

6. Copyright infringement notices

If you believe content or information in the Service or ORRA website infringes your copyright, provide:

1. The rights holder's or agent's name, address, telephone, fax, email or other automated contact method, and the name of the work or plate alleged to be infringed.
2. A statement requesting removal of, or disabling access to, content alleged to infringe copyright or plate rights.
3. Information sufficient for 8 Interactive to identify and locate the allegedly infringing content.
4. A good-faith statement that the content is unauthorized or violates copyright law.
5. A statement accepting legal liability if false information causes harm, together with supporting information, signed or sealed and sent to 8 Interactive's customer support email.

If you believe you have not infringed another person's copyright, provide:

1. Your or your agent's name, address, telephone, fax or email.
2. A request to restore removed or inaccessible content and sufficient information to identify it.
3. A good-faith statement that you have a lawful right to use the content and that its removal or disabling resulted from a false or mistaken statement by the rights holder or agent.
4. Your consent for 8 Interactive to forward the counter-notice to the rights holder or agent.
5. A statement accepting legal liability if false information causes harm, together with supporting information, signed or sealed and sent to 8 Interactive.

7. Handling alleged copyright infringement

To respect intellectual property rights, 8 Interactive applies the following procedures to allegedly infringing content or information in the Service:

1. Upon receiving a rights holder's notice, we promptly remove the allegedly infringing content and notify the user through agreed or recorded contact details. We may share the handling status and the rights holder's name, email or telephone with the user to facilitate direct resolution. Incomplete notices must be supplemented upon request.
2. Content deleted following an infringement claim cannot be restored. If a user is involved in three alleged infringement incidents, we will terminate all or part of their Service.
3. A user disputing the allegation may submit a counter-notice for forwarding to the rights holder. We request supplementation of incomplete notices and promptly forward completed notices. If the rights holder does not provide evidence of legal proceedings against the user within ten business days beginning the day after receipt, the user may re-upload the content.
4. We may request missing information from either party using their supplied email or fax.
5. Supplementation must be completed within five business days beginning the day after receiving our request. An incomplete or late response is treated as no notice under copyright law.
6. Except with user consent or for service provision, we disclose identifying information to third parties only as required by law or government authorities. An infringement report results in removal as requested, not disclosure of the user's identity to the claimant. To obtain user information, file a complaint with the district prosecutors office or Criminal Investigation Bureau; we will promptly cooperate upon an official request.

8. Google API Service: User Data Policy

The following supplements explain how the application accesses, uses, stores and shares Google user data:

1. Access. When you use ORRA, we may access information supplied through Google APIs, such as Google account information, solely to provide and improve our services.
2. Use. We use Google user data only with your explicit authorization, to improve your experience, personalize services and perform statistical analysis to improve products and services.
3. Storage. We store Google user data under data protection laws, only as long as necessary unless law requires otherwise, and ensure its security.
4. Sharing. We do not provide Google user data to third parties without consent, except to comply with law, protect our rights or prevent fraud. We may share data with affiliates or trusted companies or persons that follow our instructions and appropriate confidentiality and security safeguards.
5. Security. Appropriate technical and organizational measures protect Google user data against unauthorized access, use and disclosure.

9. Questions and suggestions

Contact the 8 Interactive team at support@no8.io with questions or suggestions.

10. Third-party AI services and sub-processing

To provide intelligent conversations, text analysis and AI Workforce features, the Service integrates APIs from Anthropic, PBC, located in the United States ("Anthropic"). When enterprise customers upload employee, applicant or end-user data, the customer is the entrusting entity under Article 4 of the Personal Data Protection Act, the Company is the processor, and Anthropic is our lawfully appointed sub-processor. International transfers and supervision are described below:

1. Transfer regions. The Republic of China (Taiwan) and the United States, where Anthropic's servers are located.
2. Supervision of Anthropic. (1) Scope and purpose are limited to user-entered text/prompts and necessary technical parameters for real-time API computation and responses. We never authorize Anthropic to use data for its own model training or other purposes. (2) Individuals can exercise Article 3 rights (inquiry, inspection, supplementation, correction, stopping processing/use and deletion) through support@no8.io; we coordinate with the recipient to fulfill them. (3) Transfers use encryption such as HTTPS/SSL to protect transmission.

The Company and Anthropic process data only under customer instructions and as necessary to provide the Service. Without prior explicit consent from the customer or individual, data is never used for our own model training, cross-customer analysis or other purposes.

You may choose whether to provide data or consent to cross-border processing. Refusal may prevent use of AI features. Individuals may exercise their Article 3 rights at any time by contacting support@no8.io.