Privacy Policy

Welcome to InPlay (hereinafter referred to as "InPlay," "we," "us," or "our"). InPlay is an AI-powered interactive story community: you watch cinematic AI stories, change the plot through your choices, chat with characters, and remix stories into your own versions. This Privacy Policy is intended to explain how we collect, use, share, and protect your personal information when you access or use the InPlay app, website, and any related services (collectively, the "Services").

By accessing or using the Services, you acknowledge that you have read and agree to this Policy. If you do not agree with this Policy, please discontinue your use of our Services.

We collect information that you voluntarily provide, information collected automatically by our systems, and information obtained from third-party sources.

2.1 Information You Voluntarily Provide

• Registration Information: When you register for an account, we may collect your username, email address, password, and date of birth.
• Profile Information: Your display name, avatar, and bio.
• User Content (AI Inputs and Outputs): We collect all content you create, upload, generate, or otherwise provide through the Services. This includes story choices, chat messages with characters, text prompts, images, audio, remixes, and comments, together with the story content generated from them and associated metadata (e.g., titles, tags, descriptions).
• Payment Information: If you purchase premium features or subscriptions, we (or our third-party payment processors) collect the payment data necessary to complete the transaction. We do not directly store your full payment card details.
• Communications: When you contact us for support or provide feedback, we collect the content of your inquiry and your contact details.

2.2 Information Collected Automatically

When you interact with InPlay, we automatically record certain technical data:

• Device and Technical Information: Including IP addresses, browser type, device model and identifiers, operating system, and screen resolution.
• Usage Data: Information about your activity within the Services, such as stories viewed, choices made, duration of use, navigation paths, and interaction records with AI characters.
• Log and Diagnostic Data: Crash reports, performance data, and error logs.
• Cookies and Similar Technologies: We use cookies to ensure the proper functioning of the Services and to enhance your user experience.

2.3 Information from Third-Party Sources

If you register using a third-party account (e.g., Google, Apple, Facebook), we may obtain your username, public profile information, and other data from that service provider.

We use your information to operate, provide, and improve InPlay. Specific purposes include:

• Providing Services: Creating and managing your account, generating and delivering story content, processing your choices, chats and remixes, and fulfilling your orders.
• Personalization: Recommending stories and creators that match your interests.
• Service Improvement and AI Training: Analyzing usage to optimize the platform. Where permitted by applicable law, we may use user-shared content (such as prompts, choices and story data) for the research, development, and training of our algorithms and AI models.
• Communications and Notifications: Sending you account notifications, service updates, or notices regarding policy changes.
• Security and Compliance: Verifying user eligibility, ensuring account security, preventing fraud, and fulfilling legal obligations.

With your consent or at your direction, we may share your data with third parties for other purposes. Where required by law, we will obtain your explicit consent before such sharing. We do not sell your personal information. We may share information in the following circumstances:

• Service Providers: Trusted third-party vendors who assist us in operating our business, such as cloud hosting providers (for story generation, media rendering and storage), payment processors, and data analytics providers.
• Business Transfers: In the event of a merger, acquisition, or asset sale, your information may be transferred to the successor entity as part of the assets.
• Legal Requirements: We may disclose information if required by law, subpoena, or to protect the rights and safety of InPlay, our users, and the public.
• Publicly Shared Content: If you choose to publicly share your stories, remixes, or profile on the platform, this content will be visible to other users.

The apps covered by this Privacy Policy are operated by InPlay. We use third-party software development kits ("SDKs") to support the features and services described in the list below. The list specifies which apps and platforms each SDK applies to.

Depending on the SDK and its configuration, personal data may be collected directly by the SDK provider or shared by us with that provider. The list below identifies each SDK and its provider, the purposes of processing, the categories of personal data involved, the circumstances in which collection or sharing occurs, and a link to the provider's privacy policy.

The linked privacy policies provide additional information about the relevant providers' data practices. They do not replace our responsibilities under this Privacy Policy and applicable law.

Where required by applicable law or platform rules, we will provide additional notice and obtain your consent before the relevant collection or processing begins. Available privacy choices and instructions for managing them are described in the relevant list entries or elsewhere in this Privacy Policy.

If you have any questions about our use of third-party SDKs or their handling of personal data, please contact us at inplay.support@musee.me. Details of the third-party SDKs used in our apps are set out below.

• Facebook SDK

  https://www.facebook.com/privacy/policy/

  Used for user login.

• Firebase SDK

  https://firebase.google.com/support/privacy

  Used for push messages, collecting and analyzing application crashes, collecting and analyzing application logs, and Google login.

• AppLovin MAX SDK

  https://www.applovin.com/privacy/

  Used for commercial monetization.

• AppsFlyer SDK

  https://www.appsflyer.com/legal/privacy-policy/

  Used to analyze the effectiveness of product placements.

• ThinkingData

  https://docs.thinkingdata.cn/ta-manual/latest/installation/installation_menu/privacy_policy.html

  Used for behavior analysis and automatic collection of launch, exit, install, crash, click and page-view events.

• Adjust

  https://www.adjust.com/terms/privacy-policy/

  Used for install attribution, deferred deep links, ad attribution, and event/revenue reporting.

• Google

  https://policies.google.com/privacy

  Used for Google third-party login, ad loading and display, rewarded ads, and ad revenue statistics.

• Expo SecureStore

  https://docs.expo.dev/versions/latest/sdk/securestore/

  Used for local secure storage of login state, tokens, or sensitive configuration.

InPlay is a global service. Your personal information may be stored and processed on servers located outside your country of residence, including in the United States or other jurisdictions. We will take appropriate security measures in accordance with applicable laws to ensure your information remains adequately protected during cross-border transfers.

Depending on your location, you may have the following rights:

• Access and Update: You can view and update your personal information by logging into your account.
• Deletion: You may request the deletion of your personal information or account, subject to legal retention requirements.
• Opt-out: You may opt out of receiving marketing emails by following the unsubscribe instructions included in the emails.
• Regional Rights (e.g., GDPR/CCPA): Users in Europe or specific U.S. regions may have specific rights regarding data portability, restriction of processing, or the right to opt out of the sale of personal information.

To exercise these rights, please contact us at inplay.support@musee.me.

We retain your information only for as long as necessary to fulfill the purposes described in this Policy or as required to comply with our legal obligations. When data is no longer needed, we will delete or anonymize it.

We have implemented reasonable legal, technical, and administrative measures to protect your personal information. However, no transmission over the internet can be guaranteed 100% secure; please use the Services with an awareness of the associated risks.

The Services are not directed to children under the age of 13 (or the minimum age required by local law). We do not knowingly collect personal data from children. If we discover that we have collected such data without parental consent, we will take immediate steps to delete it.

We may update this Privacy Policy from time to time. If significant changes are made, we will notify you by updating the "Last updated" date at the top of this page or by posting a notice within the Service.

If you have any questions about this Policy or our privacy practices, please contact us at:

Email: inplay.support@musee.me

Website: https://inplay.art

This Privacy Policy is written in English and may be translated into other languages. In the event of any inconsistency, conflict or ambiguity between the English version and translated versions of this Privacy Policy, the English version shall prevail.

This Privacy Policy is established, comes into force, and will be enforced and interpreted under the laws of Singapore, without regard to its conflict of law provisions. Any disputes arising hereunder will also be resolved in accordance with the Terms of Service.

In the event of a conflict between the provisions of the Supplemental Terms – Jurisdiction-Specific applicable to your jurisdiction from which you access or use the services, and the rest of the Privacy Policy, the relevant jurisdictions’ Supplemental Terms – Jurisdiction-Specific shall prevail.

15.1 Additional Notice for California Residents

This section applies to California residents covered by the California Consumer Privacy Act of 2018 (“CCPA”).

15.1.1 How we collect and disclose your personal information

Over the past 12 months, we have collected and disclosed your personal information as mentioned in the "What Information We Collect" and "How We Share Your Information" sections, for purposes set out in the "How We Use Your Information" section. We do not use sensitive personal information for purposes other than those permitted under the CCPA. Please refer to these sections to see details.

The category of the above information is reiterated with terms specified in CCPA as follows:

We do not knowingly collect any information about anyone under the age of 16.

15.1.2 Do we sell or share your personal information

Under the CCPA and CPRA, "sell" means disclosing personal information to a third party for monetary or other valuable consideration, and "share" means disclosing personal information to a third party for cross-context behavioral advertising.

We do not sell your personal information. However, we may share certain technical or usage information (such as device identifiers, cookies, or browsing data) with our advertising or analytics partners to deliver, measure, and improve cross-context behavioral advertising. Depending on the applicable law, such sharing may be considered "sharing" or "targeted advertising."

You have the right to opt out of our sale or sharing of your personal information, as well as to refuse the use of your data for targeted advertising. You may exercise this right at any time by clicking the "Do Not Sell or Share My Personal Information" link available on our website or within the App settings.

We do not sell or share the personal information of consumers we know to be under 16 years of age.If you have any questions or wish to learn more about how we handle such data disclosures, please contact us using the contact details provided in this Privacy Policy.

15.1.3 Your California rights

Depending on your residency, you have the following rights with respect to your personal information:

The right to know. You have the right to request to know what personal information about you we have collected, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected.

The right to delete. You have the right to request us to delete your personal information, subject to certain exceptions.

The right to correct. You have the right to request us to correct inaccurate personal information that we maintain about you. Note that correction requests are subject to certain limitations, and we may choose to delete rather than correct your personal information in some circumstances.

The right to opt-out. You have the right to opt-out of the sale or sharing of your information under CCPA.[However, as aforesaid, we do not sell or share your personal information in the context of CCPA. Therefore, we do not have an opt-out. We will not sell or share your personal information without providing you with notice and an opportunity to opt-out of such sale and sharing.]

The right to limit. Under the CCPA, you have the right to limit our use and disclosure of your sensitive personal information. However, since we currently use sensitive personal information only for the necessary purposes permitted under the CCPA, such as providing the services you request, we do not have any use cases beyond this scope at this time. If you have any questions, please feel free to contact us.

The right to non-discrimination. We will not discriminate against you for your exercise of privacy rights conferred by the CCPA.

15.1.4 How you exercise your rights

Method. You may exercise your rights by using methods described in the “What Are Your Rights and Choices” section. You may only make a verifiable consumer request for your “right to know” twice within a 12-month period.

Verifying your request. We only respond to your requests to your request when we can verify your request. In order to verify your request, we may need additional information, If we cannot verify your identity, we will let you know.

Range of our response. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. If we cannot comply with any portion of a request, the response we provide will also explain the reason, if applicable.

Authorized agent. If you choose to use an authorized agent to submit your request, we may require your agent to provide proof that you have given signed permission to submit the request. We may also require that you: (1) provide the authorized agent written permission to do so; and (2) verify your own identity directly with us. We will not require these steps if we have received proof that you have provided the authorized agent with a power of attorney pursuant to California Probate Code sections 4121 to 4130. We may deny a request from an agent that does not submit proof that they have been authorized by you to act on your behalf or from an agent that does not meet the requirements for authorized agents under the CCPA.

Fees and charges. We do not ordinarily charge a fee for our response to your requests. However, where a request is excessive, repetitive, or manifestly unfounded, we may determine to charge a reasonable fee to comply with your request.

Response timing. We will use good faith efforts to respond to your request within 45 days of receipt of such a request. Where an extension (up to a total of 90 days) is necessary, we will inform you of the reason and the needed extension period in writing. We will comply with your request to limit within 15 business days from the date of our receipt of your request.

15.1.5 Financial Incentive Program

We may offer you a Financial Incentive Program related to the collection, retention, or use of your personal information. These incentives are designed to reward user participation or engagement, such as when you complete certain tasks, participate in activities, or use our services. We may grant you virtual currency, points, coupons, discounts, or other similar benefits (collectively, "Rewards").

Participation in such programs is entirely voluntary. You may choose to join or opt out of the program at any time without any discrimination.

The categories of personal information that may be involved in these financial incentives include identifiers (such as email address, user ID); commercial information (such as transaction history, points history); and information related to your interactions (such as task completion, usage frequency, or preferences).

The personal information we collect is used solely to provide, operate, and improve the program and will not be used beyond the scope described in this Privacy Policy.

15.2 Additional Notice for Residents of European Economic Area ("EEA"),the United Kingdom and Switzerland

This section applies to residents of the European Economic Area ("EEA"), the United Kingdom ("UK") and Switzerland and supplements our general Privacy Policy. In the event of any conflict between this section and other parts of this Privacy Policy, the provisions of this section shall prevail..

15.2.1 Data Controller and Representative

Identity and contact details of the controller. The controller with respect to the processing in this Privacy Policy is VICOO PTE. LTD. The contact details of the controller are:

[Address: 91 BENCOOLEN STREET, #12-03, SUNSHINE PLAZA, SINGAPORE 189652

Email Address: inplay.support@musee.me]

Identity and contact details of the controller's representatives. In accordance with applicable data protection laws (including the GDPR, UK GDPR and the Swiss FADP)， if you have any questions，you may contact us：

[Address:91 BENCOOLEN STREET, #12-03, SUNSHINE PLAZA, SINGAPORE 189652

Email Address:inplay.support@musee.me ]

15.2.2 Legal Bases for Processing

We may only use your personal information when we have a lawful basis to do so under applicable data protection laws, including the GDPR (and UK GDPR) and Swiss FADP. These lawful bases include:

Your consent. We ask for your consent to access or use your personal information for specific purposes. With your consent, we will use your personal information.

Contractual necessity. We may process your personal information, to perform the contract we are about to enter into or have entered into with you.

Legitimate interests. We may process your personal information, where it is necessary to pursue legitimate interests of us or third parties, provided that your interests and fundamental rights and freedoms do not override those interests. The legitimate interests we rely on include (1) to improve your experience, (2) to send you marketing information, advertising and promotions about our products and services, (3) to develop, test and improve our products and services, (4) to ensure promote the safety, security and integrity of InPlay, and (5) to comply with laws, regulations, codes of practice, guidelines, or rules applicable to us and respond to requests from, and other communications with, competent law enforcement agencies, government regulators, courts and other public authorities, as well as meet our corporate and social responsibility commitments, protect our rights and property and the ones of our customers, resolve disputes, and enforce agreements.

Legal compliance. We may process your personal information, where it is necessary to comply with a legal obligation. This includes situations where we are legally required to do so or we have obligations to comply with a valid legal request such as an order or disclosure request from law enforcement agencies, government regulators, courts and other public authorities.

Public interests. We may process your personal information, where it is necessary to perform a task in the public interest, including undertaking research, preventing and detecting crime, safeguarding children and promoting public safety, security, and integrity as laid down by applicable laws and regulations.

Vital interests. We may process your personal information, where it is necessary to protect your or someone else's life, physical integrity, or safety. This could include providing law enforcement agencies or emergency services with information in urgent situations to protect health or life.

15.2.3 Your Rights under the GDPR/UK GDPR/Swiss FADP

Your rights regarding your personal information in accordance with GDPR, UK GDPR and Swiss FADP， specifically include the following:

The right of access. You have the right to request access to your personal information, which enables you to receive a copy of information undergoing processing.

The right to rectification. You may request correction of inaccurate personal information without undue delay. You may also supplement any incomplete personal information, taking into account the purposes of the processing.

The right to withdraw consent. Where your personal information is processed based on consent, you have the right to withdraw your consent at any time. The withdrawal of your consent does not affect the legitimacy of the processing that occurred based on your consent until the withdrawal.

The right to erasure (right to be forgotten). You have the right to request erasure of your personal information under the following circumstances: (1) the personal information is no longer necessary for the purposes of processing, (2) you withdraw your consent if the processing is solely based on consent, (3) you object to the processing and we have no overriding legitimate grounds or you object to the processing for direct marketing purposes, (4) your personal information has been unlawfully processed or (5) there is a legal obligation imposed on us to erase your personal information. However, where your personal information is necessary for specific purposes set forth in Article 17(3) of GDPR, the right to erasure (right to be forgotten) shall not apply.

The right to restriction. You have the right to restrict the processing of your personal information if (1) the accuracy of your personal information is contested by you, for the period in which we have to verify the accuracy of the personal information, (2) the processing is unlawful, and you oppose the deletion of your personal information and request restriction, (3) we no longer need your personal information for the purposes of processing, but your personal information is required by you for legal claims, (4) you have objected to the processing for the period in which we have to verify overriding legitimate grounds.

The right to portability. You have the right to portability, where (1) the processing of your personal information is based on a legal basis of contractual necessity or consent, and (2) the processing is carried out by automated means. This means that you have the right to receive your personal information you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit that information to another controller without hindrance from us.

The right to object. You have the right to object to the processing of your personal information at any time. We will comply with your request, unless we have an overriding legitimate ground or we need to continue processing your personal information to establish, exercise, or defend a legal claim. Where you object to the processing of your personal information for direct marketing purposes, which includes profiling to the extent that it is related to such direct marketing, we will no longer process your personal information for these purposes.

The right to lodge a complaint with a supervisory authority. You have the right to lodge a complaint about our processing of your personal information with your national data protection authority. If you are a resident of the EEA,You can click here to find contact details for data protection authorities in the EEA.

You may contact us via the contact information provided herein, if you wish to exercise all the above-mentioned rights or if you have any problems related to those rights. You will not usually have to pay a fee to exercise your rights. However, where your request requests are manifestly unfounded, repetitive, or excessive, we may charge a reasonable fee. We may need to request specific information from you to help us confirm your identity and ensure your rights. Where a third party submits a request on your behalf, we may need to take reasonable measures to verify the authenticity of the request. In order to speed up our response, we may ask for further information in relation to your request.

15.2.4 International Transfer

We may transfer your personal information outside the European Economic Area (EEA), the United Kingdom, and Switzerland for the purposes described in this Privacy Policy. For example, we may transfer your personal information to our headquarters in Singapore or to other countries or regions where our service providers or partners are located. When transferring personal information from the EEA, the United Kingdom, or Switzerland to jurisdictions outside these regions, we implement appropriate safeguards to ensure that your personal information receives a level of protection equivalent to that provided within the EEA, the United Kingdom, or Switzerland. Specifically, we rely on one or more of the following mechanisms:

Adequacy decisions. These are decisions from the European Commission under Article 45 GDPR (or equivalent decisions under other laws) where they recognize that a jurisdiction offers an adequate level of data protection. The list of jurisdictions with adequacy decisions is available here.

Other Safeguards: If we transfer your personal information to jurisdictions without an adequacy decision, we will implement one or more of the following appropriate safeguards to ensure the lawfulness of the transfer and the security of the data:

Standard Contractual Clauses (SCCs): Relying on the standard contractual clauses approved and published by the European Commission under Article 46 of the GDPR, which serve as binding contractual safeguards with the data importer.

Binding Corporate Rules (BCRs): For transfers within our group, we may rely on binding corporate rules approved by the relevant supervisory authority.

Other safeguards permitted under applicable law: Relying on other tools approved by supervisory authorities, such as approved codes of conduct or certification mechanisms.

We will provide you with key information about the appropriate safeguards we rely on, in accordance with applicable data protection laws and our internal policies. You may request this information by contacting us through the contact details provided in the "How to Contact Us" section of this Privacy Policy.

15.3 Supplementary Notice for Residents of the Republic of Korea

This section applies to users residing in the Republic of Korea ("Korea") and provides additional details about our specific practices regarding the processing of personal information of Korean users. In case of any inconsistency between this section and other parts of this Privacy Policy, this section shall prevail.

15.3.1 Age Verification and Data Processing for Adult (19+) Content

If you attempt to access adult content within our Services (content restricted to users aged 19 or older), we are required under applicable Korean laws and regulations to verify your age. This verification process involves the collection and processing of the following personal information:

Verification Method:We may verify your age using a third-party identity verification service provided by a licensed telecommunications operator in Korea.

Information Collected: Mobile phone number, name, date of birth,gender, telecommunications carrier, and verification result (adult/non-adult).

Purpose of Use: The sole purpose is to verify your eligibility to access adult content in accordance with Korean laws and regulations.

Retention Period: The verification result will be retained for up to one (1) year, allowing users to reuse the verification result during this period without re-verification. After one year, the verification record will be permanently and irreversibly deleted, and users will be required to complete age verification again.

Third-Party Recipient: Your identity information will be transferred to an authentication service provider solely for the purpose of identity verification. This provider will process your information strictly in accordance with applicable laws and its own privacy policy.

We are committed to taking appropriate technical and organizational measures to protect your data security in accordance with the Korean Personal Information Protection Act and other applicable laws.

15.3.2 Contact Information

If you reside in Korea and have any questions or complaints about this Privacy Policy or the processing of your personal information, you may contact us

Email: inplay.support@musee.me

Address: 91 BENCOOLEN STREET, #12-03, SUNSHINE PLAZA,

15.4 Additional Notice for Indonesia Residents

If you are a user located in Indonesia, in compliance with applicable Indonesian laws, we may collect and process your mobile phone number for SMS-based verification when registering or logging in.

SMS verification occurs only for account registration, identity verification, login authentication, and account security. We do not use your mobile phone number for marketing or promotional purposes without your separate and explicit consent.

On iOS, access is subject to system permission prompts. On Android, access is governed by system permission settings. You may manage or revoke this access at any time through your device’s privacy settings.

We may share your mobile phone number with third-party SMS service providers solely to deliver SMS verification codes. Such providers are required to process your data according to applicable laws and our instructions.