Privacy Policy

Last updated: May 15, 2026

1. Introduction

This Privacy Policy ("Policy") explains how Voluptas Co Inc ("we", "our", or "us") collects, uses, stores, shares, and protects your personal information when you use the Bonbon Plus iOS application (the "App" or the "Service").

Please read this Policy carefully before using the App. By creating an account or continuing to use the App, you confirm that you have read and understood this Policy. If you do not agree, please uninstall the App and stop using it.

This Policy and our Terms of Service together form the complete agreement between you and us. Where the two conflict, the provision more protective of your privacy rights will prevail.

2. Information We Collect

We collect only the minimum information necessary to provide and improve the App. Information is grouped below by source.

2.1 Information You Provide

We collect this information only when you submit it.

2.2 Information Collected Automatically

2.3 Information from Third Parties

We do not purchase or otherwise obtain your personal information from third-party advertising networks or data brokers. Personal information forwarded to us by Apple via Sign in with Apple is described in §9.3.

2.4 Children's Information

Bonbon Plus is intended exclusively for adults aged 18 years or older, regardless of the local digital age of consent. Where local law imposes a higher minimum age for certain content or services, that higher threshold also applies.

We do not knowingly collect information from minors. If we discover that a user is below the applicable age, we will delete the account and associated information promptly. Parents or guardians who become aware of unauthorized minor registration can contact us at services@bonbon.plus; we will respond within seven (7) business days.

3. How We Use Your Information

We use your personal information solely for the following purposes:

3.1 Providing Core Services

• Account registration, login, and management
• Profile display, user recommendations, and AI-powered matching
• Public chat rooms, 1-to-1 text messaging, and voice/video calls
• Delivery of virtual gifts and activation of VIP membership entitlements

3.2 Safety and Risk Management

• Detecting and preventing fraud, multi-accounting, cheating, and account compromise
• Protecting account and payment security (e.g., blocking abnormal logins)
• Responding to lawful requests from law enforcement

3.3 Content Moderation and Community Standards

• Reviewing user profiles, avatars, public posts, and private messages for policy compliance
• Handling user reports, banning violating accounts, preserving evidence

3.4 Product Improvement

• Analyzing feature usage, identifying crashes and performance issues
• Conducting A/B tests to improve the user experience (results aggregated anonymously)

3.5 Customer Support and Notifications

• Responding to your support requests
• Sending transactional notifications about your account, orders, or security (via APNs or in-app message)

3.6 Legal Compliance

• Meeting obligations imposed by applicable laws and regulations
• Responding to valid legal process

We will not use your personal information for purposes outside the scope above. If we ever need to expand the scope, we will obtain your express consent first.

3.7 You May Withdraw iOS Permissions at Any Time

You can revoke any permission previously granted (Photos, Camera, Microphone, Notifications, etc.) by going to iOS Settings → Bonbon Plus. Withdrawing a permission may disable the related feature but will not affect the existence of your account.

4. How We Share, Transfer, and Disclose Information

We do not sell your personal information to anyone. We may share information with limited third parties only in the following circumstances.

4.1 Necessary Service Providers (Data Processors)

To operate Bonbon Plus, we work with the following categories of service providers. These providers process data only on our written instructions and may not use it for their own purposes:

We have signed data processing agreements (DPAs) with the above providers and require them to maintain security standards no lower than ours. The complete list with links to each provider's privacy policy is published at https://website.bonbon.plus/privacy/subprocessors.

4.2 Other Users

Information you voluntarily make public (nickname, avatar, bio, interest tags, public posts) is visible to other users. Content you send in 1-to-1 private messages is visible only to your conversation partner.

4.3 Legal and Safety Requirements

We may disclose your information, to the extent permitted by law, when we believe disclosure is necessary to:

• Respond to a court order, subpoena, search warrant, or other valid legal process;
• Cooperate with a lawful law-enforcement investigation;
• Protect the rights, property, or safety of the Company, our users, or the public (including in life-threatening emergencies);
• Investigate possible violations of this Policy or applicable law.

4.4 Corporate Transactions

If we are involved in a merger, acquisition, asset sale, bankruptcy, or similar transaction, your information may be transferred as part of that transaction. We will notify you in advance through prominent means (push notification, in-app notice, or App launch announcement) and will require the successor entity to honor obligations no lower than this Policy.

5. Your Rights

Depending on the privacy laws applicable to you (such as, where applicable, the CCPA/CPRA and other similar laws), you may have the following rights with respect to your personal information:

5.1 Right to Access — You may view your profile information at any time within the App. To request a complete copy of your data, email services@bonbon.plus; we will respond within 30 days.

5.2 Right to Rectification — You can edit most fields directly under "My Profile". Fields that cannot be self-edited may be corrected via Customer Support.

5.3 Right to Erasure / Right to Be Forgotten — You may delete your account in Settings → Account → Delete Account. After deletion:

• Your profile, private messages, and posts will be removed from production databases within 30 days;
• Backup data will be naturally rolled over and deleted within 90 days;
• Records that we are legally required to retain (e.g., transaction and compliance records) will be kept for the periods specified in Section 7.2.

The same retention schedule applies regardless of whether the account was deleted by you, by us pursuant to §3.3, or pursuant to a verified data-erasure request you submit.

5.4 Right to Object — For non-essential processing (e.g., behavioral analytics), you may opt out via Settings → Privacy.

5.5 Right to Data Portability — Where your jurisdiction provides this right, you may request a copy of your personal data in a structured, commonly used, machine-readable format and have it transmitted to you or to another controller.

5.6 Right to Withdraw Consent — Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

5.7 Right to Lodge a Complaint — If you believe we have violated applicable privacy law, you may file a complaint with the relevant data-protection or consumer-protection authority in your jurisdiction. California residents may complain to the California Privacy Protection Agency (CPPA) or the California Attorney General's office.

To exercise any of these rights, contact services@bonbon.plus. We will respond within 30 days. We may need to verify your identity before fulfilling your request.

6. How We Protect Your Information

6.1 Technical Safeguards

• HTTPS / TLS 1.2+ encryption for all data in transit
• Passwords stored using one-way hash algorithms (e.g., bcrypt)
• Critical databases encrypted at rest
• Access control under the principle of least privilege; all sensitive operations are logged for audit

6.2 Organizational Safeguards

• Employees sign confidentiality agreements upon joining; access is revoked immediately upon departure
• Background checks for roles with access to sensitive data
• Regular security and privacy training

6.3 Data Breach Response

• We maintain an incident-response plan and will commence investigation within 72 hours of detecting a suspected breach
• If we confirm a breach that may harm your rights, we will notify regulators and affected users within the timeframes required by applicable law

6.4 Your Responsibilities

Please safeguard your account credentials. If you suspect unauthorized access, contact services@bonbon.plus immediately.

6.5 Our Commitments

• We will not sell your personal information to any third party.
• We will not rent your personal information for third-party advertising or marketing.
• We will not use your information for purposes outside the scope declared in this Policy without first obtaining your renewed consent.

7. Data Storage and International Transfers

7.1 Storage Location.

Your personal information is stored primarily in AWS data centers located in Singapore. Certain third-party processors listed in §4.1 (e.g., PostHog, OneSignal, Mailgun, Apple) may host data in other regions in accordance with their own infrastructure; see our subprocessor list at https://website.bonbon.plus/privacy/subprocessors for details.

7.2 Retention Periods.

7.3 International Transfers.

To deliver our service, your information may be transferred to and processed in countries outside your jurisdiction, including the United States, where our parent company and certain processors are located. Where applicable law requires, we implement appropriate cross-border transfer safeguards, including industry-standard contractual protections with the recipient and equivalent technical and organizational measures.

8. Cookies and Similar Technologies

The iOS App does not use traditional web cookies. It does, however, use the following functionally similar technologies:

• Local storage (NSUserDefaults / Keychain): stores login state, user preferences, and security tokens
• Device identifier (IDFV): identifies your device only within this App, used for fraud prevention and analytics
• Push token (APNs): used to deliver push notifications

These technologies are cleared when you delete the App via Settings → iPhone Storage → Bonbon Plus → Delete App.

9. Apple-Specific Disclosures

9.1 Apple In-App Purchase (IAP).

All payments within Bonbon Plus (VIP membership, virtual items, paid voice/video) are processed by Apple Inc. through the App Store IAP system. We receive only anonymized transaction receipts to grant entitlements. We do not access or store your credit card number or Apple ID password.

9.2 Refunds.

You may request refunds directly from Apple at https://reportaproblem.apple.com. Refund decisions are made by Apple. Once a refund is granted, the corresponding entitlements will be revoked.

9.3 Sign in with Apple (if enabled).

If you choose Sign in with Apple, we receive only the anonymized email address and Apple user ID forwarded by Apple. You can revoke authorization at any time in your Apple ID settings.

9.4 Child Accounts.

Bonbon Plus is not a child-directed application. If your Apple ID is registered as a child account, the Family Sharing organizer should prevent download and use of this App. Upon detection, we will terminate the account and delete its data.

10. California Residents — Additional Disclosures (CCPA / CPRA)

If you are a California resident, in addition to the rights described elsewhere in this Policy, you have the right to:

• Know the categories, sources, purposes, and recipients of personal information we collect
• Delete your personal information
• Opt out of sale or sharing — we do not sell your personal information, and we do not share it for cross-context behavioral advertising
• Correct inaccurate personal information
• Limit the use of sensitive personal information
• Non-discrimination — exercising these rights will not result in discriminatory treatment

To exercise these rights, contact services@bonbon.plus or call +1 (971) 512-4318.

11. Additional Information for International Users

Business operating Bonbon Plus: Voluptas Co Inc, with registered office at 200 N Grand Ave Pasadena CA. All privacy inquiries should be directed to services@bonbon.plus.

Lawful Bases for Processing. Where the laws of your jurisdiction require us to identify a legal basis for processing your personal information, we generally rely on one or more of the following:

• Performance of a contract (registration, transactions, service delivery)
• Legitimate interests (fraud prevention, risk control, service optimization)
• Consent (marketing notifications, non-essential analytics)
• Vital interests (life-or-safety emergencies, as described in §4.3)
• Legal obligation (tax, anti-money-laundering, response to lawful process)

Rights under local law. Where your local law grants additional rights (such as access, rectification, erasure, restriction, objection, or portability), you may exercise those rights by contacting services@bonbon.plus, subject to verification of your identity. We will respond within 30 days or such other period required by applicable law.

12. Child Safety Commitment

We have zero tolerance for child sexual abuse material (CSAM) and content that exploits or endangers minors. Our practices include:

• Hash-matching and human review of uploaded images for CSAM signals
• Immediate account termination, evidence preservation, and reporting to the National Center for Missing & Exploited Children (NCMEC, U.S.) or its equivalent within 24 hours
• Cooperation with law-enforcement CyberTipline systems
• Dedicated reporting channel: services@bonbon.plus

13. Changes to This Policy

We may update this Policy from time to time to reflect changes in law or product practice. For material changes (changes to data types, purposes, or third-party sharing), we will provide at least seven (7) days' advance notice before the changes take effect, consistent with §17 of our Terms of Service. Notice may be delivered through any of the following channels:

• App launch screen notice
• In-app message or push notification
• Email to your registered address

Continued use of Bonbon Plus after the effective date of changes constitutes acceptance of the updated Policy. If you do not accept the changes, please stop using the App and delete your account in accordance with Section 5.3.

Prior versions are archived at https://website.bonbon.plus/privacy/archive.

Governing Law. Unless otherwise required by applicable local law, this Policy is governed by the same law as our Terms of Service (§16.1): the laws of the State of California, United States of America.

14. Contact Us

We commit to providing a substantive response within 30 days of receiving your request.

© 2026 Voluptas Co Inc. All rights reserved.