LUQI Privacy Policy

1. Introduction

This Privacy Policy describes the personal information that Superb Capital Labs Inc. ("LUQI," "we," "us," or "our") collects through the LUQI iOS application and related services, why we collect it, how we use and share it, and the choices and rights you have. We are a Delaware corporation operating from Honolulu, Hawaii, and we act as the controller of your personal information.

LUQI is a mobile app that serves as your personal AI Feng Shui master. After you enter your birth date and gender, the app computes your Feng Shui chart (such as your Chinese zodiac sign, Kua number, lucky directions, and governing element) and produces daily, monthly, and yearly "energy" readings. An AI master answers questions you submit, each as a single, self-contained consultation rather than an ongoing companion chatbot. The app also includes daily guidance, an almanac, and a "Scan" feature that analyzes a photo of your room or space.

This Policy applies to your use of the LUQI app and any features offered through it. It does not apply to any third-party services or websites that we do not control. LUQI is for adults 18 and older. Your use of the Service is also governed by our Terms of Service.

Last updated: June 24, 2026.

2. Information We Collect

We collect the following categories of personal information, organized by how we obtain it.

(a) Information you provide to us

• Display name. The name you choose to show in the app.
• Date of birth. We use your date of birth for two purposes: to compute your Feng Shui chart and to verify that you are at least 18 years old. We do not collect your birth time.
• Gender. Used to calculate your Kua number.
• Questions and messages you submit to the AI master. The text of the consultation questions you ask.
• Daily check-ins and short journal notes. Any brief entries you record in the app.
• Photos of your room or space. Images you upload to use the Scan feature.
• Sign-in identifiers. When you sign in with Sign in with Apple or with Google sign-in via Firebase Authentication, we receive a user ID and may receive your name and email address from the provider, depending on what you choose to share.

(b) Information we derive

• Your computed Feng Shui profile. From your birth date and gender, we derive information such as your Chinese zodiac sign, Kua number, lucky and unlucky directions, and governing element, along with your daily, monthly, and yearly readings.

(c) Information we collect automatically

• Usage analytics. Screens viewed and in-app events, collected via Firebase Analytics.
• Subscription and purchase status. Your subscription and purchase state, received through RevenueCat and Apple.
• Technical and diagnostic data. Device type, app version, and the IP address inherent to your requests, and possibly crash data, collected via Firebase.
• Push-notification token. If and when notifications become available and you enable them, we would collect a push-notification token to deliver them. Push notifications are a planned, forthcoming feature, and we do not collect a notification token unless and until you enable it.

3. What We Do Not Collect

To be clear about the boundaries of our data practices, we do not collect the following:

• Birth time. We only use your birth date, not the time of day you were born.
• Precise or GPS location. Your lucky directions are derived from your birth chart, not from your device's location. We do not collect precise geolocation.
• Payment card details. All payments are processed by Apple. We never see or store your card numbers.
• Data from users under 18. The app is restricted to adults, and we do not knowingly collect or retain personal information from anyone under 18 for use of the Service. If someone who turns out to be under 18 enters a date of birth during onboarding, we use it only to block sign-up; we do not create a profile, send anything to the AI, or retain that date of birth. See the Children and Age Restriction section for details.

4. How We Use Your Information

We use the personal information described above for the following purposes:

• Compute your chart and readings. To calculate your Feng Shui profile and your daily, monthly, and yearly readings.
• Generate AI guidance and Scan analysis. To produce the AI master's answers and the analysis of the room or space photos you submit to the Scan feature.
• Operate, secure, and improve the Service. To run the app, maintain its security and integrity, debug and diagnose issues, and improve features.
• Manage subscriptions. To provide, renew, and administer your subscription and entitlements.
• Send transactional emails. Such as a reminder that your trial is ending, account and service notices, and similar communications.
• Analytics and diagnostics. To understand how the app is used and to monitor performance and stability.
• Safety and crisis protocol. To detect signals of self-harm or crisis and respond by showing crisis resources, as described in the Safety and Crisis Resources section below.
• Comply with law. To meet legal obligations and to establish, exercise, or defend legal claims.

5. How the AI Works and What We Send to It

The AI master's guidance, its answers to your questions, and the analysis produced by the Scan feature are generated by Google's Gemini models through Google Vertex AI, grounded in the Feng Shui calculations our app performs from your chart.

What we send to the AI. Depending on the feature you use, we send to Vertex AI the relevant facts from your computed chart, the context of your question or check-in, and/or the room-or-space photo you submit for a Scan. We send what is needed to generate a useful, self-contained response.

No-training commitment. Per Google Cloud's AI/ML Privacy Commitment and Vertex AI data-governance terms, Google does not use customer data, including the prompts and inputs we send and the responses generated, to train or fine-tune Google's foundation or AI models without permission.

What we do not claim. This is a no-training commitment, not a promise that Google never stores or sees the data. Google may process and briefly retain inputs and outputs to operate the service and for abuse monitoring, in accordance with its terms.

Vertex AI processing for LUQI occurs in the United States. AI-generated guidance is for reflection and entertainment and is not professional, medical, legal, financial, or psychological advice.

6. Service Providers and Sub-Processors

We rely on a small set of service providers (sub-processors) to operate LUQI. Each receives only the data needed for its role, and may process personal information on our behalf under contract. They are:

• Google Firebase / Google Cloud. Provides authentication, the Firestore database, file storage for your Scan photos, serverless functions, and analytics. Your data is stored on Google Cloud in the United States.
• Google Vertex AI (Gemini). Receives the relevant chart facts, your question or check-in context, and/or your Scan photo in order to generate a response, as described above. This processing occurs in the United States.
• RevenueCat. Receives an app user ID and your purchase and subscription information to manage entitlements.
• Apple. Processes in-app purchases and payments, and provides Sign in with Apple.
• Resend. Receives your email address and name to send transactional emails, such as the trial-ending reminder.

Other disclosures

Legal and compliance. We may disclose personal information if we believe it is reasonably necessary to comply with a law, regulation, legal process, or governmental request; to enforce our Terms of Service; to detect, prevent, or address fraud, security, or technical issues; or to protect the rights, property, or safety of LUQI, our users, or the public.

Business transfer. If we are involved in a merger, acquisition, financing, reorganization, or sale of all or part of our assets, personal information may be transferred as part of that transaction, subject to this Policy or a successor policy with comparable protections.

7. We Do Not Sell or Share Your Personal Information

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under California law. Because we do not sell or share personal information, we do not offer a "Do Not Sell or Share My Personal Information" link. If our practices ever change, we will update this Policy and provide such a link and any other choices required by law.

8. Data Retention

We keep personal information only as long as we need it for the purposes described in this Policy, and we apply the following general criteria:

• Account data. Information associated with your account, such as your display name, date of birth, gender, and computed profile, is kept for the life of your account.
• AI interactions and check-ins. The questions you submit to the AI master, your check-ins and journal notes, and your Scan photos are retained for as long as we need them to provide the Service, and then deleted, or until you delete the relevant entry or your account, whichever comes first, unless a longer period is required for a legal, safety, or security purpose.
• Deletion on account closure. When you close your account, we delete or de-identify your personal information, subject to limited exceptions where we must retain certain information to comply with legal obligations, resolve disputes, or enforce our agreements, and to allow for the cycling-out of routine backups.
• Crisis-resource records. Records that crisis resources were shown to a user are retained for safety monitoring, as described in the Safety and Crisis Resources section.

9. Security

We use reasonable administrative and technical safeguards designed to protect personal information against unauthorized access, use, alteration, and disclosure. The Service runs on Google Cloud infrastructure, and we rely on the security controls that infrastructure provides, along with measures such as access controls and authentication.

We want to be honest about the limits of security: no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You also play a part by keeping your sign-in method and device secure. We do not claim any particular security certification, and nothing in this Policy should be read as such a claim.

10. Safety and Crisis Resources

LUQI is not a crisis service, a medical or mental-health provider, or a substitute for professional care, and it does not monitor your messages in real time or provide emergency intervention.

If a message you submit signals self-harm or a crisis, the app is designed to show crisis resources, such as the U.S. 988 Suicide & Crisis Lifeline, instead of a normal reading. When this happens, we log on our servers that crisis resources were shown, for safety monitoring purposes. This logging is a safety record; it is not clinical monitoring and does not mean anyone is watching your messages as you send them.

If you are in crisis or think you may be in danger, please get help right away. In the United States, you can call or text 988 to reach the 988 Suicide & Crisis Lifeline, call 911, or contact your local emergency services. If you are outside the United States, please contact your local emergency number or a local crisis line.

11. Children and Age Restriction (18+)

LUQI is intended only for adults 18 years of age and older. During onboarding, we present a neutral age screen and use the date of birth you enter to confirm you are at least 18. If the date of birth indicates you are under 18, onboarding is blocked: we use that date of birth only to perform the age check, we do not create a profile, we do not send anything to the AI, and we do not retain the date of birth you entered.

We do not knowingly collect personal information from anyone under 18, and certainly not from children under 13 (within the meaning of the Children's Online Privacy Protection Act, or COPPA). If we learn that we have collected personal information from someone under 18, we will delete that information and terminate the account. If you believe a minor has provided us with personal information, please contact us at support@superb.capital so we can take appropriate action.

12. Access, Correction, and Deletion

You can access and correct much of your information directly in the app, for example by updating your display name or profile details.

In-app account deletion. You can delete your account from within the app. Account deletion removes your account and its associated data, in keeping with Apple's requirement that apps offering account creation also offer in-app account deletion. This includes data such as your profile, your computed chart, your check-ins and journal notes, your AI interactions, and your Scan photos.

Deletion is subject to limited exceptions: we may retain certain information where required to comply with legal obligations, resolve disputes, or enforce our agreements, and information may persist briefly in routine backups before it cycles out. Records that crisis resources were shown may be retained for safety monitoring as described above.

If you need help exercising any of these choices, contact us at support@superb.capital.

13. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"), gives you the following rights:

• Right to know and access the categories and specific pieces of personal information we have collected about you.
• Right to delete personal information we have collected from you, subject to exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information. As stated above, we do not sell or share personal information.
• Right to limit the use of sensitive personal information. See the note below on why this right is not triggered.
• Right to non-discrimination for exercising any of your rights.

About "sensitive personal information." Your date of birth and gender are personal information, and gender and age may also fall within the CCPA category of "characteristics of protected classifications under California or federal law." However, neither is statutory "sensitive personal information" as defined in California Civil Code section 1798.140(ae), and we do not collect precise geolocation. We recognize that the Feng Shui chart we compute, and the guidance built on it, could be viewed as relating to religious or philosophical beliefs, which is an enumerated category of sensitive personal information. The right to limit the use of sensitive personal information attaches where such information is used to infer characteristics about a consumer. We do not use any such information to infer characteristics about you for any purpose beyond delivering the Feng Shui Service you request, and we never use it for the secondary purposes the limit-use right is designed to restrict (such as cross-context behavioral advertising or profiling unrelated to the Service). For these reasons, we do not collect or process any category of "sensitive personal information" in a manner that triggers the right to limit its use, and we do not offer a corresponding link. If our practices ever change, we will update this Policy and provide any choices required by law.

How to submit a request. Email us at support@superb.capital. We will respond within 45 days, and may extend that period by up to an additional 45 days (for a total of up to 90 days) where reasonably necessary, with notice to you. We will take reasonable steps to verify your identity before fulfilling a request, such as matching information you provide against information we hold; for requests seeking specific pieces of personal information, we may apply a more stringent verification standard. Requests to know or access are generally limited to twice per 12-month period. You may use an authorized agent to submit a request on your behalf; we may require the agent to provide proof of authorization and may verify your identity directly.

Notice at Collection

We collect the following categories of personal information: identifiers (such as a display name, sign-in user ID, and any name or email received from your sign-in provider); characteristics of protected classifications under California or federal law (such as gender and age, derived from your date of birth); internet or other electronic network activity information (usage analytics and diagnostics); commercial information (subscription and purchase status); visual information (the photos you submit to the Scan feature); and other information you provide (date of birth, gender, your questions and messages, and your check-ins and journal notes), along with the Feng Shui profile we derive from your date of birth and gender. We collect this information for the purposes described in "How We Use Your Information." We disclose personal information for business purposes to the service providers described in the "Service Providers and Sub-Processors" section (for example, cloud hosting, AI processing, subscription management, and email delivery). We do not sell or share personal information. We retain personal information as described in "Data Retention."

14. EEA and UK Users (GDPR / UK GDPR)

If you are in the European Economic Area (EEA) or the United Kingdom (UK), the EU General Data Protection Regulation (GDPR) and the UK GDPR apply to our processing of your personal information. The controller is Superb Capital Labs Inc., 1111 Dillingham Blvd, Honolulu, HI 96817, support@superb.capital.

Lawful bases

• Performance of a contract (Art. 6(1)(b)). For creating and maintaining your account, providing the core Service, and delivering the AI features you request.
• Legitimate interests (Art. 6(1)(f)). For analytics, security, and product improvement. Where we rely on legitimate interests, we balance them against your rights and interests.
• Consent (Art. 6(1)(a)). For marketing email, which you can withdraw at any time.

Transactional and service emails. Emails such as a trial-ending reminder and account or service notices are not marketing. We rely on Article 6(1)(b) (performance of a contract) or Article 6(1)(f) (our legitimate interest in operating and administering your account) for these, separate from the Article 6(1)(a) consent basis used only for marketing email.

Special category data

Some information we process, such as your Feng Shui chart and the guidance built on it, may reveal or be used to infer religious or philosophical beliefs, which is a special category of data under Article 9. Special-category data requires both a lawful basis under Article 6 and a separate condition under Article 9. For this information we rely on the relevant Article 6 basis (such as performance of a contract or our legitimate interests) together with your explicit consent under Article 9(2)(a), given through a separate, unbundled opt-in. Because the core Feng Shui chart inherently involves such data, we obtain this explicit-consent opt-in at onboarding before the chart is computed; the Article 9(2)(a) explicit consent sits alongside, and does not replace, the Article 6 basis. You can withdraw this consent at any time, which stops further such processing but does not affect the lawfulness of processing carried out before withdrawal.

International transfers

We are based in the United States and process personal information there. For transfers from the EEA to the US, we rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the EU Standard Contractual Clauses together with a transfer impact assessment. For transfers from the UK to the US, we rely on the UK Extension to the Data Privacy Framework where applicable, and otherwise on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the SCCs. These mechanisms cover our US-based sub-processors, including Google Cloud and Google Vertex AI.

Your rights

Subject to applicable law, you have the rights of access, rectification, erasure, restriction of processing, data portability, objection to processing, and to withdraw consent at any time where processing is based on consent. To exercise these rights, contact us at support@superb.capital.

You also have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO). In the EEA, you may contact the supervisory authority in your country of residence, place of work, or where the alleged infringement occurred.

EU representative: [to be appointed]. UK representative: [to be appointed] (Article 27).

We retain personal information for the periods described in "Data Retention."

15. International Users and Data Location

LUQI is operated from the United States. Regardless of where you use the Service, your personal information is processed and stored in the United States and on Google Cloud, including the AI processing performed by Google Vertex AI. By using LUQI, you understand that your information will be transferred to and processed in the United States, which may have data-protection laws that differ from those of your country. Where required, we put in place appropriate safeguards for such transfers, as described in the EEA and UK section above.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this Policy. If we make material changes, we will provide additional notice as appropriate, for example through the app or by email. We encourage you to review this Policy periodically. Your continued use of the Service after an update takes effect means you accept the revised Policy.

17. Contact Us

If you have questions, requests, or concerns about this Privacy Policy or our handling of your personal information, please contact us:

Superb Capital Labs Inc.
1111 Dillingham Blvd
Honolulu, HI 96817
Email: support@superb.capital