Effective date: October 17, 2026
EmbodiFlow is a data platform developed and operated by IO-AI TECH. The hosted service operator is IO Intelligent (Shenzhen) Co., Ltd. (legal name in Chinese: 艾欧智能（深圳）有限公司). The English name is a translation of the Chinese legal name. Contact us at io@io-ai.tech or +86 0755-88658665. Our business and correspondence address is Floor 5, Building C1, China Merchants Smart Park, 459 Qiaokai Road, Fenghuang Subdistrict, Guangming District, Shenzhen, Guangdong, China.
This policy covers EmbodiFlow authentication, accounts, team collaboration, recording uploads and imports, data processing and delivery, and related support. Our corporate website, io-ai.tech, has its own privacy policy. EmbodiFlow starts with recordings already collected. It does not itself continuously capture your environment through a robot or camera, or provide device registration, heartbeats or firmware updates.
We determine the purposes of necessary account administration, platform security and business communications. For recordings and derived data supplied by a customer team, the customer generally determines the purposes and permitted uses, and we act on its instructions as a processor or equivalent service provider. Applicable law and the customer data processing agreement (DPA) determine the precise responsibilities. Your team's administrators may separately explain how they manage your membership and activity records.
| Category | Source and examples | Principal purposes |
|---|---|---|
| Account and identity information | Login email, display name, authentication information, memberships and roles supplied by you or your organization; necessary identifiers and profile information from enabled identity providers | Authentication, access administration, recovery and necessary notices |
| Recordings and derived data | Customer uploads or authorized imports of images, video, audio in supported formats, poses, joints, actions, sensor streams, timestamps, locations and metadata; episodes, labels, quality results, processing outputs, dataset versions, exports and customer-requested models | Instructed storage, conversion, quality inspection, annotation, delivery and customer-selected training or evaluation |
| Usage and security information | IP address, browser/client User-Agent, request and operation times, authentication events, sessions, task events, errors and usage facts | Security, troubleshooting, traceability and billing verification |
| Support and business information | Support requests, contact details, contracts, payment-related records and necessary diagnostic material you provide | Support, contract administration, invoicing and required recordkeeping |
| Optional analytics information | Page events, browser information, online identifiers and masked page interaction records when Google Analytics or Microsoft Clarity is enabled | Optional usage analysis and experience improvements, as described in section 6 |
Recordings may contain other people's faces, voices, movements, health-related information, children or workplace information. Joint and sensor information may also be personal data when linked to an individual. Listing a data type does not mean every format or feature is supported; the product itself shows what it accepts.
You need not consent to optional analytics to use the core service. Missing information necessary for authentication or security may prevent the corresponding service; missing inputs necessary for a recording task may prevent that task. Avoid unnecessary personal data or secrets in filenames, labels and logs.
When a customer selects files, authorizes an import or uses an authorized upload interface, recordings enter the instance's object storage. AWS deployments may use S3 storage, EC2 compute and temporary EBS volumes. Tencent Cloud deployments may use COS and CVM. Private deployments use the customer's configured local or private object storage and compute resources.
For the workflow the customer selects, compute tasks read or download inputs to temporary storage, then load portions into CPU/GPU memory for quality inspection, conversion, segmentation, annotation or other selected operations. Results are written back to the instance's storage. Customer-selected algorithms or containers may access their inputs; the customer is responsible for reviewing and authorizing their access, outputs and external calls.
Uploading data does not authorize us to use it for our own general-purpose model training, advertising profiles or sale. Customer-requested training and expressly selected AI processing are customer instructions. If we ever wanted to use data for a purpose of our own, we would first give separate notice and obtain the applicable authorization or legal basis.
Signing out of the website does not revoke tokens issued to other clients, stop their uploads or automatically cancel submitted tasks. To stop an upload, stop it in the tool that started it and sign out or revoke that tool's authorization. To stop a task, cancel it in the product.
Customers are responsible for establishing a lawful basis and giving appropriate notices before collecting, uploading, instructing processing, sharing or delivering personal data. Where consent, guardian consent or another authorization is required, customers must obtain it and keep supporting evidence. A platform user's login checkbox cannot supply consent on behalf of recorded individuals or satisfy the customer's obligations for sensitive data, children or international transfers.
For recordings that require privacy protection, until the applicable consent and anonymization evidence is in place, raw access is limited to the uploader, project or team Owners, and current project members who hold both algorithm publishing and workflow management permissions, in addition to ordinary read permissions. Running team code also checks the raw-data authority of the revision's actual publisher and of the person who submitted the run. Other reads, every export and every delivery must meet the recording's applicable privacy requirements. A project type, authorship of a data format or team membership does not waive them.
Quality inspection or format conversion is not anonymization. Face blurring may leave identifying voices, bodies, surroundings or locations; pseudonymization may still leave personal data. Customers should assess the actual results before sharing. The platform is intended for organizations and adults authorized to use it. For recordings involving children, customers must satisfy applicable guardian consent, age-specific rules and safeguards, including special requirements for information about children under 14 where Chinese law applies.
Audio kept inside a raw file stays inside the restricted raw-access boundary. Standardized outputs and deliveries do not include raw audio, and unsupported standalone audio processing cannot bypass this protection through another path.
The default international hosted deployment is AWS US East (Ohio), us-east-2, with primary object storage, account databases and compute set up as described for your instance. The default mainland China hosted deployment is Tencent Cloud Shanghai, ap-shanghai. Other supported arrangements may be specified in the customer contract.
Selecting English or Chinese changes display language only. It does not change your instance or migrate, replicate or relocate your data. Actual primary storage, databases, compute, backup locations, CDN caching and support access are described in your instance notice, deployment schedule and contract.
| Provider or recipient | Possible functions and information accessed | Location considerations |
|---|---|---|
| AWS entities identified in the deployment schedule | S3, EC2, EBS and, where enabled, CloudFront delivery of customer content | International primary resources default to Ohio; other compute, backup and edge locations are disclosed separately |
| Tencent Cloud entities identified in the deployment schedule | COS, CVM and, where enabled, EdgeONE acceleration, security inspection, request logs and caches | Mainland primary resources default to Shanghai; edge nodes and logs are not necessarily confined there |
| Relevant Google Analytics / Microsoft Clarity providers | Optional analytics, masked interaction records and diagnostics | May involve processing outside your country; the provider list for your instance names the entities, information and locations |
| Customer-selected identity, algorithm or other providers | Authentication, selected algorithms or authorized external processing | Depends on the enabled service and its notice |
| Our authorized operations personnel | Necessary support access to account information, activity records and customer data | Personnel may be in mainland China, the United States or Australia; remote access may itself be international processing |
With CDN acceleration, request metadata and authorized content may pass through edge nodes and be cached. An Ohio or Shanghai origin does not mean every copy, log or access is located there. Your deployment schedule states whether EdgeONE or CloudFront handles customer content and its cache retention and invalidation rules. Listing a provider here does not enable it or disclose data to it.
The Ohio default does not promise exclusive US storage or access. Singapore, ap-southeast-1, may be used for expressly disclosed and agreed international compute or backups; it is not automatically enabled by this notice. Mainland instances do not automatically replicate content or backups overseas because an international offering exists.
Before we enable cross-region backups, overseas analytics or overseas support access, we disclose the actual recipient, countries, purpose and data categories, and meet the applicable transfer requirements. Depending on the data and the law, these may include contractual safeguards, assessments, filings or separate consent. You can ask our privacy contact for information about the safeguards that apply. Choosing a region or ticking the sign-in acknowledgment does not by itself satisfy transfer requirements.
Necessary cookies or local storage support sign-in, security, language and the preferences you choose. This necessary processing is separate from optional analytics.
We may use Google Analytics or Microsoft Clarity for optional usage analysis. If we enable them for your instance, we will give you separate controls to accept, reject and later withdraw each one, and, where the law requires consent, nothing optional starts before you give valid consent. Rejecting or withdrawing never prevents sign-in or core data operations. We will describe the purposes, providers, retention and processing locations in a cookie and analytics notice at that time. Private deployments that do not allow outbound connections do not load external analytics.
Passwords, tokens, account personal fields, customer image and video previews, filenames and sensitive pages are excluded from analytics and page recordings. Masking some fields does not make the remaining information anonymous. The sign-in acknowledgment does not replace these choices.
| Data category | Default rule |
|---|---|
| Active accounts and customer content | Retained as necessary to deliver the agreed service, subject to customer instructions and contract |
| Customer-deleted recordings and corresponding outputs | Soft-deleted for 3 calendar months from the effective deletion request and hidden from normal customer access. Authorized administrators may restore them after verifying a recovery request; permanent cleanup follows the period |
| Account information and customer data after account closure | Generally retained for 3 calendar months from effective closure, then handled under the contract, team relationships and legal duties. Closing an individual account does not automatically delete content legitimately used by other team members |
| Temporary input files for compute tasks | Normally cleaned within 2 hours after task completion; failure, cancellation and interruption handling is described in the deployment schedule |
| Backups, object versions and CDN caches | Included in deletion scope and removed by cleanup or expiry; deletion does not mean every copy disappears instantly. Your deployment schedule states cleanup cycles and the maximum time a copy can remain |
| Security, audit, billing and legally required business records | Retained for applicable minimum periods and necessary purposes. Where mainland China network-log rules apply, the minimum is 6 months and is not shortened by the general account retention period |
The recovery period reduces accidental deletion loss; it does not override legally required earlier deletion. You may request earlier permanent deletion at our privacy email. After verifying identity and authority, we handle the request subject to law, contract, legal holds and other team members' rights. Being recoverable does not allow continued use of deleted content.
Audit and usage records preserve immutable facts, and dataset versions preserve immutable history. Where erasure or restriction is required, we use formal revocation, access restriction, de-identification or lawful deletion without silently rewriting history. De-identified records remain protected if they can still be linked to an individual. Information kept because the law requires it is used only for that purpose and handled when the requirement ends.
Data in transit uses HTTPS/TLS. Server-side permissions, team boundaries and restricted access administration protect information, and operations access is limited to what support or security work needs. Platform operations identity does not by itself grant access to customer content or allow impersonating a customer. Content needed for support comes from authorized support material or a separately approved lawful arrangement, never through an administrator path that bypasses team isolation or privacy checks.
Storage encryption, key management, operations MFA, access logging and other controls for a specific deployment are described in its security schedule. Using a cloud provider does not mean every such control is enabled, and no system is free of vulnerabilities. If a personal data incident occurs, we remediate it and give the notifications the law requires.
To report a vulnerability or information leak, email platform@io-ai.tech. Please do not access more data than you need to confirm the issue, and stop and tell us if you reach personal or customer data.
Depending on applicable law, you may request access or a copy, correction, deletion, restriction, withdrawal of consent and, where applicable, portability or objection to processing. Withdrawal does not affect earlier lawful processing or necessarily end necessary processing supported by another legal basis. You may complain to the relevant regulator.
Contact io@io-ai.tech with your relationship to the account or recording and your request. We verify identity in proportion to the risk and respond within the legal deadlines that apply. If we extend, limit or refuse a request, we explain why and what remedies you have. For customer-controlled recordings, we assist the customer and may direct you to the organization deciding that processing. Do not email passwords, complete recordings or unrelated identity documents.
Where the GDPR applies, we rely on a documented basis for account and security purposes, such as contract necessity where the individual is a party, legal obligations or assessed legitimate interests. A customer's contract with us does not automatically make every processing operation necessary for each of its staff. Processing that rests on consent can be withdrawn separately. We do not sell personal information. Where required, we will publish region-specific supplements that identify representatives, rights and transfer arrangements before serving that market.
Customers may purchase a private deployment on their own servers using Kubernetes. The contract specifies nodes, storage, backups and operational responsibilities. The customer generally determines the purposes and means of local account and recording processing and must provide its own user notice. Our responsibilities cover the implementation, maintenance and support processing it authorizes.
Private deployment does not automatically send recordings to IO-AI TECH, Tencent Cloud or AWS. Analytics, external algorithms, cloud backups, remote support, log transmission and other data egress are specified in the deployment schedule and need the customer's authorization. Customers may review and provide redacted diagnostic material for support; the scope, locations, duration and access records of remote support are agreed in advance.
Private deployment does not by itself mean there are no external connections or that every legal requirement is met. The actual network, storage and integrations determine residency and safeguards, and neither party is exempt from its legal duties because the deployment is local.
When we make a material change, we tell you through a sign-in prompt, an in-product notice or another suitable means, and we update the effective date. Processing that needs fresh consent waits for that consent. Earlier versions remain available on request.
The sign-in acknowledgment confirms that you have read this policy and the explanation of the processing needed to provide the service. It does not authorize optional analytics, give consent on behalf of everyone in a recording, or replace separate consent that the law requires for sensitive information, disclosure to third parties or international transfers. The Terms of Service, the customer DPA and the deployment schedule set out contractual responsibilities separately, and none of them reduces your statutory rights.
Questions, requests and complaints about this policy: io@io-ai.tech. Website: https://io-ai.tech.