SOZOLIVE+ Privacy Policy

Version 1.0 Effective date 6 November 2026

This policy explains how SOZO PTE LTD handles personal data for SOZOLIVE+ at plus.sozolive.asia. It covers browsing, membership, sign-in, events, missions, rewards, community participation, uploads and administrative support. It is a notice about our practices, not a request for blanket consent. Optional permissions remain separate from the data needed for the service you request.

1 Who to contact

SOZO PTE LTD is the operator responsible for SOZOLIVE+. Our address is 15 Lorong 8 Toa Payoh, #06-07 Singapore 319262. Our GST Registration No is 200904134M. Contact our privacy enquiries function at PI_Inquiry@sozo.sg, or write to the Data Protection Officer at that address. This contact also receives policy complaints and account-closure requests.

2 Information we collect

Account information includes your verified email address, display name, country, chosen interests, join date, account status and marketing preference. We record necessary consent choices and their timing. Profile pictures may be an uploaded image or a library character assigned to your account. We do not require a password for email-code sign-in. If you choose Google sign-in, we receive your Google account identifier, verified email address and display name to create or link your membership. We request basic identity information only; this does not give us access to your Gmail messages, contacts or Google Drive files. Google also handles data under its own policies.

Participation records include followed events, attendance check-ins, mission answers, ratings and free-text survey responses, checkpoint verification, photo submissions and review outcomes, Gacha results, points transactions, reward reservations and collection history. Records describe what the app recorded; a shared checkpoint code alone does not verify physical location or attendance.

Community information includes posts, captions, photos, reactions, reports and moderation decisions. We also keep information you send when requesting support, making a complaint, reporting infringement or exercising a privacy right. Business contact information may be requested to handle an organiser enquiry, but ordinary fan registration does not require business details.

Technical and security data can include IP-related request information, browser/device information supplied with requests, access logs, sign-in and security events, session identifiers, abuse-prevention records and administrative activity. These help deliver the site, limit misuse and investigate incidents. We do not require continuous location tracking or facial recognition to provide current SOZOLIVE+ features.

Do not upload identity documents, payment-card details, health information, private messages or other sensitive information into a public post, profile or survey unless a specific authorised process clearly requires it. If you submit information about someone else, you must have an appropriate basis and give them relevant notice where required.

3 Purposes of processing

We use information to verify email access, create and manage membership, deliver requested features, keep participation records, review submissions, maintain points and rewards, provide support, moderate content, investigate abuse, protect the service and satisfy applicable legal obligations. We use event, country, interest and participation information to make the membership relevant and to understand demand for events and activities.

We may use appropriately aggregated or anonymised statistics for event planning and reporting. Data that can still identify or reasonably be linked to a person remains personal data. We do not describe identifiable surveys or coded member records as anonymous merely because a name is removed.

We use your marketing preference to manage optional direct marketing about SOZO events and member opportunities. General information displayed on the website is distinct from a direct personalised campaign. Any new partner-marketing, messaging channel or materially different purpose must be explained and supported by the consent or other legal basis required for it. We do not treat these policies as permission for every future feature.

4 Choices and consent

We collect and use data with consent where required, or under another applicable basis permitted by law. Where a legal exception is used, its conditions must be met; it does not become a blanket permission. If information is needed for sign-in, reviewing a submission or fulfilling a reward, declining or withdrawing permission for that use may mean we cannot provide that particular function. We will explain relevant consequences.

Marketing is optional and can be changed in Your profile. Essential verification, security and account-service communications are not controlled by the marketing checkbox. They must not be used to conceal unrelated advertising. A future WhatsApp, SMS or telephone campaign requires the applicable channel permissions and compliance checks; providing an email address is not permission to contact a telephone number.

Gallery permission is optional and specific to a photo/caption. You can refuse it and still use membership, submit a private mission photo for review and earn the mission points available for an approved submission. A 5-point thank-you may be earned once per member for eligible optional sharing permission across mission and community photos. You keep that bonus if you withdraw permission, and changing consent repeatedly does not earn additional points.

5 Visibility of profiles and photos

Your sign-in email is not shown to other fans through ordinary community features. Your display name, chosen profile image, post, caption and reactions may be shown to the relevant signed-in community audience. A profile image may also be viewed by authorised staff for an appropriate account or moderation task. A library character does not establish your identity.

Mission photos and private survey answers are available to you and authorised staff for the relevant function. Mission photo review does not automatically make a photo public. Community photo posting makes the photo visible to signed-in event fans as explained before posting. Public mission, event and website galleries require the separate gallery permission and an authorised publishing decision.

When you withdraw gallery permission in the app, the controlled SOZOLIVE+ gallery endpoints stop making that photo available for those public placements. Private review or other necessary lawful retention can continue separately. Withdrawal does not erase the original community post, remove a profile image, delete the account or retract copies made independently by others. Ask us if you also want a post, uploaded image or account removed, or if a controlled reuse appears to remain available.

The current upload process accepts supported JPEG, PNG and WebP images up to 20 MB, subject to decoding and dimension limits. It re-encodes images and removes embedded metadata during processing. This reduces metadata exposure but does not anonymise a face, name badge, address, landmark or other detail visible inside an image. Profile images are cropped to a square; mission/community images may retain high resolution.

6 Cookies and browser storage

An essential sign-in cookie keeps you authenticated and currently expires after approximately 24 hours. Email verification codes currently expire after approximately 10 minutes. Expiry prevents use; it does not promise that every related log or security record is erased at that exact time. Signing out clears the active session and the app's working-copy storage in that tab.

SOZOLIVE+ uses browser session storage to remember pages, filters, scroll position and certain unfinished answers or forms. Working copies currently have a 24-hour application expiry and are scoped to the signed-in member and access context. Browser tab/session restoration can affect how long storage physically remains; do not treat closing a tab as secure erasure on a shared device. Files, live camera state, sign-in codes and entered checkpoint codes are not recovered as draft content. A remembered working copy is not a submitted response.

Clearing storage or blocking essential cookies can sign you out or remove unsaved work. Use sign-out and your browser controls on a shared device. We will update this notice and provide any required choices before introducing non-essential advertising, tracking or analytics technologies. Provider email-delivery or security telemetry may operate separately as explained under service providers.

7 Service providers and disclosures

Authorised SOZO personnel and contracted technical providers may process information for their assigned purposes, subject to appropriate confidentiality and access controls. Brevo is used to send verification emails; it receives the destination address and information needed to deliver and secure the message. Delivery records may include technical email metadata. The configured sender is shop@sozo.sg; this is not the privacy-request address.

Other necessary recipients can include hosting, network, storage, backup, security and support providers; professional advisers; and authorities where legally required or authorised. We must assess and control these arrangements rather than assuming a provider's public privacy notice is sufficient. We may preserve or disclose proportionate records to protect people, investigate a substantiated concern or comply with lawful process.

Event organisers, reward fulfilment partners and ticket providers do not automatically receive the entire SOZOLIVE+ database. If a particular service requires partner disclosure, we will explain the recipient, information and purpose and obtain consent where required. A partner's independent marketing requires its own appropriate permission or other applicable legal basis. SOZOLIVE+ does not currently offer members' personal data for sale as a marketplace feature.

If the business is reorganised or transferred, any personal-data disclosure must remain lawful, proportionate and protected. This policy does not permit unrestricted disclosure to any prospective buyer. External websites you choose to visit process information under their own notices; SOZO remains responsible for its own disclosure to them.

8 International processing

SOZOLIVE+ serves people across countries and may use service providers that process information outside Singapore. Overseas processing must use arrangements that meet applicable transfer requirements and provide the required comparable protection, rather than relying solely on a general clause stating that overseas transfers are allowed. Ask PI_Inquiry@sozo.sg about relevant recipients or safeguards. Public gallery material can be viewed worldwide when you permit that publication.

9 Security

We use reasonable technical and organisational safeguards appropriate to the data and risk. Current controls include verified sign-in, session checks, task permissions, personal-information access tiers, restricted photo review, controlled publishing, input checks, request limits and relevant audit records. These are safeguards, not a guarantee that an incident is impossible. Protect your email account and device and report suspicious access promptly. Do not send a live sign-in code to the privacy mailbox.

If a personal-data breach occurs, we will assess and contain it and make notifications required by applicable law. A promise to notify every person of every technical issue is not made; notification depends on the applicable legal criteria. Our incident process must preserve relevant evidence and address provider involvement.

10 Retention and deletion

We retain identifiable account and participation records while needed to provide membership and resolve relevant requests, reservations or disputes. Posts and images remain while needed for their feature or a continuing permission. Withdrawing public-gallery permission removes that publication basis, but a private mission review, legal duty or properly justified security purpose may require limited continued retention.

Consent, reward and security records may need to remain after a feature ends or an account closes to show what happened, resolve a claim or prevent repeat abuse. Backups may contain earlier records until they are rotated or securely disposed of, with access restricted and deletion instructions reapplied when necessary after restoration. A hidden post or an administrator's reversible removal is not the same as permanent deletion.

We must review retention and cease retaining data, or remove the means of identifying you, when its purpose is no longer served and retention is no longer necessary for legal or business purposes. We do not promise an automatic deletion period that the service does not implement. Contact us for a particular deletion or retention request; we will explain material limitations and any applicable refusal. We do not treat Singapore law as providing an unrestricted erasure right in every situation.

11 Access correction and complaints

Contact PI_Inquiry@sozo.sg to request access to personal data we hold about you, information about relevant uses/disclosures where required, correction, withdrawal of consent, account closure or review of a privacy concern. Explain the request and identify the affected account or content. We may request proportionate identity or authority verification; do not send an identity document unless we explain why it is necessary and provide a suitable channel.

We will handle requests as soon as reasonably possible or practicable as applicable. If an access or correction request cannot be completed within 30 days, we will inform you in writing within that period of when we expect to respond, subject to the applicable rules. A permitted access fee, if any, will be explained in advance. Exceptions can limit access or correction, including protection of another person's data; we will explain our decision where the law permits. We will preserve relevant records where legally required while a request is being handled.

You may raise an unresolved Singapore data-protection concern with the Personal Data Protection Commission through pdpc.gov.sg. Contacting us first does not remove any right to approach a regulator. A representative or guardian should explain their authority when acting for someone else.

12 Children and international members

Our proposed membership rule is 13 and above, with the guardian involvement described in the Terms and any higher activity-specific limits. We do not knowingly invite children below that minimum to register. If we learn that a child has supplied data without the required understanding, permission or eligibility, we will assess appropriate restrictions, guardian involvement and deletion or other lawful handling. A statement in a policy does not replace suitable age and consent processes.

Children and young people should use a nickname and a character avatar if they do not want to share their face, and should not post school details, live location or private contact information. Public images of children require particular care and the appropriate authority and permissions. Contact us promptly about an image of a child or a safety concern.

Mandatory local rights may apply to members outside Singapore. This policy does not declare compliance with every country's privacy law or waive rights available where you live. We must assess additional local notices, transfer requirements and age rules before expanding targeted services into another jurisdiction.

13 Policy changes

We will publish the version and effective date of an update and highlight material changes through an appropriate channel. A materially different purpose or optional disclosure that requires permission will not be authorised simply by changing this text. For an app-specific inconsistency with an older general SOZO notice, this more specific notice explains SOZOLIVE+ processing, subject to the law and any particular consent you gave.