Cosmartor Privacy Policy

In case of discrepancy between language versions, the Traditional Chinese version prevails.

Version: v1 Effective date: 2026-06-01 Last updated: 2026-06-22

---

1. Introduction

Duomei International Industrial Co., Ltd. (Chinese name: 多美國際實業有限公司; the "Company", "we", "us") values the protection of your personal data. This Privacy Policy explains how we collect, process, use, and protect your personal data through the Cosmartor mobile application (iOS / Android, the "App") and related services (collectively, the "Service"). It is established under the Personal Data Protection Act of the Republic of China (Taiwan) and related laws, and forms part of the Terms of Service.

2. Personal Data We Collect

Depending on how you use the Service, we collect the following categories of data:

2.1 Account and Identity Data

• the email you provide when registering with email/password;
• the identifier and (with your authorization) email provided by Google or Apple when you sign in with a third-party account;
• the user ID generated by the authentication service.
• Our authentication and account storage use the third-party provider Supabase (see Section 7 on processors).

2.2 User Profile Data

• name (first/last), phone number (with country code), display-language preference, and other data you enter in the App.

2.3 Product, Order, and Warranty Data

• data related to your purchase, product registration, and warranty, such as order information, purchaser name/phone/email, warranty card serials, product registration status, and installation/repair records.

2.4 Device and Usage Data

• data relating to the Smart Control Box and Suspension System you connect to via the App, such as device/firmware version, suspension setting parameters, diagnostic trouble codes (DTCs), and system status records;
• your operations, settings, and preferences within the App.

2.5 Technical and Log Data

• technical logs necessary for operation and security, such as App version, mobile operating system, error/crash logs, and connection timestamps.

2.6 Consent Records

• the versions of this Privacy Policy, the Terms of Service, the EULA, and similar documents you accepted, and the time of acceptance, kept as evidence of compliance.

We do not proactively collect precise real-time vehicle location, driving trajectories, or sensitive personal data unrelated to suspension operation. If a future feature requires additional collection, we will inform you and obtain consent beforehand.

3. Purposes and Legal Bases

We process your personal data for the following specific purposes:

Purpose	Description
Account management & authentication	Create and maintain your account and verify sign-in
Providing core services	Connect to and operate the Smart Control Box, suspension settings, monitoring, firmware updates
Product registration & after-sales warranty	Process product registration, warranty determination, repair, and maintenance
Customer service & contact	Respond to your inquiries and provide technical support
Product safety & quality improvement	Analyze faults and usage to improve product and safety
Legal compliance	Fulfill legal, accounting, tax, and dispute-resolution obligations
System security	Detect and prevent unauthorized access, abuse, and attacks

Legal bases for processing include performance of our contract with you, your consent, the Company's legitimate interests, and compliance with legal obligations.

4. Cookies and Similar Technologies

The App is a native mobile application and primarily uses on-device local storage and necessary identifiers to maintain login state and operation; it is not used for cross-site advertising tracking. If a website portion of the Service uses cookies, a separate cookie notice will apply on that website.

5. Use, Disclosure, and International Transfer

5.1 We use your personal data only as necessary for the purposes in Section 3 and do not sell your personal data to third parties.

5.2 We may share your personal data with third parties or processors in the following cases:

• Service providers / processors — such as cloud hosting, authentication (Supabase), push notifications, and customer service, processing under our instruction and supervision and bound by confidentiality;
• Authorized dealers / installation and repair locations — as necessary to perform product registration, warranty, and repair services;
• Legal requirements — to comply with law or lawful requests from courts or authorities, or to protect the rights, property, and safety of the Company, you, or third parties;
• Corporate transactions — in a merger, acquisition, or asset transfer, provided the recipient agrees to abide by this Policy.

5.3 International transfer. Some service providers used by the Service (such as Supabase) may host servers outside the Republic of China (Taiwan). In such cases, we will adopt appropriate safeguards so that your personal data receives protection equivalent to this Policy.

6. Data Retention

6.1 We retain your personal data for as long as necessary to fulfill the purposes of collection; beyond that period or upon your valid request for deletion, we proceed under Section 8.

6.2 Retention of business records. Due to legal requirements (such as tax, accounting, consumer-dispute, and warranty obligations), order, warranty, repair, and maintenance records are retained for the statutory/necessary period even after you delete your account (see Section 8.2).

7. Processors and Third-Party Services

7.1 Supabase: the Service uses Supabase for authentication and account-data storage. When you sign in with Google/Apple, those providers' privacy policies also apply. 7.2 Apple App Store / Google Play: when you download the App and make in-app transactions (if any), the respective platform's terms and privacy policy apply. 7.3 The above third parties are responsible for their own processing under their respective policies.

8. Your Rights (Including Account Deletion)

8.1 Under the Personal Data Protection Act, with respect to the personal data we hold about you, you may: inquire about or request to review it, request a copy, request correction or supplementation, request that we cease collection/processing/use, and request deletion. Some actions can be performed directly in the App's account settings; for others, contact us under Section 10.

8.2 Account deletion. You may delete your account at any time within the App (or request our support to delete it for you). After deletion:

• we will permanently delete your identity and profile data (including your account in the authentication service, name, phone, email, and other identifying data); this action is irreversible;
• the registration status of products under your name will be released (products return to unregistered and may be re-registered by a new account in the future; the warranty start date is based on the installation-completion date and does not change due to account deletion);
• due to legal obligations, business records (orders, warranty, repair, etc.) related to your transactions are retained; purchaser information stored at the time of transaction (name/phone/email snapshot) is kept for the statutory retention period and then deleted or de-identified once its purpose is fulfilled;
• we keep a non-identifying deletion record (tombstone) solely for internal audit and customer-service reconciliation.

8.3 We may need to verify your identity before you exercise these rights. Where the law permits us to withhold or refuse (e.g., to avoid impeding official duties or the significant interests of others), we will explain the reason as required by law.

8.4 You may withdraw a previously given consent at any time; withdrawal does not affect the lawfulness of processing carried out before withdrawal. Partial withdrawal may render the Service wholly or partly unavailable.

9. Data Security

We adopt reasonable technical and organizational measures to protect your personal data, including transport encryption, access control and permission management, service-to-service authentication, and data minimization. However, no internet transmission or electronic storage is perfectly secure, and we cannot guarantee absolute security. In the event of a significant data breach, we will notify you and the competent authority as required by law.

10. Children's Privacy

The Service is not directed at children. If you have not reached the age of full legal capacity, you should use it with the consent of your legal guardian. If we learn that we have collected a child's personal data without appropriate consent, we will delete it promptly.

11. Changes to This Policy

We may amend this Policy from time to time. Amendments will be posted in the App or on the Company's website with an updated "Last updated" date; for material changes, we will notify you through the App and may require you to re-confirm your agreement.

12. Contact Us

If you have questions about this Policy or wish to exercise your personal-data rights, please contact:

Duomei International Industrial Co., Ltd. (多美國際實業有限公司) Data protection contact: privacy@cosmartor.com.tw Address: 11F.-2, No. 65, Songde Rd., Xinyi Dist., Taipei City 110031, Taiwan (R.O.C.) Website: https://www.cosmartor.com.tw

---

In case of discrepancy between language versions, the Traditional Chinese version prevails.