Privacy Policy for “AVATARS – SEED”

Last updated: 08.12.2025

This Privacy Policy describes how AVATARS – SEED (“we”, “us”, “our”) collects, uses, stores, and shares personal data when you use our virtual reality application (“the App”) available on the Meta Quest platform.

We are committed to protecting your privacy and handling your data transparently and responsibly in accordance with the EU GDPR, the California Consumer Privacy Act (CCPA) where applicable, and the privacy requirements of the Meta Quest Store.

1. Data Controller

Name of Company: Breakpoint One
Address: Str. 166 16
Email: contact@breakpoint.one
Data Protection Officer: Sebastian Tusk

2. Categories of Data We Collect

When you use AVATARS – SEED, we may collect the following types of data:

2.1 Data You Provide

• Voice inputs (processed by Mistral for speech recognition)
• Chat interactions with the AI assistant

We strongly advise users not to provide personal or sensitive information during AI interactions.

2.2 Automatically Collected VR & System Data

Collected by us or by the Meta Quest Platform:

• Device information (model, OS version, language settings)
• App usage data (session duration, interactions, selected scenes)
• Technical logs, crash reports, performance data
• Controller and headset movement data (head/hand tracking)

Important:

We do not collect or store:

• raw camera images,
• guardian boundary room scans,
• biometric identifiers.

If Eye Tracking or Hand Tracking features are used (depending on user device):

• We may receive generalized interaction data (e.g., gaze-based UI selection).
• We do not store, process, or transmit raw sensor data.

2.3 Data Processed by Third-Party Services

(a) Speech Recognition – Mistral

When AI is activated and when you speak inside the app, your audio is securely transmitted to Mistral to convert speech into text.
Processed data:

• Audio snippets
• Speech transcripts

(b) Text-to-Speech – Google Cloud TTS

Responses from the AI assistant are converted to audio via Google.
Processed data:

• Text messages (no audio from you)

(c) AI Processing – Mistral (LLM)

Text inputs are processed by a Large Language Model (LLM).
Processed data:

• Chat text or speech-transcribed text
• App context (scene, topic of conversation)

Model Training Notice

We do not allow our providers to use your data for model training unless explicitly permitted by their corporate API agreements.

3. Purposes of Processing

Your data is processed for the following purposes:

• To enable core app functionality (VR environment, interactions)
• To provide AI-driven responses and dialogue
• To convert your voice to text (speech recognition)
• To generate spoken AI responses (text-to-speech)
• To improve stability, security, and performance
• To analyze usage patterns to optimize user experience
• To comply with legal obligations

No automated decision-making takes place that produces legal or significant effects.

4. Legal Basis for Processing (GDPR)

Processing is based on:

• Art. 6(1)(b) – performance of the contract (providing app features)
• Art. 6(1)(a) – user consent (optional features, microphone access)
• Art. 6(1)(f) – legitimate interest (security, performance monitoring)

If sensitive data (e.g. biometrics) were ever processed, we would request explicit consent under Art. 9 GDPR.
Currently, we do not process such data.

5. Data Sharing & International Transfers

We share data only as necessary to operate the app:

Shared With:

• Mistral (AI + speech recognition)
• Google Cloud (text-to-speech)
• Meta Platforms, Inc. (platform analytics, diagnostics)
• Hosting/Cloud providers (operational services)

International Transfers

Data may be transferred to countries outside the EU, including the United States.
We rely on Standard Contractual Clauses (SCCs) and additional safeguards where appropriate.

6. Data Retention

We retain data only as long as necessary for the purposes described above:

• Chat and interaction logs: up to 30 days, unless anonymized sooner
• Technical logs & analytics: 30–90 days
• Voice/audio data: retained only during processing, then deleted

Third-party services (Mistral, Google) follow their own retention policies as defined in their API contracts.

7. Your Rights (GDPR & CCPA)

You have the right to:

• Access your personal data
• Request correction or deletion
• Object to processing
• Request data portability
• Withdraw consent at any time
• File a complaint with your national supervisory authority

To exercise your rights, contact us at:
Contact@breakpoint.one

8. Children’s Privacy

AVATARS – SEED is not intended for children under 13.
We do not knowingly collect data from children.
If you believe a child has provided personal information, please contact us for deletion.

9. Security Measures

We use strong technical and organizational measures to protect your data, including:

• End-to-end encryption during data transmission
• Access controls & authentication
• Data minimization
• Secure server infrastructure

However, no system is fully immune to security risks.

10. Use of AI Systems

AVATARS – SEED contains an AI-driven conversational assistant.
Users should be aware:

• AI responses may be inaccurate or incomplete
• AI messages are generated based on statistical models
• Users should not enter personal, sensitive, or confidential information

We do not use AI for automated decision-making producing legal effects.

11. Changes to This Privacy Policy

We may update this Policy from time to time.
The newest version will always be available via the Meta Quest store page and/or our website.

12. Contact

If you have any questions about this Privacy Policy or your data, contact us at:

contact@breakpoint.one