Privacy Policy

Important Notice

This Privacy Policy (the “Policy”) explains how Lito collects, uses, stores, shares, and protects your personal information and how you may exercise your rights.

Lito is operated by JOYJOY TECH LIMITED, with its registered address at Rm 1307 13/F KENBO COML BLDG 335-339 QUEEN’S RD W Sai Ying Pun, Hong Kong Island Hong Kong (referred to as “Lito,” “we,” “us,” or “our”). This Policy applies to the Lito mobile application, websites, software, features, and related services (collectively, the “Service”).

Lito is intended only for users who are at least 18 years old and have reached the age of legal majority where they live. Anyone who does not meet these age requirements may not register for or use the Service.

Please read this Policy in full before using the Service, particularly the provisions highlighted for your attention regarding sensitive personal information, device permissions, information sharing, international transfers, and the protection of minors. Where applicable law requires separate consent for a particular processing activity, we will provide additional information within the relevant feature and ask you to make a choice.

If you do not agree to this Policy, do not register for, access, or use the Service. You may generally choose not to provide information that is not necessary to provide the basic Service, although certain personalized or specific features may then be unavailable.

1. Scope and Processing Principles

This Policy applies when we act as a personal information processor or data controller and determine the purposes and means of processing. Third-party websites, payment tools, app stores, social login providers, advertising platforms, and other independent services process information under their own privacy policies. This Policy does not directly govern their independent processing activities.

We process personal information in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, security, and limited retention. We collect information only to the extent reasonably necessary for the purposes described in this Policy. Except where required by law, we will not deny you the basic Service because you decline to provide information unrelated to the relevant feature.

We may update this Policy to reflect changes to the Service, legal requirements, or business arrangements. If we make a material change, we will notify you through an in-app notice, pop-up, email, or another reasonable method and update the “Last Updated” date. Where the law requires consent, we will request your consent before the change takes effect.

2. Information We Collect

The information we collect depends on the features you use, your device settings, and the permissions you grant. The main categories are described below.

Some categories described below relate to optional or future features that may not be available in the current version of Lito. We collect or process information associated with those features only if and when the relevant feature is made available and you use it, subject to any notice, permission, or consent required by applicable law or platform rules.

2.1 Information You Provide

Account and registration information: Mobile phone number, email address, verification code, password, username, nickname, date of birth or age, gender, profile image, and third-party login identifier.
Profile information: Information such as location, language, nationality, occupation, height, interests, biography, and other details you choose to display. Except for information required for registration or security verification, you may decide whether to provide these details.
User content and communications: Text, comments, images, photos, audio, video, private messages, interaction records, group content, live-stream content, and virtual-gift-related content that you upload, post, stream, send, receive, or store.
Transaction and payment information: Order numbers, top-up and purchase records, products or services, amount, currency, time, refund status, and chargeback status. Payment credentials such as full card numbers, payment passwords, and CVV codes are generally processed directly by the app store or payment service provider you select. We do not retain complete payment credentials.
Customer support, report, and appeal information: Your contact details, description of the issue, attachments, communications, complaint details, reported account or content, grounds for appeal, and the outcome of the review.
Diagnostic information: When you voluntarily report an issue, this may include the steps taken, time of operation, feature response, error code, crash logs, and other diagnostic materials you choose to upload.

2.2 Information Generated When You Use the Service

Device and network information: Device model, operating system and version, app version, system language and region, device identifiers, Android ID, IDFA, Google Advertising ID, IP address, network type, carrier, time zone, and necessary security identifiers.
Activity and log information: Login time, pages visited, click and search history, matching or recommendation interactions, use of messaging and live-streaming features, purchase history, time spent, error logs, and security event records.
Approximate location information: We may infer a general location from your IP address, network information, or selected region to provide region-related features, maintain security, and comply with law.

We access precise location, camera, microphone, photos, or media files only after you expressly grant the relevant device permission. You may disable permissions in your device settings. Disabling a permission may prevent the associated feature from working but will not affect unrelated parts of the Service.

2.3 Verification Information and Sensitive Personal Information

To prevent fake accounts, impersonation, fraud, or use of the Service by minors, we may reasonably require age, identity, or liveness verification. Depending on the feature you use, verification may involve an identity document, profile image, facial comparison video, or liveness-check result.

Before collecting verification information, we will explain the purpose, method of processing, retention period, and any available alternative and will obtain separate consent where required by law. Unless we clearly state otherwise on the relevant page and the processing complies with applicable law, facial video will be used only to complete verification and not for advertising or unrelated purposes. After verification, we will delete the original verification material within the disclosed period or convert it into an irreversible verification result.

Precise location, facial recognition information, identity documents, private communications, and information that may reveal health, religion, ethnicity, or sexual orientation may be considered sensitive personal information. Provide such information only where necessary and after understanding the associated risks. Do not disclose unnecessary sensitive information in a public profile or public content.

2.4 Information from Third Parties

If you choose to register or log in using Facebook, Google, Apple, X, Instagram, or another third-party account, we may receive a user identifier, nickname, profile image, email address, or other basic profile information in accordance with your authorization and the rules of that platform.

We may also receive transaction status, installation source, advertising interactions, device risk signals, or other necessary information from app stores, payment partners, advertising and attribution providers, analytics providers, anti-fraud providers, and lawful public sources. A third party’s independent collection of information is governed by its own privacy policy.

3. How We Use Information and Our Legal Bases

We may use personal information for the purposes below. Depending on applicable law, our legal basis may be performance of a contract, your consent, compliance with a legal obligation, protection of your or another person’s vital interests, or our legitimate interests:

Providing the core Service: Creating and maintaining accounts and providing discovery, matching, messaging, voice or video communication, live streaming, content publishing, groups, virtual gifts, and other social features.
Identity and security verification: Verifying age, identity, or liveness; identifying unusual devices and accounts; and preventing impersonation, fraud, spam, abuse, use by minors, and other security risks.
Processing payments: Confirming orders, top-ups, subscriptions, virtual items, refunds, chargebacks, and billing status and providing transaction support.
Recommendations and personalization: Arranging the display of content, users, or features based on your region, language, settings, interactions, and use of the Service. Where required by law, we will provide a way to turn off personalized recommendations.
Improving the Service: Analyzing feature use, network and system performance, crash causes, and user feedback and conducting statistics, testing, and product optimization.
Content moderation and community governance: Reviewing reports and appeals; identifying and addressing unlawful, harmful, or rule-violating content and conduct; and protecting users and the public.
Customer support and notices: Responding to inquiries, complaints, and requests and sending account, security, transaction, Service, and Policy update notices.
Advertising and marketing: Measuring campaign performance, controlling advertising frequency, and providing relevant advertising where permitted by law. Where consent is required, we will obtain it before processing information for or sending marketing communications.
Legal compliance: Satisfying retention, audit, tax, consumer protection, and regulatory obligations; responding to valid legal requests; and establishing, exercising, or defending legal claims.

If we wish to use personal information for a new purpose that is incompatible with the purpose for which it was originally collected, we will provide the required information before the new processing begins and obtain consent again where required by law.

Content you post in a public profile, feed, comment, live stream, group, or other public area may be viewed, copied, recorded, captured in a screenshot, or forwarded by other users and may appear on third-party platforms that we do not control. Consider this carefully before posting. Do not publicly disclose telephone numbers, home addresses, identification numbers, payment details, precise location, or other information that could be misused.

Private messages are not the same as absolute confidentiality. We may process relevant communications as permitted by this Policy to deliver messages, review reports, maintain security, prevent fraud, and comply with law. We will not use private messages for external advertising unless we obtain your express permission separately.

Photos, videos, biographies, or interaction content may indirectly reveal religion, health, ethnicity, political opinions, sexual orientation, or other sensitive information. You must decide whether to provide or make such content public and accept the risks associated with public sharing.

You may use privacy settings, block lists, reporting tools, location permissions, device permissions, marketing preferences, and recommendation settings to manage certain uses of information. Available controls may differ depending on your region, device, and app version.

We do not sell your personal information. We share or disclose information to the recipients below only when necessary for the purposes described in this Policy, when you have authorized us to do so, or when permitted by applicable law.

5.1 Service Providers

Cloud storage, content delivery, database, and technical infrastructure providers;
App store, payment processing, billing, and chargeback prevention providers;
Data analytics, crash monitoring, customer support, and messaging notification providers;
Advertising delivery, advertising attribution, and marketing providers; and
Identity, age, and liveness verification, content moderation, anti-fraud, and cybersecurity providers.

We use contracts, security assessments, access controls, or other appropriate measures to require service providers to process information only under our instructions and for agreed purposes and to maintain reasonable confidentiality and security safeguards.

Where we share personal information with a service provider or another third party acting on our behalf, we require through contract or other appropriate safeguards that the recipient provide protection for user data that is the same as or equivalent to the protection described in this Policy and required by applicable platform rules and law.

5.2 Affiliates and Business Transactions

We may share information with a parent company, subsidiary, or other affiliate to the extent necessary for coordinated operation, support, security, and legal compliance. Each recipient must follow protection standards no less protective than those set out in this Policy.

If a merger, acquisition, financing, reorganization, bankruptcy, asset sale, or change in the operating entity occurs, personal information may be transferred as part of that transaction. We will notify you where required by law and require any successor to continue processing information under this Policy or standards that are no less protective.

5.3 Legal, Safety, and Rights Protection

We may retain and disclose relevant information when we reasonably believe it is necessary to respond to a subpoena, court order, or law enforcement or regulatory request; comply with applicable law; investigate unlawful or rule-violating activity; protect the rights and safety of users, the platform, affiliates, or the public; prevent fraud or imminent harm; or establish, exercise, or defend legal claims.

We will share information in accordance with your direction or consent when you voluntarily share content, use a third-party login or payment service, participate in a joint event, or expressly request that we provide information to a designated third party.

6. Cookies, SDKs, and Advertising Technologies

We and our partners may use cookies, software development kits (SDKs), pixels, local storage, or similar technologies to maintain login status, remember preferences, protect security, analyze performance, correct faults, measure campaign performance, and provide advertising.

Depending on their functions, third-party SDKs may process device identifiers, IP address, app version, advertising interactions, crash information, or other necessary data. We disclose the SDKs actually used, their providers, processing purposes, and information categories in [Third-Party SDK List or Link].

You may manage some of these technologies through device settings, browser settings, in-app privacy options, or advertising identifier settings. Disabling certain technologies may limit login, recommendation, analytics, or other features. We will request your choice before enabling any non-essential cookie or SDK for which consent is required by law.

7. Data Retention and International Transfers

We retain personal information only for as long as reasonably necessary to fulfill the purpose for which it was collected, provide the Service, perform a contract, resolve disputes, maintain security, and comply with law. The specific period depends on the category of information, account status, legal requirements, and risk. For example:

Account and profile information is generally retained while the account remains active;
Transaction records are retained as required for tax, accounting, anti-money laundering, consumer protection, or dispute resolution purposes;
Security, report, and enforcement records may be retained for as long as necessary to prevent repeat violations and protect users; and
Deleted content may remain in backup systems for a short period until it is removed under the applicable backup rotation schedule.

When the necessary retention period expires, we will delete or anonymize the relevant information, except where the law requires continued retention, retention is necessary to establish or defend a legal claim, or the information has been lawfully saved or shared by another user. The applicable retention periods are provided in [Data Retention Schedule or Link].

Lito provides the Service in multiple countries or regions. Your personal information may be stored or processed in [Countries or Regions Where Servers Are Located], outside the place where you live. Data protection laws may differ among jurisdictions. When an international transfer occurs, we will use contractual clauses, an adequacy decision, certification, risk assessment, or other appropriate safeguards as required by applicable law and will obtain your consent where legally required.

8. Information Security and Security Incidents

We use administrative, technical, and organizational measures appropriate to the relevant risks to protect personal information. These measures include access controls, authentication, encryption in transit or at rest, network protection, security audits, employee access management, vendor management, and incident response procedures.

However, no internet service, storage system, or transmission method can guarantee absolute security. Use a unique and appropriately strong password, safeguard verification codes and login credentials, do not rent, sell, or share your account, and immediately change your password and notify us at contact@litoclub.com if you identify an unusual login or information leak.

If a personal information security incident is likely to create a high risk to your rights and freedoms, we will assess, control, and remediate the risk as required by applicable law and notify you and the relevant regulator within the legally required period. A notice may describe the nature of the incident, its likely effects, measures taken or recommended, and available contact channels.

9. Your Rights and Account Deletion

Depending on the law where you live, you may have the right to:

Confirm whether we process your personal information and request access to it;
Correct inaccurate or complete incomplete information;
Delete personal information or close your account;
Restrict or object to particular processing;
Withdraw consent;
Obtain a portable copy of your data;
Turn off targeted advertising or personalized recommendations;
Request human review of a decision made solely through automated processing that has a significant effect on you; and
Lodge a complaint with the competent data protection authority.

You may submit a request through the in-app settings or at contact@litoclub.com. To prevent impersonation, we may ask you to provide reasonable verification information. We will respond within the period required by applicable law and will not discriminate against you for lawfully exercising a right.

Where permitted by law, we may limit or deny a request if we cannot verify your identity, the request would infringe another person’s rights, it would materially compromise the security of the Service, it would violate a legal obligation, or the law otherwise permits refusal. We will explain the reason where appropriate.

You may request account deletion through [Me > Settings > Account and Security > Delete Account]. Uninstalling the application does not automatically delete your account or cancel an app store subscription. If the product provides a withdrawal period for deletion requests, the deletion page will clearly state the period and how to withdraw the request. After deletion is complete, you will lose access to your account, content, virtual items, and associated benefits. We will delete or anonymize information that is no longer needed in accordance with this Policy, except where retention is required by law.

You may also initiate a request to delete your Lito account and associated data outside the application through [ACCOUNT DELETION WEB URL]. When we honor an account deletion request, we will delete the account and user data associated with that account that is under our control, including associated user-generated content where required by applicable law or platform rules, except information we are legally required or otherwise permitted to retain for legitimate purposes described in Section 7. Temporary deactivation, disabling, or freezing is not treated as account deletion.

Withdrawing consent does not affect the lawfulness of processing carried out on the basis of that consent before withdrawal. If particular information is necessary to provide a feature, withdrawing consent may prevent continued use of that feature.

10. Information About Minors and Child Safety

The Service is not directed to anyone under 18 years old or below the age of legal majority where they live. We do not knowingly collect personal information from such minors. If we discover that a minor has registered for or used the Service or provided information to us, we will take reasonable steps to delete the information, terminate the account, and prevent re-registration.

If a parent or legal guardian discovers that a minor is using the Service or believes that we hold a minor’s information, please contact us at contact@litoclub.com. After verification, we will take measures such as deleting the information and blocking the relevant account.

We have zero tolerance for child sexual abuse and exploitation and child sexual abuse material. No user may use the Service to carry out or promote any of the following:

Sexualizing, sexually exploiting, or making inappropriate contact with a minor;
Grooming a minor or facilitating sexual contact with a minor or an exchange of intimate images;
Sexually extorting a minor through intimate images;
Soliciting, trafficking, or contacting a minor for commercial sexual exploitation;
Seeking, creating, possessing, trading, distributing, or concealing child sexual abuse material; or
Promoting minor dating, compensated companionship involving minors, or exploitative or deceptive dating services.

We may remove related content, preserve evidence, suspend or terminate accounts, and report the matter to law enforcement, child protection organizations, or other competent authorities as required by applicable law. If a child is in immediate danger, contact local emergency services first.

11. Contact Us and Complaints

If you have a question, comment, or complaint about this Policy, our processing of personal information, or a rights request, contact us using the details below:

Operating entity: JOYJOY TECH LIMITED
Registered address: Rm 1307 13/F KENBO COML BLDG 335-339 QUEEN’S RD W Sai Ying Pun, Hong Kong Island Hong Kong
Privacy rights request email: contact@litoclub.com
Security and child protection email: contact@litoclub.com
Data protection officer or representative, if applicable: contact@litoclub.com

We will acknowledge and handle your request within a reasonable period. If you are dissatisfied with our response, you may lodge a complaint with a data protection, consumer protection, or other competent regulator that has jurisdiction under the law where you live.