AI Privacy Policy

1. Introduction and Relationship to the Privacy Policy

Gogopass Asia Sdn Bhd ("GGPA", "we", "us" or "our") develops and operates CitraLabs, a generative artificial intelligence ("AI") video platform that allows users to create synthetic video and image content, including AI-generated presenters, from uploaded photographs, voice recordings and text prompts (the "Platform"). CitraLabs is a product and brand of GGPA and is not a separate legal entity.

This AI Privacy Policy ("Policy") supplements the CitraLabs Privacy Policy and explains the AI-specific ways we collect, use, disclose, store and protect personal data, including sensitive personal data such as biometric identifiers. General matters — data categories, purposes, retention, security, breach notification, cookies, children's data, and your rights — are governed by the Privacy Policy; this Policy adds the AI-specific detail. Where the two conflict on AI-specific or biometric matters, this Policy prevails. It should also be read together with our Terms of Service, which contains the Third-Party Consent Warranty applicable to uploads of another person's likeness or voice.

By registering for, accessing or using the Platform, you acknowledge that you have read and understood this Policy. Where your consent is legally required for a specific processing activity, we obtain that consent separately through the consent framework described in Section 6.

2. Our Role as Data Controller

For the purposes of the PDPA, Gogopass Asia Sdn Bhd is the Data User ("Data Controller") in respect of personal data processed through the CitraLabs platform.

Data Controller: Gogopass Asia Sdn Bhd, operating the CitraLabs platform.

3. Key Definitions

Other capitalised terms have the meanings given in the Privacy Policy.

4. AI-Relevant Personal Data We Process

Because the Platform generates synthetic video from human likenesses and voices, we process the following (see the Privacy Policy, Clause 3, for the full data inventory):

• Biometric and likeness data: facial images from uploaded photographs and video; voice recordings from uploaded audio; and the synthetic derivatives generated from them.
• Content and prompt data: text prompts, prompt history, uploaded reference images, and the synthetic video/image/audio outputs generated for you.
• Usage data relevant to abuse prevention and the automated screening described in Section 8.

Where you upload a photograph, video or voice recording of another identifiable individual, we process that individual's biometric data on the basis of the warranty and consent you provide under our Terms of Service (see Section 7).

5. How We Use AI-Relevant Personal Data

• To process the facial features, voice recordings and text prompts you submit, strictly in order to generate the AI video, image or audio content you have requested.
• To operate, maintain and secure the Platform, including fraud prevention, abuse detection, and the content-policy screening described in Section 8.
• To comply with legal obligations, respond to lawful requests from public authorities, and enforce our Terms of Service.

We do not use your biometric data for any purpose beyond those listed above without obtaining fresh, specific consent from you. In particular, we do not use your uploaded data or generated outputs to train or fine-tune AI models (Section 9 of the Privacy Policy).

6. Consent Framework

A single, generic "I agree" checkbox is not sufficient consent for the processing of biometric data on this Platform. Accordingly:

6.1 Generation Consent (mandatory for face/voice features). Before your first upload of media containing a recognisable face or voice, the Platform presents a separate, explicit consent step: "I consent to CitraLabs processing my uploaded images, voice recordings and text prompts solely to generate the video, image or audio content I have requested." This consent is required only for features that process a face or voice; declining it does not affect your access to features that do not (e.g. text-only or product-only generations). Without it, face- and voice-based generation is unavailable.

6.2 AI Training Consent — not currently applicable. CitraLabs does not train or fine-tune AI models on user content, so no training consent is sought and none is implied by anything you accept at sign-up. If GGPA introduces an optional model-improvement programme in future, it will be presented as a separate, unticked, opt-in checkbox, entirely independent of Section 6.1, and declining or later withdrawing it will not affect your use of the Service.

6.3 Withdrawing Consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may disable the face- and voice-based features that depend on that consent.

7. Uploading Another Person's Face, Image or Voice

Our Terms of Service contain a binding Third-Party Consent Warranty, under which you confirm, before any upload of a photograph, video or voice recording featuring an identifiable individual other than yourself, that:

• you have obtained that individual's informed, express consent for their likeness or voice to be processed by the Platform to generate synthetic content;
• you have the legal right to upload that material, including in respect of any applicable intellectual property, publicity or personality rights; and
• you will indemnify GGPA against claims arising from an upload made in breach of this warranty.

GGPA reserves the right to request evidence of such consent, to suspend an upload pending verification, and to remove content and suspend accounts found to be in breach of this warranty. This Policy governs how we process the resulting personal data; the warranty and related liability terms are set out in full in our Terms of Service.

8. Automated Decision-Making and Profiling (ADMP) Notice

In accordance with JPDP's Automated Decision-Making and Profiling Guideline, we disclose the following:

• Automated safety systems screen text prompts and scripts before generation to detect prohibited content (e.g. deepfake abuse, non-consensual likenesses, or content violating the acceptable use rules in our Terms of Service).
• These processes may produce a decision (such as blocking an upload or a generation, or flagging an account) without direct human involvement in the first instance.
• Certain upstream AI Vendors additionally apply their own automated content filters (for example, declining generations that include certain reference imagery); where a generation is declined for this reason, the Platform indicates it in-product.

9. Disclosure of Personal Data and Cross-Border Transfers

9.1 Categories of Recipients. Because generative AI video rendering is computationally intensive, GGPA relies on external infrastructure and AI Vendors to operate CitraLabs, including: GPU cloud compute providers on which GGPA self-hosts its rendering models; third-party AI model/API providers used to render or assist specific features; and hosting, payment, and email providers, each acting under contract and only to the extent necessary. The current vendor register is at Appendix A.

9.2 Cross-Border Transfers and Transfer Impact Assessment (TIA). Your personal data, including biometric data, may be transferred to and processed in jurisdictions outside Malaysia where our cloud and AI Vendors operate their servers or GPU clusters (for example, the United States, Singapore, or the People's Republic of China). GGPA assesses and documents such transfers — the destination jurisdiction, the vendor's data protection standard, and the safeguards applied — in accordance with the cross-border transfer requirements under section 129 of the PDPA (as amended).

9.3 Data Processing Agreements and Vendor Safeguards. Each cloud, GPU and third-party AI API vendor that processes personal data on our behalf is engaged under a Data Processing Agreement ("DPA") or the vendor's standard commercial terms, in each case containing commitments that the vendor will: (a) process personal data only on our documented instructions; (b) implement appropriate technical and organisational security measures; (c) not use our users' inputs — including biometric inputs — for the vendor's own purposes, including the vendor's own model training (the per-vendor commitment and its source are recorded in Appendix A and re-verified on onboarding and on any change to the vendor's published terms); (d) notify us promptly of any data breach; and (e) delete or return personal data on termination of the engagement.

10. Data Retention

Retention is governed by Clause 13 of the Privacy Policy. In summary: uploaded source images and voice recordings, prompt history and generated outputs are retained until you delete them or your account is closed, plus a limited purge period, unless a longer period is required by law. Deleting an asset in-product removes it from active storage within the stated period.

11. Data Security and Model Input Security

We implement technical and organisational measures appropriate to the sensitivity of biometric and synthetic media data, including encryption in transit, access controls, per-user scoping of stored content, and logging. In addition, given the specific risks associated with generative AI:

• No training pipeline on user content: because CitraLabs does not train models on user content, the data-poisoning and training-set-extraction attack surfaces associated with user-content training pipelines do not arise on this Platform.
• Model extraction safeguards: because our models are not trained on user content, no user's personal data is embedded in model weights and none can be reproduced from them by other users; per-user usage limits and prompt screening further protect against abuse.
• Deepfake abuse controls: automated prompt screening before generation, upstream provider content filters, and human review of flagged or reported content, consistent with the Third-Party Consent Warranty in Section 7.
• Tenant isolation: uploaded assets and generated content are scoped to the owning account, and access to another user's content is denied at the serving layer.

No system is completely secure. Data breach notification is governed by Clause 16 of the Privacy Policy (notification to JPDP within 72 hours and to affected individuals within 7 days of notifying JPDP, where the thresholds are met).

12. Your Rights as a Data Subject (AI-Specific Detail)

12.2 Data Portability. In-product export tools may additionally be provided as the Platform evolves.

12.3 Erasure and Asset/Account Deletion. The Platform provides in-product controls to delete individual uploaded assets and generated videos. Deletion removes the relevant files from our active systems within the period stated in the Privacy Policy (Clause 13). Synthetic outputs already downloaded by you or shared by you with others prior to deletion cannot be recalled from third parties' devices.

12.4 Withdrawal of Consent; Limiting Processing; Complaints. As described in Section 6.3 and Clauses 7 and 14 of the Privacy Policy. If you are not satisfied with our response, you may lodge a complaint with JPDP (www.pdp.gov.my).

13. Children's Data

The Platform is not intended for individuals under the age of 18, and the Terms of Service prohibit uploading media featuring minors. We do not knowingly collect biometric or other personal data from children. If we become aware that a child's data has been uploaded, we will delete it promptly.

15. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. Material changes, including any new use of biometric data, will be notified to you in-app or by email, and, where required, we will seek fresh consent before the change takes effect. This Policy is issued in English.

16. Contact Us

Entity: Gogopass Asia Sdn Bhd (operating the CitraLabs platform) General support: https://citralabs.com/contact

Appendix A: Categories of Sub-Processors and Transfer Destinations

The PDPA requires disclosure of the classes of third parties to whom personal data may be disclosed (s.7(1)(e)). The categories and destinations below satisfy that disclosure.

Each vendor in these categories is engaged under the safeguards described in Section 9.3, and the register is reviewed whenever a vendor is onboarded or its published terms change.