Privacy Policy

1. Introduction and Scope

This Privacy Policy explains how Torilab Company Limited ("Torilab," "we," "us," or "our") collects, uses, stores, and protects personal data when you visit torilab.ai and submit information through forms on the website.

Torilab is a research and development (R&D) company within NEKSAI Group. With respect to data collected through this website, Torilab determines the purposes and means of processing such data.

This Policy does not apply to applications and services such as Twomi, AI AVATAR, SOULRiZA, Kiketsuta, R10 Ronaldinho Playground, or Dr. Avatar. Each product has its own privacy policy published by the entity operating that product.

2. Data We Collect

We collect only the data necessary to respond to your inquiry or process your application.

2.1. Data You Provide Through the Contact Form

Please do not include sensitive data that is unnecessary for recruitment in your message or CV, such as health information, religious beliefs, identity document numbers, or bank account details.

The website does not collect biometric data (facial images, voice, or fingerprints) and does not process payments or financial data.

2.2. Automatically Collected Data

• When you submit a form: Your IP address and submission timestamp are collected to prevent spam and limit the number of submissions.
• Website statistics (with your consent): If you accept analytics cookies, we use Google Analytics to produce aggregate statistics about website usage, such as the number of visits, pages viewed, referring websites, general device and browser types, and country or region inferred from your IP address. Google Analytics does not store your IP address. We do not combine this information with your name, email address or other data you submit, do not use it to identify you or create individual profiles, and do not use it for advertising. Analytics data is kept for no longer than 2 months.
• Server logs: As with most websites, the server may record your IP address, browser type, pages visited, and access times to operate and secure the system.

2.3. Third-Party Services on the Website

• Google reCAPTCHA v3 (Contact page only): Helps us distinguish human users from automated bots and protect our forms from spam and abuse. Google, located in the United States, collects hardware and software information and interaction data on the Contact page to assess risk. Use of reCAPTCHA is subject to Google's Privacy Policy and Terms of Service.
• Google Fonts: Website fonts are loaded from Google's servers. Your IP address is therefore transmitted to Google when the fonts are loaded.
• Google Analytics (via Google Tag Manager): Produces aggregate website usage statistics. It runs only if you accept analytics cookies. Google, located in the United States, processes this data on our behalf.

The website does not use advertising cookies.

3. Purposes of Data Processing

We process personal data for the following purposes:

• Responding to questions and inquiries submitted to Torilab.
• Evaluating and discussing research collaboration, business partnership, and technology partnership proposals.
• Recruitment: reviewing applications, contacting candidates for interviews, and responding to questions about employment opportunities.
• Protecting the website and forms against spam, abuse, and unauthorized access.
• Measuring website traffic to understand how the website is used and improve its content (only if you consent to analytics cookies).
• Complying with legal obligations and lawful requests from competent government authorities.

We process personal data submitted through our forms based on your consent. You give consent separately for each purpose through the checkboxes on the form:

a. Handling your inquiry or application;
b. Storing your data in NEKSAI Group's internal systems and transferring it outside Vietnam as described in Sections 5 and 6;
c. Where applicable, retaining your application for future opportunities.

We keep a record of your consent, including the time it was given and the version of this Policy that applied. Analytics cookies are placed only when you consent through the cookie banner. You may withdraw your consent at any time (see Section 9). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

In addition, we may process personal data without your consent where this is permitted by Vietnamese law, including to comply with our legal obligations, to respond to lawful requests from competent authorities, and to protect our legitimate rights and interests against unlawful acts.

We do not sell personal data and do not use data submitted through this website for advertising.

4. Cookies

When you first visit the website, a banner allows you to accept or reject analytics cookies. Necessary cookies remain active because they are required for the website to operate. You can change your preferences at any time through the "Cookie Settings" button at the bottom of the page.

The website does not use advertising cookies. You may delete or block cookies through your browser settings. However, blocking reCAPTCHA cookies may prevent the Contact form from being submitted successfully.

5. Data Sharing

Data is shared only to the extent necessary for the purposes described in Section 3:

• Within Torilab: Recruitment inquiries are routed to the Human Resources team (hr@torilab.ai). Other inquiries are routed to the responsible team (info@torilab.ai).
• NEKSAI Group companies: Collaboration inquiries and candidate applications may be stored in NEKSAI Group's shared internal storage systems and shared with companies within NEKSAI Group, including entities located in the United States, Japan and Singapore, solely for the purposes described in Section 3. Only authorized personnel may access the data. These companies act on Torilab's instructions under written data protection agreements and may not use the data for their own independent purposes. A list of the group companies that receive data is available on request at privacy@torilab.ai.
• Service providers: We use third-party providers for website hosting (Amazon Web Services, servers in Japan), email and document storage through Google Workspace, reCAPTCHA and Google Analytics (Google), and domain management, security and content delivery (Cloudflare). These providers process personal data only on our instructions and under data processing agreements that require appropriate security measures.
• Competent government authorities: Where required by law.

6. International Data Transfers

Your data may be transferred to and stored in countries outside Vietnam, primarily the United States, Japan and Singapore, in the following circumstances:

• The website and data submitted through its forms, including CVs, are stored on Amazon Web Services servers located in Japan.
• Email, documents, and NEKSAI Group's internal storage systems use Google services, whose servers are located outside Vietnam.
• Data may be shared with NEKSAI Group companies as described in Section 5.
• Cloudflare processes website traffic through its global network of servers.

We carry out these transfers based on your consent and in accordance with Vietnamese personal data protection law, including the required cross-border transfer impact assessment. We require recipients by contract to provide an appropriate level of protection, and we also apply the safeguards described in Section 8. You may withdraw your consent to such transfers at any time (see Section 9).

7. Data Retention

We keep personal data only for as long as necessary for the purposes for which it was collected, and no longer than the maximum periods below.

We may keep data longer only where required by law or necessary to establish, exercise or defend legal claims, and only for as long as that need lasts.

8. Data Security

• Connections to the website are encrypted using HTTPS.
• Data submitted through forms is stored in a restricted administrative area. Only authorized personnel directly involved in handling inquiries or recruitment may access it.
• CV files are checked for format and security (PDF only, maximum 5 MB; files containing executable code are rejected). Files are stored in a non-public directory under randomly generated filenames, and only administrators may download them.
• Forms are protected against spam and abuse through reCAPTCHA, submission rate limits, and automated checks.

No system is completely secure. If a personal data breach occurs, we will notify the competent personal data protection authority no later than 72 hours after we discover it, where required by law, and will inform affected individuals where the breach may affect their rights and interests.

9. Your Rights

Under Vietnamese personal data protection laws, you have the following rights:

• To be informed about the processing of your personal data.
• To give or withhold consent and to withdraw consent.
• To access, view, and request a copy of your personal data.
• To request correction of inaccurate data.
• To request deletion of data.
• To request restriction of processing or object to data processing.
• To lodge complaints, report violations, initiate legal proceedings, and seek compensation for damages in accordance with the law.

To exercise these rights, please email privacy@torilab.ai with the subject "Personal data request". We may need to verify your identity before processing your request. We will acknowledge your request within 2 working days and complete it within the time limits prescribed by Vietnamese law, which as of the date of this Policy are: 10 days for requests to access, correct or receive your data; 15 days for withdrawal of consent, restriction or objection; and 20 days for deletion. These periods may be extended once where the request is complex, in which case we will tell you why. Requests are handled free of charge.

If you withdraw your consent or ask us to delete your data, we may no longer be able to respond to your inquiry or consider your application. In some cases we may be unable to delete data that we are required by law to keep; we will tell you if this applies.

10. Children

The website and Contact form are not intended for individuals under 16 years of age. Applicants for positions must be at least 18 years old, unless the position description states otherwise. We do not knowingly collect children's data. If you are a parent or legal guardian and believe that your child has submitted information to us, please contact us so that we can delete the data.

11. Links to Other Websites

The website contains links to external pages, including product websites, the App Store, Google Play, arXiv, PR TIMES, and social media platforms. These websites have their own privacy policies. We are not responsible for how those websites process data.

12. Changes to This Policy

We may update this Policy when our data processing activities or applicable laws change. The update date will be displayed at the top of the page. For significant changes, we will provide notice on the website. This Policy is available in Vietnamese, English and Japanese. In case of any discrepancy between versions, the Vietnamese version prevails.

13. Contact