Beijing office creates potential Chinese regulatory exposure despite data stored elsewhere; custom avatar creation processes voice and likeness (biometric) with retention until account deletion; unclear IP ownership of trained custom avatar models; third-party AI providers in sub-processor list may vary in data protection standards.

Use enterprise agreement with explicit data processing addendum; verify current sub-processor list at Drata trust portal; delete account promptly when no longer needed to remove biometric data; leverage ISO 27001 and SOC 2 certifications for enterprise due diligence.