Privacy Policy

This Privacy Policy ("Policy") applies to the official website operated by Xiamen MINDLOOP Digital Technology Co., Ltd. ("Fangzao", "we", "us" or "our") and its related sub-pages (collectively, the "Website").

Scope and boundary: This Policy applies to the information display, registration and login, and browsing of the Website.

Exception for product services: We provide some product services through third-level sub-domains of the domain to which the Website belongs (for example our Digital Cultural Creativity products: the HR posting assistant and the strategy planning assistant). Those product service entry points fall outside the scope of this Policy: information you provide when using such a service, and data generated or processed within it, are governed exclusively by the Terms of Service and Privacy Policy published on that service's own pages, and by the consent you give when using that service. Such services maintain their own independent registration and login systems and account data, separate from the registration and login of this Website.

Specific note on the HR posting assistant and the strategy planning assistant (a product-level standalone clause): These two products adopt a “bring-your-own-key” (BYOK) model: you configure and hold, within the product, the API credential of the model provider you choose (such as DeepSeek); we neither hold that credential nor pay for the calls on your behalf. Content you input when using these products is received by our server, undergoes security filtering and prompt processing, and is then forwarded over an encrypted channel to the model provider you have configured; the model response is also processed by our server before being returned to you. In respect of this chain we act as an entrusted processor and process your input only to the extent necessary to perform the model call and content-safety filtering, and never beyond the purposes you have authorised. This clause applies solely to the HR posting assistant and the strategy planning assistant; it does not represent the processing practices of our other businesses, other products, or this Website. The complete terms are those set out in the Privacy Policy and Terms of Service published on those products’ own pages.

Other than those separately indicated product service entry points, the Website itself does not provide product sales, online transactions or other functional services; it serves only for brand presentation, product introduction, material access and business communication.

We know the power of technology — and its dangers. On data and privacy we uphold the same principles of putting the Way first and knowing the awe: minimal necessity as the boundary, transparency as the baseline. This Policy is drafted in accordance with the Personal Information Protection Law of the People's Republic of China, the Cybersecurity Law of the People's Republic of China and other applicable laws and regulations.

Business context: This Website is a corporate brand showcase and provides registration and login so that you may learn about our products, obtain materials, submit inquiries and business cooperation requests, and access the product services we provide.

Exception for product services: We provide some product services through third-level sub-domains of the domain to which the Website belongs (for example our Digital Cultural Creativity products: the HR posting assistant and the strategy planning assistant). Information you provide when using such a product service, and data generated or processed within it, are governed by the Terms of Service and Privacy Policy published by that service itself and are not governed by this Policy. Other than those service entry points, the Website itself does not provide product sales, online transactions or other functional services.

The HR posting assistant and the strategy planning assistant adopt a “bring-your-own-key” (BYOK) model: content you input is forwarded by our server to the model provider you have configured. The full description is set out in the specific note under “Exception for product services” in this Policy, and applies solely to those two product services.

We therefore collect information only to the minimal extent necessary and do not collect personal information unrelated to the business.

We do not collect sensitive personal information unrelated to the business; we do not collect biometric, religious belief, specific-identity, medical health, financial account or location-tracking information, and we do not sell your personal information to any third party. The Website does not carry out processing activities that have a material impact on your personal rights and interests solely through automated decision-making (such as algorithmic recommendation or user profiling).

We use the information described above only for the purposes notified to you at the time of collection:

• Responding to your inquiries, partnership and contact requests;
• Maintaining the secure and stable operation of the Website, including access statistics and troubleshooting;
• With your consent, sending you product and industry information (you may opt out at any time).

If we need to use your information for purposes other than those above, we will inform you again and obtain your consent.

For your understanding, the following summarises the principles our released software products follow in handling data. Whatever form the product is delivered or deployed in (including online services provided through third-level sub-domains of the domain to which the Website belongs), these matters belong to the relationship between the product and its user and are governed by the privacy policy and software licence and user agreement published by that product or service; this Policy merely restates them, and the text published on the product or service pages prevails.

• Your business data (code, projects, configuration, rule and profile contents, reports, etc.): we do not save, read or use it for training or analysis. Data never leaves your device; license validation uploads only a device-fingerprint digest (an irreversible hash), never source code or business data.
• Help improve the product (separate consent, revocable): to make built-in rules and profiles more accurate as you use them, with your separate consent the product may transmit behavior statistics — aggregated values such as hit frequency of built-in rules and counts of manual allow/deny/ignore actions, together with operational fields such as version, crash logs and performance. Behavior statistics never include your code, documents, project paths, original custom rules or any data that identifies your business; they only record your "votes" on our baseline rules and are used to calibrate the accuracy of built-in rules.
  How we obtain your consent: when you register or first use the product, we ask you whether you wish to join our product improvement programme through a separate and prominent option. That option is left unticked by default and takes effect only once you actively tick it; we never make the choice for you in advance.
  A benefit of taking part: as recognition of your contribution, users who join the improvement programme receive priority access to internal testing of our new products. This benefit does not reduce the product or service that other users receive under their valid subscriptions.
  Declining does not affect your rights: whether or not you tick the option, the basic functionality and service quality of the product are unaffected; we will not refuse service, remove features or lower service levels because you chose not to join.
  You may disable or withdraw this consent at any time in product settings or the account centre.

Our own products are held to the same standard: we never silently transmit data. "Help improve the product" is your optional contribution, not a default extraction.

The content pages of the Website are static. We do not use third-party tracking cookies and have not integrated third-party analytics tools (such as Baidu Analytics), and we do not use cookies for advertising or user profiling. The registration and login functions use technical cookies or local storage strictly necessary to maintain your login state; such data lasts only as long as your login session and expires when you sign out.

The server may generate basic logs for session maintenance and security protection; such logs do not contain personally identifiable information.

If analytics tools or cookies are introduced in the future, we will update this Policy and inform you through appropriate means.

We do not provide your personal information to any other personal information handler, nor do we make it publicly available. We may provide your personal information in accordance with the law, or entrust a third party with processing where necessary, only in the following circumstances (entrusted processing is not the same as providing to a third party; the entrusted party may not process your personal information beyond the agreed purpose):

• Where required by laws and regulations or by regulators making lawful inquiries;
• Where necessary to ensure the secure operation of the Website or to protect your or other users' lawful rights and interests;
• Where, to provide the registration, login and account-management capabilities of the Website, we entrust a technical service provider with processing your account identifier and login credentials to the extent necessary. The entrusted party processes such information only on our instructions, may not use it for its own purposes, and must delete or return it as agreed once processing is complete.

Should entrusted processing, sharing or transfer arise in the future, we will separately inform you of the purpose, method and scope of processing and enter into relevant agreements in accordance with the law.

Location: Your information is stored within mainland China. We will not provide your personal information outside the country without legal authorisation and your separate consent.

Retention periods: We retain your personal information for the periods set out below and delete or anonymize it upon expiry; where laws and regulations require a longer retention period, that requirement prevails.

Security measures: We adopt reasonable technical and organizational measures to protect your information, including but not limited to access control, encrypted transmission and the principle of least privilege, to prevent unauthorized access, use, disclosure or destruction.

Account deletion: Once signed in, you can delete your account yourself under "Account → Data & privacy". Deletion takes effect immediately — your email, nickname and login credentials are erased or anonymized on the spot, and your sign-in sessions, email-verification and password-reset records are deleted at the same time. If you cannot sign in, you may also email mindloop@foxmail.com; after verifying your identity we will complete the deletion within 15 working days, except for information that laws and regulations require us to retain (such as access logs).

The Website is a brand showcase site intended for corporate clients and adults. It does not provide services to minors and does not proactively collect minors' personal information, and we do not process the personal information of minors under the age of fourteen.

If you find that the Website has inadvertently collected a minor's personal information, please notify us via the Contact Us page, and we will delete it promptly after verification.

Under the Personal Information Protection Law of the People's Republic of China and other applicable laws and regulations, you have the following rights in respect of the personal information we handle on the Website:

• Access and copy: to access and obtain a copy of your personal information handled on the Website; you can also export your account data yourself under "Account → Data & privacy" (a standard JSON file) without submitting a separate request;
• Correction and supplementation: to correct or complete personal information that is inaccurate or incomplete;
• Deletion: to request deletion where the processing purpose has been achieved, you withdraw your consent, or we handle personal information in violation of laws and regulations;
• Withdrawal of consent: to withdraw consent previously given (withdrawal does not affect the lawfulness of processing carried out on the basis of consent before withdrawal);
• Account deletion: to delete your Website account (see the "Storage and protection" section);
• Explanation: to request that we explain this Policy and our personal information handling rules;
• Complaints and reports: to file complaints or reports with us or with the regulatory authorities.

How to exercise your rights:

1. Submit a request: email mindloop@foxmail.com, or contact us through the Contact Us page or live support (WeCom), stating your specific request, the personal information concerned and your contact details;
2. Identity verification: to protect the security of your personal information, we will verify your identity (for example, through your account login state or by matching your account identifier); requests that fail verification may be refused;
3. Handling and response: once verification is complete, we will handle and respond within 15 working days; where the matter is complex and an extension is needed, we will explain the reason to you;
4. Fees: we do not charge a fee for the first exercise of rights such as access and copying; for repetitive requests beyond a reasonable frequency, we may charge a reasonable cost-based fee in accordance with the law and notify you in advance.

Requests we may refuse: we may refuse, with reasons, requests where your identity cannot be verified, where an exception under laws and regulations applies (for example where processing is necessary to perform a statutory obligation), or where the request is manifestly unfounded or abusive.

Complaints and remedies: if you believe our handling of your personal information has harmed your lawful rights and interests and our negotiation with you fails, you may file a complaint or report with the cyberspace, telecommunications or public security authorities responsible for personal information protection, or bring an action before a people's court in accordance with the law.

This Policy may be updated from time to time as our business develops and laws and regulations require. Updates will be published on this page with the revision date; material changes will be brought to your attention in a prominent manner.

Version: v1.7　Published and effective: 2026-09-22 (previous version v1.6, 2026-09-14)

Summary of this update: following the launch of self-service data management in the account system, we have updated the corresponding clauses — (1) you can now export a copy of your account data yourself under "Account → Data & privacy" (a standard JSON file) without submitting a separate request; (2) self-service account deletion takes effect immediately (your email, nickname and login credentials are erased or anonymized on the spot, and your sign-in sessions and related records are deleted at the same time), while the manual route — email us if you cannot sign in, completed within 15 working days — remains available; (3) the retention wording for account registration information has been tightened accordingly.

* This page is version v1.7, published and effective 2026-09-22 (previous version v1.6, 2026-09-14). Controller information, registered address and contact channels are published as shown; the text is updated as our business and applicable law evolve.