Privacy Policy

1. What we collect

Account information: the name, email address and password you register with (only a salted hash of the password is stored, never the password itself).

Business data: the products, supplier and client contacts (which may include names, phone numbers, WeChat IDs, emails, addresses, tax IDs), orders, payments, expenses and their receipt files your company records in the platform.

Photos and files you deliberately take or upload: product photos, business cards, payment slips, documents.

Logs: sign-in times, an audit trail of who created/changed/deleted records, and AI usage counts.

We do not collect device information unrelated to the service, run advertising trackers, or embed third-party analytics scripts.

2. How it is used

Only to: provide the catalog, order and finance features; extract product and business-card fields from photos you submit using an AI vision model (results are labelled for human verification); send account emails (password resets, verification, approval notices); keep accounts and data secure; and export or back up data on your instruction.

3. Storage and isolation

Each company's (tenant's) data is isolated at the database layer: cross-tenant access is refused by row-level security policies, continuously verified by automated tests. The operator's panel shows counts and activity only — never any tenant's amounts or business details.

4. Sub-processors

The following providers process data on our behalf, strictly for the purposes above:

· AI vision: Moonshot AI (Beijing Moonshot Technology Co., Ltd.) for mainland deployments; deployments outside the mainland may use Anthropic PBC (USA). Photos are transmitted only for extraction and are not used for training.

· Email delivery: Tencent Exmail (Tencent Cloud), receiving only the recipient address and message content.

· Cloud hosting: the cloud provider hosting your deployment (see your instance's service agreement).

· Exchange rates: open.er-api.com — public rates only, no personal information is transmitted.

5. Retention and deletion

Account and business data are kept for the life of the service. A company administrator can export all company data from Settings at any time — including while the account is suspended. Deletions of records such as contacts are written to the audit log. Documents of completed transactions (proforma invoices, payment records) are accounting records retained for the statutory period under applicable accounting-archive regulations and are not deleted on individual request.

6. Your rights

You may access, correct and supplement your personal information, request deletion within the scope the law allows, and obtain a copy of your data. Direct requests concerning data inside a company to that company's administrator first; platform-level requests reach us at the contact below and are answered within fifteen working days.

7. Security

HTTPS everywhere; salted password hashing; enforced row-level security; authenticated file serving; daily integrity-checked backups; real-time alerts for anomalous sign-ins and server errors.

8. Changes and contact

Updates to this policy are published on this page with a new date. Contact: abel@mbarete.cn.