Privacy Policy

The data controller for the Service is:

We collect only what we need to provide the Service. You may decline to provide optional information; some features may then be unavailable, but the rest of the Service still works.

2.1 Information you provide

• Account details: email address, username or display name, avatar. Passwords for email sign-up are stored hashed and cannot be recovered by us;
• Third-party sign-in: if you sign in with WeChat, Google, GitHub or enterprise single sign-on, we receive only the basic profile the provider returns (account identifier, email, display name, avatar);
• Company and invoicing details: company name, tax identification number, invoice title and any other credentials you submit;
• Communications: emails, forms, tickets and feedback you send us;
• Subscription details: the email address and preferences you give when subscribing to our newsletter;
• Business content: text, customer records and conversations you enter or import when using AI features (see 2.4).

2.2 Information collected automatically

• Device and network: IP address, browser type, operating system, device identifiers and time zone;
• Sign-in and session: sign-in time, session validity, and the IP and browser used (for account security and unusual-login detection);
• Usage and logs: pages visited, features used, timestamps, request outcomes and error logs;
• Feature-call metadata: which AI tool was called, when, whether it succeeded and whether a quota limit was hit (for billing, quota and abuse prevention).

2.3 Payment information

When you buy a paid service we collect the order number, item, amount, payment status, payment channel and the transaction reference it returns. We do not collect or store your full card number, CVV or payment password — those are collected and handled solely by PCI-DSS compliant third-party payment processors (see Section 5).

2.4 Input to AI features

When you use AI generation, reply or analysis features, your input is transmitted to third-party model providers to produce the result. For the AI tools on this website we record only call metadata (see 2.2) and do not retain your input itself. In products that work continuously on your behalf, such as the 派宝 console, business content (customer records, conversation history, follow-up notes) is stored under your account as required for the feature itself, and used only to provide the Service to you.

2.5 We do not set out to collect sensitive personal information (such as biometrics, religious belief, health data, financial account passwords or precise location tracking). Where a specific feature genuinely requires it, we will explain the purpose and necessity and obtain your separate consent.

We may aggregate or de-identify information for statistics and product analysis. Such information can no longer identify an individual and is not personal information.

We do not use your business data to train our own or any third party's general AI models without your explicit prior consent.

We use cookies and local storage only where needed:

Website analytics use Plausible Analytics (plausible.io), which sets no cookies, collects no personally identifying markers and performs no cross-site tracking. Its privacy notice is at https://plausible.io/privacy .

You can manage or clear cookies in your browser. Note that disabling strictly necessary cookies breaks sign-in and payment.

We do not sell your personal information, and we do not share it for a third party's own marketing. We share it only in the following cases, and only as far as necessary:

5.1 Service providers (processors). They may act only on our instructions, only as needed to provide the Service, and are bound by confidentiality and data-protection obligations:

5.2 Legal and regulatory requests. Where required by law, court order or a competent authority, we disclose the minimum necessary after verifying that the request is lawful.

5.3 Protecting rights. Where necessary to protect the lawful rights, safety or property of us, you or other users, or to deal with unlawful or fraudulent activity.

5.4 Corporate transactions. In a merger, division, acquisition or transfer of assets we will notify you in advance and require the successor to remain bound by this policy; failing that, we will ask it to seek your consent afresh.

5.5 With your consent. For any other purpose you have separately and explicitly agreed to.

We apply industry-standard technical and organisational measures:

• Encryption in transit: TLS/HTTPS site-wide, with HTTP Strict Transport Security enabled;
• Storage: account passwords are irreversibly hashed; keys and credentials are managed centrally and never committed to source code;
• Access control: internal access is limited to what is strictly necessary, and staff are bound by confidentiality obligations;
• Payment isolation: full card data is handled by PCI-DSS compliant processors and never enters our systems;
• Monitoring and audit: access and operation logs are retained, and security configuration and dependency vulnerabilities are reviewed regularly.

No internet service can be absolutely secure. Please keep your credentials safe and never share passwords or verification codes.

If a personal-information security incident occurs that may affect your rights, we will notify affected users within 72 hours of discovery by email, in-product notice or public announcement, report to the regulator as required by law, and explain what we have done and what you can do.

We keep personal information only as long as needed for the purposes in this policy, unless the law requires longer:

After these periods we delete or anonymise the information. Where retention is required by law or by an ongoing dispute, we restrict processing until the reason for retention ends.

Within the limits of applicable law (including the PRC Personal Information Protection Law and, where applicable, the GDPR), you have the following rights:

How to exercise them: email [email protected] from your registered address, stating the right you wish to exercise and the details we need to identify you. We verify and respond within 15 business days and no later than 30 days. We may need to confirm your identity first, to protect your account.

If you believe we have not handled your personal information lawfully, you may complain to the competent authority where you live; under the GDPR, that is your local data protection authority. We would also welcome the chance to resolve it with you directly first.

With your consent we may email you product updates, industry news and offers.

You can opt out at any time: use the "unsubscribe" link at the foot of any marketing email, turn the subscription off in account settings, or email [email protected]. We stop sending within 3 business days.

Opting out affects marketing only. It does not stop notices necessary for the Service itself, such as billing, security alerts, changes to terms, or outage announcements.

派宝 serves cross-border trade, and our servers and some providers may be located inside or outside mainland China (including Hong Kong SAR, Singapore, the United States and the EU). When you use features that reach overseas channels — overseas messaging platforms, third-party model providers, international card payments — the related personal information is transferred to recipients outside mainland China.

For such transfers, and in line with Articles 38–39 of the PRC Personal Information Protection Law, we: tell you separately the name and contact details of the overseas recipient, the purpose and the categories of personal information involved, and obtain your separate consent; enter into agreements containing data-protection obligations with the recipient (using standard contractual clauses where applicable); and take the measures needed to ensure the recipient's processing meets the standard set by this policy and applicable law.

You may refuse an international transfer, but features that depend on overseas services will then be unavailable to you.

The Service is intended for businesses and professional users and is provided only to individuals aged 18 or over. We do not knowingly collect personal information from anyone under 18.

If you are a guardian and believe a minor has given us personal information without your consent, contact [email protected] and we will delete it promptly after verification.

The Service may link to third-party websites or integrate with third-party platforms (messaging, payment, scheduling). This policy covers only the information we collect and process directly.

Third parties handle your information under their own privacy policies, and we are not responsible for their practices. Please review those policies before using them.

We may update this policy. For material changes — for example to purposes, methods, sharing, or your rights — we give at least 15 days' notice by email or a prominent in-product notice, and update the date at the top of this page.

Where a change requires your separate consent (such as processing new categories of sensitive personal information, or adding an overseas recipient), we will seek that consent again.

Continuing to use the Service after the effective date means you accept the updated policy.

For any question, comment or complaint about this policy or your personal information:

We handle requests as quickly as we can, normally within 15 business days.