Privacy Policy.

P1 Introduction & scope

This Privacy Policy describes how CHENGTUZHI TRADING CO., LIMITED (the "Company", "we", "us" or "our") collects, uses, discloses and protects personal data when you:

• Visit or interact with our website at chengtuzhi.com and any sub-domain we operate;
• Install and use our mobile management applications (the "Apps") published on Google Play and Apple App Store;
• Communicate with us by email, contact form or other channels referenced on this website.

The controller of your personal data is CHENGTUZHI TRADING CO., LIMITED, registered in Hong Kong at Rm A19(H19) 12/F WING TAI CTR 12 HING YIP ST, Kwun Tong, HK. Where the European GDPR or the UK GDPR applies, the Company acts as the data controller; where the LGPD applies, the Company acts as the controller ("controlador"); where the CCPA/CPRA applies, the Company acts as the "business".

This policy does not cover third-party sites we link to. If you click a link to a third-party site (for example, a Google Play or App Store page), that site's own privacy policy will apply.

P2 Information we collect

We collect the categories of personal data described below. We do not knowingly collect biometric data, sensitive government identifiers or precise location data unless you explicitly opt in.

P2.1 Website data

• IP address (truncated where feasible);
• User-agent string, referrer, pages visited, timestamps;
• Server logs from the hosting environment (GitHub Pages + Pages CDN).

P2.2 Voluntary data

• Name, email, message body, company and any other information you choose to share with us via the contact form or email links.

P2.3 App data

• Device identifiers (IDFA on iOS, GAID on Android, hashed where feasible);
• OS version, app version, locale, in-app events, crash logs;
• Opt-in / opt-out status for analytics and personalised advertising;
• Account-related identifiers if you create an in-app account (email address, hashed password, role).

P2.4 Do-not-collect list

We do not collect biometric identifiers, racial or ethnic origin, political opinions, religious beliefs, trade-union membership, genetic data, health data or sex-life / sexual orientation data. We do not collect precise location unless you opt in.

P3 How we use personal data

We use personal data for the following purposes, with the lawful basis identified under GDPR Article 6.

We do not use personal data for automated decision-making that produces legal effects or similarly significantly affects you (Art. 22 GDPR). Ad-targeting decisions are not "solely" automated decisions with legal effect within the meaning of Art. 22.

P4 Cookies & similar technologies

The website uses a consent management platform (CMP) that blocks non-essential cookies for EEA, UK and Swiss visitors until consent is granted. We classify cookies and similar trackers as follows:

We do not load third-party advertising trackers on chengtuzhi.com. Advertising trackers appear in our Apps only, and only after explicit in-app consent where required (see P5).

P5 Mobile app — data and ad SDKs

Our Apps integrate advertising SDKs as well as first-party analytics and crash-reporting components. The Apps are not aimed at children. The four ad formats used in the Apps are described below; the catalogue of all 19 ad platforms we integrate (or may integrate) is set out in P6.

P5.1 Ad formats

P5.2 Data each SDK category collects

• Device identifiers (IDFA/GAID, hashed where feasible);
• IP address, coarse location (if the user has granted location permission);
• Event timestamps and ad-interaction events (impression, click, completion);
• App version, OS version, locale, free disk space, network type.

P5.3 Opt-out

You can opt out of personalised advertising through:

• iOS: Settings → Privacy & Security → Apple Advertising → toggle "Limit Ad Tracking".
• Android: Settings → Google → Ads → toggle "Opt out of Ads Personalisation".
• In-app settings (where supported by the SDK): Settings → Privacy → "Opt out of interest-based ads".

P6 Advertising and ad-platform compliance

This section enumerates every advertising platform whose SDK is integrated (or may be integrated in the future) into our Apps. For each platform we state the SDK behaviour, the data collected, the lawful basis, the opt-out mechanism and a link to the platform's privacy page.

P6.1 Your ad choices (global opt-out links)

• Digital Advertising Alliance (DAA) — youradchoices.com/choices;
• European Interactive Digital Advertising Alliance (EDAA) — youronlinechoices.eu;
• Network Advertising Initiative (NAI) — optout.networkadvertising.org;
• Google Ads Settings — adssettings.google.com.

P6.2 The 19 ad platforms

We periodically audit this list. Region-specific addenda (for example, the Pangle EEA addendum and the Meta Audience Network EU addendum) are reflected in the platform's own opt-out and consent flow, which is presented inside each App before any personalised ad request.

P7 International data transfers

The Company is based in Hong Kong SAR. Where personal data is transferred out of Hong Kong — for example, to the EEA, UK, US, Canada, Australia, Singapore or Japan — we rely on the transfer mechanisms identified below.

P8 Regional privacy rights

Depending on where you live, you may have rights under the following laws. For each region we identify the applicable law, the rights you enjoy and the contact route.

P8.1 European Union — GDPR (Regulation (EU) 2016/679)

If you are in the EU, the General Data Protection Regulation applies. Lawful bases are set out in Art. 6 and detailed in P3. Data-subject rights include:

• Right of access (Art. 15);
• Right to rectification (Art. 16);
• Right to erasure / right to be forgotten (Art. 17);
• Right to restriction of processing (Art. 18);
• Right to data portability (Art. 20);
• Right to object (Art. 21);
• Right to withdraw consent (Art. 7(3));
• Right to lodge a complaint with a supervisory authority (Art. 77).

We are not required to appoint a Data Protection Officer (DPO) given the nature, scope and purposes of our processing. We are not required to appoint an EU representative. To exercise your rights, contact support@chengtuzhi.com.

P8.2 United Kingdom — UK GDPR & Data Protection Act 2018

If you are in the UK, the UK GDPR and the Data Protection Act 2018 apply. The rights mirror those under the EU GDPR (Arts. 15–22) and you may complain to the Information Commissioner's Office (ICO) at ico.org.uk. We are not required to appoint a UK representative. Contact support@chengtuzhi.com.

P8.3 California, United States — CCPA / CPRA

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) applies. You have the right to:

• Notice at collection — what we collect, why and with whom we share it (this section).
• Right to know what personal information we have collected about you.
• Right to delete personal information we have collected from you.
• Right to correct inaccurate personal information.
• Right to limit use of sensitive personal information (we do not collect sensitive PI within the meaning of CPRA).
• Right to opt out of sale or sharing — we do not sell personal information for monetary or other valuable consideration; cross-context behavioural advertising may constitute "sharing" under CPRA, which you may opt out of via the in-app toggle or by emailing support@chengtuzhi.com.
• Non-discrimination for exercising any CCPA/CPRA right.

P8.4 Brazil — LGPD (Lei nº 13.709/2018)

If you are in Brazil, the Lei Geral de Proteção de Dados (LGPD) applies. Legal bases are set out in Art. 7 and include consent, performance of a contract, legitimate interest and legal obligation. Data-subject rights under Art. 18 include confirmation of existence, access, correction, anonymisation, portability, deletion and information about sharing. The data protection authority is the Autoridade Nacional de Proteção de Dados (ANPD). Contact support@chengtuzhi.com.

P8.5 Canada — PIPEDA & provincial laws (e.g., Quebec Law 25)

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies, supplemented by applicable provincial laws (for example, Quebec's Law 25). You have the right of access, the right to challenge accuracy, and the right to withdraw consent. The Office of the Privacy Commissioner of Canada (OPC) is the federal supervisory authority. Contact support@chengtuzhi.com.

P8.6 Australia — Privacy Act 1988 (Cth) & Australian Privacy Principles (APPs)

If you are in Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply. APP 8 governs cross-border transfers of personal information and requires us to take reasonable steps to ensure that an overseas recipient does not breach the APPs. The Office of the Australian Information Commissioner (OAIC) is the supervisory authority. Contact support@chengtuzhi.com.

P8.7 Singapore — PDPA (Personal Data Protection Act 2012)

If you are in Singapore, the Personal Data Protection Act 2012 (PDPA) applies. The PDPC oversees compliance. We will obtain consent (or rely on another legitimate basis under the PDPA), notify you of the purpose, and cease retention when the purpose is exhausted. Contact support@chengtuzhi.com.

P8.8 Japan — APPI (Act on the Protection of Personal Information)

If you are in Japan, the Act on the Protection of Personal Information (APPI) applies. We use personal information within the stated purpose and apply the APPI's rules on cross-border transfer. The Personal Information Protection Commission (PPC) is the supervisory authority. Contact support@chengtuzhi.com.

P9 Children's privacy

Our Apps are not aimed at children. We do not knowingly target advertising at children and we honour OS-level ad personalisation flags (Limit Ad Tracking on iOS, Opt out of Ads Personalisation on Android).

If we learn that we have collected personal data from a child under the applicable threshold without verifiable parental consent, we will delete that data on notice. Please contact support@chengtuzhi.com if you believe this has happened.

P10 Data retention

P11 Security measures

We apply technical and organisational measures designed to protect personal data, including:

• TLS in transit for the website and Apps (HTTPS enforced);
• Role-based access control for staff with access to personal data;
• Vendor due diligence for every processor that handles personal data;
• Encrypted storage of credentials and account identifiers;
• A documented breach-response procedure with notification timelines consistent with GDPR Art. 33 / 34 and equivalent regional laws.

P12 Third-party processors

P13 Changes to this policy

We may revise this policy from time to time. The "Last updated" header at the top of this page reflects the current version. Material changes will be notified by an in-app banner or a website notice, and (where required by law) by re-prompting for consent.

P14 Contact us

For any privacy question, request, or complaint, contact us via one of the following routes:

• General privacy questions: support@chengtuzhi.com
• Key-account / contract-related privacy questions: liuqiumeng@chengtuzhi.com
• Postal address: Rm A19(H19) 12/F WING TAI CTR 12 HING YIP ST, Kwun Tong, HK

We will respond within the timeframes required by applicable law (typically within 30 days for GDPR / UK GDPR access requests).

P15 App-store compliance references

Our Apps and this policy are designed to comply with the latest published versions of:

• Apple App Store Review Guidelines — developer.apple.com/app-store/review/guidelines/
• Google Play Developer Program Policy — support.google.com/googleplay/android-developer/topic/9871336

Where an App Store requirement imposes a stricter rule than this policy (for example, around children's data, advertising identifiers or "Data Used to Track You" disclosures), the App Store rule governs the in-App experience.