Privacy Policy

1. Definitions and scope

This Privacy Policy ("Policy") applies to all services provided by the backspacegeo platform ("Platform"). The platform operator ("we", "us") acts as the personal information processor under the Personal Information Protection Law (PIPL), the Data Security Law and the Cybersecurity Law of the PRC, and applicable overseas laws (see the Overseas Privacy Compliance page). This Policy explains what we collect, how we use it, how long we keep it, with whom we share it, and what rights you have. Where we process data entrusted by enterprise customers (as a processor), the Data Processing Agreement (DPA) applies.

2. Who we are (data controller / handler)

The operator's legal name, registered address, unified social credit code and the contact details of our personal information protection officer are those published on the Platform's official website; enterprise customers may agree data protection contacts in their contracts. We have designated a personal information protection officer responsible for this Policy and for handling data subject requests; contact details appear in the Contact us section.

3. What we collect

(1) Account and identity data: registration phone number (or corporate email), name, company, position; (2) Business data: brands, products, keywords, website URLs, knowledge-base documents, content assets, leads and form submissions you submit; (3) Usage and device data: login times, IP address, browser identifiers and operation logs (for security auditing and anti-abuse); (4) Payment data: order records and invoice details (payments are processed by licensed payment institutions; we do not store full card numbers). We collect no personal information unrelated to the service, and no classified state secrets (see section 11).

4. Lawful bases for processing

We process personal information on the following bases: (1) performance of contract (delivering your subscription); (2) your consent (e.g. enabling overseas models, marketing communications — withdrawable at any time); (3) legal obligations (log retention, tax and audit cooperation); (4) legitimate interests (network and information security, fraud and abuse prevention). Before relying on legitimate interests we conduct a balancing assessment to ensure your rights are not unduly affected.

5. How we use information

Collected data is used solely to: deliver AI visibility monitoring, content production, distribution and reporting; protect account and data security (login auditing, brute-force prevention, anomaly detection); metering and quota management; service quality improvement; and legal compliance. We do not use personal information for unrelated purposes; new purposes require fresh consent.

6. Data classification and important data

We classify and grade data per the Data Security Law: customer business data is treated as "general data" by default with tenant isolation and other safeguards; we neither solicit nor request "important data", and the Acceptable Use Policy prohibits uploading important data or state secrets. If your scenario involves important data or requires a cross-border security assessment, tell us in writing before signing and we will assess the arrangement separately.

7. Sharing, entrusted processing and third parties

We involve external processing only: (1) sending necessary data to AI engine/model providers to complete your monitoring and generation tasks (list in the Sub-processors page); (2) using cloud, SMS and email infrastructure providers (same list); (3) cooperating with lawful mandatory requests from authorities (we respond prudently within legal bounds and keep records); (4) with your explicit consent. We never sell your personal information and never share it for third-party advertising. All processors sign data protection terms and remain under our supervision.

8. AI and training data (core commitment)

(1) Your business data is never used to train any public AI model nor to improve providers' foundation models; (2) our agreements with model providers include no-training clauses; (3) data sent to models is limited to what each task requires (e.g. monitored question terms, text excerpts for generation/retrieval); (4) customers may restrict AI calls to domestic models only (see the AI & Data Use Statement).

9. Retention periods

We keep information for the shortest period necessary for its purpose: account data — service duration plus deletion within 30 days after closure (unless law requires otherwise); business data (monitoring results, content, leads) — retained during service, exportable for 30 days after termination; to support verification of monitoring results (the industry group standard recommends keeping monitoring raw records for at least 3 years after project closure) and for potential dispute resolution, business data is retained for 3 years after termination (inaccessible during that period), then deleted or anonymized; network logs — at least 6 months per Article 21 of the Cybersecurity Law; order and financial records — at least 10 years per tax law; security incident records — at least 3 years. On expiry we delete or anonymize the data.

10. Your rights and how to exercise them

Under PIPL and applicable laws you may: access and copy your personal information (self-service via Data Export); correct inaccurate information; delete (via account closure or request, except where retention is legally required); withdraw consent (e.g. revoke overseas model authorization); request an explanation of processing rules; and obtain a portable copy. We respond within 15 working days of receipt (up to 30 days for complex cases with reasons given). Submit requests via Contact us or use the in-platform self-service functions.

11. Classified information red line (required reading for public-sector customers)

This Platform is a commercial SaaS service and must not be used to process any state secrets, work secrets, classified information or internal sensitive documents of government bodies. Do not upload, generate or distribute such information through the Platform; the uploader bears all consequences of violations. Do not use the Platform for classified work; for government/public-sector compliance needs, contact us to assess private deployment and tailored arrangements.

12. Security measures

Our technical and organizational measures include: TLS transport encryption and AES-256 encryption at rest; dual isolation by tenant and project (cross-tenant access refused at the architecture layer); role-based access control on least privilege; multi-factor authentication and anomalous-login detection; operation audit logs; backup and recovery; employee confidentiality agreements and access approval workflows; and a vulnerability response process. We benchmark against MLPS (Cybersecurity Classified Protection) Level 3 requirements for security baseline self-assessment and continuous remediation (a self-assessment mechanism, not a certification). No system is absolutely secure; in a data security incident we will notify you and report to regulators as required by law.

13. Cross-border transfers

Data is stored in mainland China by default. When you actively enable an overseas AI engine or overseas distribution channel, necessary data (e.g. monitored question terms, text excerpts) is transferred abroad to complete that operation. We follow Article 38 of PIPL: for transfers involving personal information we adopt the standard contract issued by the Cyberspace Administration of China (CAC) (filed or in the process of filing), or a security assessment/certification, and we disclose the scope and recipients to you. You can switch off overseas model calls in platform settings (domestic-only), effective immediately.

14. Sensitive personal information and minors

We in principle do not process sensitive personal information (biometrics, health, financial accounts, etc.). If a scenario genuinely requires it (e.g. you upload documents containing patient information), you must ensure separate consent has been obtained and inform us; we will assess separately and apply enhanced safeguards. The Platform serves business users and is not intended for individuals under 14; if we discover inadvertent collection we will delete it promptly.

15. Cookies and similar technologies

We use essential cookies to maintain login sessions and form security (CSRF tokens), remember language preferences, and for traffic analytics. See the Cookie Notice for details.

16. Policy updates and notice

We may update this Policy from time to time. Material changes (scope of collection, purposes, sharing recipients) are published prominently on the official site with 30 days' advance notice to registered users; other changes take effect on publication. Continued use after the effective date constitutes acceptance; if you do not accept, you may stop using the service and close your account.

17. Complaints and reporting channels

If you believe our processing infringes your lawful rights, contact us via Contact us; we reply within 15 working days. You may also complain to regulators: the Cyberspace Administration of China (CAC) reporting center (12377), the Ministry of Industry and Information Technology (MIIT) telecom appeals center (12321), or market regulators (12315). For personal information disputes you may also bring proceedings before a competent court.

18. Contact us

Personal information protection officer / data protection contact: as published on this website and agreed in contracts. The operator's legal name, registered address and unified social credit code are those published on the Contact page and set out in the signed contract; data protection requests may be sent to the email address or phone number listed there. We handle requests within 15 working days of receipt; where an extension is needed we will give reasons.