Chinesia Privacy Policy

Chinesia is an international Chinese-language education product for learners worldwide, operated by Shenzhen Zhangyuxuandong Information Technology Ltd. ("we", "us"). For the processing activities described here we act as the personal information handler (referred to as the "data controller" in some jurisdictions).

What this policy applies to

This policy applies to the services we provide in any product form, including but not limited to:

• the Chinesia official website (www.chinesia.com.cn) and all of its pages and online features;
• the Chinesia mobile application (iOS and Android);
• Chinesia H5 pages, mini programs, embedded web views, and Chinesia services offered through partner channels;
• specific features such as the HSK computer-based mock test, learning reports, courses and vocabulary practice.

Where a product or feature has its own privacy notice, that notice applies together with this policy. If the two conflict, the specific notice prevails for that product or feature and this policy continues to apply to everything it does not cover.

What this policy does not apply to

This policy does not apply to products and services provided to you independently by third parties (for example third-party websites you reach through our services, or other apps you download yourself). Those services process your information under their own privacy policies.

Please read the bold text carefully. By clicking "Agree", registering an account or continuing to use our services, you confirm that you have read and understood this policy. Where processing involves sensitive personal information, sharing or cross-border transfers, we will obtain your separate consent.

Language versions

This policy is provided in several languages for your convenience. If the versions differ in meaning, the Simplified Chinese version prevails, unless the law of your country or region requires the local-language version to prevail.

We follow the principle of data minimisation: we collect only what a specific feature needs, never "just in case". Information comes from three sources: what you give us, what is generated automatically as you use the services, and what we receive from third parties with your authorisation.

Category	Details	When it is collected	Required?
Account and identity	Mobile number or email address, verification code, password (stored encrypted); where you sign in with Apple, Google, Facebook, LINE, Kakao, Naver, WeChat or QQ, the account identifier, nickname and avatar you authorise us to receive	Registration, sign-in, account recovery	Required — no account can be created without it
Profile	Nickname, avatar, gender, year of birth, native language, country or region, learning goal and level	Completing your profile, matching content	Optional — basic learning is unaffected
Learning data	Answers to lessons and questions, scores, time spent, mistakes and bookmarks, progress, HSK mock test results and learning reports	Learning, practice, mock exams	Required — this is the service itself
Voice recordings	Audio recorded during speaking practice and pronunciation assessment	When you use speaking features	Optional — requires your microphone permission
Images and files	Avatars and screenshots you upload with feedback	At upload	Optional — requires camera or photo library permission
Transactions and orders	Order number, item, amount, time, payment channel and the transaction reference it returns, redemption codes and entitlement records	Purchases and redemptions	Required — to complete the transaction and provide support
Device and log data	Device model and brand, operating system and version, app version, device identifiers (such as IDFV, IDFA, Android ID, OAID), language and time zone, screen resolution, network type and carrier, IP address, crash logs, key operation logs	Throughout your use, including foreground, background and silent states where a connection must be maintained	Required — for account security, troubleshooting and statutory log retention
Approximate location	Country or region level location inferred from your IP address	Serving local language and content, risk control	Required. We do not collect precise GPS location unless you separately grant it for a specific feature
Communications	Your correspondence with support, materials you submit, survey responses	Enquiries, complaints, after-sales	Optional, but withholding it may affect how we can help
Cookies and similar technologies	See section 4	Website and H5 use	See section 4

About sensitive personal information

Some of the above — in particular voice recordings, identity details and transaction information — is treated as sensitive personal information in certain jurisdictions. We process it only after you enable the relevant feature and give separate consent, and strictly for that purpose. Speaking recordings are used solely to score pronunciation and fluency. They are not used for voiceprint recognition, not used to identify you, and not used to train models linked to your identity.

What we never collect

We do not collect information about your race or ethnicity, religious or philosophical beliefs, political opinions, trade union membership, sexual orientation or health, nor genetic or biometric data such as facial or fingerprint templates, nor information relating to criminal convictions and offences.

De-identified and aggregated data

We aggregate or de-identify information for statistics and research (for example the overall accuracy rate on a grammar point). Such data cannot identify you directly or indirectly and is not treated as personal information; if we ever re-associate it with you, we will handle it under this policy again.

We use your personal information only for the purposes listed below. For any new purpose we will explain it and obtain consent again. The "legal basis" column applies to users in jurisdictions that require one to be stated (such as the EEA, the UK and Thailand).

Purpose	Information used	Legal basis
Creating and managing your account, verifying identity, account recovery	Account and identity, device and log data	Performance of our contract with you
Delivering courses, vocabulary practice, HSK mock tests and learning reports; syncing your progress across devices	Learning data, account and identity, profile	Performance of contract
Adapting practice content and difficulty to your performance and generating personalised study suggestions	Learning data, profile	Performance of contract; consent where required
Pronunciation assessment and feedback	Voice recordings	Your consent
Processing orders, issuing receipts, after-sales and refunds	Transactions and orders, account and identity	Performance of contract; legal obligation
Account and payment security, anti-cheating, preventing bulk registration and score manipulation, troubleshooting	Device and log data, approximate location, transactions	Our legitimate interests (keeping the service and its users safe); legal obligation
Service-related notifications (study reminders, order status, policy changes)	Account and identity, device and log data	Performance of contract; our legitimate interests
Marketing and promotional messages (push, SMS, email, in-app)	Account and identity, profile	Your consent; you may opt out at any time without affecting your use of the service
Analytics, measuring campaign performance, improving the product and teaching content	De-identified learning and log data	Our legitimate interests; consent where the law requires it
Handling enquiries and complaints, running surveys	Communications, account and identity	Performance of contract; our legitimate interests
Complying with law, responding to regulators and legal process, establishing or defending legal claims	As required in the specific case	Legal obligation; our legitimate interests

About automated decision-making

We adjust practice content and difficulty automatically based on your learning data. This affects only the questions and suggestions you see and produces no legal or similarly significant effect on you. We do not use automated decisions to determine whether your account remains available, what price you pay, or other significant matters. To request human review, or if you would rather not receive personalised learning recommendations, contact us as set out in section 14.

On our website and H5 pages we use cookies and local storage such as localStorage; in the mobile app we use device identifiers for equivalent purposes. They fall into three groups:

• Strictly necessary — keeping you signed in, remembering your interface language, and security mechanisms such as cross-site request forgery protection. Disabling them makes signing in and core features impossible.
• Preferences — remembering your language, interface and study settings so you do not have to set them again.
• Analytics — understanding page visits and feature use so we can improve the product. This data is analysed in de-identified form.

You can accept, refuse or delete cookies through your browser settings, and reset or limit advertising identifiers in your device settings. Note that refusing strictly necessary cookies will prevent sign-in and some core features from working.

We respect browser "Do Not Track" signals. As the industry has no uniform standard for handling them, we do not collect additional information on the basis of that signal.

We do not sell your personal information, and we do not share it for third parties' own marketing purposes.

Sharing

We share the minimum necessary personal information in the following situations. Recipients must act on our instructions for the agreed purpose, sign a data processing agreement and apply confidentiality and security measures:

• Service providers — cloud computing and storage, push notifications, payments and settlement, speech assessment, customer support systems, analytics and crash reporting, content delivery (see section 6);
• Affiliates — for unified accounts, support and security controls, within the purposes described in this policy;
• Institutional customers — where you use services paid for by a school, institution or employer as its student or staff member, we may provide your progress and results so that it can administer the course or assessment;
• Legal requirements — where compelled by law or by a judicial or administrative authority, or as necessary to establish or defend legal claims, investigate unlawful or fraudulent conduct, or protect the safety of persons and property;
• other situations for which you have given separate consent.

Transfer

We do not transfer your personal information except as required by law or with your separate consent. In a merger, division, acquisition or bankruptcy liquidation, we will tell you the name and contact details of the recipient and require it to remain bound by this policy; if the purpose of processing changes, we will seek your consent again.

Public disclosure

We do not publicly disclose your personal information unless compelled by law or with your separate consent. A nickname and avatar you choose to make public in your profile may be visible to other users who follow your invitation link; you can change or delete them at any time.

Please note that information you post publicly may be collected and used by others. Take care before publishing anything that identifies you.

To deliver features such as push notifications, payments and speech assessment, our apps integrate third-party software development kits (SDKs) and interfaces (APIs). These third parties act under their own privacy policies, which are not governed by this policy. We test and audit their behaviour and require them to collect and use data lawfully and as agreed.

Category and purpose	Typical providers	Information they may process
Push notifications: study reminders, order and campaign notices	JPush (Aurora Mobile), Firebase Cloud Messaging (Google), Huawei Push, and handset makers' system push channels	Device identifiers, device and system information, network status and type, channel tokens required for delivery
Analytics and crash diagnostics: locating crashes, measuring feature use and campaign performance	Firebase, AppsFlyer	Device identifiers, device and system information, network information, app usage and event logs
Payments and settlement: purchases and subscriptions	Apple In-App Purchase, Google Play Billing, WeChat Pay, Alipay, PayPal	Order and transaction information, device and network information for payment risk control
File and image upload and storage: avatars, feedback screenshots	Alibaba Cloud	The files you upload and the device and network information needed to upload them
Chinese speech assessment: scoring pronunciation and fluency	Tencent Cloud Smart Speech Assessment	The audio you record and the prompt text used for scoring
Device identification: recognising devices, preventing bulk registration and cheating	MSA OAID and comparable device identifier services	Device identifiers, device and network information

Push SDKs may request system permissions such as network state, storage and notifications, and usually initialise only on the corresponding handset brand. Third-party SDKs may change how they process data when they release new versions or adjust their policies; you can check their official websites for the latest details. We re-verify them when we ship app updates and will update this policy where necessary.

We currently store personal information on servers located in the People's Republic of China. Because we serve users worldwide, your personal information may be transferred outside your own country or region, or from your location into China, in the following cases:

• you use our services outside China and your account and learning data must be synchronised to our servers in China;
• features such as push notifications, payments and speech assessment require the necessary information to be sent to service providers located in other countries or regions.

For such transfers we apply the safeguards required by law, including: informing you of the name and contact details of the overseas recipient, the purpose of processing and the categories of information involved, and obtaining your separate consent; carrying out a personal information protection impact assessment; and entering into standard contracts with recipients (such as the standard contract for outbound transfers issued by the Cyberspace Administration of China, or the EU Standard Contractual Clauses), supported by encryption and access controls.

You may contact us as set out in section 14 to request the list of overseas recipients and a copy of the safeguards in place.

We keep your personal information only for as long as is necessary for the purposes set out in this policy, then delete or anonymise it. Specifically:

• Account and learning data — kept while your account exists, so that you can review your records and reports at any time;
• After account deletion — deleted or anonymised within a reasonable period, normally no more than 30 days, except where the law requires otherwise;
• Transaction and financial records — kept as required by tax, accounting and e-commerce law; in mainland China, for no less than three years from completion of the transaction;
• Network and security logs — kept as required by cybersecurity law; in mainland China, for no less than six months;
• Voice recordings — kept only as long as needed to complete the assessment, and deleted on a rolling basis once the result has been produced.

In setting retention periods we consider the volume, nature and sensitivity of the information, the risk of harm from unauthorised use or disclosure, whether the purpose can be achieved another way, and applicable legal requirements. Where retention must be extended for legal reasons or an ongoing dispute, we restrict processing to that specific purpose.

We apply organisational, technical and physical measures that meet industry standards to protect your personal information against unauthorised access, disclosure, alteration and loss:

• data in transit is protected with TLS encryption, and credentials such as passwords are stored using irreversible hashing;
• internal access follows the principle of least privilege — only authorised staff may access personal information, only as far as their duties require, and access is logged for audit;
• staff receive data security and privacy training and sign confidentiality undertakings;
• we maintain an incident response plan and carry out security assessments and drills regularly.

If a breach, alteration or loss of personal information occurs or is likely to have occurred, we will activate our incident response plan, take remedial action, and inform you by email, in-app notice or public announcement as required by law of what happened, the likely consequences and the steps you can take, while reporting to the competent authorities.

Please note that the internet is not an absolutely secure environment and we cannot guarantee the security of information in transit. Keep your account and verification codes safe, never share them, and sign out after using a shared device. If you notice anything unusual about your account, contact us immediately.

To the extent permitted by applicable law, you have the following rights over the personal information we hold about you:

• To be informed and to access — to know how we process your information and to obtain a copy of it;
• To rectify and complete — to correct inaccurate information or complete information that is incomplete;
• To erase — where the purpose has been achieved, you withdraw consent, we have processed unlawfully, or in other cases set out by law;
• To restrict and object — to have processing paused while accuracy is checked, or to object to processing based on our legitimate interests; you may object to direct marketing at any time and without giving reasons;
• To data portability — where technically feasible, to have your information transferred to you or a third party you nominate in a structured, commonly used, machine-readable format;
• To withdraw consent — at any time; this does not affect the lawfulness of processing carried out before withdrawal, and we may be unable to continue providing the related feature afterwards;
• To delete your account — at any time; once deleted you can no longer sign in or view your learning records, so please consider carefully;
• To an explanation — to ask us to explain our processing rules;
• To complain — to a supervisory authority or through the courts (see the appendices).

How to exercise them

You can view and edit your profile and manage notifications and permissions directly in the account and settings pages of the product. You may also exercise the rights above by contacting us as set out in section 14. To protect your account we may need to verify your identity and may ask for further details about your request.

Exercising your rights is normally free of charge. If a request is manifestly unfounded, repetitive or excessive, we may charge a reasonable fee or refuse it, and we will explain why.

When we may not be able to comply in full

We may refuse a request in whole or in part, giving reasons, where it relates directly to a statutory obligation, national security or defence, criminal investigation, prosecution, trial or enforcement; where there is clear evidence of bad faith or abuse of rights; where complying would seriously harm the legitimate rights and interests of others; or where trade secrets are involved.

We take the protection of minors' personal information seriously.

• Our services are aimed primarily at adults. If you are under 18 (or under the age of majority where you live), please read this policy and use our services with the consent and guidance of a parent or guardian.
• In mainland China, where a child under 14 uses our services, a parent or guardian must read and agree to this policy and the children's personal information rules. We handle such information under the Provisions on the Protection of Children's Personal Information Online and apply stricter safeguards.
• In the EEA and the UK, if you are below the age of digital consent in your country (generally 16, and between 13 and 15 in some member states), we rely on the consent of your guardian as our legal basis.
• We do not knowingly collect personal information from children under 13. If we learn that we have done so without guardian consent, we will delete it as soon as possible.

If you are the guardian of a minor and have questions about their use of our services or their personal information, contact us as set out in section 14 to access, correct or delete it.

Our website and app may contain links to third-party websites, applications or services, such as app stores, social platforms and partner pages. These third parties operate independently, their handling of information is not governed by this policy, and we cannot control it.

We recommend reading their privacy policies before giving them any personal information. To the extent permitted by law we are not responsible for losses caused by the acts of third parties.

We may revise this policy as our services and the law evolve. The revised policy will be published on this page and the "Last updated" date at the top will change.

For material changes we will notify you separately — by in-app notice, push, email or a prominent announcement — and obtain your consent again where the law requires it. Material changes include: a significant change in our service model (for example a substantive change to the purpose, categories or manner of processing); a change of control or of the operating entity; a change in the main recipients of shared, transferred or disclosed information; a significant change in how you exercise your rights; and a change to the contact details of our personal information protection officer.

If you do not agree with the revised policy, please stop using the relevant services and you may delete your account. Continuing to use the services means you accept the revised policy.

We have appointed a personal information protection officer responsible for privacy matters. For questions about this policy or your personal information, or to exercise the rights described in section 10, contact us:

• Email: octopustimes-study@zh-games.com (please write "Privacy request" in the subject line)
• Post: Personal Information Protection Officer, Shenzhen Zhangyuxuandong Information Technology Ltd., Room 802, Building 11, Phase II Software Park, Nanshan District, Shenzhen, China
• Telephone: +86-755-82548561

We normally reply within 15 business days of receiving your request and verifying your identity, and no later than 30 days for complex or numerous requests, telling you the reason for any extension in advance.

If you believe our processing has harmed your rights and we cannot resolve the matter together, you may also complain to the competent supervisory authority or bring proceedings before a court with jurisdiction. Region-specific channels are set out in the appendices below.

This appendix applies to users of our services in mainland China and applies together with the main body. In case of conflict, this appendix prevails for those users.

Matters requiring separate consent

Under the Personal Information Protection Law, we obtain your separate consent in the relevant context — rather than relying on blanket consent — for: processing sensitive personal information such as speaking recordings; sharing your personal information with third parties; providing personal information outside the People's Republic of China; and publicly disclosing your personal information.

Your rights

In addition to section 10, you may ask us to explain our processing rules. If you die, your close relatives may, for their own lawful and legitimate interests, exercise rights of access, copying, correction and deletion over your relevant personal information, unless you arranged otherwise during your lifetime.

Complaints

If you believe we have breached personal information protection laws, you may complain or report to the authorities responsible for personal information protection, including the cyberspace administration, telecommunications regulator, public security organs and market regulation authorities, or bring proceedings before a competent people's court. The national internet reporting hotline is 12377 (www.12377.cn).

This appendix applies to users in the European Economic Area, the United Kingdom and Switzerland, under the General Data Protection Regulation (GDPR), the UK GDPR and the Swiss Federal Act on Data Protection.

Data controller

Shenzhen Zhangyuxuandong Information Technology Ltd. Contact details are in section 14.

Legal bases

The legal basis for each processing activity is set out in the table in section 3: performance of our contract with you (Article 6(1)(b) GDPR), your consent (Article 6(1)(a)), our legitimate interests (Article 6(1)(f)) and compliance with a legal obligation (Article 6(1)(c)). For special category data under Article 9 GDPR we rely on your explicit consent. You may withdraw consent at any time.

Your rights

You have the rights of access, rectification, erasure ("right to be forgotten"), restriction of processing, objection and data portability, and the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you. See section 10 for how to exercise them.

International transfers

Your personal data is transferred to China and other countries for which the European Commission has not issued an adequacy decision. We rely on the EU Standard Contractual Clauses (for UK users, the International Data Transfer Agreement or Addendum), combined with a transfer impact assessment and supplementary measures such as encryption and access controls. You may contact us for a copy of the relevant documents.

Complaints to a supervisory authority

You have the right to lodge a complaint with the data protection authority of your habitual residence, place of work or the place of the alleged infringement. UK users may complain to the Information Commissioner's Office (ico.org.uk). We would still encourage you to contact us first so that we can address your concerns quickly.

This appendix applies to users of our services in the Kingdom of Thailand under the Personal Data Protection Act B.E. 2562 (PDPA).

Data controller and legal bases

The data controller is Shenzhen Zhangyuxuandong Information Technology Ltd.; contact details are in section 14. We process your personal data on one or more of the following bases: your consent; necessity for performance of a contract with you; compliance with a legal obligation; and our or a third party's legitimate interests (where these do not override your fundamental rights). Sensitive personal data under section 26 of the PDPA is processed only with your explicit consent.

Your rights

You have the rights to access and obtain a copy, to data portability, to object to processing, to erasure or anonymisation, to restriction of use, to rectification, to withdraw consent, and to lodge a complaint where we fail to comply with the PDPA. See section 10 for how to exercise them; we will respond within 30 days of receiving your request.

Cross-border transfers and complaints

Your personal data may be transferred outside Thailand, including to China. We apply appropriate safeguards under section 28 of the PDPA or transfer with your informed consent. If you believe we have breached the PDPA, you may complain to the Office of the Personal Data Protection Committee (www.pdpc.or.th).

If you use our services in the countries or regions below, we also comply with local personal information protection law in addition to the main body of this policy. Where local law grants you stronger protection or additional rights, local law prevails:

• Korea — Personal Information Protection Act (PIPA). You may request access, correction, deletion and suspension of processing, and may complain to the Personal Information Protection Commission (PIPC) or the Privacy Infringement Report Centre (118).
• Vietnam — Decree No. 13/2023/ND-CP on Personal Data Protection. You have rights to be informed, to access, correct, delete, restrict and object to processing, and to withdraw consent, and may complain to the Department of Cybersecurity and Hi-tech Crime Prevention under the Ministry of Public Security.
• Japan — Act on the Protection of Personal Information (APPI). You may request disclosure, correction, suspension of use and suspension of provision to third parties, and may complain to the Personal Information Protection Commission (PPC).
• Russia — Federal Law No. 152-FZ on Personal Data. You may request access, correction and destruction of your personal data, withdraw consent, and complain to Roskomnadzor.
• Other countries and regions — we process your personal information to the standard of protection set out in this policy and comply with mandatory local legal requirements.

Wherever you are, you can contact us as set out in section 14 to exercise your rights.