Tanxinghuo Cloud Privacy Policy

This Policy applies to the Tanxinghuo Cloud Web service, iOS and Android apps, WeChat-assisted features, and related APIs. The iOS Bundle ID and Android package name are com.jiyuanpulian.erpcreat.mobile.

Organization customers determine the purposes, people, and permissions for entering employee, customer, supplier, and operational data and ordinarily manage that organization business data. We provide hosting, synchronization, security, and technical processing according to the organization's activated configuration and authorization. For information required for platform account security, device sessions, service logs, and the platform's own operation, we assume the personal information processing responsibilities required by applicable law.

The service is provided and operated by 杭州星瑾商贸有限公司 (“we,” “us,” or “our”). The email for support, privacy complaints, and personal information rights requests is listed in the “Contact us” section of this Policy.

Before entering another person's telephone number, address, signature, or photo, a user should confirm that there is a lawful business purpose and provide any required notice. Do not upload identity documents, medical, religious, biometric, or other highly sensitive information unrelated to organization work.

A customer may have multiple delivery addresses. The recipient, telephone number, address and map location selected when creating an order are saved with that order for delivery and later verification. Editing or disabling an address-book entry does not automatically rewrite historical orders. If no map point is selected, coordinates from another address are not substituted for the selected destination.

• We process information necessary to perform the enterprise service agreement and complete user-requested sales, inventory, finance, delivery, printing, and collaboration workflows.
• Location, camera, photos, microphone, speech, Bluetooth, notifications, and other device capabilities are used after system permission prompts and an affirmative user action. Separate consent will be obtained when required by law.
• To protect account, organization data, and transaction security, we record necessary sessions, device and IP information, operation logs, idempotency identifiers, and error information.
• Where laws, regulatory requirements, dispute resolution, or protection of significant lawful interests require processing, it is carried out under the applicable rules.

The app does not request system Contacts permission and does not read mobile contacts for marketing. The device system or a map/navigation app may separately process the blue location dot, maps, or navigation according to its own privacy settings. Android permission names and settings paths may vary by OS version and device manufacturer.

Voice input uses system speech recognition. Audio may be processed by Apple or the recognition service configured on an Android device; recognition is not guaranteed to occur entirely on-device. It starts only when the user actively selects voice input. Manual notes remain available if permission is refused.

Continuous location does not start merely because the app is installed or a user signs in. The organization must enable the capability for the account, the user must grant “Always” and Precise Location permissions, and the user must tap Start Work or expressly begin a delivery task. Location updates support team dispatch and, where the user has customer-relations permission, may also provide nearby-customer alerts. When the user ends work, completes all related deliveries, signs out, or switches accounts, the system stops the corresponding location updates and clears points waiting to be uploaded.

Location samples include coordinates, accuracy, and time and may reveal a person's movements, so they may be sensitive personal information. Organization administrators may view them only within their permissions and business scope. The server rejects cross-organization access and prevents clearly low-accuracy or out-of-order samples from replacing trusted location data. Raw work-location samples are retained for no longer than 30 days, then removed through the system's deletion process. A location fact included in a user-submitted visit or delivery-acceptance record is retained for the period applicable to that business record.

When a user selects “Remember password,” iOS uses Keychain and Android uses Keystore. Clearing the selection or expressly signing out removes the secure stored credential. On the Web, password saving is controlled by the browser's standard password manager and the password is not written to Web localStorage. The server validates passwords only through the secure authentication process and does not display plaintext passwords in this Policy or in logs.

The app stores account-isolated drafts, recently used data, preloaded lists, update-announcement state, and weak-network sync queues on the device to support offline recovery and reduce repeated entry. Unuploaded photos and recoverable drafts may remain isolated under the original account after sign-out, organization switching or an in-place update; they are not transferred to another account. Signing out does not delete all local data. Unwanted photos or drafts can be removed through the relevant workflow before formal submission. Uninstalling the app or clearing its data may make unsynchronized content unrecoverable. If a device is lost, an administrator should disable the account and revoke sessions promptly.

According to organization settings, business data may be shown within the same organization to the primary account holder, administrators, and authorized employees. Customer ownership, department, role, module permission, and data scope affect visibility. Hiding an element on a page is not the only protection; the server also checks organization, account, permission, and record status.

WeChat customer bills are disabled by default. The following applies only when the system and organization enable the feature and a user actively shares a bill: a person holding the share card or link can view the shared document. Historical unpaid balances and reconciliation feedback require customer identity verification using a WeChat identity digest and a short-lived confirmation code separately supplied by the organization, without creating an employee account. Shares expire after 30 days by default and can be revoked earlier. Customer WeChat authorization lasts up to 180 days and viewing sessions up to 30 days. Confirming a bill means verification, not payment or delivery acceptance. Revoking access does not delete source documents or feedback retained for lawful organization needs. To revoke authorization or ask about records, contact the sharing organization or use the support information on this page.

Except for organization-authorized collaboration, what is necessary to provide the service, security protection, or legal requirements, we do not sell, rent, or disclose personal information to unrelated third parties. If the operating entity changes through a merger, division, or asset transfer, notice will be provided as required by law and the successor will be required to continue complying with this Policy, or any necessary consent will be obtained again.

We will update this list when a provider, interface, or privacy rule materially changes. Sentry currently exists only as an unconnected code placeholder and is not listed as an active data recipient.

As of this version, the core Tanxinghuo Cloud Web service, APIs, PostgreSQL database, and uploaded files operate on Tencent Cloud servers in mainland China. We do not intentionally transfer organization business data outside mainland China for advertising or data trading.

Apple's App Store, APNs, system speech and weather services, and other third-party services actively invoked by users may process necessary information through their global infrastructure and under their privacy terms. Where an activity constitutes a cross-border transfer under applicable law, we will complete the required assessment, notice, separate consent, or other legally required procedure.

• Raw work-location samples: no longer than 30 days. A location confirmed in business evidence is handled under the retention period for the related record.
• Sessions, device information, and push tokens: while the session is valid, the account is active, or the device is subscribed, then according to security and deletion cycles after the session is revoked, account disabled, user signed out, or notifications turned off.
• Organization orders, inventory, finance, approvals, visits, acceptance records, audits, and related attachments: while the organization uses the service and for the period needed to satisfy financial, tax, audit, dispute-resolution, and contractual obligations.
• Local drafts and cache: retained under the relevant account and device for workflow recovery. Unsynchronized photos or requests may remain isolated after sign-out or account switching, until actively cleared by the user or handled under the relevant feature rules after completion.

After the necessary period ends, information is deleted, anonymized, or restricted according to its nature and technical conditions. Deletion from backups may be completed through the secure rotation cycle; during that period the information is not used for ordinary business operations.

Safeguards include HTTPS, account sessions, organization isolation, server-side permissions, database constraints, transactions, idempotency controls, operation auditing, backups, and minimizing open network ports. No network or storage system can guarantee absolute security. If an incident may affect a person's rights, we will act promptly to control the risk and notify the organization, user, or competent authority as required by law.

Users can view or correct their name, telephone number, and email address under “Me → Personal Profile” in the app and can withdraw device permissions in system settings. Correction, export, or deletion of business data generally must be handled by the relevant organization administrator according to permissions and audit requirements.

To exercise rights such as access, copies, restriction of processing, account deactivation, or deletion, follow the Support and Data Request process and submit the account, organization, request scope, and verifiable identity information. We will handle the request promptly after verifying identity and organization authorization, and respond within the period required by applicable law. For a complex request, we will explain the reason and an estimated response time.

Withdrawal does not affect the lawfulness of processing that occurred before withdrawal. Records involving completed sales, inventory, receipts or payments, financial or tax evidence, audits, disputes, or another person's lawful rights may not be physically deleted immediately. Their use will be restricted during the legally required or otherwise necessary period, then they will be deleted or anonymized.

An organization representative may create a primary account through self-service signup. Employee accounts are created by the organization’s primary account holder or administrator. When an employee leaves, the administrator archives the account under “Employees and Permissions,” revokes sessions, disables notifications and work-location tracking, and transfers customer responsibilities to another person in the same organization where needed. Historical records retain stable attribution to the employee so that financial and inventory facts are not distorted.

An individual may request to stop using the service and delete deletable account information. An organization ending the service may request data export and deletion. For steps, identity-verification materials, and records that cannot be deleted, see the account deactivation explanation.

Tanxinghuo Cloud is intended for organizations and their authorized staff and is not directed to children under 14. Organizations must not create accounts for minors who do not meet employment and compliance requirements. If information about a child was collected by mistake, a guardian or organization administrator should use the Support page to request assistance.

When features, third-party services, or legal requirements change, we will update the version and date. Material changes involving processing purposes, sensitive personal information, or user rights will be presented again through a sign-in message, in-app announcement, or organization notice, and consent will be obtained again where required by law. Continued use alone will not substitute for consent that is legally required.

Service operator (registered legal name)

杭州星瑾商贸有限公司

Support and privacy email

starrorangee@163.com

For account and organization business-data issues, first contact the relevant organization administrator. For platform technical support, privacy complaints, and data requests, visit https://starcraet.com/support?lang=en.

You may use the email above for technical support, privacy complaints, and personal information rights requests. Organization customers may also use the service contact channel established when their service was activated.