Cookie Policy

This page explains which cookies and browser storage the uxtrade.net website operated by 内蒙古优讯通讯有限责任公司 (including the pages and front end associated with "优讯通讯") actually places in or reads from your browser, what each of them is used for, how long each is kept, and how you can view, block and delete them. The list below is written item by item against the real implementation in our code; it contains no speculative statements. We do not place third-party advertising cookies and we do not carry out cross-site behavioural tracking.

1. What this policy covers and its scope

This policy applies to the cookies, localStorage and sessionStorage that we read from or write to your device when you browse uxtrade.net and its multilingual pages. It also applies when the website is browsed or shared inside the in-app browser of WeChat.

This policy does not apply to: data managed by other clients of ours (for example our WeChat Mini Program) when you use our services through them; local data written by browser extensions or security software that you have installed; or cookies set by third-party websites after you follow a link away from this site. Processing by those third parties is governed by their own rules.

This policy should be read together with our Privacy Policy. Where a cookie or local storage item is linked to your login state, it forms part of the personal data processing described in the Privacy Policy. For the full description of that processing, the list of processors, cross-border transfers, retention periods and your rights as a data subject, please see the Privacy Policy and the "Appendix: Unified Legal Terms" at the end of this page.

2. What cookies and browser storage are

A cookie is a short piece of text that a website stores on your device through your browser. The browser sends it back to us with your subsequent requests to the same site, so a cookie can preserve state across pages and across reloads, and it can be configured to expire after a set time. Cookies are either first-party, written and read by us alone, or third-party, written by another domain. When you browse the public pages of this site, we do not use third-party cookies.

Browser storage is a separate mechanism that sits alongside cookies. The data stays on your device, is not sent automatically with every request to the server, and can only be read by our own page scripts when needed. We use two kinds:

• localStorage: has no expiry date and remains under the same site in the same browser until you delete it or a page script removes it. On this site it is used only in the administration back end, to preserve unsaved editing drafts.
• sessionStorage: its lifetime is limited to the current tab session; it is cleared when the tab is closed and is not shared between tabs. On this site it holds the per-session de-duplication marker for article view counting.

The division of labour on this site can be summarised as follows: cookies are used where the server must know a state across requests; localStorage is used where data should persist in the same browser without being uploaded on every request; sessionStorage is used where data only needs to live for the current browsing session and may be discarded when the page is closed. Our guiding principle is to use session-level storage wherever possible rather than long-lived storage, and to store a marker rather than content wherever possible.

3. How we classify cookies

We follow the classification used in Article 5(3) of the General Data Protection Regulation (GDPR) and in the prevailing approach of supervisory authorities, and divide the technologies used on this site as follows:

• Strictly necessary cookies: without them the service you have requested cannot be provided, or cannot be provided securely in the way you asked for. On this site they remember the interface language you selected, keep your login session, record your choice on the cookie notice, and de-duplicate article view counting within a session. Under the Article 5(3) exemption for cookies that are necessary for the provision of an information society service explicitly requested by you, and under the prevailing approach of supervisory authorities, strictly necessary cookies do not require prior consent. All cookies currently used on this site fall into this category.
• Functional cookies: used to remember choices you have made in order to improve your experience. Our language preference cookie has a functional character: it remembers your language choice and takes precedence over automatic detection based on IP address. Because the language preference directly determines the content you see, we treat it together with the strictly necessary category while listing it separately in this policy.
• Analytics: used to understand how heavily a page or a piece of content is viewed. This site does not integrate any third-party analytics, advertising or cross-site tracking SDK. Our only measurement is the session-storage de-duplication marker described above, together with server-side access logs (the scope, fields and retention period of the access logs are set out in section 2.7 of the Privacy Policy).
• Third-party and marketing: used for advertising, cross-site profiling or social plug-ins. This site does not use third-party advertising cookies, does not perform cross-site behavioural tracking, does not perform device fingerprinting, and does not embed social plug-in buttons.

4. Cookies and browser storage actually used on this site

The list below reflects the actual current state of this site, item by item, and corresponds to the implementation in our code. Apart from the items listed, this site writes no other cookies:

• yx_locale (type: strictly necessary cookie, with a functional character) — purpose: to remember the interface language you chose manually and, on later visits, to give it precedence over automatic language detection based on IP address; when you open a URL that carries a language prefix, the server also writes that language back into this cookie. Owner: first party. Retention: about one year from the last write. Attributes: Path=/, SameSite=Lax; it is deliberately not HttpOnly so that the front-end language switcher can write it directly, which means page scripts can read it, but it holds only a language code. Code references: src/lib/geo-locale.ts (the LOCALE_COOKIE constant and the one-year, Path=/ and SameSite=Lax settings in localeCookieOptions), src/components/LanguageSwitcher.tsx (the client-side write), src/middleware.ts (reading the preference and writing it back when the URL carries a locale).
• yx_cookie_choice (type: strictly necessary cookie) — purpose: to record the choice you made on our cookie notice. It has only two possible values, accept and necessary, and it exists so that the notice is not shown again. We use a cookie rather than local storage because that lets the server know during rendering whether you have already chosen, which avoids the flicker of rendering the notice and then hiding it. Owner: first party. Retention: about one year. Attributes: Path=/, SameSite=Lax; not HttpOnly, because it is written by the buttons in the front end, and it contains a single value with no identifier. Code references: src/lib/cookie-consent.ts (the COOKIE_CONSENT_NAME and COOKIE_CONSENT_MAX_AGE constants and writeCookieChoice), src/components/site/CookieNoticeBar.tsx (the two buttons).
• member_token (type: strictly necessary cookie; present only after you register for or sign in to a website member account) — purpose: the login credential for website members, used to recognise your login state when you open member-related pages. Owner: first party. Retention: up to 30 days; it becomes invalid immediately when you sign out, at which point the server clears it with maxAge 0. Attributes: Path=/, SameSite=Lax, HttpOnly (page scripts cannot read it), and Secure when the site is served over HTTPS. Its contents are a server-issued session token and never your password in plain text. Code references: src/lib/auth-token.ts (the MEMBER_COOKIE constant and the 30-day value), src/lib/auth.ts (Path=/, SameSite=Lax, HttpOnly and the Secure decision in setMemberCookie), and the member API routes under src/app/api/member. If you never register for or sign in to a website member account, this cookie is not written.
• admin_token (type: strictly necessary cookie; present only after an administrator signs in to the administration back end) — purpose: the administrator login credential, used to identify the administrator and to control access to the administration back end. Owner: first party. Retention: up to 7 days; it becomes invalid immediately on sign-out or when verification fails. Attributes: Path=/, SameSite=Lax, HttpOnly, and Secure when the site is served over HTTPS. Code references: src/lib/auth-token.ts (the ADMIN_COOKIE constant and the 7-day value), src/lib/auth.ts (setAdminCookie), src/middleware.ts (which reads this cookie on /admin paths as a server-side gate and redirects to the login page when it does not pass). This cookie appears only in the administration back end; an ordinary visitor browsing the public site never causes it to be set.
• sessionStorage key yx_article_view_<articleId> (type: strictly necessary / counting de-duplication; this is browser storage, not a cookie) — purpose: to record whether you have already viewed a given article in the current browser session, so that views of the same article are not counted twice within that session; the article ID in the key distinguishes one article from another. Owner: first party; it exists only on your device. Retention: cleared when the tab is closed (session lifetime). Contents: the single marker value 1, with no personal data. Code reference: src/components/site/ArticleViewBeacon.tsx (the yx_article_view_ key prefix, after which the article view reporting endpoint is called). How the server side de-identifies article view counting is described in section 2.8 of the Privacy Policy.
• localStorage key yx_quote_draft_v1:<quotationId> (type: administration back end only; browser storage, not a cookie) — purpose: to preserve an editing draft in the quotation editor that has not yet been submitted to the server, so that an accidental reload or a dropped connection does not lose the entered content, and to warn when a local draft is newer than the server version on reopening. Owner: first party; it exists only on the administrator's own device. Retention: until the draft is cleared (the corresponding draft is actively removed after a successful save) or the administrator clears browser data. Contents: the business data of the quotation (document structure, line items and amounts) and the save time; the key contains the business document ID and never a login password. Code references: src/lib/quote-draft.ts (the yx_quote_draft_v1: prefix, readQuoteDraft, writeQuoteDraft, clearQuoteDraft), src/components/admin/quotation/QuotationEditor.tsx.
• localStorage key yx_admin_software_draft (type: administration back end only; browser storage, not a cookie) — purpose: to preserve an unsubmitted form draft on the software download management page of the administration back end, so that a reload does not lose what has been entered. Owner: first party; it exists only on the administrator's own device. Retention: until the draft is cleared or the administrator clears browser data. Contents: the values of the form fields on that page and the save time. Code reference: src/app/admin/downloads/page.tsx (the DRAFT_KEY constant).
• WeChat JS-SDK external script (Tencent) (type: third-party script, which may set identifiers of its own in your browser) — our pages load the WeChat JS-SDK script jweixin-1.6.0.js from res.wx.qq.com. When the sharing capability is used inside the in-app browser of WeChat, this site calls a signing endpoint and sends the full address of the current page (without the fragment) to WeChat in order to generate a signature. That script runs under the rules of WeChat and Tencent and may set identifiers of its own in your browser. We can neither read nor control any cookie that this script sets; its processing is governed by Tencent's rules and WeChat's related notices. Code references: src/app/[locale]/layout.tsx (which loads the script with the afterInteractive strategy), src/components/site/WechatShare.tsx (which loads it and requests a signature only inside the in-app browser of WeChat), src/app/api/wechat/jssdk/route.ts (which receives and validates the page URL before requesting a signature).

All cookies on this site are first-party cookies; no cookie is written to this site by a third-party domain. Neither the cookie that records your notice choice nor the language preference cookie takes part in any form of user profiling or advertising.

Our website filing number is 蒙ICP备2026005797号-2.

5. Technologies we do not use

To avoid any misunderstanding, we state expressly which technologies this site does not currently use:

• We do not use third-party advertising cookies and we do not integrate any advertising delivery or advertising attribution platform.
• We do not use cross-site behavioural tracking, we do not build browsing profiles across websites, and we do not supply browsing data to data brokers.
• We do not perform device fingerprinting and we do not generate identifiers capable of recognising you across sites through Canvas, font lists, hardware characteristics or similar means.
• We do not embed social platform plug-in buttons or pixels such as like buttons or share-counting pixels. On our pages the WeChat sharing capability is provided through the external script described above, inside the in-app browser of WeChat, and only for sharing.
• We do not integrate third-party website analytics SDKs. Access statistics on this site are recorded by our own servers; their scope and retention period are set out in section 2.7 of the Privacy Policy.
• We do not use cookies to record sensitive personal data, and we do not base automated decisions that produce legal effects or similarly significantly affect you on cookies.

6. Your choices and controls

On your first visit to this site, a cookie and privacy notice appears at the bottom of the page. It explains that this site uses strictly necessary cookies and browser storage and offers two buttons, "Accept" and "Necessary only", together with a link to the Privacy Policy. Whichever button you press, this site writes only one value into the single cookie yx_cookie_choice, in order to remember your choice and stop showing the notice repeatedly; your click does not cause any other cookie to be written.

We state the real difference between the two options frankly: because this site currently uses strictly necessary cookies only, the two options are functionally identical, and the only difference is the value recorded as your preference. We do not claim that choosing "Necessary only" switches off tracking technologies, because no such technologies are deployed on this site in the first place; nor do we describe strictly necessary cookies as something that can be turned off, because the language preference and the login state are prerequisites for the corresponding features. If we introduce any non-essential cookie in the future, we will first implement a consent management mechanism so that such cookies are not activated before you have made a choice, and we will update the inventory in this policy.

Beyond the notice bar, you can manage cookies and browser storage at any time through your browser's own settings:

• View which cookies and local data are currently stored, together with their contents, expiry and the site they belong to.
• Delete all or selected cookies and browser storage data, including the items written by this site.
• Block cookies from this site or from all sites, or keep them only for the session and clear them when the browser closes.
• Set per-site exceptions, for example allowing this site's language preference cookie while blocking third-party scripts.

If you delete or block cookies and browser storage, the following consequences may occur:

• Your interface language preference is cleared, so this site will again determine the language automatically from your IP address or browser language settings, and you will need to choose a language once more.
• Your member login state or administrator login state becomes invalid and you will need to sign in again by entering your credentials; an unsaved back-end draft may not be recoverable.
• The cookie notice will appear again, because the cookie recording your choice no longer exists.
• If you disable JavaScript entirely in your browser, or disable browser storage for this site, features that depend on front-end storage, such as automatic draft saving in the administration back end, will be affected. Basic browsing of the public pages, reading content and viewing contact details do not depend on those capabilities.

On opt-out signals: we currently do not treat Do Not Track (DNT) or Global Privacy Control (GPC) signals differently, because this site does not use cross-site tracking. Our processing is the same whether or not such a signal is received, and there is no tracking technology for a signal to switch off. The standards by which browsers and supervisory authorities recognise those signals are also not yet uniform. If we introduce non-essential cookies in the future, we will implement consent management and respond to such signals technically before activating them.

7. How cookies relate to personal data and access logs

Most cookies on this site contain only a short value (a language code, a choice result) or a server-issued session token, and do not in themselves contain directly identifying information such as your name, telephone number or email address. However, a member login credential, in combination with a login state, can be linked to a specific member account. For that reason, and within the terms of the Privacy Policy, cookies connected with a login state form part of personal data, and their processing follows the purposes, usage rules and retention periods described in the Privacy Policy.

Our servers keep access logs for site security, troubleshooting and traffic statistics. Access logs are generated by the server when a request is received, irrespective of whether you permit cookies, and they do not use cookies to stitch together your activity across sites. The fields and retention period of the access logs are set out in section 2.7 of the Privacy Policy; the de-identification applied to article view counting is described in section 2.8 of the Privacy Policy.

We do not combine cookie data with personal data obtained from other sources for advertising purposes. If a change of control occurs, for example a merger or acquisition, we will inform you of the resulting changes in data processing as required by law, and this policy will be updated accordingly.

8. Changes, contact and the appendix

When this site adds or adjusts cookies, browser storage or third-party scripts, we will update the inventory on this page and indicate the change prominently on the page and in the notice bar. Material changes will be explained before they take effect through a site announcement or the notice bar. We recommend that you review this page periodically to stay informed about the technologies this site actually uses.

If you have questions about this policy, or wish to access, correct or delete information related to cookies, you can contact us at the legal and privacy address sales@uxtrade.cn; you may also use the telephone number and postal address published on our Contact page. We will reply within a reasonable period. The complete ways of exercising data subject rights, and the applicable time limits, are set out in the "Appendix: Unified Legal Terms" at the end of this page.

The identity of the controller, legal bases, processors, cross-border transfers, retention periods, data subject rights, security measures, changes and effective version, applicable law and language precedence are set out in the "Appendix: Unified Legal Terms" at the end of this page. Current version: 1.0; effective date: 2026-09-01. The Simplified Chinese version of this page is authoritative; other languages are reference translations.

Appendix: Common Legal Terms (applying to all agreements and policies on this site)

This appendix contains the common terms of our Privacy Policy, Cookie Policy, Terms of Service, Disclaimer, Acceptable Use Policy, Intellectual Property and Trademark Notice, Children's Privacy Notice, Data Subject Rights and Account Closure Notice, Report and Infringement Complaints page and Accessibility Statement. It is displayed together with each of those documents.

Appendix 1. Identity and contact details of the controller

• Personal information handler (data controller): 内蒙古优讯通讯有限责任公司
• Registered address: Hohhot, Inner Mongolia, China
• Website: uxtrade.net
• General business contact: sales@uxtrade.cn; 16604712005
• Dedicated privacy and legal affairs mailbox: sales@uxtrade.cn
• Reports and infringement complaints: sales@uxtrade.cn; 16604712005
• Website filing (ICP): 蒙ICP备2026005797号-2

For the processing activities described in these documents, we are the "personal information handler" within the meaning of the Personal Information Protection Law of the People's Republic of China and the "controller" within the meaning of Article 4(7) of the General Data Protection Regulation (GDPR).

Our main establishment is in the territory of the People's Republic of China. If applicable foreign law requires us to appoint a local representative (for example under Article 27 GDPR) or a data protection officer, we will make that appointment in accordance with the law and publish it on this page. Until such an appointment is made, you may contact us directly at sales@uxtrade.cn and we will handle your request ourselves.

Appendix 2. Processing activities, categories of data and legal bases

The list below sets out the processing activities we actually carry out, the categories of data involved and the corresponding legal bases (Article 6(1) GDPR).

• Account registration and sign-in — Data: name, mobile number, email address, password hash, session identifier. Legal basis: necessary for the performance of the service contract you request (Article 6(1)(b)); protecting account and system security is our legitimate interest (Article 6(1)(f)).
• Quotation and contact forms — Data: name, telephone number, email address, company name, description of requirements. Legal basis: necessary to take steps at your request prior to entering into a contract (Article 6(1)(b)). The form also contains a hidden "honeypot" field that only detects automated spam submissions; genuine visitors never fill it in and it is not your personal data.
• Quotations, contracts and after-sales reconciliation — Data: customer name, contact telephone, email address, company name, project or requirement description, quotation line items and amounts, share token. Legal basis: performance of a contract (Article 6(1)(b)); after-sales and warranty traceability is our legitimate interest (Article 6(1)(f)).
• Online repair requests and online enquiries — Data: contact person, telephone number, equipment and fault description, enquiry nickname and message content. Legal basis: performance of a contract or steps taken at your request (Article 6(1)(b)).
• WeChat Mini Program sign-in, nickname/avatar and mobile number authorisation — Data: sign-in code, openid, the nickname and avatar URL you confirm, mobile number. Legal basis: your consent (Article 6(1)(a)). You may withdraw your consent at any time; withdrawal does not affect the lawfulness of processing carried out on the basis of consent before withdrawal.
• Sending quotations and contracts by email — Data: recipient email address, subject line, body and attachments. Legal basis: performance of a contract (Article 6(1)(b)).
• Access logs and security protection — Data: IP address, request path and query parameters, request method, User-Agent, referrer, access time, and coarse IP-derived country, province/city and network operator. Legal basis: safeguarding service and network security and preventing attacks and abuse is our legitimate interest (Article 6(1)(f)); it also falls within the grounds permitted under Article 13 of the Personal Information Protection Law of the People's Republic of China, as further specified by Chinese law.
• Article popularity statistics (de-identified) — Data: a de-identified identifier consisting of the first 16 characters of a salted hash of the visitor's IP address. Legal basis: measuring content popularity is our legitimate interest (Article 6(1)(f)). The identifier contains no plaintext IP address and is not linked to any account.
• Content and asset management — Data: articles, product information, cases and illustrations that we write, photograph, generate or use under licence (some illustrations are generated by AI from text prompts). Legal basis: performance of a contract and our freedom to conduct business (Article 6(1)(b) and (f)).
• Compliance with legal obligations — Data: the minimum scope required by the competent authorities (filing information, material lawfully requested). Legal basis: legal obligation (Article 6(1)(c)).
• Handling reports and infringement complaints — Data: complainant identity and contact details, evidence of rights, URL of the content complained about. Legal basis: legal obligation and our legitimate interests (Article 6(1)(c) and (f)).

If we later introduce non-essential cookies or marketing communications, we will obtain your consent first and list them here. We do not subject you to automated decision-making that produces legal effects or similarly significantly affects you (for example automated price discrimination or automated refusal of service).

Appendix 3. Processors and third-party recipients

We engage the following third parties on a data-minimisation basis. They process data on our instructions and act as processors within the meaning of Article 28 GDPR. Each "purpose" arises only when the relevant function is actually used; it does not occur on every visit.

• Qiniu Cloud (object storage and content delivery): processes images, audio/video and text asset files, including avatars and on-site fault photographs that you upload. Purpose: asset storage and accelerated delivery.
• DeepSeek (api.deepseek.com; text generation and translation): processes text we submit, which may include quotation copy, product information, article drafts and image prompts, together with the project and requirement descriptions, company names and product specifications contained in them. Purpose: text generation, material drafting and multilingual translation.
• Alibaba Cloud Tongyi Qianwen / DashScope (including Qwen-Image and Tongyi Wanxiang; image generation): processes the text prompts we submit. Purpose: generating illustrations for the website and articles. Prompts are normally produced by a text model from internal material and generally do not contain your contact details.
• Tencent WeChat (Mini Program sign-in, fast mobile number verification, JS-SDK sharing): processes the sign-in code, openid, the nickname and avatar you authorise, the result of fast mobile number verification and the current page URL required for JS-SDK signatures. Purpose: identity within the Mini Program and sharing capabilities inside WeChat.
• Tencent WeCom (internal customer-service alerts): processes an event notification when a new online enquiry arrives (it does not contain the full conversation). Purpose: enabling our staff to respond promptly.
• The SMTP email service provider we configure (email delivery): processes the recipient address, subject line, and the body and attachments of quotations or contracts. Purpose: sending you quotations, contracts and notices.
• IP geolocation services (ipapi.co, ip-api.com) and a local IP database (ip2region): process the visitor's IP address, or country and region information derived from it. Purpose: identifying the region of origin, selecting the site language and applying security policies.
• CDN / reverse proxy and server hosting services: host the website, database and backups and process access request logs. Purpose: providing network connectivity, availability and disaster recovery.

Apart from the processors listed above, situations where you have given consent, and situations required by laws or by a lawful request of a judicial or administrative authority, we do not provide your personal information to any third party. We do not sell your personal information and we do not share it for third-party advertising purposes. We have not integrated any third-party advertising or cross-site behavioural tracking SDK.

Appendix 4. Cross-border transfers

• Your personal information is primarily stored and processed on servers located in the territory of the People's Republic of China; static assets are stored in a domestic object storage service (Qiniu Cloud).
• If you access or use our services from outside China, your personal information will be transferred to and processed in China. Such transfers are subject to Article 44 et seq. GDPR. We implement contractual and organisational safeguards for those transfers in accordance with applicable law and will put in place the required transfer mechanisms where the law so requires.
• Where we use service providers outside China to process text or prompts, the relevant text is transferred to those providers' systems. We submit only the text necessary for the processing purpose and seek to avoid submitting sensitive personal information unrelated to our business.
• Because using our services necessarily involves transferring data to China, please do not submit personal information if the law of your jurisdiction does not permit such a transfer. You may still browse the public content anonymously.

Appendix 5. Retention periods

• Account information (website membership and WeChat Mini Program): for as long as the account exists; deleted or anonymised after account closure.
• Enquiries, quotations, contracts and correspondence: for the duration of the service relationship and for 3 years afterwards (needed for after-sales support, warranty, reconciliation and limitation defences).
• Repair records: 1 year after the warranty period expires.
• Access logs (including IP address, User-Agent, request path and time): no longer than 6 months, after which they are deleted or aggregated into statistics that no longer contain IP addresses.
• De-identified identifiers used for article view counting: no longer than 12 months.
• Report and infringement complaint materials: 1 year after the matter is closed, for review and dispute handling.
• Records we must keep by law (for example concluded contracts, accounting vouchers, logs that authorities require us to retain): retained for the period prescribed by law, which may be longer than the periods above.

Once a retention period expires we delete or anonymise the data so that it can no longer be linked to you. These periods reflect our current system implementation and business needs and do not exhaust every situation required by law; where a longer retention period applies to a particular item of data, we will explain the specific basis.

Appendix 6. Your rights

To the extent provided by applicable law, you have the following rights in relation to your personal information. The methods of exercise, supporting documents and response times are set out in the Data Subject Rights and Account Closure Notice.

• Information and access: to learn whether we process your information and to obtain a copy.
• Rectification: to have inaccurate or incomplete information corrected or completed.
• Erasure: to have your personal information deleted in the circumstances provided by law.
• Restriction of processing: in certain circumstances, to require us to store the data without processing it further.
• Objection: to object to processing we carry out on the basis of legitimate interests.
• Data portability: to receive the information you provided to us in a structured, commonly used, machine-readable format.
• Withdrawal of consent: to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Not to be subject to solely automated decision-making.
• Complaint: you have the right to lodge a complaint with the personal data protection supervisory authority in your country or region (for example a national data protection authority in the EU/EEA, the UK Information Commissioner's Office, or the Cyberspace Administration of China and its local offices). If you contact us first at sales@uxtrade.cn, we will do our best to resolve the matter directly.

Exercising these rights will not lead us to refuse you service or treat you in a discriminatory way. To protect your information, we may verify your identity before acting on a request.

Appendix 7. Security measures

We apply technical and organisational measures appropriate to the risk. The measures listed below are all actually in place on this site; we do not list measures we have not implemented.

• Encryption in transit: the site is served over HTTPS and sends HSTS (Strict-Transport-Security) together with X-Content-Type-Options, Referrer-Policy, Permissions-Policy and a report-only Content Security Policy (CSP Report-Only).
• Password protection: account passwords are stored as salted bcrypt hashes; we neither store nor can recover your plaintext password.
• Role separation: administrator and ordinary member roles are separated, and the admin interface and member interface authenticate independently. Administrative write operations validate the request origin (Origin/Referer) to reduce cross-site request forgery risk.
• Anti-abuse: sign-in, registration, enquiry and mobile number binding endpoints are rate limited; malicious IP addresses can be blocked.
• Access logging: IP address, User-Agent, request path and time are recorded for security auditing, troubleshooting and rate limiting.
• Least privilege: assets are stored in object storage with restricted access paths, and administrative accounts are limited to authorised personnel.

There is no zero-risk solution for transmission over the internet or for storage. We do not promise absolute security in all circumstances. If a personal data security incident occurs, we will take remedial measures promptly in accordance with the law and, where the law requires it, inform you by a notice on this site or through the contact details you provided, describing the nature of the incident, its possible impact, the measures taken and the steps you can take to protect yourself.

Appendix 8. Changes, effective date and version

• Current version: 1.0; effective date: 2026-09-01.
• How we notify changes: we update the version number and effective date on this page and publish them here. For material changes — such as an expansion of the scope of collection, a change in the recipients of personal information, a change in cross-border transfer arrangements, or a change in the way you can exercise your rights — we will give advance notice by a prominent notice on the site and, where necessary, ask for your consent again.
• Previous versions are available on request.

Appendix 9. Governing law and dispute resolution

• The formation, validity, interpretation and dispute resolution of the agreements and policies on this site are governed by the laws of the mainland of the People's Republic of China.
• Disputes arising out of these terms should be resolved through friendly negotiation. If negotiation fails, the dispute shall be submitted to the competent people's court at our domicile (Hohhot, Inner Mongolia Autonomous Region).
• Note for users outside China: the governing law and jurisdiction provisions above do not exclude rights that you enjoy under mandatory provisions of the law of your country or region and that cannot be excluded by agreement, including your rights as a data subject under the GDPR and your right to lodge a complaint with your local supervisory authority. Where mandatory law in your jurisdiction requires local law to apply, that law applies to the extent it is mandatorily applicable.

Appendix 10. Language versions

Our agreements and policies are available in Simplified Chinese, English, Russian and Mongolian. The Simplified Chinese version prevails. The English, Russian and Mongolian versions are reference translations provided for convenience; in the event of ambiguity, omission or inconsistency between a translation and the Simplified Chinese version, the Simplified Chinese version prevails.

The language-precedence clause is a choice of law matter and takes effect once confirmed by the company; if the company decides on a different arrangement, the wording published on this page as updated will apply.

Appendix 11. Relationship between the documents

Our Privacy Policy, Cookie Policy, Terms of Service, Disclaimer, Acceptable Use Policy, Intellectual Property and Trademark Notice, Children's Privacy Notice, Data Subject Rights and Account Closure Notice, Report and Infringement Complaints page and Accessibility Statement together constitute the entire agreement between you and us regarding your use of the platform. Each document applies to the specific matters it governs. If any document conflicts with this appendix on the identity of the controller, legal bases, processors and third-party disclosures, cross-border transfers, retention periods, data subject rights, security measures, changes and effective date, governing law or language precedence, this appendix prevails; on the specific matters governed by a particular document, that document prevails. If any provision is held invalid or unenforceable, the validity of the remaining provisions is not affected.