国际版隐私协议 / Privacy and Security Terms

一、我们如何收集信息

我们仅收集必要且最小化的数据：

1. 账户标识信息：注册时收集邮箱或手机号。法律依据为履行服务合同与合法利益，手机号以哈希化去标识形式存储。
2. 输入数据：包括您主动输入的日期、时间等内容，用于履行合同及响应用户主动提供的信息。
3. 自动收集的技术信息：包括 IP 地址、设备类型、浏览器信息，用于安全防护、反欺诈和系统优化，最长保留 90 天。
4. Cookie 与类似技术数据：用于维持登录、偏好设置及统计分析；在适用法律要求下，我们会通过 Cookie 弹窗征得您的同意。

1. How We Collect Information

We only collect necessary and minimal data:

1. Account identification information: We collect your email address or mobile phone number when you register. The legal basis is performance of a service contract and legitimate interests, and phone numbers are stored in hashed, de-identified form.
2. Input data: Content such as dates and times that you voluntarily enter, processed for contract performance and based on your voluntary provision.
3. Automatically collected technical information: Including IP address, device type, and browser information for security protection, anti-fraud, and system optimization, retained for up to 90 days.
4. Cookies and similar technologies: Used to maintain login status, preference settings, and statistical analysis. We will obtain consent where required by applicable law.

二、信息使用目的与限制

（一）核心用途

1. 提供、维护及改进服务
2. 验证身份与安全防护

（二）严格限制

• 不进行个性化广告画像
• 不出售用户个人数据
• 不将数据用于未经同意的 AI 训练

（三）法律例外情形

仅在合法要求下披露，例如法院或监管机构要求、履行法定义务、防止欺诈或安全风险时。

2. Purposes and Restrictions on Information Use

2.1 Core Purposes

1. To provide, maintain, and improve our services
2. To verify identity and ensure security protection

2.2 Strict Restrictions

• No personalized advertising profiling
• No sale of personal user data
• No use of data for AI training without prior consent

2.3 Legal Exceptions

Disclosure shall only be made when legally required, including by courts or regulators, to fulfill legal obligations, or to prevent fraud or security risks.

三、数据共享与第三方管理

（一）必要共享场景

1. 云服务提供商（仅限加密数据）
2. 支付服务提供商

（二）共享原则

• 数据最小化
• 严格合同约束（DPA）
• 定期安全审计

（三）国际合规说明

所有第三方需符合 GDPR、CCPA 或等效标准。

3. Data Sharing and Third-Party Management

3.1 Necessary Sharing Scenarios

1. Cloud service providers, with encrypted data only
2. Payment service providers

3.2 Sharing Principles

• Data minimization
• Strict contractual obligations through DPAs
• Regular security audits

3.3 International Compliance Note

All third parties shall comply with GDPR, CCPA, or equivalent standards.

四、Cookie 与追踪技术政策

（一）Cookie 类型

1. 必要 Cookie（始终启用）
2. 功能 Cookie（用户可控制）
3. 分析 Cookie（默认关闭，需用户 opt-in 同意）

（二）用户选择权

• 用户可随时通过 Cookie 设置进行 opt-out
• 欧盟用户首次访问将显示 Cookie 同意横幅

（三）禁止行为

• 不使用跨站广告追踪
• 不进行隐蔽指纹识别

4. Cookie and Tracking Technology Policy

4.1 Types of Cookies

1. Necessary Cookies, always enabled
2. Functional Cookies, user-controllable
3. Analytical Cookies, disabled by default and requiring opt-in consent

4.2 User Choices

• Users may opt out at any time through cookie settings
• EU users will see a cookie consent banner on first visit

4.3 Prohibited Practices

• No cross-site advertising tracking
• No covert fingerprinting

五、数据存储与跨境传输

（一）存储方式

• 数据存储于合规地区，包括但不限于中国香港、新加坡、日本等地区
• 采用 TLS / AES-256 加密保护

（二）跨境传输机制

• 欧盟：标准合同条款（SCCs）
• 美国：符合 CCPA/CPRA 要求
• 其他地区：采取等效保护措施

5. Data Storage and Cross-Border Transfers

5.1 Storage Methods

• Data is stored in compliant jurisdictions, including but not limited to Hong Kong SAR of China, Singapore, Japan, and other regions
• Protected by encryption such as TLS and AES-256

5.2 Cross-Border Transfer Mechanisms

• EU: Standard Contractual Clauses
• US: Compliance with CCPA/CPRA requirements
• Other regions: Equivalent protection measures

六、您的数据权利

（一）全球适用权利

• 访问数据
• 更正数据
• 删除数据
• 限制处理
• 反对处理
• 数据可携带

（二）加州用户权利（CCPA）

• 知情权
• 删除权
• 拒绝出售个人信息权

（三）行权方式

邮箱：info@qmdj.ai

响应时间：30 天内

6. Your Data Rights

6.1 Globally Applicable Rights

• Access your data
• Correct your data
• Erase your data
• Restrict processing
• Object to processing
• Data portability

6.2 Rights for California Residents

• Right to know
• Right to deletion
• Right to opt out of sale of personal information

6.3 How to Exercise Your Rights

Email: info@qmdj.ai

Response time: Within 30 days

七、安全防护措施

• 数据加密（TLS 1.3 / AES-256）
• 访问控制（RBAC + 2FA）
• 定期安全测试

发生数据泄露时，我们将在适用情况下于 72 小时内通知监管机构，并通知受影响用户。

7. Security Protection Measures

• Data encryption (TLS 1.3 / AES-256)
• Access control (RBAC + 2FA)
• Regular security testing

In the event of a data breach, we will notify the competent supervisory authority within 72 hours where applicable and notify affected users.

八、儿童隐私保护

• 不向未满法定年龄用户提供服务
• 欧盟：16 岁以下需监护人同意
• 美国：遵守 COPPA（13 岁以下）

8. Children’s Privacy Protection

• Services are not provided to users below the legal age
• EU: Parental or guardian consent required for users under 16
• US: Compliance with COPPA for users under 13

九、数据保留政策

• 用户数据仅在必要期限内保存
• 注销账户后合理期限内删除
• 法律要求除外

9. Data Retention Policy

• User data is retained only for the necessary period
• Data is deleted within a reasonable time after account cancellation
• Except where required by law

十、政策更新机制

• 重大变更将提前通知
• 继续使用视为接受更新

10. Policy Update Mechanism

• Material changes will be notified in advance
• Continued use constitutes acceptance of the updated policy

十一、联系我们

邮箱：info@qmdj.ai

11. Contact Us

Email: info@qmdj.ai