Privacy Policy
Last updated: October 5, 2026
Guwaxi ("we") respects and protects your personal information. This Privacy Policy is formulated in accordance with applicable laws and regulations including the Personal Information Protection Law of the People's Republic of China (PIPL), the Cybersecurity Law of the PRC (CSL), the Data Security Law of the PRC (DSL), the Regulations on Network Data Security Management, the General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA). It explains how we collect, use, store, share, and protect your personal information. Please read each section carefully.
1. Overview and Scope
This Policy applies to the personal information processing activities involved when you use the Guwaxi website, clients, and related services (collectively, "the Service"). "Personal information" refers to various information related to an identified or identifiable natural person recorded electronically or otherwise, excluding anonymized information. "Personal information processor" refers to us as the organization that determines the purposes and methods of processing. This Policy does not apply to the privacy policies of third-party software you may use; such cases are the responsibility of the respective third parties. If you are under 14 years of age, please read this Policy and use the Service under the supervision of a guardian; processing your personal information requires guardian consent.
2. Personal Information We Collect
We collect only the minimum information necessary to provide the service, including: (1) registration and verification: mainland China mobile phone number, username, and your password stored as a PBKDF2-HMAC-SHA256 one-way hash (600,000 iterations); (2) account and order data: subscription records, paid orders, and payment-method identifiers (no full card numbers stored); (3) yuanbao and referral data: yuanbao balances and transaction records, and, for withdrawals, the payee name, payout account (stored encrypted) and last-four ID digits you provide for verification; (4) AI service data: inputs you submit to AI features, generated outputs and billing logs; (5) usage data: software download/update records, version information, device identifiers; (6) feedback and notifications: feedback you submit and notification preferences; (7) security and audit data: login IP, login time, and operation logs. We do not collect information unrelated to the service, nor device data such as contacts or photo libraries.
3. Collection Methods and Legal Basis
Our legal bases for processing personal information include: (1) your consent, e.g., receiving marketing notifications, using the invitation reward feature; (2) necessity for concluding or performing a contract, e.g., account registration, providing software distribution and updates, processing paid orders; (3) necessity for performing statutory duties or obligations, e.g., retaining network logs for no less than six months per CSL, cooperating with regulatory inspections; (4) necessity for responding to public health emergencies or protecting life and health in emergencies. We process your personal information only under the above legal bases, following the principles of purpose limitation and data minimization. If the processing purpose, method, or information type changes, we will re-notify and obtain consent as required by law.
4. Purpose of Use
The personal information collected is used to: (1) provide software distribution, version updates, and download services; (2) authenticate accounts and manage sessions; (3) process subscriptions, orders, and payments; (4) send system notifications, security alerts, and service announcements; (5) improve product experience through aggregated statistics and anonymized analytics; (6) ensure system security, prevent fraud and abuse; (7) handle user feedback and support requests. We will not use your personal information for purposes other than those stated; any change in purpose will be separately notified with consent obtained as required by law. You may disable non-essential notifications (e.g., marketing) at any time via account settings without affecting core service usage.
5. Sharing, Transfer and Public Disclosure
We do not share your personal information with third parties, except: (1) with your separate consent; (2) with service providers engaged by us (e.g. SMS, email, payment gateways), which may process only as necessary and under confidentiality obligations; (3) AI model service providers: when you use AI features, we transmit your inputs to the large-model providers you choose or that the platform has configured to generate outputs; some of them may be located outside mainland China (see Section 7 for cross-border arrangements); (4) as required by laws, regulations or lawful requests by administrative or judicial authorities. We never sell your personal information. In mergers or acquisitions, successors are required to continue honoring this policy. For other transfers or disclosures we will inform you of the recipient and purpose and obtain separate consent as required by law.
6. Storage and Protection
Your personal information is stored on servers within mainland China (except as otherwise required by law). Security measures include: (1) passwords stored as irreversible PBKDF2-HMAC-SHA256 one-way hashes (600,000 iterations); (2) sensitive data such as payout accounts and key material encrypted at rest with AES-256-GCM; all transport encrypted with TLS; data isolated by app_id; (3) parameterized queries against SQL injection, plus CSP and HSTS against cross-site attacks; (4) audit logging of all administrator operations with two-factor checks on critical actions; (5) periodic security assessments and vulnerability remediation. We retain personal information only as long as necessary; after account deletion it is removed or anonymized within 15 business days, except where law requires longer retention (e.g. network logs of at least six months). Where personal information is or may be leaked, tampered with or lost, we will immediately take remedial measures and notify you and regulators as required by law.
7. Cross-Border Data Transfer
Personal information collected and generated in mainland China is stored domestically in principle. When you use AI features, your submitted inputs are transmitted to large-model providers powering the platform; where such a provider is located offshore or its processing involves offshore transfer, we will fulfill cross-border obligations under Articles 38-42 of the PIPL (via one of: CAC security assessment, personal information protection certification, or a standard contract filed with the provincial cyberspace authority, as applicable), obtain your separate consent, and ensure the overseas recipient provides protection no lower than this policy. We publish the actually enabled model providers in the AI feature interfaces. For users subject to GDPR, cross-border transfers follow GDPR Chapter V and Standard Contractual Clauses.
8. Cookies and Similar Technologies
We use httpOnly, Secure cookies to store authentication tokens for session management; these cookies do not contain personally identifiable information and are valid only during the session. We do not use third-party tracking cookies. Website analytics are collected via a self-hosted PostHog service for aggregated statistics and product improvement only, not shared with third-party advertising platforms. You may manage or delete cookies at any time via browser settings, though this may affect login status and some features. Cookie types used include: strictly necessary cookies (authentication sessions) and analytics cookies (PostHog aggregated statistics), none of which involve cross-site tracking.
9. Your Rights and How to Exercise Them
Under PIPL, GDPR, and CCPA, you have the following rights regarding personal information: (1) right to know and decide: understand the purpose, method, and scope of processing, and to limit or refuse processing; (2) right to access and copy: request to view and obtain a copy of your personal information; (3) right to correct and supplement: request correction of inaccurate or supplementation of incomplete information; (4) right to deletion: request deletion when the purpose is achieved, consent is withdrawn, or processing is unlawful; (5) right to data portability: obtain and transfer your personal information in a structured, commonly used format; (6) right to withdraw consent: withdraw previously given consent at any time, without affecting processing before withdrawal; (7) right to object to automated decision-making: refuse decisions with significant impact made solely by automated means; (8) right to explanation: request an explanation of the processing rules. To exercise these rights, email privacy@guwaxi.com; we will respond within 15 business days.
10. Protection of Minors
We attach great importance to protecting the personal information of minors. If you are a minor under 14, you should read this Policy and use the Service under guardian supervision; processing your personal information requires guardian consent. We take the following special protective measures for minors: (1) establishing dedicated processing rules, collecting only information necessary for the Service; (2) not engaging in commercial marketing to minors through automated decision-making; (3) guardians have the right to access, correct, delete minor's personal information, and withdraw consent. If a guardian discovers we are processing a minor's information without consent, they may contact us to delete it at any time. This Service is not actively offered to users under 14; if such registrations are discovered, we will delete the relevant information as required by law.
11. Policy Updates and Contact
This Policy may be updated from time to time. For material changes (e.g., expanded processing purposes, additional information types, changes in sharing scope), we will notify you 30 days in advance via website announcement or email; if you do not agree with the updated Policy, you may stop using the Service or delete your account, and continued use constitutes acceptance. We have designated a Data Protection Officer (DPO) responsible for privacy matters, contactable at privacy@guwaxi.com. If you have questions, complaints, or suggestions regarding personal information processing, please contact us first; if unsatisfied with our response, you may file a complaint with the cyberspace administration or other competent regulatory authority. The right of interpretation of this Policy belongs to us.