Privacy Policy

Version V1.0-en · Effective 24/08/2026

Privacy Policy

Peiban (Yuanqi Task Box) Privacy Policy

Version: V1.0-en | Updated: 24 August 2026 | Effective: 24 August 2026

Xiheyao (Hangzhou) Technology Co., Ltd. (the "Operator" or "we") recognises the importance of your personal information. We take appropriate security measures in accordance with applicable laws and regulations and endeavour to keep your personal information secure and under control.

IMPORTANT: This Policy covers important rules on processing your personal information, including sensitive personal information, sharing with third parties and automated decision-making. Please read and fully understand the entire Policy before using the Service, particularly the provisions highlighted in bold. This Policy takes effect when you actively tick the confirmation box.

Article 1. How we collect and use your personal information

1.1 Registration and login. When you authorise WeChat login to this Mini Program, we obtain the following information with your authorisation: your WeChat OpenID (required to identify your account and log in); UnionID (when you authorise identification across platforms); and your nickname and profile picture (optional, to display your profile; refusal does not affect basic login). We do not obtain this information without your authorisation.

1.2 Providing the Service and interactions. To provide core services such as AI companionship and task management, we collect information generated through your use, including chat content, interaction records, long-term memories, preferences and task data. This information is necessary for personalised services and continuity of conversations.

1.3 Personalised analysis and service improvement. We use your birth details, MBTI, chat content, long-term memories, goals, tasks and status information to generate character matches, personalised replies, plans, rankings, reminders and reviews. This analysis is for assistance and does not constitute a definite prediction.

1.4 Model training. We may use irreversibly anonymised data for statistics, evaluation, risk control and service improvement. Before using identifiable chat content, long-term memories or sensitive interaction data to train general-purpose models, we will obtain separate consent as required by law. Entrusted service providers may process data only on the Operator's instructions and may not use it for their own purposes.

1.5 Payments and orders. When you purchase membership, we collect order details, payment status and transaction times. Third-party payment providers such as WeChat Pay process payments; we do not store complete payment information such as bank card numbers or passwords.

1.6 Security and risk control. To protect accounts and keep the Service stable, we collect device information, login logs, operation records and network environment information for security, anomaly detection and troubleshooting.

Article 2. Mini Program local storage and technical information

2.1 This Mini Program uses WeChat Mini Program local storage to store necessary information such as login tokens, account-isolated caches and preferences, to maintain your login status and service experience.

2.2 We collect technical information such as error logs and network request logs for troubleshooting and service improvement.

2.3 This Mini Program does not use cookies. If we integrate third-party SDKs or APIs in future, our Third-Party SDK and API List will identify each one's name, provider, collected fields, purposes and processing methods.

Article 3. How we share, transfer and publicly disclose your personal information

3.1 We do not sell your personal information to third parties. We share it only in the following circumstances and strictly require recipients to process it for the agreed purposes and in the agreed manner:

(1) Entrusted processing: to provide the Service, we entrust necessary data to AI technology providers, cloud infrastructure providers and other processors. They may process it only on our instructions, not for their own purposes, and are subject to our supervision.

(2) Joint processing: if we jointly determine processing purposes and methods with another entity, we will inform you of that entity's identity and the applicable processing rules.

(3) Provision to other personal information processors: we provide your information to other processors only at your express request or where required by law.

(4) Infrastructure services: providers of basic services, such as WeChat, process necessary information under their platform rules.

3.2 See the Third-Party Information Sharing List for details. That list has the same effect as this Policy and is updated under the same version.

The third-party providers and processing roles enabled in production are listed below. The Operator determines the purposes and methods of personal information processing and is the personal information processor for the Service. Model, cloud, speech and search providers process information only within the Operator's instructions and contracts. Production uses only services or deployment capabilities in mainland China. Overseas models and overseas relay services are not enabled, including for automatic fallback or backup calls.

3.3 We do not publicly disclose your personal information without consent, except where required by laws and regulations or necessary to protect the public interest or the lawful rights and interests of the Operator and users.

Article 4. How we store and protect your personal information

4.1 Your personal information is stored on servers in the People's Republic of China. Application servers, the PostgreSQL database, Redis cache, local vector database and business backups are deployed in Tencent Cloud's Beijing region in mainland China (ap-beijing, Beijing Zone 7). If cross-border transfers of personal information are involved, we will conduct the legally required security assessment and obtain your separate consent.

4.2 We retain personal information only for the shortest period necessary for its processing purpose. The specific periods are: (1) Account details, nickname, profile picture, birth details, preferences and emergency contacts: for the life of the account, then deleted or anonymised in online business systems within 30 days after account closure; records legally required to be retained are stored separately. (2) Original chats and interaction records: until you delete them, close your account or have not logged in for 24 consecutive months, whichever occurs first; deleted or anonymised in online systems within 15 working days of the trigger. (3) Long-term memories, summaries, profiles, preferences, goals and tasks: for the life of the account; deleted from online systems within 15 working days of a clearing request, or deleted or anonymised within 30 days after account closure. (4) AI audio files and caches: retained with the corresponding messages; temporary audio files without an associated message are cleared within 24 hours. (5) Login, operation, network and security logs: six months from creation, or, where legally required or needed for an ongoing security incident or dispute, until that incident or dispute is resolved. (6) Order, payment, refund, invoice and settlement records: five years from completion of the transaction, or longer if tax, accounting or regulatory rules require. (7) Complaints, reports and appeals: three years after the ticket is closed, or until relevant litigation, arbitration or regulatory investigations end. (8) Major safety risk and emergency intervention records: three years after closure, or until the statutory period expires or the matter is resolved where law provides otherwise or the matter remains ongoing. (9) Database and file backups: retained on a rolling 30-day basis and automatically overwritten. Data deleted from online systems is no longer used for routine business and is overwritten within the backup rotation cycle of at most 30 days. After the applicable retention period, we delete or anonymise your personal information.

4.3 We use technical and organisational measures including encrypted transmission, access controls, data masking and security audits to protect personal information.

4.4 Irreversibly anonymised information that cannot identify an individual is no longer personal information under law. De-identified information may still identify an individual when combined with other information, so we continue to protect it as personal information.

Article 5. Your rights

5.1 Access and copies. You may access and obtain copies of your personal information. Submit a request through "My account - Contact support" (WeChat Customer Service) in the Yuanqi Task Box Mini Program; we will provide it in accordance with law after verifying your identity.

5.2 Correction and completion. You may request correction or completion if your personal information is inaccurate or incomplete.

5.3 Deletion and interaction data management. You may request deletion of personal information. We distinguish between: (1) deleting a message or an entire conversation; (2) clearing long-term memories and summaries; (3) copying or exporting interaction data; and (4) closing your account. You may request each separately. Deletion does not mean immediate physical removal from every backup: backups cease to be actively used and are progressively overwritten within the established rotation cycle. Data copying or transfer is available only where legally required and technically feasible. We may retain necessary records for security, audits, dispute resolution, contractual performance and legal obligations.

5.4 Account closure. You may request account closure. After closure, we delete or anonymise personal information as required by law, unless laws and regulations provide otherwise. Closure does not automatically entitle you to a refund or release you from existing responsibilities.

5.5 Withdrawal of consent. You may withdraw consent. Withdrawal does not affect the validity of processing conducted on the basis of consent before its withdrawal.

5.6 Limits on exercising rights. We may lawfully refuse or request reasonable explanations for requests that are repetitive, manifestly unjustified, outside statutory scope or may harm others' rights. Processing periods begin after identity verification and receipt of complete materials.

Article 6. Protection of minors' personal information

6.1 The Service is available only to individuals aged 18 or over and is not intended for minors. We do not knowingly collect minors' personal information. If we discover it was collected in error, we will promptly delete it in accordance with law. Payments mistakenly made by minors are handled in accordance with law.

Article 7. Sensitive personal information and emergency contacts

7.1 Interactions may involve sensitive personal information such as your health, emotional state, finances or intimate relationships. This information arises from what you voluntarily enter. We process it only as necessary to provide the Service and fulfil legal obligations.

7.2 If you set an emergency contact, we collect that person's name and contact details. We contact them only to the extent necessary when legally prescribed conditions arise, such as expressed self-harm or suicidal tendencies or a major risk to personal safety.

7.3 To the extent necessary to fulfil legal obligations, protect life and health or address emergencies, we may process risk identification records and contact guardians, emergency contacts or relevant organisations without relying on your consent at that moment. Disclosure is limited to what is necessary to address the risk. We do not promise to detect every risk or guarantee successful contact.

7.4 You must ensure that information about others is obtained lawfully and that they have been duly informed. Requests to correct or delete emergency contact information, or objections to its processing, are handled under Article 5.

Article 8. Automated decision-making and personalised analysis

8.1 We use personal information for personalised analysis, content ranking, risk identification and service recommendations. This includes chat content, long-term memories, preferences and task data. The basic approach is to generate matching rankings and personalised replies from your interaction data.

8.2 These analyses are for assistance, do not constitute definite predictions about you and are not used to impose unreasonable differences in prices or benefits.

8.3 Where automated decisions significantly affect your personal rights and interests or are used for commercial marketing or notifications, we provide explanations, options to decline non-essential personalisation or other applicable channels as required by law. We do not make a general promise that all personalisation and security or risk-control features can be disabled.

Article 9. Updates to this Policy

9.1 We may revise this Policy from time to time. General wording updates take effect after publication.

9.2 For material changes to processing purposes, methods, types of information, sensitive information or provision to other processors, we will inform you again and obtain consent as required by law.

Article 10. Contact us

10.1 For questions, comments or suggestions about this Policy or personal information protection, contact us through "My account - Contact support" (WeChat Customer Service) in the Yuanqi Task Box Mini Program.

10.2 We will respond promptly after receiving your request and verifying your identity.