XiaoYingLou Privacy Policy

1. Information We Collect

To provide ID photo, portrait photo, professional profile photo, and related photo services, we may collect the following information:

Information you provide:

• Account information: nickname, phone number, WeChat-related identifiers, login status, and similar account data;
• Photos and images: original photos, selfies, processed photos, and generated results that you upload or create;
• Order and payment information: order ID, purchased items, points usage, payment status, and refund records;
• Support and feedback information: questions, screenshots, contact details, and communication records you submit.

Information collected automatically:

• Device information: device model, operating system, app version, browser type, device identifiers, and similar information;
• Log information: access time, page path, click behavior, error logs, IP address, and related data;
• Usage data: features used, selected specifications/templates, generation history, and download behavior;
• Approximate location information: which may be derived from IP address or system permission, for security, risk control, statistics, or localization.

2. Photos, Facial Images, and Sensitive Information

XiaoYingLou's core service requires processing photos you upload. Photos may contain facial images, likeness, body appearance, clothing, background, and other sensitive information.

We process photos for purposes including:

• Generating ID photos, portrait photos, professional profile photos, or other photo results based on your choices;
• Adjusting background, size, composition, clothing, makeup, hairstyle, lighting, pose, and style;
• Saving your photo history, order results, and download records;
• Conducting necessary safety review, troubleshooting, after-sales support, and quality improvement.

To complete photo processing and generation, relevant image data is processed in the Alibaba Cloud environment through Alibaba Cloud AI Service Gateway and related image-processing services. Relevant data is stored within China.

We will not sell, rent, or provide your facial images to third parties for advertising or marketing without your consent. Unless otherwise clearly stated and authorized, we will not use identifiable facial images for public display or advertising materials. After a user deletes photos or account-related data, we delete the corresponding image data according to product rules, except for necessary records that must be retained for legal compliance, transaction records, security risk control, or dispute resolution.

3. How We Use Information

We use collected information to:

• Provide, maintain, and improve XiaoYingLou services;
• Complete photo processing, generation, storage, download, and support;
• Manage accounts, orders, points, membership benefits, and payment records;
• Process refunds, support requests, complaints, disputes, and security issues;
• Conduct product analysis, experience optimization, troubleshooting, and risk control;
• Send necessary service notices, security reminders, order notices, and feature updates;
• Comply with laws, regulations, regulatory requirements, and platform rules.

4. Information Storage and Security

We take reasonable technical and organizational measures to protect your personal information and photo data, including access control, transmission encryption, permission management, log auditing, and security monitoring.

However, no internet environment is absolutely secure. We make reasonable efforts to protect data security, but cannot guarantee that any transmission or storage method is completely risk-free.

5. Data Retention and Deletion

We retain your information for as long as necessary to achieve the purposes described in this Policy. The retention period for uploaded photos, generated photos, order records, and account information depends on whether you continue using the account, delete photos, require support, or whether retention is required by law.

You may delete individual photos, original uploads, or generated results in “My Photos” within the product, and may request account deletion through the product’s account features. After deletion, we will delete or anonymize related data according to product rules and legal requirements, except where retention is required for legal compliance, regulatory purposes, dispute resolution, transaction records, or security risk control.

6. Information Sharing and Third-Party Services

We do not sell your personal information. To provide the Service, we may share or entrust processing of information within the necessary scope with the following types of third parties:

• Alibaba Cloud OSS, servers, content delivery, security services, Alibaba Cloud AI Service Gateway, and related image-processing services: used for image upload, storage, download, photo processing and generation, security protection, and service stability; they may process photos, generated results, device/log information, and necessary order-related information;
• WeChat Login and WeChat Open Platform related services: used for account login, identity recognition, Mini Program capabilities, and message/jump capabilities; they may process authorized WeChat OpenID/UnionID, nickname/avatar information, and login status;
• WeChat Pay, Alipay, Apple IAP, and other payment service providers: used for payment, settlement, refunds, order verification, and transaction security; they may process order IDs, payment status, transaction records, device information, and risk-control information;
• Data analytics, crash analysis, push notification, and customer support tool providers: used for traffic statistics, product analysis, troubleshooting, notification delivery, and customer support; they may process device information, log information, usage behavior, error information, and customer support communications;
• Recipients required by laws, courts, administrative authorities, or platform rules.

We require third parties to process information only within the scope necessary for service purposes and to adopt reasonable protection measures.

7. Cookies, Analytics, and Tracking Technologies

On websites, H5 pages, or other web services, we may use cookies, local storage, pixel tags, analytics SDKs, or similar technologies to maintain login status, remember preferences, measure traffic sources, analyze page performance, and optimize conversion paths.

You may manage some tracking technologies through browser or system settings. Disabling them may affect parts of the service experience.

8. Your Rights

To the extent permitted by applicable law, you may exercise the following rights:

• Access, correct, or supplement your account information;
• Delete photos you uploaded or generated;
• Request deletion of your account and related data;
• Withdraw certain permissions or consent;
• Request an explanation of personal information processing rules;
• Submit complaints, inquiries, or requests about personal information processing.

We will process your request according to legal requirements after verifying your identity.

9. Protection of Minors

Our Service is primarily intended for adults or users who use the Service with guardian consent. If a minor needs to use the Service, a parent or legal guardian should read and agree to this Policy and related service rules.

If we discover that we have collected personal information of a minor without guardian consent, we will take deletion, processing restriction, or other necessary measures in accordance with law.

10. Cross-Border and Overseas Processing

If cloud services, technical services, or operational support involve overseas processing or cross-border transfer, we will take necessary measures according to applicable laws and regulations, and where required, obtain your separate authorization or complete relevant compliance procedures.

11. Policy Updates

We may update this Privacy Policy due to product changes, laws and regulations, or operational needs. Updated policies will be published on the relevant page. For material changes, we will provide reasonable notice.

Your continued use of the Service means you understand and accept the updated Policy.