Privacy Policy

Last updated: September 2026

This Privacy Policy explains how XiaoC Trade Assistant (the "Tool", "we" or "us") collects, uses, stores, shares and protects your information when providing the product and services, and the rights you have. By using the Tool, you indicate that you have read and understood this policy.

We follow the "minimum necessary" principle: we collect information only within the scope necessary to deliver the features, do not use your business data for purposes not stated in this policy, and never sell your information to unrelated third parties.

1. Information We Collect

1. Account & Device Information

Account information: the email used for sign-in and authorization, and your password in encrypted form;
Device information: device fingerprint (irreversibly hashed), binding and sign-in status, and necessary software version information.

2. Business Data You Enter

Products, customers, follow-up records, quotations and various foreign-trade documents;
Production plans, factory daily reports (including output, defects, notes and optional photos), customer progress and other collaboration data.

3. Social-Media Ad Lead Data (after your authorization)

After you connect and authorize a Facebook (Meta) or Google Ads ad account, we receive lead information submitted through your ad forms via the official APIs, such as name, email, phone number, country/region and work email;
Access tokens and other credentials obtained during authorization are used solely to retrieve leads and for no other purpose.

4. Google Maps Public Information

In the "Google Maps lead generation" feature, we collect publicly available business information based on the keywords you set (such as company name, address, phone number, website, social-media links and public ratings). This information comes from public sources, and you are responsible for using it in compliance with applicable rules.

2. How We Use Information

Providing and maintaining core features: lead intake, lead-pool management, production collaboration, document editing and export;
Account and permission management: sign-in verification, factory/customer access authorization and share-link controls;
Security and risk control: preventing unauthorized access, abuse and fraud, and keeping the service stable;
Service improvement: optimizing the product experience based on de-identified statistics.

3. Sharing and Disclosure of Information

We do not sell your personal information. We share only the necessary information in the following cases:

Recipient	Shared Content	Purpose
Social and advertising platforms (Meta / Google, etc.)	Your authorized ad accounts and form leads within the authorization scope	Lead intake, initiated by your own authorization
Collaborators you designate (factories / customers)	Production progress and daily-report information you share with them via share links	Production collaboration and progress sharing
Cloud service and infrastructure providers	Data necessary for storage and computing	Operating the service, bound by contract and confidentiality obligations
Authorities as required by law	Information required by applicable laws and regulations	Complying with legal obligations and responding to lawful requests

4. Data Storage and Security

Local-first database: the full business database is installed on your own computer. In personal mode, your data stays only on your computer; in cloud mode, data is encrypted in transit and at rest;
Encrypted credentials: sensitive credentials such as ad accounts and mailboxes are stored in encrypted form, never delivered to the client in plaintext and never written into logs in plaintext;
Account isolation: cloud data is strictly isolated between accounts, and collaboration data is shared only within the authorized scope;
Transport security: data is transmitted over HTTPS;
Access control: share links can be revoked at any time, and access logs are kept for traceability;
Retention: information is kept only for the period necessary to achieve the purposes described in this policy, and is deleted or anonymized afterwards.

5. Your Rights

Access and correction: you can view and edit the business data you entered in the Tool at any time;
Deletion: you can delete relevant data, or request account cancellation and deletion of cloud copies;
Withdrawal of authorization: you can disconnect your social-media ad accounts in the binding management at any time; afterwards we stop receiving the corresponding leads;
Export: you can export your business documents and necessary data.

6. Children's Privacy

The Tool is intended for business users and foreign-trade professionals, and is not directed at minors. We do not knowingly collect personal information from minors. If you become aware of such a case, please contact us so we can delete the information.

7. Updates to This Policy

We may update this policy from time to time. Material changes will be announced through in-tool notices or on this page. Continued use of the Tool means you accept the updated policy.

8. Contact Us

If you have any questions, comments or complaints about this Privacy Policy, or wish to exercise the rights above, please reach us through the "Help & Support" entry in the Tool. We will process and respond within a reasonable period.