This Policy explains how personal information is handled when Xiliu APM provides enterprise manufacturing and operations management services, and how individuals may exercise their rights.
Personal information handler and platform operator
Xiliu APM website and the support channels stated in the order contract
01Scope and processing roles
This Policy applies to the Xiliu APM web console, iOS, Android/PDA clients, application programming interfaces, and related features expressly included in a customer contract. It does not apply to third-party products or services for which the third party independently determines the purposes and means of processing.
For account provisioning, contract performance, platform security, support, and service operations, 苏州星河共轨智能科技有限公司 independently determines the relevant purposes and means and acts as the personal information handler.
For employee, customer, supplier, contract participant, or similar information uploaded through the platform where the enterprise customer determines the purposes and means, the customer will generally act as the personal information handler and the operator will process the information on the customer's instructions under the contract. Individuals may first contact their organization's administrator. We will assist the customer with rights requests as required by the contract and applicable law.
02Information we process and why
Category
Examples
Main purposes
Account and organization data
Name or nickname, work email, phone number, account identifier, company/tenant, department, position, role, permissions, account status, and authentication records.
Provision and manage accounts, authenticate users, control access, support enterprise collaboration, recover accounts, and provide support.
Enterprise business data
Personal information in customer and supplier contacts, contract participants, orders, procurement, inventory, production, quality, finance, equipment, after-sales, and approval records.
Provide the management features selected by the customer; create documents, reports, alerts, and audit records; and perform the customer contract.
Files and intelligent-assistance data
Drawings, images, documents, attachments, prompts, context, outputs, and human-review results submitted by authorized users.
Store and collaborate on files; parse, search, and review drawings or documents; provide intelligent suggestions; and track issues.
Device, client, and log data
IP address, browser and operating system type, terminal or device identifier, app version, access time, requests, operations, audit events, errors, and security-event information.
Maintain sessions, support client compatibility, troubleshoot, prevent attacks, audit higher-risk operations, and protect tenant isolation.
Payment, notification, and integration data
Subscription plan, order number, amount, payment channel, payment status, transaction identifier, notification destination and delivery status, and customer-configured API, webhook, or third-party connection details.
Settle subscriptions, reconcile payment results, deliver business notifications, and connect systems authorized by the customer. Payment authentication data such as payment passwords is handled by the payment provider and is not requested by the platform.
Inputs and outputs from intelligent-assistance features may contain inaccurate or incomplete information. They may be used, according to customer settings and the contract, to deliver, evaluate, and improve the features used by that customer. Unless separately agreed and supported by a required lawful basis, we will not independently use customer business data to train an unrelated public general-purpose model.
The platform is not designed to routinely collect sensitive personal information such as biometric, medical, or precise-location data. If a specific workflow requires sensitive personal information, we or the enterprise customer will provide the required notice, explain necessity and impact, apply stricter safeguards, and obtain separate consent where required. Do not upload sensitive information unrelated to a legitimate business purpose.
03Sources and legal bases
Information may be provided directly by you, entered by your organization administrator or another authorized user, supplied by a device or third-party system connected with customer authorization, or generated automatically when you use the Service.
Depending on the context, we process information as necessary to enter into or perform a contract, on the basis of valid consent, to comply with legal duties, to protect life, health, or property in an emergency, to process lawfully disclosed information within a reasonable scope, or on another basis permitted by law. If the purpose or means materially changes, we will provide a new notice or obtain consent where required.
04Local storage and similar technologies
The web and mobile clients may use cookies, local storage, or similar technologies to retain login sessions, access tokens, tenant and permission context, security state, and necessary preferences such as language. These technologies support authentication and core functions and are not used for third-party cross-site advertising tracking.
You can clear such data through browser or device settings. Disabling storage required for authentication or security may prevent login or other functions from working. This legal page stores only your Chinese/English display preference in your browser's local storage.
05Processors, sharing, transfers, and disclosure
Service providers: Depending on deployment and contract settings, we may use providers for cloud infrastructure, networking and content delivery, object storage, databases and backups, email or messaging, payments, intelligent models/vector search, monitoring, and customer support. Contracts, access controls, and safeguards restrict their purpose, duration, method, and data scope and require return or deletion when processing ends.
Sharing with independent recipients: We do not sell personal information. Before providing information to a third party that independently determines its purposes and means, we will identify the recipient, purpose, method, and categories and obtain separate consent or establish another lawful basis as required.
Corporate changes: If a merger, division, restructuring, or asset transfer involves personal information, we will identify the recipient. A recipient that changes the original purpose or means must independently satisfy applicable legal requirements.
Required disclosure: We may disclose information to the extent necessary to comply with law, legal process, or a lawful request from a competent authority, or to protect the lawful rights and interests of users, customers, the platform, or the public.
The providers and integrations actually enabled depend on deployment, customer selections, and the order contract. Enterprise customers may request information about arrangements relevant to their Service through the contracted support channel.
06Storage location and cross-border processing
The deployment and primary storage location are determined by the customer contract, deployment inventory, and applicable legal requirements. Personal information collected or generated in mainland China that is legally required to remain in China will be stored in China.
Cross-border transfers are not a default feature of the Service. If a customer-selected integration, support arrangement, or other necessary workflow requires a transfer outside China, we will first assess necessity and adopt the legally required mechanism, such as a security assessment, certification, standard contract, or other measure, and provide notices or obtain separate consent where applicable.
07Retention
We retain personal information only for the shortest period necessary for the purposes in this Policy. When a precise period cannot be determined in advance, we consider the Service term, the contractual export or settlement period, user and customer deletion choices, sensitivity, security-audit needs, and legal retention duties.
Account, permission, and enterprise business data is generally retained during the Service term and the export or handover period stated in the contract.
Transactions, invoices, contracts, and other regulated records are retained for applicable tax, accounting, archive, and dispute periods.
Login, operation, security, and error logs are retained for the period necessary for security audit, investigation, and legal compliance.
Backup data is overwritten or securely deleted through the established rotation cycle, except for copies subject to a lawful hold, litigation preservation, or required recovery validation.
At the end of the applicable period, information is deleted or anonymized. If deletion is temporarily prohibited by law, processing is limited to storage and necessary security measures.
08Your personal information rights
Subject to applicable law, you may have rights to be informed, make decisions, restrict or refuse processing, access, copy, correct, supplement, or delete personal information, withdraw consent, close a personal account, and request an explanation of processing rules. Where conditions issued by the competent authority are met, you may also request transfer to a designated personal information handler.
You may first use account-profile or enterprise-administration features, contact your organization administrator, or contact us through the channels below. To protect accounts and enterprise data, we may verify identity, account ownership, and authority. We will respond within the period required by law or the contract. If a request cannot be fulfilled, we will explain why and identify an available complaint path.
If the enterprise customer is the personal information handler, we may refer the request to that customer and provide necessary assistance. Deletion may be restricted by tax, audit, employment, contract-performance, dispute, or other legal duties. Withdrawing consent does not affect processing already performed lawfully before withdrawal.
09Security and incident response
We use measures appropriate to the Service and risk, including tenant isolation, role-based and least-privilege access, encryption in transit, access tokens, audit logs, backup and recovery, vulnerability remediation, and supply-chain and runtime controls. Enterprise administrators must promptly disable departed or unauthorized users, configure access appropriately, and protect passwords, terminals, API keys, and exported files.
If personal information is or may be leaked, altered, or lost, we will take remedial measures and notify regulators and affected individuals when required. A notice may describe the incident, potential impact, measures taken or recommended, and contact information, unless applicable law permits no individual notice because effective measures have prevented harm.
10Children
The Service is designed for enterprise operations and is not a consumer service directed to children. Enterprise customers must not provision accounts for or enter personal information about children under 14 unless the workflow is necessary, lawful, and supported by guardian consent. If we learn that a child's information was processed without appropriate authorization, we will investigate, stop the relevant processing, and delete or otherwise handle the information as required by law.
11Policy updates
We may update this Policy when laws, product features, processing purposes, or provider arrangements change. For material changes to purposes, means, categories, or rights procedures, we will provide notice through the product, an in-service message, a contracted channel, or another prominent method. Where renewed consent is required, it will be obtained before the change takes effect. Previous versions may be requested through support.
12Contact us
Personal information handler and platform operator: 苏州星河共轨智能科技有限公司.
For questions, complaints, or requests concerning this Policy, personal information rights, or a security incident, use the contact entry on the Xiliu APM website or the support channel in your order contract. Do not send passwords, verification codes, complete identity documents, payment credentials, or other unnecessary sensitive information through a public channel.
* “Suzhou Xinghe Gonggui Intelligent Technology Co., Ltd.” is an English translation provided for reference and is not represented as the company's registered English name. The Chinese registered name controls. This English Policy is provided for convenience. If the Chinese and English versions conflict, the Chinese version prevails unless applicable law requires otherwise.