Privacy Policy

1. 01Introduction and scope
2. 02Information we collect
3. 03How we use information
4. 04Legal bases for processing
5. 05Sharing and processors
6. 06International transfers
7. 07Retention
8. 08Security
9. 09Advertising and monetisation
10. 10Advertising formats
11. 11Cookies and similar technologies
12. 12Your rights by region
13. 13Children's privacy
14. 14App store compliance
15. 15Do Not Track and GPC
16. 16Changes to this policy
17. 17Contact us
18. 18Effective date

1. Introduction and scope

This Privacy Policy explains how Meihang Co., Limited ("Meihang", "we", "us") handles personal information when you visit meihangyx.com (the "Website"), when you use our mobile management application distributed through the Apple App Store and Google Play (the "App"), and when you contact us by email, telephone or through our enquiry form.

Meihang Co., Limited is a Hong Kong company providing international trade, marketing consultancy, wholesale and import/export of general goods, and supply chain support services. This Policy applies to both the Website and the App, and to all related services we operate.

This document is prepared with reference to the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), Brazil's LGPD, Canada's PIPEDA, the Australian Privacy Principles, Singapore's PDPA, India's DPDP Act, Japan's APPI and South Korea's PIPA. Where a local law imposes stricter obligations than this Policy, the local law prevails.

2. Information we collect

We collect information in the following categories.

2.1 Account and identity information

When you create an account in the App or otherwise identify yourself to us, we may collect your name, business email address, company name, job title, telephone number, country or region, and the credentials you choose to use for authentication.

2.2 Device and technical information

We collect device model, operating system and version, application version, browser type, screen resolution, language, time zone, network type, crash logs and diagnostic information. This is used to keep the App stable and to understand which features are actually used.

2.3 Usage and interaction data

We record pages visited, screens viewed, features used, search terms entered, the time and duration of each session, in-app actions, error events and the approximate location derived from your IP address. This powers real-time order tracking, inventory views, supply chain tracking and the consulting dashboard inside the App.

2.4 Business and transaction information

When you use our trading services we process the information needed to fulfil them: purchase orders, product specifications, quantities, delivery addresses, supplier and logistics counterparties, invoices, customs and shipping documentation, and payment instructions. Failing to provide this information may prevent us from performing the contract.

2.5 Optional location information

With your permission, the App may collect precise or approximate location data to help confirm delivery points, collection locations and shipment handovers. Location is optional; declining permission does not remove any other functionality.

2.6 Advertising identifiers

We and our advertising partners may use the Apple Identifier for Advertisers (IDFA) and the Google Advertising ID (AAID), along with related device and cookie identifiers, to measure advertising performance and, where permitted and consented, to personalise advertising. Section 9 sets out the full partner list and the opt-out routes available.

2.7 Communications

We retain your email correspondence, enquiry-form submissions, support tickets, survey responses and any documents you send us, so that we can answer you accurately and keep a record of our dealings.

2.8 Information from third parties

We receive information about you from service providers that support our business — for example, shipment milestone updates from logistics partners, and aggregated, anonymised delivery and market statistics. We do not purchase data brokers' consumer lists.

3. How we use information

• To provide, operate, personalise and support the Website and the App, including every feature described in our service description: international trade, marketing consultancy, wholesale and import/export of general goods, and supply chain support services.
• To process orders, prepare documentation, arrange freight and fulfil our contractual obligations to you and to our counterparties.
• To provide real-time order status, inventory levels, supply chain tracking, consulting dashboards, investment planning and wholesale/retail management information.
• To send you service announcements, shipment updates and — where you have consented — marketing communications about our services.
• To maintain the security, integrity and availability of our services, and to prevent fraud, abuse and violations of our Terms of Service.
• To understand how the App and Website are used, so that we can improve features, fix defects and prioritise development.
• To measure the effectiveness of advertising, and to personalise advertising where you have consented to such personalisation.
• To comply with legal, regulatory, sanctions and export-control obligations, and to enforce our agreements.
• To detect and investigate security incidents, and to establish, exercise or defend legal claims.

4. Legal bases for processing

Depending on your location and the processing activity, we rely on the following legal bases for processing personal information.

5. Sharing and processors

We do not sell personal information for money. We share personal information only with the categories of recipients below, and only to the extent needed for the stated purpose.

• Processors and service providers — hosting and cloud infrastructure, content delivery, customer relationship management, transactional email, crash reporting, analytics, payment processing, and the development of our App. They act on our instructions under written data processing terms.
• Business counterparties — suppliers, factories, freight forwarders, customs brokers, inspection agencies, distributors and customers, to the extent required to perform a transaction you have requested.
• Advertising partners — the networks and platforms listed in section 9, to deliver and measure advertising. Where such partners act as our processors we contractually restrict their use of data; where they act as independent controllers, their own policies also apply.
• Professional advisers — auditors, accountants, insurers, legal advisers and compliance consultants, subject to confidentiality duties.
• Authorities and regulators — where disclosure is required by law, court order, sanctions or export-control rules, or needed to protect the rights and safety of any person.
• Corporate transactions — in a merger, reorganisation or sale of assets, personal information may transfer to the successor entity, subject to this Policy continuing to apply.
• With your consent — for any other disclosure we will seek your consent first.

6. International transfers

Meihang is established in Hong Kong and works with counterparties and service providers located in other countries. Personal information may therefore be processed outside the country in which it was collected, including in Mainland China, the EEA, the United Kingdom, the United States, Singapore and India.

Where a transfer is subject to the GDPR or the UK GDPR, we rely on an adequacy decision, standard contractual clauses approved by the relevant supervisory authority, or another lawful transfer mechanism, together with a transfer risk assessment where required. Our Hong Kong operations are recognised in the EU Commission's applicable adequacy decisions in respect of the European Union–Hong Kong arrangement for certified data recipients.

7. Retention

We keep personal information only as long as necessary for the purposes described in this Policy, or as required by law.

• Account and transaction records — for the duration of the business relationship and afterwards for the period required by tax, customs, accounting and record-keeping obligations.
• Correspondence and enquiry records — typically for three years from the last interaction.
• Usage, log and analytics data — typically for 24 to 36 months.
• Advertising identifiers and consent records — for the lifetime of the identifier, plus the period required to demonstrate that consent was given or withdrawn.
• Security incident records — in line with applicable regulatory retention periods.
• Support tickets — for 24 months from closure, unless a longer period is needed for an active claim.

When information is no longer required, we delete it, anonymise it, or take steps to ensure it can no longer be used to identify you.

8. Security

We apply administrative, technical and physical safeguards appropriate to the sensitivity of the information we hold. Measures include encryption in transit using TLS and encryption at rest for databases and backups, role-based access controls with least-privilege administration, multi-factor authentication for administrative accounts, environment segregation between development and production, regular vulnerability assessment and penetration testing, logging and monitoring of access to personal data, staff training on data protection, and incident response procedures with defined escalation and notification timelines.

No system is completely secure. If a breach affects your personal information and is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within the statutory period (72 hours under the GDPR where applicable) and notify affected individuals where required.

9. Advertising and monetisation

The App is supported by advertising. We integrate third-party advertising SDKs supplied by the networks and platforms listed below. These partners may collect device identifiers, IP address, advertising identifiers (IDFA and AAID), coarse location inferred from network information, and information about your interactions with the App in order to serve and measure advertising.

We configure our advertising partners in accordance with the consent state of your device. Where GDPR, UK GDPR, CCPA/CPRA or similar legislation requires prior consent for personalised advertising or for sharing data for cross-context behavioural advertising, personalisation is disabled until you provide consent. You can withdraw consent at any time through your device settings, the in-app privacy controls, or the opt-out links below.

Personalised and non-personalised advertising. Personalised advertising uses information about your interests, inferred from your activity within the App and from advertising identifiers, to select which ads you see. Non-personalised advertising is selected without using such information — for example, by context, general device type or approximate region — and is served where you have not consented to personalisation or have exercised your opt-out right.

Consent platforms. Where required, we implement an industry consent management platform so that your choice is recorded and transmitted to our advertising partners before personalised advertising is served.

Apple App Tracking Transparency (ATT). On iOS we display the system App Tracking Transparency prompt. No tracking — including sharing data for cross-context behavioural advertising — occurs unless you permit it in that prompt.

Advertising identifiers. The IDFA (Apple Identifier for Advertisers) and the AAID (Google Advertising ID) are resettable identifiers controlled by Apple and Google. You can reset or restrict them through your device settings, and you can opt out of personalised advertising through the platform-level opt-out pages linked above.

10. Advertising formats and your control

We use the following advertising formats in the App:

• App open ads — displayed when you first open the App, or when you return to it after a period away. Closable, and skipped without loss of functionality.
• Rewarded video ads — optional video ads that grant a benefit such as a premium insight, an expedited document review or a discount, in exchange for watching to completion.
• Interstitial ads — displayed at natural breaks between screens, such as after an order has been submitted. Never shown while you are entering data.
• Banner ads — a static or rotating strip shown at the top or bottom of a screen without covering the underlying content.

You control the experience: every ad is skippable or dismissible, none of them blocks the App, and the purchase-ads button in the App can be disabled where the operating system offers that choice. Disabling personalised ads does not limit any trading feature — order tracking, inventory, supply chain tracking, consulting dashboards, investment planning and wholesale management continue to work exactly as before.

11. Cookies and similar technologies

The Website uses cookies and similar technologies — including local storage, session storage, pixels, SDKs and similar tags — for the following purposes.

• Strictly necessary — maintaining your session, remembering security and consent choices, and providing core Website functionality. These cannot be switched off.
• Analytics and performance — understanding which pages are used, how the site performs and where visitors experience difficulty. We use aggregated or pseudonymised data for this.
• Functional — remembering preferences such as language and region so that we can present relevant content.
• Advertising — measuring campaigns, limiting frequency, and serving personalised advertising where you have consented.

You can control cookies through your browser settings and through any consent interface we present. Blocking cookies may reduce functionality, but it will not affect your ability to browse our pages or use the trading features of the App.

12. Your rights by region

Subject to the law that applies to you, you may hold some or all of the following rights. Where a right does not apply to you, we will still respond to any request you make.

13. Children's privacy and age policy

The App and the Website are not directed to children. We do not knowingly collect personal information from anyone under the age of 13, and we do not knowingly collect information from users under 16 in jurisdictions where the applicable age of digital consent is 16. If you are a parent or guardian and believe a child has provided us with personal information, please contact us and we will delete it promptly.

We comply with the Children's Online Privacy Protection Act (COPPA) in the United States, with Article 8 of the GDPR in the European Union and equivalent provisions elsewhere, and we publish age ratings appropriate to the content of the App in each app store listing. Age ratings are also reflected in the in-app controls described in section 10.

14. App store compliance

Our App is distributed through the Apple App Store and Google Play. We comply with the Apple App Store Review Guidelines, including Guideline 5.1.1 on data collection and storage, and with the Google Play Data Safety section, Google Play's Families policy and its Families advertising rules, and the Google Play Developer Policy. Where a platform requires a specific declaration — for example, a privacy policy link, a data safety form or an age rating — that declaration is consistent with this Policy.

Where we use the Advertising ID, we use it in accordance with the Google Play Advertising ID policy and the Apple ATT framework, and we do not use it for fingerprinting or for any prohibited purpose.

15. Do Not Track and Global Privacy Control

Some browsers send a Do Not Track (DNT) or Global Privacy Control (GPC) signal. Because there is no agreed standard for interpreting these signals across the web, we treat GPC as a valid request to opt out of the sale or sharing of personal information and of targeted advertising where the law recognises such a signal, and we apply it consistently in the App and on the Website. For other privacy settings, you can use the controls described in sections 9 and 11, or contact us directly.

16. Changes to this policy

We may update this Policy to reflect changes in our services, our partners or the law. The revised Policy will be posted on this page with an updated "last revised" date, and where the change is material we will provide notice through the App, by email, or through a prominent notice on the Website. Prior versions of this Policy can be requested from our business support team.

17. Contact us

For any privacy question, request or complaint, contact us at support@meihangyx.com. For matters relating to a key account, write to liaoyuhua@meihangyx.com.

Meihang Co., Limited
UNIT 98 OF FACTORY A, 1/F, UNION HING YIP FACTORY BUILDING, NO. 20 HING YIP STREET, KWUN TONG, HONG KONG
Website: meihangyx.com

18. Effective date

Effective date: [Effective Date] · Last revised: [Last Revised Date]