Privacy Policy
This policy explains how we collect, use, store and protect your personal information.
Plain-Language Version
- We collect only the information we need, to provide the service, keep it secure and improve it.
- We do not sell your information and do not use it for advertising.
- Your data is stored on Tencent Cloud.
- We cannot see or store the card number you pay with.
- For information that visitors leave on your website, you decide how it is handled. We only store it for you.
- You can contact us at any time to access, correct or delete your own information.
- Orders, payments, invoices and similar records must be kept by law and cannot be deleted.
- If you run into a problem, email us.
- This plain-language version is only an aid. The full text prevails.
Full policy
1. Scope and the Handler
1.1 The handler of personal information is Shanghai Fanzhi Technology Co., Ltd. (上海帆质科技有限公司) (address: Shixing Park, Lane 666 Xianing Road, Jinshan Industrial Zone, Shanghai; hereinafter the "Company"). Contact email: support@b2bfront.com. Where a User pays online through Stripe, the handler of the payment information also includes the payee, YE TING (叶挺), an individual (the "Payee").
1.2 This policy applies in the following situations:
- visiting the Company's website (b2bfront.com) or using the Company's dashboard (app.b2bfront.com) (the "Dashboard");
- submitting a form on the Company's website to ask a question, request a diagnosis or ask for a proposal;
- being invited to join a Site as a member;
- paying for an order through Stripe.
1.3 This policy does not apply to inquiries and other information that visitors to a User's Site submit on that Site. For that information the Site owner is the responsible party and the Company only stores it on the Site owner's behalf; see section 11.
2. Information the Company Collects
2.1 The Company collects the following information in the following situations:
| Situation | Information collected | Notes |
|---|---|---|
| Registration and login | Email, display name, password (only the encrypted result is stored), version of the terms agreed to, last login time | Email is used for login, verification and notices |
| Login security | Device label, browser and operating system summary, a digest of the login IP, session expiry time | Used only to recognise logins from a new device and to protect the account |
| Email verification and invitations | Verification code, invitee email, role, invitation expiry time | Invitations are valid for 7 days |
| Members and permissions | Member email, role, join time, activity record | The activity record notes who did what and when |
| Website inquiry forms | Name, mobile number, WeChat ID, email (optional on some forms), message, main products, website address, convenient contact time; the page and referrer the User came from | Used to contact the User and assess needs |
| Site application | Company name, Site name, company profile, main product summary, desired domain name, city | Used to process the application and set up the Site |
| Corporate bank-transfer payment | Order details, payer name, transfer receipt, invoicing details | Users should upload only corporate bank-transfer receipts and must not upload screenshots that show a personal bank card number |
| Online payment (Stripe) | Payer name, email, billing address (when the page asks for it), payment method brand and last four digits, country, order number, payment result | The User's full card number is submitted directly to Stripe; the Company does not access or store it |
| Emails the Company sends to the User and their delivery results | Used for account notices, verification codes, inquiry notifications and so on |
2.2 The Company does not actively collect sensitive personal information such as national ID numbers, personal bank card numbers or facial images. A User who provides any of these in a message or an uploaded file is asked to contact the Company beforehand.
2.3 The Company does not use advertising scripts on its website or Dashboard, and does not pass visit data to third-party analytics services.
3. Purposes and Legal Basis of Use
3.1 The Company uses the above information for the following purposes:
| Purpose | Information used | Legal basis |
|---|---|---|
| Creating and managing accounts, providing the Dashboard and Site services | Account, member and Site information | Necessary for the performance of the contract with the User; the User's consent |
| Keeping the service secure, identifying unusual logins, preventing spam | Login device and IP digest, activity record | Necessary for the performance of the contract; protecting accounts and systems |
| Sending service emails such as verification codes, invitations, renewal reminders and inquiry notifications | Necessary for the performance of the contract | |
| Orders, payment matching, invoicing, reconciliation | Order, payment and invoicing information | Performance of the contract; compliance with the legal duty to keep financial records |
| Processing online payments and refunds, preventing fraud | Payer and order information (through Stripe) | Necessary for the performance of the contract |
| Replying to inquiries, assessing needs, following up on the service | Inquiry form information | The User's consent |
| Improving and maintaining the service, troubleshooting | Operation records, usage | Necessary to perform the contract |
| Handling the User's rights requests, complying with the law | Information related to the request | Compliance with legal obligations |
3.2 The Company will not use the above information for any other purpose of which the User is not aware. Where it needs to use the information for a new purpose, the Company will notify the User in advance and obtain consent again.
4. Cookies and Similar Technologies
4.1 The Dashboard (app.b2bfront.com) uses 4 cookies, all of them required for login: two keep the User signed in, one prevents forged requests, and one marks that a login has ended. Where the User chooses "remember me", the cookies are kept until their expiry time; otherwise they expire when the browser is closed.
4.2 The Dashboard also stores interface preferences (sidebar collapse, theme) in the User's browser. These contain no personal information.
4.3 The Company's website does not use advertising cookies or scripts.
4.4 The payment page is provided by Stripe. Stripe may use cookies or similar technologies to prevent fraud, and Stripe's privacy policy applies.
4.5 The cookie banner that visitors see on a User's Site is a notice from the Site owner to the visitor, not a notice from the Company to the User. See section 11.
5. Sharing, Entrusted Processing and Disclosure
5.1 The Company does not sell the User's personal information and does not provide it to others for advertising purposes. To provide the service, the Company uses the following categories of providers, who process the relevant information only to the extent necessary to provide the service:
| Category | Purpose | Information handled |
|---|---|---|
| Cloud hosting and storage | Servers, database, files and backups (data nodes are described in section 6) | All platform data |
| Email delivery | Sending system emails | Recipient email, email content (verification codes, invitations, notices and so on) |
| Network and content delivery | Domain resolution, website delivery, inquiry forwarding | Site content, visit traffic, submitted inquiry content |
| Office collaboration | The Company's office email | Emails between the User and the Company |
| Online payment (see 5.2) | Online payment processing, fraud prevention, reconciliation | Payer information, payment method, order amount, device and IP information |
5.2 About Stripe. Where a User pays through Stripe, Stripe processes the payment on the Company's behalf. At the same time, Stripe decides for itself how to process part of that information (for example for fraud prevention, anti-money-laundering and legal compliance), and Stripe's privacy policy (https://stripe.com/hk/privacy) applies to that part. The Company does not store the full card number.
5.3 Where the law requires it, or a competent authority lawfully requires it, the Company will provide information as the law provides, and will notify the User where the law allows.
5.4 If the Company undergoes a merger, division or similar event that requires personal information to be transferred, the recipient will remain bound by this policy and the Company will notify the User.
5.5
6. Where Information Is Stored
6.1 The User's account information and Site data are stored in Tencent Cloud's Japan data node and Hong Kong data node. The pages of the User's Site are delivered to visitors worldwide through a content delivery network.
6.2 A User who registers and ticks the box to agree to this policy and the Terms of Service is deemed to have acknowledged and agreed that the Company stores and processes the User's information in the data nodes above. The User may withdraw consent at any time, but after withdrawal the Company can no longer continue to provide the Dashboard service.
6.3 Where a User pays through Stripe, the payment information is handled by Stripe and may be located in Hong Kong, the United States and other places. Details:
| Item | Details |
|---|---|
| Payment processor | Stripe Payments Europe, Limited and its affiliate Stripe, LLC |
| Contact | See Stripe's privacy policy page https://stripe.com/hk/privacy |
| Information | Payer name, email, billing address, payment method information, order amount, device and IP information |
| Purpose | Completing the payment, preventing fraud, reconciliation, refunds |
| How the User exercises rights | Raise it with Stripe through its privacy policy page, or contact the Company at support@b2bfront.com, and the Company will help pass it on |
6.4
7. Retention Periods
7.1 The Company keeps information according to the table below, and deletes or anonymises it when the retention period ends:
| Information | Retention period |
|---|---|
| Account information | While the account exists. After the account is deactivated: 【TBC-decision】 |
| Login sessions and verification code records | 30 days after they expire or are used, then deleted |
| Activity record (audit log) | 365 days |
| Invitation records | After the invitation expires: 【TBC-decision】 |
| Financial records such as orders, payments and invoices | 【TBC-decision: the statutory retention period for accounting records, to be confirmed by the accountant】 |
| Online payment records (order number, amount, payment method brand and last four digits, result) | 【TBC-decision: the accounting records period】. Stripe's own retention period is in Stripe's privacy policy |
| Contact details left through website inquiry forms | Deleted 365 days after the case is closed |
| Site data (Site content, members, inquiries) | During the service period; after expiry there is a 15-day grace period; when the grace period ends the Site is suspended, then kept for another 90 days after suspension, then cleared (see section 6 of the Terms of Service) |
| Backups | Backed up regularly; older backups expire automatically as they rotate. Old copies in backups cannot be deleted one by one ahead of time |
8. Security Measures
8.1 The Company takes the following measures to protect personal information:
- encrypted transmission;
- Site data of different Users is kept separate, so one Site cannot read another Site's data;
- passwords are stored encrypted, and for login IPs only a digest is stored;
- the Company's staff have no right by default to view data inside a User's Site; acting on a User's behalf requires the User's authorisation and is recorded;
- daily backups, with recovery drills from time to time.
8.2 No system can guarantee absolute security. If a leak of personal information occurs, the Company will take remedial steps as the law requires and notify the affected Users and the relevant competent authorities.
9. The User's Rights
9.1 The User may: access and copy their personal information; correct inaccurate information; request deletion (for example where the purpose has been achieved, the User withdraws consent, or the retention period has ended); withdraw consent; ask the Company to explain this policy; and close their account.
9.2 How to exercise them. The User should email support@b2bfront.com, stating the account email and the specific request. The Company will first verify the User's identity (by replying to the account email for confirmation) and will answer within 【TBC-decision: suggested 15 working days】.
9.3 Please note:
- Account closure is requested by email and handled by the Company after verification. A User with a Site under their name must first transfer it or take it offline;
- financial records such as orders, payments and invoices, and the activity record, cannot be deleted where the law or reconciliation requires them to be kept; the Company will explain why;
- old copies in backups expire on rotation and cannot be deleted one by one ahead of time;
- notification emails already sent to the mailboxes of the User's colleagues are not within the Company's control.
9.4 Where the Payee is an individual or company in Hong Kong, the User may also make an access and correction request to the Company under Hong Kong's Personal Data (Privacy) Ordinance.
9.5 If the Company does not handle the User's request properly, the User may complain to the competent authority.
10. Minors
The Company's service is for businesses and not for anyone under 18 years of age. If you find that a minor has provided information to the Company, please contact the Company to have it deleted.
11. Information of Site Visitors
11.1 Site visitors do not need to register. For inquiries that visitors submit on a User's Site (name, email, phone, message, attachments and so on), the Site owner decides how they are handled. The Company stores them on the Site owner's behalf, handles them according to the Site owner's settings and instructions, and does not use them for its own purposes.
11.2 A visitor who wishes to view, correct or delete the information they submitted should contact the company to which they sent the inquiry. If a visitor writes directly to the Company, the Company will pass the request on to that company and, once the company agrees, will help carry it out.
11.3 The Site owner should explain to visitors on its Site how their information is handled and, where needed, obtain their consent (including cookie consent).
11.4 Site inquiry information is kept for 92 days by default. After that the personal information is erased and only statistical information such as country and status is kept. The Site owner may change this number of days.
12. Changes to This Policy
The Company may update this policy at any time, and the updated version will show its version number and the date of the update. For major changes such as the purpose or method of handling, the Company will notify Users by email and Dashboard notice at least 7 days in advance and, where needed, obtain the User's consent again.
13. Contact Details and Personal Information Protection Contact
- Contact email: support@b2bfront.com
- Address: Shixing Park, Lane 666 Xianing Road, Jinshan Industrial Zone, Shanghai
This policy is authoritative in its Simplified Chinese text; other language versions provided by the Company are for reference only, and where they differ from the Simplified Chinese text, the Simplified Chinese text prevails.