Privacy Policy / 隐私政策

1. Information We Collect / 我们收集的信息

When you register an account, we collect: / 当您注册账户时，我们收集：

• Email address / 邮箱地址 — authentication, notifications, email verification / 登录、通知、邮箱验证
• Password / 密码 — bcrypt hashed; plaintext is never stored. Contract necessity. / 使用 bcrypt 加密存储，明文从不存储。合同必需。
• Name / 姓名 (optional / 可选) — personalization / 个性化展示
• Company information / 公司信息 (founder profile / 创业者资料) — company name, stage, industry, one-liner / 公司名称、阶段、行业、一句话介绍
• Investment preferences / 投资偏好 (investor profile / 投资者资料) — investment amount, industries, stage, geography / 投资额度、关注行业、阶段、地域

When you use product features, we also record: / 当您使用产品功能时，我们还会记录：

• Outreach email content and sending status / 外联邮件内容与发送状态
• CRM contacts and pipeline stages / CRM 联系人与融资漏斗阶段
• Uploaded decks and data room documents / 上传的文稿与数据室文档
• Deck view tracking data (IP hash, slide views, duration) — requires viewer consent / 文稿浏览追踪数据（IP 哈希、浏览页码、停留时长）— 需浏览者同意
• Payment transaction records — contract necessity + legal obligation / 支付交易记录 — 合同必需 + 法律义务
• Audit logs — legitimate interest (security) / 审计日志 — 合法利益（安全）
• Consent records — legal obligation / 同意记录 — 法律义务

2. Third-Party Processors / 第三方处理者

We use the following third-party services to process your data: / 我们使用以下第三方服务处理您的数据：

• Alibaba Cloud OSS / 阿里云 OSS — file storage (decks, data room documents) / 文件存储（文稿、数据室文档）
• Alibaba Cloud DirectMail / 阿里云邮件推送 — email delivery (notifications, verifications) / 邮件发送（通知、验证）
• Tongyi Qianwen / DashScope / 通义千问 — AI text generation (outreach emails) / AI 文本生成（外联邮件）
• PostgreSQL — primary database, self-hosted or managed instance / 主数据库，自托管或托管实例
• Stripe (optional / 可选) — payment processing. stripe.com/privacy
• WeChat Pay / 微信支付 (optional / 可选) — payment processing. pay.weixin.qq.com
• Alipay / 支付宝 (optional / 可选) — payment processing. open.alipay.com
• Google OAuth (optional / 可选) — authentication provider / 身份验证提供商
• SMTP Provider / SMTP 提供商 (configurable / 可配置) — email delivery / 邮件发送

These providers have their own privacy policies, and your data is subject to their terms. / 这些服务提供商各自有其隐私政策，您的数据受其政策约束。

3. Cross-Border Data Transfers / 跨境数据传输

4. Deck View Tracking & Consent / 文稿浏览追踪与同意

Deck tracking offers three privacy modes: / 路演文稿追踪提供三档隐私模式：

• Off / 关闭追踪: No tracking data is recorded. / 不记录任何浏览数据。
• Anonymous / 匿名追踪 (default / 默认): Records slide number and view duration. IP address is SHA-256 hashed; no personal identification. / 记录页码和停留时长，IP 地址经 SHA-256 哈希处理，不识别个人身份。
• Full / 完整追踪: Identity-level data is recorded only after the viewer sees a consent banner and agrees. / 浏览者首次访问时显示同意横幅，同意后才记录身份级数据。

This mechanism complies with GDPR Article 6 and the PIPL notice-and-consent requirements. Deck view tracking uses a consent banner — not cookies — for viewer consent. / 此机制符合 GDPR 第 6 条和《个人信息保护法》的告知-同意要求。文稿浏览追踪使用同意横幅（而非 Cookie）获取浏览者同意。

5. Data Storage & Security / 数据存储与安全

• Passwords are hashed using bcrypt (10+ rounds) — irreversible / 密码使用 bcrypt 算法加密，无法逆向还原
• All data transmitted over HTTPS (TLS encryption in transit) / 所有数据通过 HTTPS 加密传输
• Database deployed on access-controlled servers; only authorized personnel have access / 数据库部署在受控服务器，仅授权人员可访问
• File storage supports server-side encryption (OSS configuration dependent) / 文件存储支持服务端加密（取决于 OSS 配置）
• Audit logs are append-only and immutable / 审计日志为仅追加、不可变

6. Your Rights / 您的权利

Under the PIPL, GDPR, and applicable data protection laws, you have the following rights: / 根据《个人信息保护法》、GDPR 及适用的数据保护法律，您享有以下权利：

• Right of Access / 查阅权: View your personal data via Settings → Export Data. / 通过设置 → 导出数据查看您的个人数据。
• Right to Rectification / 更正权: Correct your information via Settings → Edit Profile. / 通过设置 → 编辑资料更正您的信息。
• Right to Erasure / 删除权: Delete your account and all associated data via Settings → Delete Account. A 30-day grace period applies before permanent deletion. / 通过设置 → 注销账户删除您的账户及全部数据。永久删除前有 30 天宽限期。
• Right to Data Portability / 数据可携带权: Export all your data in JSON or CSV format via Settings → Export Data. / 通过设置 → 导出数据以 JSON 或 CSV 格式导出您的全部数据。
• Right to Object to Processing / 拒绝处理权: Withdraw consent for specific processing via Settings or API. / 通过设置或 API 撤回特定处理的同意。
• Right to Withdraw Consent / 撤回同意权: Toggle off specific processing in Settings → Privacy. / 在设置 → 隐私中关闭特定处理。

7. Data Retention / 数据保留

• Account data / 账户数据: Duration of account + 30 days after deletion / 账户存续期间 + 删除后 30 天
• Payment records / 支付记录: 5 years (tax / legal requirement) / 5 年（税务 / 法律要求）
• Audit logs / 审计日志: 2 years / 2 年
• Email suppression list / 邮件抑制列表: Indefinite (legal requirement for unsubscribe compliance) / 无限期（取消订阅的法律合规要求）
• Deck view tracking (anonymous) / 文稿浏览追踪（匿名）: 90 days / 90 天
• Deck view tracking (with consent) / 文稿浏览追踪（经同意）: 365 days / 365 天

After account deletion, all personal data including uploaded documents will be removed within 30 days, except where legal retention obligations apply. Data export is available before deletion. / 账户注销后 30 天内将删除全部个人数据（包括上传的文档），法律要求保留的除外。删除前可导出数据。

8. Cookie Policy / Cookie 政策

We use only essential cookies. No advertising or tracking cookies are deployed. / 我们仅使用必要 Cookie，不部署广告或追踪 Cookie。

• Session cookie / 会话 Cookie: Maintains your login session. Expires when you close your browser. / 维持您的登录会话，关闭浏览器时过期。
• CSRF token / CSRF 令牌: Protects against cross-site request forgery attacks. / 防止跨站请求伪造攻击。
• Locale preference / 语言偏好: Remembers your language and region preference for a consistent browsing experience. / 记住您的语言和地区偏好以提供一致的浏览体验。

Deck view tracking does not use cookies. Viewer consent is obtained through a consent banner displayed on first visit. / 文稿浏览追踪不使用 Cookie。浏览者同意通过首次访问时显示的同意横幅获取。

9. Contact / 联系我们