Privacy Policy

Yuanfan ("the Service") is operated by Yuanfan ("we", "us" or "our"). This Privacy Policy explains what information we collect when we provide the Service, how we use and share it, how long we keep it, and how you can access, correct and delete it. Please read this policy and our Terms of Service before you sign up for or use the Service.

1. Information we collect

Information you provide

• Sign-up and sign-in: your mobile phone number, password (stored encrypted; we cannot see it) and SMS verification codes. If you sign in with WeChat, we receive your WeChat OpenID.
• Company and team: your company name, contact name, and the names and phone numbers of the members you invite.
• Business content: the images, videos, audio and other media you upload, and the captions, comment replies, customer records, follow-up notes and knowledge base content you write or generate.
• Orders and invoices: the plan you buy, order amount, payment method and transaction number, and the invoice title, tax ID and email address needed to issue invoices. We do not store your bank card number or payment password.

Information created when you use the Service

• Logs: IP address, browser type, access time, sign-in records, and records of key actions such as publishing, deleting, disconnecting accounts and changing member permissions. We use them to keep your account secure and to troubleshoot problems.
• Cookies: used to keep you signed in and for security checks. See section 7.

Information from the platforms you connect

When you connect a social media account on the Accounts page, we obtain that account's data through the platform's official API, as described in section 2. We never obtain or store your platform passwords.

2. Platform data and how we use it

When you connect an account, the platform lists the permissions we request on its authorization page, and access is granted only after you approve. We read data only within the scope you approve. Publishing, replying and deleting happen only after you or your team members take the action or set it up.

TikTok

• Data we read: your public profile (display name, avatar, username, bio and verification status), follower, following, likes and video counts; the list of videos you have posted with their views, likes, comments and shares; and, before you publish, your creator settings (available privacy options, whether comments, Duet and Stitch are allowed, and the maximum video length).
• Actions on your behalf: publishing videos or photo posts with the content and settings you confirm.
• Purpose: showing account and post performance, publishing content and creating reports.

YouTube

• Data we read: your channel name, avatar, description, subscriber, video and view counts; the titles, descriptions, views, likes and comment counts of your channel's videos; comments on your videos; and YouTube Analytics data such as watch time, subscriber changes, and aggregated viewer age, gender and country or region.
• Actions on your behalf: uploading videos with the title, description, tags, privacy status and "made for kids" setting you provide; replying to comments; deleting videos that you choose to delete in the Service.
• Purpose: showing channel and video performance, publishing videos and handling comments in one place.
• Storage and updates: we re-read stored video titles, descriptions and comments from YouTube at least every 30 days, and delete videos and comments that have been removed from YouTube. Anything we cannot re-read within 30 days (for example, because access was revoked) is deleted. If you revoke the Service's access, we delete your channel's data within 7 days.

The Service uses YouTube API Services. By using the YouTube features of the Service, you agree to be bound by the YouTube Terms of Service. To learn how Google handles your data, see the Google Privacy Policy. In addition to disconnecting your channel in the Service, you can revoke the Service's access to your data at any time on the Google security settings page. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Facebook Pages

• Data we read: the list of Pages you manage, each Page's name, picture and follower count; Page posts with their engagement and insights data; comments on Page posts, including the commenter's public name and profile picture.
• Actions on your behalf: publishing posts, photos and videos to the Pages you choose; replying to comments; deleting posts that you choose to delete in the Service.
• Purpose: showing Page and post performance, publishing content and handling comments and inquiries in one place.

Instagram

• Data we read: the profile of the Instagram professional account linked to your Page (username, profile picture, bio, follower and post counts); posts with their engagement and insights data; comments on your posts, including the commenter's username.
• Actions on your behalf: publishing photos, videos and Reels; replying to comments.
• Purpose: showing account and post performance, publishing content and handling comments and inquiries in one place.

Threads

• Data we read: your profile (username, profile picture, bio and follower count); your posts with their engagement and insights data; replies to your posts.
• Actions on your behalf: publishing posts; replying to replies; deleting posts that you choose to delete in the Service.
• Purpose: showing account and post performance, publishing content and handling replies in one place.

WhatsApp Business

• Data we read: messages that customers send to your business number (text, images, files and so on), the customer's WhatsApp number and profile name, and message delivery status.
• Actions on your behalf: sending the replies and message templates that you write or approve.
• Purpose: handling customer inquiries in one place and recording follow-ups.

Other platforms

X, LinkedIn, Pinterest, Reddit, Bluesky, Mastodon, Telegram and Discord: we read your profile and the engagement data of the content you post, and on some platforms the replies to your posts. We publish content according to your settings, and delete content posted through the Service when you choose to.

Public data

For accounts you add as "public accounts" without authorization, and for post comments that a platform's official API does not provide, we obtain only the profiles, posts, engagement data and comments that are publicly displayed on the platform, for analytics and comment handling.

3. How we use information

• Providing the Service: account management, publishing, comment and message handling, customer follow-up, analytics and reports.
• AI-assisted features: when you use copywriting, translation, comment analysis or the AI assistant, we send the content needed for that task (for example a caption, the original comment or a customer message) to a third-party large language model provider and return the result to you. We never send platform access tokens or your password.
• Security and support: verifying your identity, preventing fraud and abuse, troubleshooting, and answering your questions.
• Service notifications: verification codes, publishing results, expiring authorizations, billing and plan expiry reminders.

We do not sell your personal information or platform data, and we do not use it for advertising or to train AI models. Data obtained from the platforms is shown only to members of your workspace who have the required permissions.

4. How we share information

We share information only in the following cases, and require recipients to process it only for the agreed purpose and with the agreed security measures:

• Service providers: cloud hosting and file storage, SMS, email, payment (WeChat Pay and Alipay) and large language model providers receive only the information needed to provide their service.
• Platforms and systems you choose: the content and replies you publish are sent to the relevant platform. If you create an API key or set up a webhook, the related data is sent to the system you specify.
• Legal requirements: when required by law, legal process or government authorities.
• Business changes: in a merger, acquisition or asset transfer, we will require the successor to keep following this policy and will notify you.

5. Retention and deletion

• Social media account data is kept while the account stays connected. When you disconnect an account on the Accounts page, we immediately revoke its access token (where the platform supports it) and delete the account's token, profile, post records, statistics, comments and messages, as well as the customer records created from that account's comments and messages. Customer records you entered manually are kept.
• Accounts whose authorization has become invalid (for example, you revoked access on the platform, changed your password, or the token expired and cannot be renewed) are deleted automatically, together with the data above, if they are not reconnected within 30 days (6 days for YouTube channels).
• Platform data that must be kept current: YouTube video titles, descriptions, comments and similar data are kept for no more than 30 days, during which we re-read and update them. Content removed from the platform is deleted, and anything we cannot re-read in time is deleted.
• Workspaces: you can ask us to close your workspace. After verifying your identity, we delete all of its data within 7 days.
• Other records: orders and invoices are kept for the period required by law; sign-in and security logs are kept for at least 6 months as required by law; SMS verification code records are kept for 7 days; files created by the toolbox are kept for 30 days.

Deleting the data we store does not delete the content you have already published on the platforms. To delete that content, do so on the platform, or delete the post in the Service's post list (on platforms that support deletion, it is deleted there as well). See the Data Deletion Instructions for step-by-step instructions.

6. Security

• Platform access tokens and API keys are stored encrypted, and passwords are stored with one-way hashing.
• All traffic to the website is encrypted with HTTPS.
• Data is isolated between workspaces, members get access according to their role, and key actions are logged.
• If a personal information security incident occurs, we will notify you promptly as required by law and take remedial action.

7. Cookies

We use cookies to keep you signed in, to protect against cross-site request forgery, and to remember the page language you choose. Your browser's session storage is used only to remember whether an on-screen notice has been shown. We do not use advertising or third-party analytics cookies, and we do not allow third parties to serve advertisements in the Service. You can clear or block cookies in your browser, but you will not be able to sign in with cookies blocked.

8. Your rights

• Access and correction: view and update your profile and workspace information under Profile in the workspace.
• Deletion: disconnect accounts, delete posts and customer records, or ask us to close your workspace. See the Data Deletion Instructions.
• Withdrawing authorization: disconnect an account on the Accounts page, or remove the Service in the platform's app settings. Withdrawal does not affect processing carried out before it.
• Questions and complaints: contact us as described in section 12. We will respond within 15 working days.

9. Children

The Service is intended for businesses and professionals and is not directed to anyone under 18. If we learn that we have collected information from a minor without a guardian's consent, we will delete it promptly.

10. Where data is stored

The Service runs on servers located outside mainland China, so the information you provide and create is stored on those servers. The social media platforms you connect are also located outside mainland China. We protect information transferred across borders as required by law.

11. Changes to this policy

We may update this policy because of changes in law or our business. The updated version will be posted on this page, and we will notify you of material changes through in-app messages. If we start to use your data in a way or for a purpose not described in this policy, we will ask for your consent first.

12. Contact us

If you have any questions, comments or complaints about this policy or how we handle personal information, contact us:

• Email: support@yuanfan.example